Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Understanding NAC

How much can a LAN switch protect your network?

Article comments

Call it NAC (Cisco's Network Admission Control) or, well, NAC (network access control), or even NAP (Microsoft's Network Access Protection). Any way you refer to it, these schemes for shutting out unwanted users at the LAN switch port level are among the most buzzed about network technologies.

Almost all Ethernet vendors offer some sort of NAC technology -- even D-Link, SMC and Linksys on the low end. Advanced network product integration, such as Cisco's NAC or Nortel's Secure Network Architecture, allow LAN switches to communicate with back-end security gear to filter dangerous or unsecure users and shut down unwanted network activity -- in theory. And almost every LAN vendor offers basic network protection features, such as 802.1X, access control lists, and media access control address filtering.

So how much protection a LAN switch can provide to an overall network is really a question of how much protection is needed, and what extra gear is required to make a meaningful impact on LAN security, experts say.

"How much security can NAC provide? I don't know -- say, seven pounds," jokes Joel Snyder, senior partner at Opus One and a Network World Lab Alliance member. In all seriousness, Snyder has extensively tested most NAC products on the market, and says there are four points along the 'enforcement spectrum,' or levels of protection that make up NAC.

The first is called 'go/no-go'. This is a very basic pass-fail authentication challenge that a switch can provide. "It's similar to if you try to get on a wireless LAN, but don't know the WEP key," Snyder says. Most enterprise switches support the 802.1X protocol, which, when deployed with a back-end RADIUS authentication server, can provide this basic kind of pass/fail NAC protection.

The second level is what Snyder calls virtual LAN 'schwinging,' in which users are put on different virtual LANs (VLAN) based on a NAC framework. A campus could be divided into several VLANs, each designated for various departments, or employee levels with certain access privileges. Based on credentials presented at the 802.1X authentication phase, users can be shunted -- or 'schwinged' -- into their proper network segment. This involves a more intelligent back-end server or application, which is able to identify credentials, correlate user identities with access rights, and send commands to LAN switches to adjust switch port VLAN settings accordingly.

"There isn't a huge amount of granularity," with this technique, Snyder says. But most switches on the market support VLANs and a standard called RFC 3580, which is the method for telling a switch what users are on what VLANs.

"That must be driven by some outside piece of software, so the switch by itself is not a standalone NAC solution," Snyder says.

The next two levels are simple packet filtering, and the highest level is full firewalling, or packet inspection.

With simple packet filtering, "some switches can do more than just put you on a VLAN," Snyder says. "They can limit where you can go on a per-user basis." This is known as Port-based Access Control Lists -- where an ACL is applied to a specific port or user -- and not to an entire switch or VLAN. This kind of feature is found on higher-end LAN switches, such as those from Cisco, Enterasys, HP and Nortel, Snyder says.

This fourth level is the area of some focused niche NAC start-ups. "It's more of a speciality product. It's not like you're going to go into your wiring closet and find a LAN switch already installed that can do stateful packet filtering," Snyder says. Companies offering this kind of 'firewall-to-the-LAN-port' feature include ConSentry and Nevis, both of which have appliances that sit behind a LAN access layer and provide firewalling.

"The switch designer's mind is different from the firewall engineer's mind," Snyder says.

Switch engineers think in terms of maximum throughput and availability, while firewall makers look to keep things out. This conflict of philosophies makes switch-based NAC a tricky product to design, which has kept product development and adoption at a slow pace.

But for even the lowest levels of NAC, the technology is "a huge step forward -- not necessarily what a total anal-retentive security person might ask for, but it's a lot," Snyder says. "For most people, the question is, what can we do with the switches we've got?"


Share:

More from Techworld

More relevant IT news

Comments




Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *