Network Access Control: Network security starts with user connectivity

• Historically, local networks were considered trusted environments. NAC reflects today’s reality, where Wi-Fi devices, BYOD, IoT elements, external users, and even compromised endpoints routinely connect to internal infrastructure, making the assumption of trust obsolete.
• The core NAC principle is ‘verify the identity and posture of the device before granting it access’. It goes far beyond a simple Wi-Fi password, validating who is connecting, from what device, and whether they meet security requirements.
• What does NAC control? User and device access, their network placement and permissions. NAC is not used primarily for blocking access, but for network segmentation and controlled limitation of device movement.
• NAC significantly reduces the risk of an attacker proceeding to compromise other systems, accounts, and networks after breaching a network and gaining initial access to it.
• NAC is not an antivirus, EDR, or attack detection tool. It is a tool for defining and enforcing access policies based on your rules.

Aruba ClearPass, as the core component of the service, acts as the Policy Manager responsible for user and device authentication. It determines what level of access an employee, guest, printer, or camera receives.

The service architecture distinguishes the roles of ‘Publisher’, ‘Standby Publisher’, and ‘Subscriber’. These represent individual nodes within a multi-instance ClearPass environment – typically in an HA cluster or a distributed environment. Publisher is the primary (control) node in the ClearPass cluster, hosting the main Policy Manager database. It is responsible for managing the configuration, licence, and setup replication to Subscribers and authentication.

Subscriber (Standby Publisher) is a replication (subordinated) node that downloads configuration from the Publisher. It supports authentication scaling (e.g. across multiple sites) and provides failover functionality in the event of an outage of the main node. Like the Publisher, a Subscriber can process authentications and enforce access policies.

As a virtual appliance, ClearPass can be operated in CRA’s cloud environment, in the organisation’s environment, or in a public environment, such as Microsoft Azure or Amazon AWS.

With this service, we can authenticate devices such as PCs, laptops, mobile devices, APs, printers, and BYOD devices. Authentication can be performed via switches, APs, ClearPass, or Active Directory.

The service provides multiple authentication methods, including 802.1X, MAC Authentication, and TACACS+ / RADIUS, and integrates with a wide range of security products from various vendors (e.g., Active Directory, MDM, firewalls, SIEM).

NAC can be deployed in classic metallic LAN networks, Wi-Fi networks, as well as in remote access networks.

1. Identification and authentication. Each network access attempt is automatically analysed:
    
   • User (identity verification),
   • Device (type, operating system, and fingerprint),
   • Connection location and method,
   • Device security posture.
2. Policy evaluation. Based on defined security policies, the system decides:
    
   • Whether access will be granted,
   • To what extent,
   • Or whether the device will be restricted or denied entirely.
3. Dynamic control and response:
    
   • Access rights can be changed in real time.
   • The system dynamically segments the network, isolates high-risk devices, and can automatically respond to security incidents.

NAC can be delivered in two functional variants across all deployment scenarios. The basic, Standard option, provides core functionality, i.e., access policy analysis and authentication, checking who connects, from what device, and to which resources.

The enhanced, Advanced option, adds device security posture checks before and during network access. It detects whether an antivirus is active and up-to-date on the device, and decides about granting network access accordingly.

All devices within an organisation’s network must be operated under the same variant, meaning that the Standard and Advanced options cannot be combined in a single service package.