What Is NAC? Network Access Control, 802.1X and Unauthorised Device Access

One of the most fundamental questions in corporate network security is this:

When a device connects to the network, how do you know who that device really is and whether it is authorized to connect to the network?

If a user gains network access directly when they plug an ethernet cable into a socket or connect to the corporate Wi-Fi network, an important security risk can arise.

Because not every device connecting to the network is trusted.

That device;

a corporate laptop,

a personal telephone,

a guest computer,

an IoT device,

a printer,

an IP camera,

an unknown device,

an unauthorized access point

or a compromised endpoint

may be any of these.

For this reason, in modern corporate networks using only a firewall is not enough.

The firewall:

where the traffic on the network can go

controls this.

NAC, on the other hand:

who or which device can connect to the network

controls this.

The expansion of NAC is:

Network Access Control

that is:

Control of Access to the Network

as it is expressed.

The fundamental purpose of NAC systems is:

To verify the identity of the users and devices that want to connect to the network, to evaluate their security state and to grant the appropriate network access dynamically.

For this reason NAC is one of the important components of modern Network Security, Zero Trust and Identity-Based Access Control architectures.

What Is NAC?

NAC - Network Access Control is the security approach that makes it possible to control the users and devices connecting to the corporate network according to identity, device type, security state and access policies.

A NAC system tries to answer the following questions:

• Who is this device?
• Who is the user?
• Is the device corporate?
• Is the device managed?
• Is the security posture suitable?
• Which network segment should it be placed in?
• Which resources should it be able to reach?
• Should a suspicious device be placed in quarantine?

Why Is Network Access Control Necessary?

In the classical network architecture a device can gain broad network access when it connects to an ethernet port or performs Wi-Fi authentication.

However, this approach is not sufficient in terms of modern security requirements.

Because:

Network connection is not equal to Trust

That is, connecting to the network physically or wirelessly does not mean that the device is trusted.

What Are the Fundamental Aims of NAC?

The principal goals of NAC are these:

• To block unauthorized devices
• To verify user identity
• To determine device identity
• To perform device posture checks
• To apply dynamic VLAN assignment
• To manage guest access
• To control BYOD access
• To classify IoT devices
• To detect rogue devices
• To place compromised devices in quarantine
• To increase network visibility
• To support the Zero Trust approach

What Is the Difference Between NAC and a Firewall?

The firewall:

Network traffic control

provides this.

NAC:

Network admission control

provides this.

That is, the firewall:

"Where can this device reach?"

answers this question.

NAC, on the other hand:

"Can this device connect to the network?"

answers this question.

The Relationship Between NAC and Network Segmentation

After recognizing the user or the device NAC can direct it to the appropriate network segment.

For example:

Corporate Laptop

→

Corporate VLAN

Guest Device

→

Guest VLAN

IoT Device

→

IoT VLAN

Non-Compliant Device

→

Quarantine VLAN

This structure:

Identity-Based Segmentation

supports this approach.

What Is 802.1X?

802.1X is the port-based network access control standard defined by the IEEE.

It can be used for user or device authentication in ethernet and wireless network environments.

How Does 802.1X Work?

There are three fundamental components in the 802.1X architecture:

Supplicant

Authenticator

Authentication Server

What Is a Supplicant?

It is the device that wants to connect to the network or the authentication client on that device.

For example:

Windows laptop

macOS device

corporate mobile device

What Is an Authenticator?

It is the network component that provides control between the device and the authentication server.

Generally:

Switch

Wireless Access Point

or Wireless Controller

it can be any of these.

What Is an Authentication Server?

It is the central system that verifies the user or device identity.

Most often:

RADIUS Server

is used.

How Does the 802.1X Flow Work?

In simplified form:

Endpoint

↓

Switch / Access Point

↓

RADIUS Server

↓

Identity Verification

↓

Access Decision

What Is RADIUS?

RADIUS:

Remote Authentication Dial-In User Service

is the protocol widely used in network access authentication, authorization and accounting processes.

What Does RADIUS Do?

RADIUS can carry out the following operations:

Authentication

Authorization

Accounting

What Is Authentication?

It is the verification of the identity of the user or device.

What Is Authorization?

