Selected, architected and operated the city’s enterprise network access control on ForeScout CounterACT: vendor evaluation in 2016, wired enforcement in 2018, wireless two years after that, ending with the platform making automated changes on the wireless controller. Seven years from a product comparison to a control that could quarantine a port anywhere in the estate.
The architecture decisions that mattered
The appliances sat inside the network rather than in the DMZ. A control that decides what may join the estate belongs where the estate is, not at its edge.
Monitor interfaces came off both core switches, so visibility did not depend on one of them.
The access-port template was supplied as part of the design, because the policy has to understand what a normal port looks like. A NAC that does not account for the voice VLAN quarantines every desk phone in the building on day one — which is the sort of failure that ends a program in week one and gets remembered for a decade.
The hard part was never the technology
Enforcement ran inside a building shared with four other agencies that reimaged their own machines on their own schedules, answering to their own elected officers. Among them a state prosecutor’s office operating on the city network across two neighboring counties.
So the design had to include its own suspension: standing enforcement down on a subnet by agreement, and putting it back days later. That is not a workaround. In a federated estate a control with no negotiated exception path does not get adopted at all — it gets an exemption written for it by someone with more authority than the architect, and then it never comes back.
The same reasoning as everywhere else on this record: in an estate nobody can be ordered around, a standard survives because the people it constrains agreed to it, and agreement includes agreeing on how to switch it off.
Outcome
A control that could quarantine a port anywhere in the city, run inside a federation where standing it down by agreement was part of the design.