3

I'm studying about 802.1X port based authentication and RADIUS, and I came across the terms of NAC (Network Admission Control) and NAP (Network Access Protection). As long as I know NAC tries to unify some endpoint security stuff (virus scanners, IDS, etc) with authentication. So how does it enhance 802.1X? Does it provide policies or something so that one can use virus scanners or IDS with 802.1X?

I think NAP is more or less the same thing as NAC, but it is Windows variant. Does it provide any additional functionality?

4

802.1X does perform either a computer or a user authentication to allow the network access.

NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I consider 802.1X to be the standard of NAC.

Beware here of the abbreviation collision around NAC which stands for Network Access Control and Network Admission Control.

Network Admission Control (origin Cisco) and Network Access Protection (origin Microsoft) are also two commercial NAC (Network Access Control) going further than the standard 802.1X. They verify that the connecting operating system is in a correct state (through the checksum of some components), and that the endpoint anti-virus is on and up to date.

NAC (Network Admission Control), the Cisco version is more network aware and less Windows addict. Unfortunatly this software solution stopped being supported by Cisco in 2011.

NAP (Network Access Protection), the Microsoft solution is more Windows aware and less network adapted.

From my own short experience, these 2 software solutions might be easily deceived as long as you get the control of the endpoint PC (Windows, MacOS X, Linux…). You can easily install an endpoint yes-agent replacing the editor one.

Then I advise to stick to the 802... standards, which have their limitations and defaults, but with no hidden features which advantage the attackers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.