* Some words of caution when implementing NAC
Here are two cautionary tales about NAC implementations, both from Rob Whiteley, an analyst with Forrester Research.
First, a large corporation wanted to implement NAC and tried out the three different categories: software, appliances and network-based. After testing, it settled on an appliance.
The appliance used SNMP commands to communicate with switches, and that created a problem. The business already had a complex network management platform in place that kept track of SNMP traffic, and the NAC appliance was essentially hijacking the traffic. That created triggered problems for the management platform.
The second tale involved a business that refreshes its PC configurations periodically as a matter of desktop maintenance. This is automated using pxeboot, a pre-boot execution environment that pulls down a new desktop image before the operating system starts up.
When pxeboot tried to do this for several hundred PCs, the NAC appliance the company installed didn’t get a NAC endpoint check report from the devices and quarantined all of them. The company had to make a workaround to solve the problem.
Both cases point out that businesses must carefully test NAC in their network environments before they bring NAC live. NAC is primarily a security technology, but it has implications for the IT teams that focus on desktops, operations, networking, identity management, change management, etc.
The bottom line for customers is that they should have well-defined tasks for NAC and attempt to address them directly and concisely without introducing any more complexity than is absolutely necessary. And then the NAC solution should be vetted very carefully to avoid these types of unintended effects.
