Network Access Control (NAC)

Network Access Control (NAC) decides at the access point which users and devices are allowed to connect to the enterprise network. This article explains authentication via 802.1X and the assessment of device state, and shows how guest and BYOD access are cleanly separated and how NAC differs from ZTNA.

In many enterprise networks, a free network port or the Wi-Fi password is enough to reach internal systems. At the same time, the number of devices that no one manages centrally is growing: printers, cameras, building technology, personal smartphones. Network Access Control answers the question that comes before every further security measure: who and what is actually on our network, and with what authorization? For IT decision-makers, NAC is therefore less a single product than an ordering principle for network access.

What is Network Access Control (NAC)?

Network Access Control refers to procedures that tie access to the network to conditions. Before a device may communicate, it is checked who uses it and whether it complies with the company's security requirements. On the basis of this check, the system assigns the device a suitable network segment with defined permissions or refuses the connection. NAC thus acts at the earliest possible point, on the wired port as well as in the Wi-Fi. As a byproduct, a continuously updated picture of all connected devices emerges. This visibility makes NAC the foundation for inventory and segmentation in the local network, because only known devices can be meaningfully classified and effectively restricted. Enforcement is handled by the existing infrastructure: switches and access points implement what central policies specify.

How does NAC work?

Authentication via 802.1X: The end device identifies itself with a certificate or with login credentials. The switch or access point forwards the request to a central RADIUS server, which decides on access.
Device recognition: Systems without 802.1X support, such as printers or sensors, are identified by characteristics such as MAC address and communication behavior and assigned to a device class.
State check: Before granting access, NAC assesses the device state, for example patch level and active endpoint protection. Devices that fail to meet the requirements end up in a quarantine segment with access to update services.
Dynamic segment assignment: Instead of static port configuration, each device automatically receives, after the check, the appropriate VLAN along with the associated access rules.
Guest and BYOD portals: Visitors and personal devices register via a portal and receive time-limited access to an isolated segment with no connection to internal systems.
Ongoing control: If the state of a device changes, access can be revoked or adjusted during operation.

Why NAC matters

Visibility: NAC produces a continuously up-to-date inventory of all devices on the network, including the systems that no administrator ever set up.
Control at the entry point: unknown or manipulated devices are stopped before they even reach internal systems. This also applies to attacks from within the building itself, for example via freely accessible ports in meeting rooms.
Containment of IoT risks: cameras, sensors, displays, and building technology are given tightly limited segments instead of a clear view of the entire network.
Clean guest separation: visitors and service providers work in isolated areas, without anyone having to reconfigure ports manually.
Provability: who was connected, when, and with which device can be documented, an important building block for audits under ISO 27001 or NIS2.

Typical deployment scenarios

NAC unfolds its benefit wherever many different devices meet shared infrastructure:

Campus and office sites: 802.1X secures the wired network and the Wi-Fi, and managed devices log in automatically with certificates.
Production and OT areas: machines and controllers are given their own segments, and new or replaced components stand out immediately.
Reception and visitor areas: guest access with self-registration and time limits replaces passed-around Wi-Fi passwords.
BYOD programs: personal devices are granted access to selected services and stay consistently separated from the internal network.

NAC vs. ZTNA

NAC and Zero Trust Network Access pursue a similar goal from a different starting point. NAC controls admission to the network itself: it acts at the site's port and decides which segment a device ends up in. ZTNA controls access to individual applications, regardless of which network the request comes from. The connection is established per session on the basis of identity and context, mostly as part of a SASE/SSE architecture . In practice, the two approaches complement each other: NAC orders and protects the local network with its stationary devices, while ZTNA governs the application access of mobile users from any location. Anyone who combines the two controls on-site network access and external application access according to the same principles.

NAC at KAEMI

At KAEMI, access control is part of the network design and not an afterthought. In projects around the Software-Defined LAN , we plan and operate campus networks in which 802.1X authentication and dynamic segment assignment belong together from the start. For fine control between systems, microsegmentation complements access control with rules at the level of individual workloads. This creates a network that knows its devices and consistently restricts them. In doing so, we work in a technology-open way and align the solution with your sites and device inventories. If you would like to reorganize network access at your sites, get in touch with us via the contact page .

Frequently asked questions about Network Access Control (NAC)

Do we need NAC if we already use firewalls?

Yes, the two act at different points. A firewall controls transitions between network zones, but does not see which device logs in at an office port. NAC starts exactly there: it decides on admission to the network and assigns each device to a segment. The firewall then enforces the rules between these segments.

What prerequisites does 802.1X need?

What is required is a RADIUS server as the central decision authority, switches and access points with 802.1X support, and end devices with matching configuration. For managed devices, login with certificates distributed via a dedicated certificate infrastructure is recommended. Devices without 802.1X capability are recognized via profiling and connected with their own rules.

How does NAC handle printers and IoT devices?

Such devices often do not support 802.1X and are therefore identified via profiling, for example by MAC address and communication behavior. Since these characteristics can be spoofed, such devices belong in tightly limited segments with minimal permissions. This way, a compromised IoT device stays a local problem and does not become a springboard into the entire network.

Does ZTNA make our NAC redundant?

No. ZTNA governs access to applications and plays to its strengths with mobile users and cloud services. At the site, the question remains which devices are allowed to connect to the local network, from printers through machines to building technology. NAC continues to answer this task. The two approaches complement each other into an end-to-end access strategy.

How do you introduce NAC without disrupting operations?

A phased approach has proven itself. First, NAC runs in monitoring mode and captures all devices without blocking connections. On this basis, device classes and rules are defined and coordinated with the business units. Only after that is enforcement activated, site by site. A quarantine segment with self-help options catches special cases.