Open source swarms around NAC

Universities lead the way, but wide acceptance may take awhile

A pair of Harvard University IT staffers last week released a free virtual appliance that supports their open source network access control platform -- just one of many free NAC tools springing up to address security-hungry customers.

Called PacketFence Zero Effort NAC (ZEN), the Harvard-developed appliance consists of an operating system image that runs on Linux or Windows and performs policy checks of devices as they log on to networks.

PacketFence ZEN is the latest innovation among about a dozen free NAC packages, most them created at colleges in reaction to the same Sasser and Blaster worms that led commercial vendors -- such as Cisco, Microsoft and the Trusted Computing Group industry consortium -- to develop NAC for profit.

NAC has proven so popular that Infonetics projects commercial vendors will reap US$3.9 billion in NAC sales by 2008, but the open source alternatives probably won't share in the payday, says Rob Whiteley, an analyst with Forrester Research. "Open source NAC will be a catalyst that big vendors like HP or IBM will wrap around their own products and then support the heck out of it," for a fee, he says, but that will take some time and leave out the open source innovators.

That's OK with Dave LaPorte and Kevin Amorin, the two Harvard IT workers who develop PacketFence together in their off hours. "We're just doing it because it's fun, and we use it on our jobs, and it's useful to a lot of people," says LaPorte.

Their software authenticates users via any method supported by open source Apache Web servers. It performs vulnerability scans and can divert machines found lacking to remediation sites. It can isolate devices from the network using DHCP changes as well as manipulating Address Resolution Protocol caches.

Commercial vendors rely mainly on 802.1x port authentication to isolated devices, which is arguably more secure, according to analyses of various NAC architectures. But some open source projects embrace 802.1x as well.

While it may not be booming, PacketFence is making headway, says Ludovic Marcotte, chief systems architect at Inverse, a Montreal integrator that installs and supports PacketFence commercially. "Most of our clients are big universities or school boards or large companies where we normally have 2,000 up to 100,000 users," he says.

One of these is Williams College in Williamstown, Massachusetts, which is phasing out its homegrown access-control platform based on Cisco's VLAN Membership Policy Server (VMPS) that maps media access control MAC) addresses to virtual LANs, says Mark Berman, the school's director of networks and systems. "VMPS is not long for this world. Cisco is phasing it out," Berman says.

In addition, PacketFence supports DHCP distribution of IP addresses, which will be needed as Williams implements VoIP, he says. The VMPS alternative relied on static IP addresses.

Price and independence also play a role in the decision to use PacketFence. "The cost for us is a tiny fraction of what we would have paid Cisco, and I think that what we're getting is at least as good," Berman says. "One of the things that going with PacketFence gave us is it unties the knot that tied us to Cisco. We can run any switch we want at the edge as long as it supports SNMP."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

Logitech Ultimate Ears Wonderboom Bluetooth Speaker

Learn more >

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?