What Is Network Access Control (NAC)?

The standard mechanism is IEEE 802.1X, which defines three roles. The supplicant is software on the endpoint that presents credentials. The authenticator is the switch port or access point the device connects to, which blocks all traffic except the authentication exchange until a decision is made. The authentication server — in practice almost always a RADIUS server, which is what the NAC platform presents itself as — evaluates the credentials and returns a verdict. Until that verdict arrives, the port passes nothing else, which is what makes 802.1X an admission control rather than a monitoring tool.

Credentials travel inside EAP, the Extensible Authentication Protocol, and the method chosen matters more than most other decisions in the deployment. EAP-TLS uses a certificate on the device and is the strongest common option, because there is no password to phish or reuse; it also requires a certificate lifecycle, which is the real cost. Password-based methods such as PEAP with MSCHAPv2 are easier to roll out and inherit every weakness of the passwords behind them. Organizations with an existing certificate authority and device management generally standardize on EAP-TLS for managed endpoints and reserve password methods for cases they cannot avoid.

The verdict is more than yes or no. A RADIUS response can carry attributes that tell the switch which VLAN to place the port in, which downloadable access list to apply, or which security-group tag to attach to the traffic. This is the part that turns authentication into segmentation: the same physical port becomes a corporate segment for an employee laptop, a restricted segment for a contractor, and an isolated segment for an unrecognized device, decided per session rather than per cable.

Most networks are full of endpoints with no supplicant and no way to hold a credential — printers, badge readers, cameras, building-management controllers, medical devices, industrial sensors, older phones. The standard fallback is MAC Authentication Bypass, in which the switch reports the device's hardware address to the policy server and the server decides based on that address alone. It works, it is unavoidable, and it is weak by construction: a MAC address is broadcast in the clear and trivial to copy, so MAB authorizes anything that claims the right address.

Profiling is what makes MAB tolerable. The NAC platform builds a fingerprint of each device from the traffic and metadata it already emits — DHCP options, HTTP user-agent strings, mDNS and other discovery chatter, open ports, organizationally unique identifier lookups on the hardware address — and compares behavior against the profile it expects. A device that authenticated as a label printer and then began scanning the subnet has failed its profile even though its address is still correct. Profiling is a detection layer over a weak credential rather than a replacement for one, and it should be described that way in any design document.

Guest and unmanaged devices usually get a third path: web authentication, where the endpoint is placed in a restricted segment and redirected to a captive portal to accept terms, enter a sponsored credential or register. Two developments complicate all of this. Randomized hardware addresses, now the default on mainstream mobile operating systems, break MAC-based recognition of personal devices and force either per-network address stability settings or a shift to certificate-based enrollment. And the sheer growth in non-authenticating equipment means the MAB population is rising in most estates, not falling, which is an argument for segmenting those devices tightly rather than for trusting the address more.

Authentication answers who; posture assessment answers what condition. A posture check evaluates the endpoint against a policy before granting full access: operating system version and patch level, disk encryption enabled, host firewall on, an endpoint protection agent installed and actually running with current definitions, required configuration present, prohibited software absent. A device that fails is not simply refused — it is placed in a remediation segment with access to whatever it needs to fix itself, re-checked, and admitted when it passes.

There are two ways to collect that evidence and the choice shapes the whole deployment. An agent on the endpoint gives detailed, reliable answers and requires that the agent be deployed, maintained and kept compatible across every operating system in the estate. Agentless assessment infers condition from the outside using scanning, management-protocol queries and integration with existing device-management or endpoint-protection platforms; it covers devices that will never accept an agent and sees less. Most real deployments run both, agent-based for corporate-managed endpoints and agentless for everything else.

The failure mode to design against is a posture policy strict enough to lock out the people who need to fix things. A remediation segment that cannot reach the patch server, an encryption check that fires during a scheduled reboot, or a definitions-age threshold shorter than the update interval will all generate support load rather than security. Pilot the policy in a reporting-only mode long enough to see what a normal week looks like before it starts denying access.

An admission decision made at connection time goes stale immediately. The mechanism that fixes this is RADIUS Change of Authorization, defined in RFC 5176, which lets the policy server push a new decision into a session already in progress without waiting for the device to reconnect. The server can move the port to a different VLAN, apply a new access list, force re-authentication, or terminate the session outright — in seconds, from a central point, across the whole access layer.

That capability is what makes NAC useful to the rest of the security stack rather than only at onboarding. When an endpoint detection platform flags a host as compromised, or a SIEM correlates activity into an incident, the response action can be a Change of Authorization that drops that device into an isolation segment while it is still connected. The equivalent without CoA is somebody walking to a wiring closet, which is not a response time anybody wants to publish. It also runs in the benign direction: a device that has finished remediation gets moved out of quarantine automatically rather than waiting for a support call.

Continuous re-evaluation is the same idea on a timer — periodic posture re-checks, session timeouts that force re-authentication, and policy changes that take effect on live sessions rather than at next connect. This is the specific point at which NAC stops being a gate and starts being the device-side enforcement of a zero-trust design, and it is worth confirming during evaluation that the access-layer hardware genuinely honors CoA, because support quality varies more than datasheets suggest.

The policy engine is only as capable as the equipment executing its decisions, and the requirements are concrete. Access switches need 802.1X authenticator support, MAC Authentication Bypass for devices without supplicants, dynamic VLAN assignment from RADIUS attributes, and honored Change of Authorization. Downloadable access lists per session are highly desirable, because they allow enforcement finer than a VLAN boundary. Wireless needs WPA2-Enterprise or WPA3-Enterprise with the controller or access points acting as authenticators against the same policy server, so a device gets the same treatment wired or wireless.

Unmanaged switches are the structural problem. They cannot be authenticators, so anything behind one is invisible to the policy — and a small unmanaged switch under a desk turns one authenticated port into an unknown number of unauthenticated devices. Multi-host and multi-domain authentication modes on the upstream port mitigate this partially by authenticating more than one endpoint per port, but the durable fix is to eliminate unmanaged switches from the access layer. Any NAC scoping exercise should begin with an honest inventory of them, including the ones nobody documented.

Two more practical constraints. IP telephony creates the classic multi-domain case, where a phone and a PC share one port and belong in different segments — a supported pattern on business-class switches and one to verify explicitly rather than assume. And the policy server becomes infrastructure the network now depends on, which means redundancy, and a documented decision about what a switch should do when no policy server answers: fail open and admit everything, or fail closed and admit nothing. Neither answer is universally right, and discovering that your default is the wrong one during an outage is the expensive way to find out.

The dominant failure is enforcing too early. A NAC rollout that switches ports into closed mode before the estate is understood will lock out equipment nobody knew existed, and the resulting outage usually ends the project rather than the misconfiguration. The disciplined sequence is monitor mode first — authenticate and log, enforce nothing — for long enough to see a full business cycle including month-end and any seasonal equipment; then a low-impact mode in which failures land in a restricted segment rather than being denied; then closed enforcement, one site or one building at a time.

Discovery is where the real work sits. Every deployment finds devices that were never inventoried, devices whose owner left the organization years ago, and devices that turn out to be load-bearing for something important. The monitoring phase is what surfaces them, which is why shortening it to hit a date is the most reliably regretted decision in this category of project.

Finally, treat exceptions as debt rather than as design. Every device permitted by hardware address alone, every port excluded from authentication, and every posture rule waived for a specific team is a hole with a name attached. Recording them with an owner and a review date keeps the exception list finite; leaving them undocumented produces, within a couple of years, a NAC deployment that authenticates only the devices that were easy.