It is the determination of which resources the verified user or device can reach.

What Is Accounting?

It is the recording of the user or device access activities.

What Is AAA?

AAA:

Authentication

Authorization

Accounting

is the combination of these concepts.

What Is EAP?

EAP:

Extensible Authentication Protocol

is the authentication framework used in the 802.1X authentication process.

What Is EAP-TLS?

EAP-TLS is a strong 802.1X authentication method that provides mutual authentication using client and server certificates.

Why Is EAP-TLS Strong?

It can use a digital certificate instead of a password.

For this reason it can reduce the credential theft risk.

What Is Certificate-Based Authentication?

It is the verification of the user or device through a digital certificate.

Why Is Certificate-Based NAC Strong?

An attacker may not be able to gain network access merely by capturing a username and password.

What Is PEAP?

Protected Extensible Authentication Protocol is one of the EAP authentication methods.

EAP-TLS or PEAP?

It can vary according to the security requirement.

Since EAP-TLS is certificate based it can offer strong authentication.

Does 802.1X Work on Every Device?

No.

Some devices may not support 802.1X.

For example:

Printer

IP Camera

IoT Device

Legacy Device

What Is MAB?

MAB:

MAC Authentication Bypass

is the method that allows devices that do not support 802.1X to receive network access through their MAC address.

Is MAB Secure?

On its own it is not a strong authentication method.

Because a MAC address can be spoofed.

What Is MAC Spoofing?

It is a device imitating the MAC address of another device.

Where Can MAB Be Used?

Not supporting 802.1X:

Printer

Camera

IoT

Legacy Network Device

it can be used on devices such as these.

Which Controls Should Be Added When MAB Is Used?

Device Profiling

Network Segmentation

Restricted ACL

Monitoring

controls such as these can be applied.

What Is Device Profiling?

It is the determination of the device type from the characteristics of the device connecting to the network.

How Is NAC Device Profiling Performed?

Various technical signals can be used.

For example:

MAC OUI

DHCP Fingerprint

DNS Behaviour

HTTP User-Agent

LLDP

CDP

SNMP

What Is MAC OUI?

It is the part of the MAC address that can show the manufacturer information.

What Is DHCP Fingerprinting?

It is the estimation of the operating system or device type from the device's DHCP request behaviour.

Why Is Device Profiling Important?

It helps to create a complete inventory of the devices on the network.

Does NAC Provide Asset Visibility?

Yes.

It can make it possible to see the devices connecting to the network centrally.

What Is an Unknown Device?

It is a device that has connected to the network but whose identity or ownership is not known.

Why Is an Unknown Device Risky?

It may be one of these:

Unauthorized device

Shadow IT

Attacker device

Legacy device

Misconfigured device

What Is a Rogue Device?

It is a device that connects to the corporate network without permission.

What Is Rogue Device Detection?

It is the detection of unauthorized devices on the network.

What Is a Rogue Access Point?

It is a wireless access point connected to the corporate network without permission.

Why Is a Rogue AP Dangerous?

It can create an uncontrolled wireless access point to the corporate network.

Can NAC Detect a Rogue AP?

Depending on its network visibility and profiling capabilities it can help.

What Is BYOD?

BYOD:

Bring Your Own Device

is employees using their personal devices to access corporate systems.

What Is the Security Risk of BYOD?

A personal device:

May not contain EDR.

Its patch level may not be known.

It may not have disk encryption.

It may carry malware.

Should BYOD Be Admitted Directly to the Network?

A limited segment or a special access policy must be applied on a risk basis.

What Is a BYOD VLAN?

It is the network segment reserved for personal devices.

Are BYOD and the Guest Network the Same?

Not always.

A BYOD device may belong to an organization user.

A guest device may belong to an external user.

What Is Guest Access?

It is guest users receiving network access in a controlled way.

How Should the Guest Network Be?

Generally:

Internet Access Only

Corporate Network Deny

it is configured in this way.

What Is a Guest Portal?

It is the captive portal on which the guest user registers or authenticates before access.

What Is Sponsor-Based Guest Access?

It is guest access being approved by an employee of the organization.

What Is Guest Account Expiration?

It is the automatic closing of the guest account at the end of a certain period.

