Enterasys has wheeled out a bundle of its technology, called Secure Open Convergence, to protect VoIP networks - and that protection includes NAC.

VoIP is a difficult area for NAC because NAC relies on endpoint assessment as a key factor in deciding whether a device gains admission to a network. VoIP phones are typically proprietary and don’t support client software that can scan and report in on their security posture.

Since thorough NAC endpoint checking that employs client software is out of the question, the next option is using MAC authentication - authenticating a machine based on its MAC address. This can be combined with identifying the operating system of the phone, the switch port being used and other externally discernable factors to create a NAC policy for phones.

The assessment may give some assurance that the device logging in as a phone is actually a phone, but it leaves open the possibility that he device is something else spoofing a phone. It tells nothing at all about whether the device is infected.

The only way to protect against a device masquerading as a phone or an infected phone executing a malicious exploit is to monitor the behavior of these devices once they are on a network.

The NAC protection needs to have post-admission policies that state what resources an IP phone is allowed to connect with. For example, a device identifying itself as a phone and trying to connect to a human resources server is probably not a phone. A post-admission NAC policy ought to cut that device off the network.

This is valuable protection for a VoIP network and Enterasys is right to include its NAC gear as part of its VoIP-protection initiative.

Tim Greene is senior editor at Network World.