NAC appliances reveal who's rapping at your network door

As the NAC (network access control) market matures, the solutions are becoming more sophisticated at identifying users and assessing the security compliance of host devices. Answering questions such as how snugly they fit into the existing infrastructure (is it a forklift upgrade?) and how well they qualify a device’s security compliance posture before admitting it to the network helps to separate the wheat from the chaff.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource Try Sun servers, workstations and storage products free for 60-days. Sponsored by Sun Microsystems

NAC is all about identifying end-users, checking their host devices to ensure they’re within defined security requirements (anti-virus installed and running, for instance), and then assigning a security policy to them.

The security policy is key. It has to be created dynamically to fit a user’s current security status. The policy must determine whether the user is logged in on a wireless connection or in a conference room. Is it a line-of-business manager or the CEO? Are the user’s anti-virus signatures current? Are there any open ports on the hosts that violate acceptable policy? As a user’s posture changes, so should the security policy they receive.

When selecting a NAC system, administrators will also need to consider whether they want to deploy a solution that enforces at the host level or at the network layer. Doing it at the host level entails installing software agents on end-user systems across the enterprise and requires local access to each host. This approach can provide an extremely effective means of enforcement (see Elemental Compliance System).

Controlling user access at the network level may require wholesale equipment upgrades, but it can prevent an unknown user from gaining even the tiniest access to the LAN.

In this review, I tested four NAC appliances that enforce at the network layer and inspect all end-user traffic as it passes through. I had the opportunity to check out the Caymas 525 Identity-Driven Access Gateway, Lockdown Networks Enforcer 4.2, Nevis Networks LANenforcer 1048, and the Vernier EdgeWall 7000.

The good news is that each solution actually works insofar as authenticating users and applying access policies to them. All support a captive portal log-in for user authentication, which is fine for guest or unmanaged devices, but a captive portal is Caymas’ only means of logging in users. All vendors but Caymas support 802.1x for a more seamless log-in for managed devices. Two of the appliances reflect some of their past uses: Caymas has a strong SSL VPN history and Vernier includes many features borne of wireless security. Neither of these features detracts in any way from their respective products; they just add flavoring.

End point vulnerability assessment is where the products vary the most. Of the four, only Nevis currently lacks a host-checking engine. Caymas pushes either an ActiveX or Java agent down to the client on connect (which requires the logged-on user to have local administrative or power user rights), and destroys the agent at log-off. Vernier’s host check is agentless but does need Windows credentials to scan the device. Lockdown covers all bases with an agentless mode, Windows and Mac agents, and SMB (Service Message Block) scanning like that in Vernier. The one common theme is that for any of these solutions to truly determine the security posture of a host, access to the local device is required.

At the end of my evaluation, I found that none of the products cover every base. Each one is missing the last piece of the NAC puzzle: scalability, end point assessment, or reporting. The one that came closest to meeting all aspects of an ideal NAC solution is the Caymas 525 Identity-Driven Access Gateway. My biggest complaint is the cost of the unit -- $70,000 -- but this is for all features enabled, even the SSL VPN services for 5,000 concurrent users. Vernier’s EdgeWall 7000 was the low-price leader and was just narrowly edged out by the Caymas appliance. If it had a better on-device reporting system, it would have scored a little better and claimed top honors.

Caymas 525 Identity-Driven Access Gateway

The Caymas 525 Identity-Driven Access Gateway is an SSL VPN appliance for secure remote access to applications and data, as well as a flexible NAC solution for managing user access to the network. The 525 authenticates users then dynamically builds an access control policy based on their security postures. Its host-assessment capabilities aren’t as comprehensive as Vernier’s but they do provide a good measure of confidence.

Capable of handling as many as 5,000 concurrent users, the 525 is a 2U appliance with four Gigabit Ethernet interfaces and redundant power supplies. Each interface can provide connectivity to different network segments, allowing for flexible deployment. All user traffic must pass through the 525, but physical location in the infrastructure isn’t as important as how traffic flows through the device. Typically, like the other NAC solutions, admins will place the 525 near the network core.