Cisco plans to blend two NAC schemes

Cisco is planning a hybrid of its NAC schemes that will address customer concerns about the complexity, maintenance and speed of the company’s current options.

The upgrades would make it possible for customers to buy Cisco’s NAC appliance - the NAC option most of its customers opt for first - and later migrate to its network-based NAC Framework architecture without having to swap out as many elements.

Click to see: Cisco's NAC migration

Currently NAC Appliance and NAC Framework use different client software to evaluate the security posture of network endpoints as part of the NAC process. And the NAC Framework relies on its Access Control Server (ACS) to determine which access policy to apply while the NAC Appliance relies on its separate management server to determine if endpoints are in compliance.

Cisco calls the more unified NAC picture oneNAC, according to a source knowledgeable about what Cisco is saying to its customers about its NAC road map.

One of the problems all NAC customers face is that NAC appliances in general don’t scale large enough to accommodate a large corporate wide deployment without using many appliances, says Rob Whiteley, an analyst with Forrester Research.

The solution is network-based NAC that scales to large deployments without requiring a proliferation of new devices on the network, he says. A migration strategy between appliance and network-based NAC would simplify customers’ transitions to wider NAC deployments.

Cisco describes its NAC plans as a path for customers to buy its NAC Appliance now and migrate to its NAC Framework over time.

“Our customers like to start with NAC Appliance because it's easier and doesn't require upgrading their infrastructure gear all at once, but they also like many aspects of the Framework approach,” a Cisco spokesman said in an e-mail.

“So in interpreting 'oneNAC', it refers to making sure both solutions are interoperable with each other, that customers get investment protection, etc. That way, customers can upgrade infrastructure as part of the natural refresh cycle while getting started with NAC.”

One of Cisco’s NAC options is an appliance that can sit inline with traffic to enforce access policies. The throughput is 1Gbps, a limiting factor for faster networks.

The appliance can also be deployed out of the traffic stream - out-of-band - and use Cisco network switches to enforce NAC policies.

Cisco Framework relies on software deployed on network endpoints in combination with Cisco’s ACS/RADIUS server to trigger 802.1X enforcement of admission policies. One drawback customers find is that adding and updating policies is complex because it involves directly touching the RADIUS server and refreshing local policy directories, the source says.

“The technology is there, but to get the implementation is a battle,” says the source, who spoke on the condition of anonymity because the source’s employer didn’t authorize speaking to the press.

OneNAC would draw on pieces of both architectures. It would use the management-server portion of the NAC appliance implementation as the single place for customers to create, add and change NAC policies, the source says. And it would be fully compliant with the 802.1X authentication standard, the source says.