What is network access control?
Network access control (NAC) decides whether a device may join a wired or wireless network and what it may reach once it does. On a network without it, a live wall jack in a lobby or a shared Wi-Fi passphrase is enough to get an IP address and a path to internal servers. NAC puts a checkpoint at the moment of connection. It establishes who the user is and what the device is, compares the device against policy, and then places it: on the production network, in a limited segment, in quarantine or nowhere at all.
A policy server makes the decision. Switches, wireless controllers and VPN concentrators enforce it by opening or closing the port, assigning a VLAN or applying an access list. NAC traditionally decides at admission and rechecks periodically; zero trust extends the idea by evaluating every request after the device is on the network.
How NAC authenticates devices with 802.1X
IEEE 802.1X provides port-based authentication with three roles:
- Supplicant: the 802.1X client on the laptop, phone or other endpoint, which offers a certificate or a username and password.
- Authenticator: the switch or wireless access point. Until the device is approved, the port carries nothing except EAP over LAN (EAPOL) frames, which the authenticator forwards to the server without judging them itself.
- Authentication server: usually RADIUS on UDP 1812, with accounting on 1813. It makes the decision and answers Access-Accept, which can carry a VLAN assignment, or Access-Reject.
EAP-TLS, where both the server and the client present certificates, is the strongest common method because no password exists for anyone to phish or crack. PEAP uses a server certificate and the user's password inside a TLS tunnel. Devices that cannot run a supplicant, such as printers and cameras, fall back to MAC Authentication Bypass (MAB), which uses the MAC address as the identity. Because a MAC address is simple to forge, MAB devices should land in a restricted VLAN, with profiling that confirms a device claiming to be a printer still behaves like one.
Posture checks and quarantine
Authentication proves who is connecting; a posture check asks whether the device is safe to admit. Typical checks confirm a supported operating system with recent patches, a running and current EDR or antivirus agent, full-disk encryption, an enabled host firewall and a device that is managed and not jailbroken. Devices that pass are placed on their usual VLAN. Devices that fail are placed in a quarantine, or remediation, network whose access list permits little beyond update servers and instructions for fixing the problem. Once the device is healthy it is assessed again, and the policy server can use RADIUS Change of Authorization (CoA) to push the new placement to the switch while the session is still up.
NAC user=akim host=LT-3308 auth=EAP-TLS posture=FAIL reason=bitlocker_off,patch_age_21d result=VLAN 950 quarantine
Persistent, dissolvable and agentless assessment
| Method | How it works | Fits |
|---|---|---|
| Persistent agent | Installed permanently; deep, continuous checks and often self-remediation | Corporate laptops |
| Dissolvable agent | Downloaded at connection, runs its checks once, then removes itself | Contractor and personal devices |
| Agentless | Uses directory, MDM and EDR data, network scans and traffic profiling | Printers, IoT and other devices that cannot run software |
Captive portals for guests
A captive portal redirects an unauthenticated device's first web request to a sign-in page where a guest accepts the acceptable use policy, enters a voucher code or gets approval from an employee sponsor. The device is then admitted, by MAC address and for a set time, to a guest VLAN with internet access only. The portal proves that someone clicked accept and offers only weak identification. It adds no encryption, and because admission is tied to a MAC address, another device can copy that address and ride on the guest's session.
Network access control on the CompTIA Security+ exam
NAC sits under SY0-801 objective 4.1, which names 802.1X, captive portals and endpoint posture checks among the mitigating controls. Map the scenario to the problem. Stop unknown laptops from working when plugged into office jacks points to 802.1X. The switch in the exchange is the authenticator, and the system that checks credentials is the RADIUS authentication server. A laptop authenticates but its EDR agent is stopped points to a quarantine VLAN, not full access and not a permanent block. Visitors must agree to the usage policy before browsing points to a captive portal, and vendor laptops may not have software installed permanently points to a dissolvable agent. Distractors include TACACS+, which handles administrator logins to routers and switches rather than devices joining the network, and MAC filtering or port security, which limit addresses but check neither identity nor device health.