Network access control (NAC)
With NAC, we make sure that only known, compliant devices can connect to the network. Unknown devices are placed in an isolated zone.
What NAC does
What we check before a device gets in
Under the Zero Trust principle, every access request has to be judged on its own, wherever it comes from. NAC does this at the moment a device connects to the network. We describe the full architecture in our Zero Trust guide.
Device identification
NAC identifies every connecting device before letting it in, and uses its classification to decide whether it may connect and, if so, into which zone.
Individual authentication (802.1X)
Every user or device connects with its own credentials, typically a certificate or a domain account. You can see who connected, when and where, and access can be revoked for each user or device individually.
Device posture
We check whether the device is registered in your device management system, whether it is managed, and whether it is up to date. Only known, compliant devices can connect to the network.
Unknown devices
Devices in the isolated zone cannot reach internal network resources until they have been classified.
Rollout
From monitor mode to enforcement
We choose the solution independently of any vendor, to fit your environment and the equipment you already have. At first, NAC only watches. We enforce the rules once they match the devices actually on your network.
-
Asset inventory and profiling
We map which devices connect to the network and group them by type, for example into workstations, printers, and cameras.
-
Rules per device type
For each device type, we define what that group can access and which zone it goes into.
-
Monitor mode
NAC evaluates connections but does not block anything yet. This shows which devices it would shut out, and we correct misclassifications before enforcement begins.
-
Gradual enforcement
We turn enforcement on step by step, so a faulty rule cannot hit the entire network at once.
Deliverables
What you get at the end
items handed over
- Inventory and profiling of connecting devices
- Access rules per device type
- Gradual enforcement starting from monitor mode
- Documentation
Related services
What goes alongside NAC
NAC decides what gets to connect. What may flow between zones, and how staff reach your systems from outside, is handled by other services.
Network segmentation
We split a flat corporate network into zones so that one infected device cannot reach the whole network.
Wi-Fi network with on-site survey
An enterprise wireless network with separate networks for guests, staff, and devices.
Zero trust remote access (ZTNA)
Application-level access for remote work instead of VPN, with a device compliance check at connection time.
Firewall and VPN
Design, installation, and configuration of a next-generation firewall, together with site-to-site VPN.
Frequently asked questions
The questions we hear most
Why isn't a shared Wi-Fi password enough?
Because you can't tell who connected with it, only that someone did. A password that fifty people know ends up with outsiders within a few months, and with WPA2, anyone who records the connection and has the password can decrypt the traffic afterward. The certificate-based form of individual authentication is stronger than the password-based one, because a certificate cannot be disclosed or leaked. We covered this in detail in our article on Wi-Fi security in the enterprise.
What about printers and cameras that can't authenticate?
Printers, IP cameras, building automation, and meeting room devices do not support 802.1X, and they typically run with default passwords and old firmware. They belong in their own segment with restricted outbound traffic, and their management interfaces should be reachable only from the IT segment. NAC steers these devices into the segment meant for them as well. Our article on segmenting the internal network covers how to design the segments.
Do I need NAC or ZTNA?
They are meant for different situations. NAC vets the devices that connect to the internal network, while ZTNA handles remote access. With a classic VPN, device posture usually doesn't count. With ZTNA it is part of the decision, and the user gets access to a specific application instead of the network. ZTNA builds on identity, so the order matters: central identity and MFA first, then device management, and only then ZTNA. Our article comparing ZTNA and VPN walks through the migration steps.
Can NAC be used in OT environments?
Yes. The implementation is different there: you cannot install an agent on control devices, and continuous authentication makes no sense for a PLC. That is why access control in OT follows the zones and conduits model (IEC 62443), and supplier maintenance channels need strong identity and MFA. The rest of industrial protection is covered on our OT services page.
