IT‑IS‑Networking
Technology › Security Architecture

Network Access Control

Deciding what may join a network and proving it — from arguing against MAC-based port security in 2006 to operating citywide enforcement across agencies that could each stand it down.

Also known as NAC, 802.1X, ForeScout CounterACT, Port Security, Posture Assessment

Left to right is time. Each row is one of the 8 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

The position was taken in 2006: securing ports by MAC address is not a control, because a MAC address is printed on the device and anyone who can read it can present it. Authenticate the user or the device instead.

Fifteen years later the estate had it — identity in Cisco ISE, posture and enforcement in ForeScout CounterACT, certificate-based SSIDs where those were needed, rather than 802.1X everywhere.

Three things this discipline actually turns on, none of them the product:

The access-port template. Policy has to know what a normal port looks like before it can recognize an abnormal one. A NAC that does not account for the voice VLAN quarantines every desk phone in the building on day one.

Where the appliances sit. Inside the network rather than in the DMZ, with monitor interfaces off more than one core switch, because a control on what may join the estate belongs where the estate is.

The negotiated exception. In a federated estate, enforcement that cannot be stood down by agreement on a subnet and restored days later does not get adopted — it gets exempted permanently by someone senior enough to insist.

Also assessed on the consulting side: network access control feasibility on a pipeline operator’s mixed-vendor estate, where the question is less whether it can be done than what it does to the things that must never be locked out.

Applied in

  • Fourteen Weeks on the ToolsApril – August 2024The densest hands-on stretch of the NRI tenure — seven client engagements worked personally, in the configuration and the peer reviews and the customer calls, while taking over a team from the second day.
  • Port-Level Authentication: The 2006 Position2006–2023An argument made in 2006 that securing ports by MAC address was not the answer — held across four platform generations, and in production fifteen years later by a route other than the one proposed.
  • Administrative Identity for the Network Estate2006–2022Sixteen years and three platform generations of who may type a command on a city switch and what is recorded when they do — begun as a procurement condition in 2006, closed with multi-factor and a duty-separated account standard.
  • Enterprise Network Access Control2016–2022Seven years from vendor evaluation to a control that could quarantine a port anywhere in the city — and the federated exception handling that made enforcement survivable in a building shared with four other agencies.
  • Juniper Enterprise Security Suite2009 – 2021A security platform rather than a firewall — selected on an instrument written before anyone knew who would win, operated for twelve years, and retired in stages on a plan the same team wrote.

Career

See also

Also searched as

  • zero trust
  • ZTNA
  • microsegmentation
  • least privilege network
  • IAM
  • PAM
  • privileged access management
  • MFA
  • identity governance
  • TACACS
  • RADIUS
  • 802.1X

Compliance-driven isolation and per-tenant policy, designed under regulatory constraint before the vocabulary existed.