Network Access Control

A corporate network provides access to data, servers, and employee workstations. Each device should be authenticated and receive permissions that match the organization's policy. Uncontrolled open access increases the risk of unauthorized use of these resources. Controls can cover wired connections, Wi-Fi, managed devices, and personal devices.

determines which devices may connect, checks the user identity and device state, and assigns an access scope. A policy can include the user role, department, device type, and security requirements. NAC can apply these decisions to each network connection. The result can be full access, restricted access, redirection to a remediation network, or connection denial. The policy can also select a different VLAN, ACL, or bandwidth profile after authentication. The system can record the reason for the decision and how long it remains valid.

NAC in Modern Networks

Network access now comes from many device types and locations, so one rule cannot cover every connection. Remote work, cloud services, and wireless connections add further factors:

Bring Your Own Device (BYOD):Employees now use their personal laptops, tablets, and smartphones for work. These devices are not managed by the company's IT department and could be insecure, unpatched, or even infected with malware. NAC can check the operating-system version, encryption, and required security controls before granting access and can assign a restricted segment.
Internet of Things (IoT): The number of connected devices has grown substantially. Networks now host smart thermostats, security cameras, industrial sensors, and medical equipment. Many IoT devices have limited built-in security, which increases their exposure to attacks. NAC can identify device types from connection profiles and place them in isolated network segments to limit the effects of compromise.
Guest and Contractor Access: Businesses regularly need to provide temporary network access to visitors, vendors, and contractors. NAC allows for the creation of separate, isolated guest networks with limited privileges (e.g., internet access only) and time-based access that automatically revokes credentials after a set period. Guest enrollment can require employee approval or a one-time code.
Compliance and Regulation: Organizations processing personal data in the European Union may be subject to the GDPR, while HIPAA-covered entities must protect health information. Financial organizations may also be subject to PCI DSS. NAC supports access policies and provides logs for review, but it does not replace a complete compliance program.

802.1X: Roles and Access Control

The standard defines access control for a port before a device is admitted to the network. In a wired network the port belongs to a switch, while a wireless access point acts as the authenticator. The model contains three roles that cooperate in the access decision:

The Supplicant: The Client Device.
The supplicant is the end device trying to gain network access, such as a laptop, smartphone, VoIP phone, or IoT camera. Windows, macOS, and Linux include supplicant software, also called a requester. It can use a password, certificate, or another EAP method selected by the configuration.
The Authenticator: The Access Device.
The authenticator is the infrastructure device to which the supplicant is connected, usually a wireless access point or Ethernet switch. Until it receives a decision, it blocks user traffic except for authentication messages and relays the exchange between the supplicant and authentication server. The local exchange uses EAPOL, and the server response can include VLAN and ACL parameters. The port changes state only after a response that matches policy is received.
The Authentication Server.
The authentication server verifies credentials and decides whether access is allowed. It can use a user directory, device database, and policies that define the access scope. RADIUS is commonly used between this server and the authenticator, carrying requests, challenges, and authorization responses. The response can also include session parameters.

RADIUS: AAA Communication

is a client/server protocol used between an authenticator, such as a switch or access point, and an authentication server. It supports centralized AAA and can carry EAP messages used by 802.1X. In a classic deployment, the server may be outside the authenticator's subnet, which uses the server address and a shared secret. Classic RADIUS commonly uses UDP, with port 1812 used for authentication and 1813 for accounting. EAP exchanges also require message-integrity protection, such as the Message-Authenticator attribute.

RADIUS supports three AAA functions:

Authentication: Verifying identity with credentials such as a username and password pair or a digital certificate. The result can be success, failure, or a request for another EAP message. The method and identity source are selected by the deployment.
Authorization: Determining permissions. After authentication, the RADIUS server sends access parameters to the authenticator, such as a Virtual LAN (VLAN), an Access Control List, or a bandwidth limit. Attributes can depend on the user, group, or device.
Accounting: Collecting session data, such as connection time, transferred data, and used resources. Session start and stop messages support billing, auditing, capacity planning, and incident review.

The 802.1X Authentication Flow

The supplicant and authenticator exchange EAPOL (EAP over LAN), while the authenticator and authentication server exchange RADIUS. RADIUS packets carry messages. The authenticator relays these messages between the supplicant and server without terminating the selected EAP method. The EAP method therefore operates between the endpoint and server independently of the transport used between authenticator and server.

Initiation:Your laptop (supplicant) is plugged into an Ethernet port on a switch (authenticator). The port is currently in an "unauthorized" state, blocking all traffic except 802.1X messages. The supplicant sends an 'EAPOL-Start' message, announcing its presence. In Wi-Fi, the access point performs the corresponding authenticator role.
Identity Request:The switch (authenticator) responds with an 'EAP-Request, Identity' message, asking for the supplicant identifier. The message is carried locally through EAPOL.
Identity Response:The supplicant replies with an 'EAP-Response, Identity' message containing its user identity, typically a username.
RADIUS Forward:The switch takes this identity, packages it into a 'RADIUS Access-Request' packet, and sends it over the network to the pre-configured RADIUS server (authentication server). The deployment must also establish a shared secret and message-integrity protection.
The Challenge:The RADIUS server looks up the user. It starts an EAP method, such as PEAP (Protected EAP), and sends further messages through the switch with a 'RADIUS Access-Challenge' response. This phase creates a TLS tunnel between the supplicant and the server, protecting credentials such as the password that follows.
The Verdict:The supplicant provides its credentials within the EAP tunnel. The RADIUS server validates them against an identity source such as Active Directory. If they are correct, the server sends a 'RADIUS Access-Accept' message back to the switch.
Granting Access: The 'Access-Accept' message contains authorization information. It might include attributes telling the switch, "This user belongs to VLAN $20$ (Sales) and should have this Access Control List applied to their port." Attributes can also specify a session duration, traffic priority, or accounting server.
Success:The switch configures the port according to the RADIUS server instructions and passes an 'EAP-Success' message to the supplicant. The port enters the "authorized" state, and normal network traffic can flow. If authorization parameters include a VLAN or ACL, they are applied before the session is admitted.

Posture Assessment, Quarantine, and Remediation

Modern NAC systems go beyond authentication. Before connection and, in some cases, during a session, they assess whether the device complies with policy. This process is called posture assessment.

A NAC agent on the supplicant can report the device's security status. The NAC system compares this information with a policy that defines a compliant device. The policy might require a particular operating system, patch level, protection status, and firewall configuration. The result can depend on the device type and user role:

A specific operating system version and patch level, with updates applied.
The presence and status of antivirus software, including whether it is running and up to date.
The local firewall being enabled with the required policy.
The absence of certain unauthorized applications or configuration changes, including prohibited services.

If a device fails the check, the RADIUS server can instruct the switch to place it in an isolated quarantine VLAN instead of granting full access. The VLAN may provide access only to update servers. The user may be redirected to a portal with repair instructions, such as an antivirus update. After the device meets the requirements, it can authenticate again and receive full access. The system can also reassess the device during the session and revoke access after a state change. This limits the risk of malware spreading across the corporate network. Quarantine should retain access to update and logging systems.