Burning NAC questions

Take a look at important questions surrounding Cisco, NAC implementation and NAC policies.

Part 2 of 2. In the second part of our look at important network-access control issues, we take a look at important questions surrounding Cisco, NAC implementation and NAC policies. Review part 1, 'Who Needs NAC Anyway?' here.

Shouldn't I just wait for Cisco?

There's really no need to wait because depending on what you want out of NAC, Cisco may already have it.

And if Cisco doesn't yet offer what you want, there is still no need to wait because you can get alternatives from other vendors.

Cisco has a NAC appliance that can check devices before they get network access for virus software that it is updated and turned on and whether patch levels meet policy.

That said, the device is criticized by some for what it cannot do. "Cisco remains behind many of the other vendors in this space because of the inability to perform assessment checks beyond initial connection," says Mandy Andress in her recent review of the appliance for Network World.

For example, the device does not perform periodic rechecks of devices once they have been admitted to the network to make sure they maintain their security posture.

The Cisco NAC Appliance does afford multiple enforcement methods, including placing the device inline with traffic where it can restrict traffic directly, having it work in tandem with 802.1X authentication or running it out of band where it controls an access switch. It can also enforce NAC for devices attaching via SSL or IPSec VPN through Cisco gear.

There are other appliances from other vendors that do more, and if Cisco's appliance comes up short, these others can fill the bill.

Cisco also has a scheme that builds NAC into its network architecture, a design that scales better for large rollouts. One of the problems all NAC customers face is that NAC appliances in general don't scale large enough to accommodate a major corporate-wide deployment without relying on many appliances, says Rob Whiteley, an analyst with Forrester Research. Cisco's network-based NAC requires certain switch specifications that may mean upgrades for some customers. As a result, some are holding off until they need to upgrade.

One problem customers see with Cisco NAC is that it has two separate designs that don't have interchangeable parts. Currently Cisco NAC Appliance and its network-based NAC Framework have separate clients to evaluate the security posture of network endpoints.

Also, the NAC Framework relies on Cisco's Access Control Server (ACS) to determine which access policy to apply while the NAC Appliance relies on its own management server to determine if endpoints are in compliance.

Cisco has a migration strategy called OneNAC to simplify the transition between appliance and network-based NAC with interchangeable clients and a single server. But that plan still has some details to be ironed out.

Regardless of its comparative merits, Cisco's NAC has a solid base of loyal customers, according to Current Analysis' latest annual NAC study. The report says that 67 percent of current Cisco NAC Appliance customers and 68 percent of Cisco NAC Framework customers would consider buying more Cisco NAC gear.

The flip side is that the numbers imply that about a third of these customers would not consider more Cisco NAC products, but the survey doesn't state their reasons.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?