What is NAC?
Network Access Control, told as a story about a gatekeeper at every wall socket.
The hallway has sockets all along the wall.Plug in, and you're on the hallway. Cable sockets, and Wi-Fi too.
Anything can be plugged in.A guest laptop, a strange box, an old printer… and once in, they can go anywhere.
NAC questions the thing the moment it's plugged in."Do you belong here? Washed recently (updated)? Got your dog (antivirus)?"
Fail the check, and you get the guest hallway.Guest laptops get a narrow hallway to the yard (internet) only. The muddy printer goes to the laundry room (updates) first. The strange box never connects.
Lots of things can't wear a tag.Fridges, cameras and old printers can't wear one. So they're known by face (MAC address) alone — and a face can be faked.
NAC = the gatekeeper that, the moment something plugs in, asks whether it belongs and whether it's clean — and sends the rest to the guest hallway.
Network Access Control. The gatekeeper (MFA) checks people; NAC checks things. It's the castle that always asks, applied to the hallway. Cisco ISE, Aruba ClearPass, FortiNAC.
When grown-ups say it
- 802.1X
- Show your tag when you plug in. The rule: the socket asks first, the thing answers.
- Certificate
- A castle-issued tag. Hard to fake. → same idea as the ring that knows the gate
- MAC address
- The thing's face. What you check when there's no tag. Can be faked.
- Posture check
- Washed? Updates, antivirus, disk encryption. → mud on the shoes
- VLAN
- Splitting the hallway. Main, guest, laundry. → the hallway watcher
- Quarantine · remediation
- The laundry room. Wash (update), then come back.
- Guest network
- The guest hallway. Reaches the yard (internet) but no rooms.
- Profiling
- Guessing by looks. "This looks like a printer." How untagged things get sorted.