Why Should Guest Access Be Time-Limited?

Permanent guest access can increase the security risk.

What Is IoT Network Security?

It is the secure classification of IoT devices on the network and the limiting of their access.

Why Are IoT Devices Difficult?

Many IoT devices:

Do not support 802.1X.

Do not support EDR.

Offer limited patching.

May use default credentials.

How Is NAC Used in IoT Security?

Device Profiling

MAB

Dynamic VLAN

Restricted ACL

IoT devices can be isolated with these.

An IoT Segmentation Example

IP Camera

↓

Camera VLAN

↓

NVR Only

Other network access:

DENY

A Printer Segmentation Example

Printer

↓

Printer VLAN

↓

Print Server

Allow

Other unnecessary communication on the user network:

Deny

What Is Device Posture Assessment?

It is the checking of the security state of the device connecting to the network.

What Can a Posture Check Control?

For example:

OS version

Patch level

EDR status

Antivirus status

Disk Encryption

Firewall status

What Is a Compliant Device?

It is a device that meets the conditions of the organization's security policy.

What Is a Non-Compliant Device?

It is a device that does not meet the security requirements.

What Should Be Done With a Non-Compliant Device?

According to the policy:

Block

Quarantine

Restricted Access

can be given.

What Is a Quarantine VLAN?

It is the network segment in which devices that do not meet the security requirements or that are suspicious are isolated.

What Can Be Done in the Quarantine VLAN?

Only:

Update Server

EDR Management

Remediation Portal

access to systems such as these can be given.

What Is a Remediation Network?

It is the network on which non-compliant devices receive limited access in order to close their security gaps.

What Is Dynamic VLAN Assignment?

It is the automatic assignment of a VLAN according to the identity information of the user or the device.

A Dynamic VLAN Assignment Example

Finance User

→

Finance VLAN

Guest

→

Guest VLAN

Camera

→

IoT VLAN

Unknown Device

→

Quarantine VLAN

What Is a Dynamic ACL?

It is the automatic application of an access control list according to the authentication result.

What Is a Downloadable ACL - dACL?

It is the sending of a dynamic ACL to the network device from the RADIUS server.

Can Role-Based Access Control Be Used in NAC?

Yes.

Network access can be determined according to the user's role.

What Is Role-Based Network Access?

For example:

Employee

Contractor

Administrator

Guest

IoT

can receive different access policies.

What Is Identity-Based Network Access?

It is network access being determined not only by IP or port but according to the user's identity.

Where Can User Identity Be Taken From in NAC?

For example:

Active Directory

LDAP

Identity Provider

Certificate

Why Is Active Directory Integration Important?

Different network access policies can be applied according to user groups.

How Do NAC and Active Directory Work Together?

The RADIUS server can verify with AD during user authentication.

What Is Machine Authentication?

It is the verification of the device connecting to the network independently of the user.

What Is User Authentication?

It is the verification of the person using the device.

Why Is Machine + User Authentication Strong?

It makes it possible to verify both the device and the user.

Can a Computer Certificate Be Used in NAC?

Yes.

A machine certificate can be used with EAP-TLS.

Can a User Certificate Be Used?

Yes.

According to the architecture a user certificate or a machine certificate can be used.

What Is PKI?

PKI:

Public Key Infrastructure

is the infrastructure that provides certificate lifecycle management.

Is PKI Necessary for NAC?

If certificate-based authentication is going to be applied, PKI can be critical.

What Is the Certificate Lifecycle?

Certificate:

Issuance

Renewal

Revocation

Expiration

is the management of these processes.

What Is a CRL?

CRL:

Certificate Revocation List

is the list of revoked certificates.

What Is OCSP?

Online Certificate Status Protocol

makes it possible to check the certificate validity state online.

Why Is Certificate Revocation Important for NAC?

By revoking the certificate of a lost or compromised device its network access can be blocked.

Are Switch Port Security and NAC the Same?

No.

Port security generally provides MAC-level restriction.

NAC offers far more advanced identity and policy enforcement.

What Is Port Security?

It is the control that limits the permitted MAC address behaviour on a switch port.

What Is Sticky MAC?

It is the switch learning the connected MAC address and associating it with a certain port.

