Click to see: Clear Choice Analysis logo

Network access control represents the most significant change in the way that networks are secured since the invention of the firewall. But it’s also contentious, confusing and — when done right — complicated.

With the stampede of vendors laying claim to NAC territory, IT managers are now presented with an overwhelming number of architectures and tools designed to help create a strong link between users, end systems and access to network resources.

In an effort to provide some insight into how each may or may not fit into your network, herein is a breakdown of their similarities and differences.

NAC is a broad new buzzword, and security and network vendors all have ideas about how best to give their products and services a place in the NAC universe. The major NAC schemes we examined were Cisco's Network Admission Control, Juniper's Infranet, Microsoft's Network Access Protection and the Trusted Computing Group’s (TCG) Trusted Network Connect.

Before diving into the who's who of NAC, it's important to understand its basic elements (see NAC primer).

There are three fundamental approaches to NAC based on where the access control is being enforced in the enterprise: edge control, core control and client control.

Edge control takes the principle of the firewall and pushes it to the edge of the network, where systems connect. If you are protecting a LAN, the individual switch port becomes the NAC control point. If you are working with a VPN connection, the IPSec concentrator or the SSL VPN device is in charge of enforcing access controls. In a wireless environment, the access point or wireless switch plays the NAC role.

In the core control schema, controls can be enforced anywhere in the network providing it's in deeper than the edge device. You could insert a NAC device inline, or as a passive tap, between edge switches and the core, where it would collect authentication and endpoint-security information, and then enforce the appropriate access control policy.

Whitepapers

• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users
• IT Departments on Data Security: A Research Concepts Survey

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports