Network access control (NAC) deployment: Every device identified. Every connection authorized.
We design, deploy and operate network access control so every user, laptop, phone and IoT device is identified, checked and given only the access it needs. One policy covers wired, wireless and VPN, and enforcement moves from monitor mode to closed mode in planned phases.
- Access
- 802.1X · MAB · EAP-TLS
- Enforcement
- VLAN · dACL · SGT · CoA
- Administration
- TACACS+ · audit trail
Outcomes
Access decided by identity, not by which port is free.
An open wall jack should not be an open door. With network access control in place, every switch port, SSID and VPN gateway asks the same policy engine who is connecting, whether the device is healthy and what it may reach.
-
01
Every endpoint identified and accounted for
Device profiling from DHCP, RADIUS, SNMP, HTTP and active scans builds a live inventory of what is connected, from managed laptops to printers, cameras and badge readers that cannot run a supplicant.
-
02
Least-privilege access without re-addressing
Dynamic VLANs, downloadable ACLs and security group tags apply policy by role, so a contractor and an employee on the same switch reach different resources with no subnet redesign.
-
03
Access that reacts to device health
Posture results, MDM compliance and alerts from firewalls or a SIEM can trigger RADIUS Change of Authorization to restrict or quarantine a device mid-session, with no one walking to a closet.
What we deliver
The full NAC scope, engineered end to end.
Greenfield builds, migrations between NAC platforms and cleanups of deployments that grew without a design. Every piece is designed, configured, tested and documented. Take the whole program or the parts you need.
Request a NAC assessmentWired, wireless and VPN authentication
- 802.1X with EAP-TLS, PEAP and TEAP, including machine and user authentication
- MAC Authentication Bypass (MAB) with endpoint groups for devices that cannot run a supplicant
- Access-switch port templates, WPA3-Enterprise SSIDs and RADIUS authorization for remote access VPN
- Multivendor enforcement with standard RADIUS attributes and the vendor-specific attributes each platform supports
Device profiling and posture
- Profiling from DHCP fingerprints, RADIUS accounting, HTTP user agents, SNMP and active scans
- Custom profiles and fingerprint overrides for IoT, OT and facilities devices
- Posture with persistent or dissolvable agents: antimalware, patch level, disk encryption and host firewall checks
- Remediation messages, grace periods and reassessment timers that users can live with
Guest access and BYOD onboarding
- Hotspot, self-registration and sponsored guest portals, with MAC caching for returning visitors
- BYOD onboarding with native supplicant provisioning for Windows, macOS, iOS and Android, and per-user device limits
- EAP-TLS certificates from a built-in CA or one subordinate to your enterprise PKI, issued over SCEP
- Branded portals, acceptable use terms and sponsor roles for front desks
Group-based segmentation
- Role and security group model with a policy matrix built around business functions
- Dynamic VLAN assignment and downloadable ACLs for least-privilege access
- Security group tags assigned at the access layer and carried across the campus and data center
- RADIUS Change of Authorization to re-authorize, restrict or quarantine a session
TACACS+ device administration
- TACACS+ for routers, switches, firewalls and wireless controllers from multiple vendors
- Shell profiles and command sets mapped to Active Directory groups
- Command accounting for change review and audit evidence
- Local fallback accounts and break-glass procedures, documented
Identity sources and integrations
- Active Directory and LDAP identity sources with attribute-based authorization
- Certificate authentication tied to your PKI, with OCSP or CRL revocation checks
- MDM and UEM compliance status used as an authorization condition
- User, device and group context shared with SIEM and next-generation firewalls, plus event-driven CoA
Architecture to operations
High availability and day-2 administration
- Distributed or clustered deployments, with policy nodes placed close to the users they serve
- Redundant policy nodes, load-balanced RADIUS and replicated configuration for high availability
- RADIUS, EAP and portal certificates tracked and renewed before an expiry can stop authentication
- Authentication log triage and root-cause analysis for failed connections
- Policy tuning as new device types, SSIDs and sites come online
- Profiling feed updates, patches, version upgrades and backups, planned and tested
How we work
Visibility first. Enforcement when the data says so.
NAC projects stall when enforcement arrives before anyone knows what is on the network. We sequence the rollout so authentication data proves each step before the next one begins.
-
01Design
Assess and design
We inventory switches, controllers, VPN gateways and code levels, identity sources, PKI and endpoint types. In an existing deployment we audit policy and failed authentications first.
Output: policy matrix · node placement · test plan
-
02Monitor mode
Build and observe
Policy nodes and network devices go live with open authentication. Nothing is blocked. We collect profiling data, fix supplicant and certificate issues and confirm every device class authenticates as designed.
Output: endpoint inventory · validation results
-
03Low-impact · Closed
Enforce in phases
Low-impact mode applies pre-authentication ACLs first. Closed mode follows site by site or device class by device class, each cutover in a change window with CoA tested and a rollback ready.
Output: as-built documentation · cutover records
-
04Operate
Operate and tune
Runbooks, dashboards and handover training for your team. We add new device types, tune policy and plan upgrades as scheduled work or as part of managed network services.
Output: runbooks · change records · training
Where it fits
Built for networks that answer to auditors.
Network access control earns its place wherever you must prove who connected, what they reached and who changed the network.
-
Government agencies
Certificate-based 802.1X, least-privilege authorization and TACACS+ accounting, designed with the NIST SP 800-53 access control, identification and authentication, and audit families in mind.
EAP-TLS · TACACS+ · audit trail
-
Healthcare, finance and other regulated industries
Clinical, payment and building systems profiled into restricted groups, with posture and segmentation designed with HIPAA and PCI DSS requirements in mind.
Profiling · posture · segmentation
-
Multi-site and mixed-vendor networks
One policy for switches, wireless controllers and VPN gateways from different vendors, with policy nodes close to users and critical-authentication fallback, so a WAN outage does not become an access outage.
RADIUS · CoA · vendor attributes
-
Hybrid work, guests and BYOD
Posture checks for laptops returning from home, sponsored visitor access, time-limited contractor accounts and certificate onboarding for personal phones, all from the same policy engine.
Posture · guest portals · EAP-TLS onboarding
Standards and protocols we work with
- IEEE 802.1X
- EAP-TLS
- PEAP
- TEAP
- MAB
- RADIUS
- RADIUS CoA
- RadSec
- TACACS+
- Dynamic VLAN
- Downloadable ACLs
- Security group tags
- WPA3-Enterprise
- Device profiling
- Posture assessment
- X.509 PKI
- SCEP
- OCSP
- Active Directory
- LDAP
- SNMP
- Syslog
- REST APIs
Platform experience: Cisco Identity Services Engine (ISE) · Aruba ClearPass
Network access control questions, answered plainly
Have a question that is not here? Ask an engineer.
Not when the rollout is sequenced correctly. Monitor mode authenticates every port without blocking anything, so we can see which printers, phones and building systems lack a supplicant. Those devices are handled with MAB and profiling policies before low-impact or closed mode is switched on.
Yes, in most networks. Access control is built on 802.1X, RADIUS, RADIUS CoA and TACACS+, so one policy engine can authenticate and enforce across vendors. Enforcement uses the attributes each platform supports, such as VLAN assignment, filter IDs or downloadable ACLs, and we validate each device model and code version during testing.
No. Dynamic VLANs and downloadable ACLs segment well for many environments. Security group tags become worthwhile when the number of roles and destinations makes IP-based rules hard to maintain, or when firewalls should enforce by group instead of by address. We help you decide based on your platforms and policy.
Yes. We start with a health check of policy nodes, certificates, policy and failed authentications, document what exists and fix what is fragile. A migration runs the new platform alongside the old one and moves switches, SSIDs and sites in planned waves, each with a rollback path to the previous RADIUS servers until it is proven.
Related services
Access control works best with the network around it.
Zero Trust Access (SSE)
Identity-based access for users off the corporate network, with secure web gateway and ZTNA policy that complements on-site NAC.
Next-Generation Firewalls
Identity-aware firewall policy that uses the user, device and group context your access control already knows.
Enterprise Wireless
Surveyed, validated Wi-Fi with WPA3-Enterprise SSIDs and role-based policy ready for 802.1X enforcement.
Get in touch
Let's talk about your network.
Tell us where you are today. A senior engineer will respond with practical next steps, not a sales script.