Does Sticky MAC Take the Place of NAC?

No.

Is DHCP Snooping Part of NAC?

It is not NAC directly but it is a complementary control for Layer 2 security.

What Is DHCP Snooping?

It is the switch security feature that helps to block unauthorized DHCP servers.

What Is Dynamic ARP Inspection?

It is the Layer 2 security control that helps to reduce ARP spoofing attacks.

What Is IP Source Guard?

It is the switch feature that helps to reduce the IP spoofing risk.

Should NAC and Layer 2 Security Be Used Together?

Yes.

It forms a defense in depth approach.

What Is Wired NAC?

It is the control of ethernet network access with NAC.

What Is Wireless NAC?

It is the control of Wi-Fi network access with NAC and 802.1X.

What Is WPA2-Enterprise?

It is the Wi-Fi security method that uses 802.1X/RADIUS for enterprise authentication.

What Is WPA3-Enterprise?

It is the security standard that offers modern enterprise Wi-Fi authentication and encryption capabilities.

What Is PSK?

PSK:

Pre-Shared Key

is the shared Wi-Fi password usage model.

Why Is a Shared Password Risky on Enterprise Wi-Fi?

The password can be known by many people.

Identity attribution becomes difficult.

A former employee can continue to know the password.

Why Is 802.1X Wi-Fi Strong?

Every user or device can gain access with separate authentication.

Can NAC and VPN Be Used Together?

Yes.

Device posture and identity checks can be applied during remote access.

What Is the Difference Between NAC and ZTNA?

NAC:

Controls access to the network.

ZTNA:

Controls application/resource access through identity and context.

Is NAC Part of Zero Trust?

Yes.

In particular:

Verify Explicitly

Use Least Privilege

it supports these principles.

What Is Zero Trust NAC?

It is the approach of evaluating the device connecting to the network in terms of identity and posture not only once but continuously.

What Is Continuous Authorization?

It is access being re-evaluated not only at the moment of login but throughout the session.

What Is Risk-Based Access?

It is the application of different access policies according to the user or device risk score.

What Is Context-Aware Access?

In the access decision:

Identity

Device

Location

Time

Risk

it is the use of context information such as this.

What Is NAC and EDR Integration?

NAC can take the endpoint security posture information from the EDR.

What Can NAC Do After an EDR Alarm?

The suspicious endpoint can automatically be placed in the Quarantine VLAN.

What Is NAC and SIEM Integration?

NAC authentication and access events can be sent to the SIEM.

What Are NAC Logs?

For example:

Authentication Success

Authentication Failure

Device Profiling

VLAN Assignment

Posture Failure

Why Are NAC Logs Valuable for the SOC?

The SOC can answer the following questions:

Which device connected?

Who connected?

Where did they connect from?

Which VLAN were they assigned to?

Did authentication fail?

NAC and SOAR Integration

Automatic response can be applied after suspicious behaviour.

For example:

SIEM Alert

↓

SOAR Playbook

↓

NAC Quarantine

What Is Automated Network Isolation?

It is the automatic restriction of the device's network access as a result of a security incident.

How Is NAC Used in Incident Response?

The compromised endpoint:

Corporate VLAN

↓

NAC Policy

↓

Quarantine VLAN

can be isolated in this way.

NAC and NDR Integration

When NDR detects suspicious network behaviour NAC can place the device in quarantine.

An Example Scenario

NDR:

Lateral Movement Alert

↓

SIEM:

Incident Created

↓

SOAR:

Response Trigger

↓

NAC:

Endpoint Quarantined

What Is NAC and MDM Integration?

Device compliance information can be taken from Mobile Device Management systems.

What Is MDM?

Mobile Device Management is the central management of corporate mobile devices.

What Is UEM?

UEM:

Unified Endpoint Management

is the central management of different endpoint types.

Can NAC and UEM Be Used Together?

Yes.

The device compliance status can be used in the network access decision.

NAC Deployment Models

NAC can be applied with different methods.

What Is Inline NAC?

It is the NAC deployment model that works on the network traffic path.

What Is Out-of-Band NAC?

It is the NAC architecture that performs policy enforcement outside the network traffic path.

