McAfee NAC hits on endpoint assessment, but misses on other standard access-control measures

McAfee

Cost: $20,370 for 1,000 users.

Score: 3.03

McAfee network-access control has a strong foundation in the breadth of security checks it can render, and it’s got strong ties to McAfee’s mature endpoint-security management platform, but it lacks some standard NAC capabilities, such as a captive portal for guest users, the ability to authenticate users against external repositories and the option of creating custom endpoint checks.

The product comprises a central server, a software agent called McAfee Policy Enforcer Agent and management hooks into McAfee’s ePolicy Orchestrator (ePO), which also is used to manage pretty much all of McAfee’s antivirus, antispam and host intrusion-prevention tools.

McAfee primarily provides self-enforcement for network access based on the posture of device in question. The Policy Enforcer Agent residing on the client machine routinely conducts policy checks (with no noticeable performance impact in our testing), and if it finds a problem, the agent on the device limits network connectivity as opposed to having a piece of the network infrastructure handle enforcement. Check Point also offers this level of self-enforcement.

You also can integrate McAfee NAC with leading VPN providers, such as Check Point and Juniper, to either allow or drop connections based on McAfee-driven system assessments or use SNMP to control your network switch in order to force virtual-LAN changes. 

The company asserts that future releases will provide further enforcement support through the McAfee IntruShield network IPS product, as well as 802.1X and DHCP ties.

For testing, we deployed McAfee NAC and ePO on a Windows 2003 server and used both the agent-based endpoint assessment and self-enforcement efforts as well as switch integration for network-based enforcement activities.

The McAfee NAC product does not support direct integration for external authentication, but instead relies on the authentication information on the endpoint accessed by the agent software. In McAfee’s scheme, policies are assigned based solely on the posture of device and not in any way on the user who might driving the device. Device-based access works well when you have a diverse population of users with the same endpoint-security requirements. Alternatively, user-based access works best when you have specific security requirements for a user’s role where they could be using different endpoint systems to access the network.

Enforcement zones, a McAfee term that is akin to access policies, are defined to specify what network resources can be accessed depending on the compliance state of the machine. You can shunt machines to a general quarantine zone, a missing patch zone, an active infection zone and an unwanted software zone.

McAfee provides network switch control to force VLAN changes only for guest endpoints that fail compliance assessments. McAfee does not provide the traditional captive-portal approach for guest access that most competing NAC products offer. Assessment for unmanaged (guest) systems can occur through a remote scan or through an Active X control accessed on a Web page (there is no authentication happening here, so it is not akin to a portal). The remote scan may be a problem if the unmanaged device is running a firewall that blocks access. But barring that condition, the product identifies rogue systems as a device without the ePO agent installed.