McAfee

Cost: $20,370 for 1,000 users.

Score: 3.03

McAfee network-access control has a strong foundation in the breadth of security checks it can render, and it’s got strong ties to McAfee’s mature endpoint-security management platform, but it lacks some standard NAC capabilities, such as a captive portal for guest users, the ability to authenticate users against external repositories and the option of creating custom endpoint checks.

The product comprises a central server, a software agent called McAfee Policy Enforcer Agent and management hooks into McAfee’s ePolicy Orchestrator (ePO), which also is used to manage pretty much all of McAfee’s antivirus, antispam and host intrusion-prevention tools.

McAfee primarily provides self-enforcement for network access based on the posture of device in question. The Policy Enforcer Agent residing on the client machine routinely conducts policy checks (with no noticeable performance impact in our testing), and if it finds a problem, the agent on the device limits network connectivity as opposed to having a piece of the network infrastructure handle enforcement. Check Point also offers this level of self-enforcement.

You also can integrate McAfee NAC with leading VPN providers, such as Check Point and Juniper, to either allow or drop connections based on McAfee-driven system assessments or use SNMP to control your network switch in order to force virtual-LAN changes. 

The company asserts that future releases will provide further enforcement support through the McAfee IntruShield network IPS product, as well as 802.1X and DHCP ties.

For testing, we deployed McAfee NAC and ePO on a Windows 2003 server and used both the agent-based endpoint assessment and self-enforcement efforts as well as switch integration for network-based enforcement activities.

The McAfee NAC product does not support direct integration for external authentication, but instead relies on the authentication information on the endpoint accessed by the agent software. In McAfee’s scheme, policies are assigned based solely on the posture of device and not in any way on the user who might driving the device. Device-based access works well when you have a diverse population of users with the same endpoint-security requirements. Alternatively, user-based access works best when you have specific security requirements for a user’s role where they could be using different endpoint systems to access the network.