What Is Agent-Based NAC?

Posture information is collected using a NAC agent on the endpoint.

What Is Agentless NAC?

It is the NAC approach that works through device profiling and network telemetry without requiring an endpoint agent.

What Is the Difference Between Agent-Based and Agentless NAC?

Agent-based can provide deeper endpoint posture information.

Agentless, on the other hand, is more suitable for IoT and unmanaged devices.

What Should Be Done Before NAC Deployment?

Asset Discovery

Network Topology

Switch Compatibility

Wireless Compatibility

Identity Integration

PKI Readiness

Why Is a NAC Project Difficult?

NAC is not merely the installation of a security product.

The network, identity and endpoint infrastructure are affected together.

Which Teams Should Work Together on a NAC Project?

Network Team

Security Team

System Team

Endpoint Team

Identity Team

What Is the Biggest Risk in a NAC Project?

It is an incorrect policy blocking production access.

Should NAC Be Run in Monitor Mode First?

It is generally a strong transition approach.

What Is Monitor Mode?

Devices are monitored but not blocked immediately.

Should NAC Policy Enforcement Be Done in Stages?

Yes.

For example:

Visibility

↓

Profiling

↓

Authentication

↓

Enforcement

↓

Posture

What Is a NAC Pilot Deployment?

It is applying NAC first on a limited group of users or on a limited network segment.

Why Is a Pilot Important?

It reduces the operational risk.

What Is NAC Fail-Open?

It is the approach of permitting access when the NAC or authentication system is not working.

What Is NAC Fail-Close?

It is the blocking of access when the authentication infrastructure is not working.

Which One Is More Secure?

Fail-close is stronger in terms of security.

However, it can create an availability risk.

What Is a Critical Device Exception?

It is a device specially exempted from the NAC policy.

Why Is Exception Management Important?

Exceptions can create a security gap over time.

How Should Exceptions Be Managed?

Owner

Reason

Risk

Expiration Date

they must be recorded with these.

What Is NAC High Availability?

It is the redundant architecture that allows the NAC and RADIUS infrastructure to continue working in the event of an outage.

Why Is RADIUS Redundancy Important?

If RADIUS goes down network access can be affected.

What Is NAC Capacity Planning?

It is the sizing of the infrastructure according to the number of authentications and devices.

What Is an Authentication Storm?

It is a large number of devices performing authentication at the same time.

When Can an Authentication Storm Occur?

After a power outage,

a switch restart,

a wireless controller restart

in situations such as these.

Why Is NAC Performance Important?

Authentication latency can affect the user experience.

What Is NAC Policy Cleanup?

It is the regular removal of old or unnecessary access policies.

What Is a NAC Rule Review?

It is the periodic examination of the network access policies.

What Is a NAC Security Assessment?

It is the examination of the NAC architecture, authentication and policy configuration from a security point of view.

What Should a NAC Audit Contain?

802.1X coverage

MAB usage

Guest access

Device profiling

Exception list

RADIUS security

NAC Security KPIs

For example:

802.1X Coverage

Unknown Device Count

Non-Compliant Device Count

Guest Account Count

MAB Device Count

NAC Security KRIs

For example:

Unmanaged Device

Expired Certificate

Permanent Guest Account

Unauthorized Device

Unrestricted MAB

What Should a NAC Dashboard Show?

Connected Devices

Device Type

User Identity

Authentication Status

Assigned VLAN

Posture Status

The Most Frequently Made Mistakes in NAC

The mistakes frequently encountered in organizations are these:

• Accepting every device that connects to the network as trusted
• Not using 802.1X
• Using a shared Wi-Fi password
• Using MAB for unrestricted access
• Not monitoring unknown devices
• Not performing device profiling
• Not separating the guest network from the corporate network
• Giving BYOD devices the same access as corporate devices
• Placing IoT devices on the user VLAN
• Not creating a quarantine network
• Not performing posture assessment
• Leaving NAC exceptions without a time limit
• Running RADIUS without redundancy
• Neglecting certificate lifecycle management
• Not sending NAC logs to the SIEM

NAC Checklist

• Are all the devices on the network visible?
• Are unknown devices being detected?
• Is 802.1X being used?
• Is wired access being controlled?
• Is wireless access being controlled?
• Has EAP-TLS been evaluated?
• Is the certificate lifecycle being managed?
• Is RADIUS redundant?
• Are the devices using MAB registered?
• Is device profiling active?
• Is the guest network separate?
• Is a BYOD policy available?
• Is there IoT segmentation?
• Is dynamic VLAN being applied?
• Is a quarantine VLAN available?
• Is posture assessment being performed?
• Do the NAC logs go to the SIEM?
• Is there NAC-EDR integration?
• Is the exception list examined regularly?
• Is NAC HA being tested?

