This document discusses Network Access Control (NAC) and how it works with other McAfee products to secure network access. NAC checks systems for health compliance against policies before and after network admission. It works with Microsoft NAP and McAfee NSP to enforce compliance for both managed and unmanaged systems. NAC is integrated into the McAfee ePolicy Orchestrator console and provides a unified way to control network access and security across endpoints, appliances, and network devices.

1. What is NAC?

2. Why Do We Need NAC ?
 NAC protects the network from
non-compliant or infected systems
 Provides enforcement methods to
protect the network
 Can perform pre- and post-admission
controls
 Pre-admission: scanning for “health”
 Post-admission: monitoring the
network and the traffic continuously
for threats

3. Three Generations of NAC
In 2004, Cisco launched
Network Admission Control
focused on Authentication
and health
Too complex and
expensive, required
upgrading of switches and
routers.
1
In 2005, Vendors
approached from their
strengths:
Cisco/Juniper introduced
appliances to simplify
deployment
Sophos/Symantec/McAfee
focused on Endpoint
Microsoft announced NAP
infrastructure
Third Generation (2008):
Unification of Compliance,
Security and Access Control
Unification of Network and
Endpoint Elements
2 3
Cisco is appliance oriented; Microsoft: server oriented; McAfee: endpoint & appliance oriented

4. What is NAC ?
 Network Access Control (NAC) is an
extension to ePO 4.0
 Provides network security by controlling
system access to network resources
 Access is granted according to the
system’s “health” status
 System’s “health” is assessed against a
set of defined compliance rules

5. NAC And Other Products
 NAC works together with Microsoft NAP
(Network Access Protection) as well as
with McAfee NSP (Network Security
Platform), formerly IntruShield
 In this case, NAC provides the “health”
statement, while enforcement is done
together with the other product

6. Managed vs. Un-managed Hosts
 Managed Hosts (those having a
running McAfee agent) can be handled
by NAC (enforcing a policy through ePO)
 Un-managed Hosts are detected but
they must be managed either by MS- NAP
or NSP (Network Security Platform,
IntruShield 5.1)

7. NAC & IntruShield
 MNAC 3.1 combined with IntruShield
5.1 provides complete monitoring of
managed and un-managed system
 McAfee will offer an appliance based
solution (NAC Appliance)
 NAC appliance provides pre-admission
control for un-managed systems
 IntruShield appliance provides
additional post-admission monitoring

8. 06/09/16
ToPS Advanced
Total Protection for Endpoint
Single Integrated Management
Console - ePO
Anti-Spyware
Host Intrusion Prevention
Desktop Firewall
Anti-Virus
Web Security
Policy Auditing
Network Access Control
Anti-Spam (Email server)

9. McAfee Network Access Control
3.1 Software
• Tightly integrated with Microsoft Network Access Protection (NAP) for
control of unmanaged systems
• Support for ePolicy Orchestrator 4.0
• Standards-based system health checks
– XCCDF and OVAL®
• The industry’s most advanced check library
• Creation of custom checks for system health policies
Key Features

10. Combined Network
IPS + NAC Solutions
McAfee Unified Secure Access Strategy:
Integrated Across Your Infrastructure
Endpoint
Security Solutions
NAC-only Appliance
Solutions
• Network Enforcement
• Full IPS Functionality
• Post and Pre-admission
Control
Network Security
Platform
• Cost Effective In-Line NAC
• Access Protection for
Unmanaged Endpoints
• Network-Class Platform
NAC Appliance
• Endpoint Health Assessment
• NAP Integrated
• Managed Endpoint Control
ToPS Advanced

11. 11
06/09/16
McAfee Network Security Platform with
NAC Add-on (formerly McAfee IntruShield)
• Combined IPS and NAC on same platform
• NAC software add-on deploys with simple upgrade
• Access Protection for Unmanaged Endpoints
• Built-in Host Quarantine
• Network-Class reliability and availability
• Identity-based access control
– Access based on organizational roles/users
– Integrates with Microsoft Active Directory
• Comprehensive post-admission control through:
– Application protocol
– Source/destination addresses
– Obtains endpoint health from MNAC
– IPS-detected malicious behavior
• NAC monitoring and reporting
– Reports on access logs (who, when, where) and
action taken
• Software Available on all I-Series Platforms
Security AND Performance.
No Compromise.

12. 12
06/09/16
McAfee Network Security Platform –
NAC Appliance*
• NAC functionality on Network-Class Appliance platform
• Access Protection for Unmanaged Endpoints
• Flexible deployment
– Deploying in DHCP-mode
– Inline behind a VPN or LAN
• Identity-based access control
– Access based on organizational roles/users
– Integrates with Microsoft Active Directory
• Comprehensive post-admission control through:
– Application protocol
– Source/destination addresses
– Obtains endpoint health from MNAC
• NAC monitoring and reporting
– Reports on access logs (who, when, where) and
action taken
Security AND Performance.
No Compromise.
*Available end 2008

13. Unified Secure Access Process
Scan for rogue devices, alert
and report
Step 2: Discover
Pre or Post Admission health
against policy is checked.
Malicious behavior monitored
Step 3: Enforce
Take action based on
outcome of policy check or
behavior
Step 4: Remediate
Monitor endpoint to ensure
ongoing compliance
Step 5: Monitor
Define health, machine/user
identity, application policy
Step 1: Policy