computer science

Network Admission Control

Network Admission Control is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Network Admission Control rather than just read about it. In short: Network Admission Control (NAC) refers to Cisco's version of network access control, which restricts access to the network based on identity or security posture. When a network device (switch, router, wireless access point, DHCP server, etc.) is configured for NAC, it can force user or machine authentication prior to granting access to the network.

Key takeaways

Network Admission Control belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Network Admission Control to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Network Admission Control from memory before moving on to harder problems.

Reference excerpt

Network Admission Control (NAC) refers to Cisco's version of network access control, which restricts access to the network based on identity or security posture. When a network device (switch, router, wireless access point, DHCP server, etc.) is configured for NAC, it can force user or machine authentication prior to granting access to the network. In addition, guest access can be granted to a quarantine area for remediation of any problems that may have caused authentication failure. This is enforced through an inline custom network device, changes to an existing switch or router, or a restricted DHCP class. A typical (non-free) WiFi connection is a form of NAC. The user must present some sort of credentials (or a credit card) before being granted access to the network. In its initial phase, the Cisco Network Admission Control (NAC) functionality enables Cisco routers to enforce access privileges when an endpoint attempts to connect to a network. This access decision can be on the basis of information about the endpoint device, such as its current antivirus state. The antivirus state includes information such as version of antivirus software, virus definitions, and version of scan engine. Network admission control systems allow noncompliant devices to be denied access, placed in a quarantined area, or given restricted access to computing resources, thus keeping insecure nodes from infecting the network. The key component of the Cisco Network Admission Control program is the Cisco Trust Agent, which resides on an endpoint system and communicates with Cisco routers on the network. The Cisco Trust Agent collects security state information, such as what antivirus software is being used, and communicates this information to Cisco routers. The information is then relayed to a Cisco Secure Access Control Server (ACS) where access control decisions are made. The ACS directs the Cisco router to perform enforcement against the endpoint. This Cisco product has been marked End of Life since November 30, 2011, which is Cisco's terminology for a product that is no longer developed or supported.

Posture assessment Besides user authentication, authorization in NAC can be based upon compliance checking. This posture assessment is the evaluation of system security based on the applications and settings that a particular system is using. These might include Windows registry settings or the presence of security agents such as anti-virus or personal firewall. NAC products differ in their checking mechanisms:

802.1X Extensibile Authentication Protocol Microsoft Windows AD domain authentication - login credentials Cisco NAC Appliance L2 switch or L3 authentication Pre-installed security agent Web-based security agent Network packet signatures or anomalies External network vulnerability scanner External database of known systems

Agent-less posture assessment Most NAC vendors require the 802.1X supplicant (client or agent) to be installed. Some, including Hexis' NetBeat NAC, Trustwave, and Enterasys offer an agent-less posture checking. This is designed to handle the "Bring Your Own Device" or "BYOD" scenario to:

Detect and fingerprint all network attached devices, whether wired or wireless Determine if these devices have common vulnerabilities and exposures (a.k.a. "CVEs") Quarantine rogue devices as well as those infected with new malware The agent-less approach works heterogeneously across almost all network environments and with all network device types.

See also Access control Network Access Protection Cisco NAC Appliance PacketFence

References

External links Network Admission Control - Cisco Systems Agent-less Network Admission Control - NetClarity, Inc. FastNAC Next-generation NAC

Worked examples

Example 1 — a first encounter with Network Admission Control

Start with the simplest possible case. Write down what Network Admission Control claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Network Admission Control before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Network Admission Control ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Network Admission Control

In research: Network Admission Control appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Network Admission Control in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Network Admission Control is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, so understanding it makes those chapters shorter.
In everyday life: Look for Network Admission Control outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Network Admission Control in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Network Admission Control means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Network Admission Control out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Network Admission Control in simple terms?

Why does Network Admission Control matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Network Admission Control?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Network Admission Control.