* NAC that can supplement infrastructure may be what customers really want
NAC is getting close to the time when customers will start looking less for NAC boxes they can add to their networks and more for NAC that can supplement their infrastructure.
Appliances that sit inline to handle endpoint checks, authentication and enforcement of NAC policies are not the answer for large deployments because of the large number of devices that model requires. There would quickly be too many devices added to the network to manage and maintain effectively in a broad rollout.
This has been obvious from the get-go, but these types of devices prove useful anyway in targeted deployments within large companies – the guest/consultant scenario – or broader deployments in small organizations.
As NAC becomes better understood by businesses, they are becoming more willing to consider it for wider use, and will look for practical ways to deploy it.
One major change since NAC first came out is the adoption of 802.1x support in network switches. As time goes by, more and more businesses refresh their switching infrastructure, include 802.1x and thereby make it suitable to support NAC without separate enforcement devices. Network infrastructure will only become more NAC friendly with time.
Perhaps the biggest change coming is Microsoft’s NAP server, due out next month, perhaps. (You never know with Microsoft.) That in combination with the integrated NAP/NAC client in its Vista desktop software will make many customers start looking at this as the basis for their own access control projects.
NAP relies on a variety of network devices to enforce policies, but does not rely on adding devices to the network specifically to perform this function.
This is all probably bad in the long run for vendors dedicated strictly to the inline boxes, but good in the long run for customers who can push NAC back into the category of a layer of network security rather than a separate undertaking requiring significant time, effort and cash.
