Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Tutorial: Network Access Control (NAC): Page 8 of 11

Deployment Styles

There are four basic ways NAC systems integrate into the network, each with benefits and drawbacks. Many NAC products provide for more than one deployment model.

>> In-line NAC puts an appliance as a bump in the wire, usually between the access switch and the distribution switch. When deciding where to place the device, remember that the farther you get from the hosts, the more potential targets are available to an attacker.

An in-line NAC product can block traffic, like a network firewall, but its ACL is tailored to individual hosts. Other enforcement methods, like VLAN steering, are also available. The benefit of in-line NAC is that if no other enforcement method is available, in-line blocking is still an option. The downsides are that you're adding another potential failure point (determine if the device fails open or shut), and you'll need one device for each enforcement point.