Open source swarms around NAC

Universities lead the way, but wide acceptance may take awhile

A pair of Harvard University IT staffers last week released a free virtual appliance that supports their open source network access control platform -- just one of many free NAC tools springing up to address security-hungry customers.

Called PacketFence Zero Effort NAC (ZEN), the Harvard-developed appliance consists of an operating system image that runs on Linux or Windows and performs policy checks of devices as they log on to networks.

PacketFence ZEN is the latest innovation among about a dozen free NAC packages, most them created at colleges in reaction to the same Sasser and Blaster worms that led commercial vendors -- such as Cisco, Microsoft and the Trusted Computing Group industry consortium -- to develop NAC for profit.

NAC has proven so popular that Infonetics projects commercial vendors will reap US$3.9 billion in NAC sales by 2008, but the open source alternatives probably won't share in the payday, says Rob Whiteley, an analyst with Forrester Research. "Open source NAC will be a catalyst that big vendors like HP or IBM will wrap around their own products and then support the heck out of it," for a fee, he says, but that will take some time and leave out the open source innovators.

That's OK with Dave LaPorte and Kevin Amorin, the two Harvard IT workers who develop PacketFence together in their off hours. "We're just doing it because it's fun, and we use it on our jobs, and it's useful to a lot of people," says LaPorte.

Their software authenticates users via any method supported by open source Apache Web servers. It performs vulnerability scans and can divert machines found lacking to remediation sites. It can isolate devices from the network using DHCP changes as well as manipulating Address Resolution Protocol caches.

Commercial vendors rely mainly on 802.1x port authentication to isolated devices, which is arguably more secure, according to analyses of various NAC architectures. But some open source projects embrace 802.1x as well.

While it may not be booming, PacketFence is making headway, says Ludovic Marcotte, chief systems architect at Inverse, a Montreal integrator that installs and supports PacketFence commercially. "Most of our clients are big universities or school boards or large companies where we normally have 2,000 up to 100,000 users," he says.

One of these is Williams College in Williamstown, Massachusetts, which is phasing out its homegrown access-control platform based on Cisco's VLAN Membership Policy Server (VMPS) that maps media access control MAC) addresses to virtual LANs, says Mark Berman, the school's director of networks and systems. "VMPS is not long for this world. Cisco is phasing it out," Berman says.

In addition, PacketFence supports DHCP distribution of IP addresses, which will be needed as Williams implements VoIP, he says. The VMPS alternative relied on static IP addresses.

Price and independence also play a role in the decision to use PacketFence. "The cost for us is a tiny fraction of what we would have paid Cisco, and I think that what we're getting is at least as good," Berman says. "One of the things that going with PacketFence gave us is it unties the knot that tied us to Cisco. We can run any switch we want at the edge as long as it supports SNMP."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?