NAC Maturity Model

Level 1 - Uncontrolled Access

A device that connects to a network port gains access directly.

Level 2 - Device Visibility

The devices connecting to the network are seen and profiled.

Level 3 - 802.1X Authentication

User and device authentication is applied.

Level 4 - Dynamic Access Control

Dynamic VLAN, posture and automated quarantine are used.

Level 5 - Zero Trust NAC

Identity, device posture, risk and continuous authorization are applied together.

Frequently Asked Questions

What is NAC?

NAC means Network Access Control and it checks the identity and security state of the users and devices connecting to the corporate network.

What is 802.1X?

802.1X is the port-based authentication standard for wired and wireless network access.

What is RADIUS?

RADIUS is the protocol used in network access authentication, authorization and accounting processes.

What is EAP-TLS?

It is a strong 802.1X authentication method that provides certificate-based mutual authentication.

What is MAB?

MAC Authentication Bypass is the method that allows devices not supporting 802.1X to authenticate through their MAC address.

Is MAB secure?

On its own it is not strong because a MAC address can be spoofed.

What is Device Profiling?

It is the determination of the device type from the technical characteristics of the device connecting to the network.

What is Posture Assessment?

It is the checking of whether the device meets the patch, EDR, encryption and other security requirements.

What is Dynamic VLAN?

It is the automatic assignment of a VLAN according to the identity information of the user or the device.

What is a Quarantine VLAN?

It is the network segment in which suspicious devices or devices that do not comply with the security policy are isolated.

What is the difference between NAC and a firewall?

NAC controls who can enter the network, while the firewall controls where the traffic on the network can reach.

Is NAC part of Zero Trust?

Yes. It supports the identity, device posture and least privilege access approach.

Conclusion: Connecting to the Network Should Not Mean Being Trusted

In the traditional network security approach a device can gain network access when it connects to a corporate switch port or Wi-Fi network.

In the modern security approach, however, the first question:

"Is the cable connected?"

is not this;

"Who is this device?"

it should be this.

Then the following questions must be asked:

Who is the user?

Is the device corporate?

Is its security state suitable?

Which resources does it need to reach?

NAC moves these questions to the centre of the network access decision.

For this reason the modern NAC approach:

Connect → Identify → Authenticate → Assess → Authorize → Monitor

works in this way.

For example:

Corporate Laptop

Valid Certificate

Authorized User

Compliant Security Posture

↓

Corporate Access

In contrast:

Unknown Device

No Authentication

↓

Quarantine / Deny

this approach can be applied.

The real value of NAC is not merely blocking devices.

The real value:

is making network access identity-aware.

For this reason NAC;

Network Segmentation,

802.1X,

RADIUS,

PKI,

EDR,

SIEM,

NDR,

SOAR

and Zero Trust

when used together with these technologies forms a far stronger security architecture.

As a result, corporate network access must be built on this principle:

"Not everyone who can connect to the network can access the network."

The right approach for modern Network Security:

Verify First, Connect Second

should be this.

The Next Chapter

What Are IDS and IPS? Network Intrusion Detection and Attack Detection Systems

In the next chapter;

IDS, IPS, NIDS, NIPS, Signature-Based Detection, Anomaly Detection, Behavioral Detection, Inline Inspection, Out-of-Band Monitoring, Network TAP, SPAN Port, False Positive, False Negative, IPS Tuning, Exploit Detection, CVE, Threat Signature, Evasion Technique and Zero-Day Detection

we will handle these topics in detail.

And we will answer this critical question:

"How can a firewall tell that there is an attack inside network traffic it has permitted?"