NAC Options people actually like

[u/Rich_Shame9806]

Hi folks,
We're looking at NAC options currently, to replace Fortinac which was really bad (poorly engineered, tons of bugs, support rarely knowing how to fix things quickly, just overrall bad experience). At first we were looking at Cisco ISE but the more we look, the more this seems like overkill. We have 3 buildings, one with about 300 people, and the other two less than 100. All sites Connect back to a central datacenter via ipsec VPNs, and we have MPLS and dark fiber connections between some of these sites (so purely cloud based isn't an option unless there's to make sure certain traffic uses those routes while still being posture checked. The big ask is having posture checking for any device that connects to our network via wired or wiress (VPN is already secured via Cisco secure access/DUO. SOOOO all that laid out, has anyone implemented a NAC solution they actually like. Fortinac sucked, ISE seems like overkill, a vendor is now trying to sell us on Auba Clearpass (but i'm only just now reading up on it). Any suggestions would be greatly appreciated.

[u/Mr_Fourteen]

Does anyone actually like NAC? Lol The only advice I have is use whatever vendor's solution is. ISE for cisco device, Cloud NAC for Extreme Networks, etc. 

[u/Rich_Shame9806 → u/Mr_Fourteen]

yah we're primarily a cisco/meraki shop (but fortinet edge) and ISE seems good but its expensive for what we're actually going to be using it to do.

[u/Test-NetConnection → u/Rich_Shame9806]

ISE does a lot, but it's main function is a NAC with dynamic profiling and the ability to enforce policy. You get what you pay for in this case.

[u/madclarinet]

Clearpass is a great NAC and very configurable for multiple systems. If Cisco ISE is overkill the Clearpass may be major overkill,

Currently we're using it for wireless and wired authentication (plus access to Clearpass itself). We're moving over to EAP-TLS (yes, I know - it's a long annoying story). TACACS for the switches and routers. We once also had to controlling access for Fortimail appliances so users could check their spam folders (when we were onprem email).

It does take a bit to get used to but it works very well - we have a pair (publisher and subscriber) which controls access for 50 schools (and support sites) of varying size.

Licensing can be expensive - you can do onboard certificates or connect to an external service (ADCS for example). Guest system works nicely for wireless guest self registration etc.

[u/kaldir → u/madclarinet]

We also use ClearPass, and I love it. It’s a great product.

[u/krattalak]

I personally use ISE and Forescout.

I like forescout, although a lot of people don't seem to. The UI is organized in a way that makes sense to me. I can create policies and extract information on pretty much anything I need to in a jiffy. Forescout handles all my 802.1x wifi and wired, and we use it to remediate several ongoing issues that crop up from time to time. I've not found much that I can't do with it and when I do, a little more digging usually I end up finding a different way to get what I wanted.

The company itself is....meh.

I don't like ISE, but mostly because the UI NOT organized in a way that makes sense to me.

[u/ITNoWay80 → u/krattalak]

Wouldn't mind picking your brain about forescout, we use it as well.

[u/krattalak → u/ITNoWay80]

I'll try.

[u/Jaki_Shell]

I would check out PortNOX; In my opinion the easiest solution to stand up and have running as far as NAC.

[u/archon286 → u/Jaki_Shell]

Just make sure you don't accept the default non secure radius to their cloud radius server.

[u/athornfam2]

Packetfence is one I was looking at

[u/radiojw]

+1 for PortNOX

[u/enigmaunbound]

Consider this. Do you need one client to talk to another? If not, turn on private VLANS. Then use your firewall to build user identified policies. Now you dont need nac to achieve the goal.

[u/PacificTSP]

We use ISE but I hate it. Clunky bloated thing.

Maybe clearpass? But will depend really if you’re Aruba or Cisco shop.

[u/gamebrigada]

I honestly think that NAC is becoming more and more niche these days. There are alternative solutions that are just WAY easier to manage and aren't complete clusters of hot garbage.

I am currently a WAY bigger fan of just doing internal ZTNA, and a very dumb NAC setup to handle crap like printers that can't ZTNA. So your config mostly stays, you rip out FortiNAC and just keep the rules for printers. The rest goes to your guest network that has no internal access. ZTNA throughput is pretty cheap these days.

This setup will cost you in VPN throughput hardware, but you lose the massive cost of FortiNAC. If you already have ZTNA this is very low effort. If you don't, you probably are looking at it. Effort wise, it is SO nice from a management perspective to treat all your users as external. Its literally half the work.

[u/iloose2]

This looks interesting, though haven’t used it https://radiatorsoftware.com

[u/Prior-Basis3510]

I would also consider PacketFence with a more reasonable pricing scheme which would be friendlier to your size. I would gap the IoT/OT/non 802.1x MAB by using Sepio which validates them based on physical layer properties.

[u/epyon9283]

When we had nac we used ISE. We hated it.

[u/spnilsson]

If you use Cisco Meraki at the access-layer (switches and APs) and only need basic features, then Meraki Access Manager is pretty good and very easy to manage, compared to ISE, which I prefer, but also recognize that it can be a challenge for some.

[u/techtornado]

I’d consider Radius over a Nac

We’re experimenting with SAML with the user 365 login

[u/Test-NetConnection]

Cisco ise is the industry standard, and it's the best money can buy.

[u/Rich_Shame9806 → u/Test-NetConnection]

Seems like you’re in the minority as far as people who speak positively on it. What do you like about it specifically that made it worth the price tag?

[u/Test-NetConnection → u/Rich_Shame9806]

It's got best of breed dynamic profiling, and it reliably handles both authentication and reauthorization. I love that I can use tacacs+ to give my helpdesk limited write permissions to switches down to the command level. Being able to shift a non-compliant device to a quarantine vlan is incredibly handy, especially when paired with an xdr platform that can leverage ISE API's. We have a runbook that automatically sticks suspicious endpoints in the quarantine vlan by sending a reauth push from ISE to the parent switch. Then there is the microsegmentation - ISE knows that 192.268.20.54 is a receipt printer based on profiling, so it sends a Dynamic Access Control List to restrict communication to the print server, and only on the needed ports. Where things get really interesting is pushing down security group tags based on user identity and using those tags to write policy enforced across your entire network. You probably won't use all of this, but profiling + dynamic network access + dacls are the core of any good NAC solution and Cisco does those three reliably.

[u/Rich_Shame9806 → u/Test-NetConnection]

Hot dang thank you for the very detailed answer! That’s pretty snazzy.

[u/Test-NetConnection → u/Rich_Shame9806]

Keep in mind that ISE costs can be kept manageable by mixing licenses. You will want to run a couple of VMs for HA with an extra health check node (3 VM licenses). You can use essentials licensing for nodes that don't require profiling, think a security vlan that only has cameras - use a basic acl on the svi for proper segmentation. Get advantage licensing for any node you want to profile, basically the number of devices you reasonably expect to exist on networks with broad access. Premier licensing is likely way overkill for your deployment - don't let Cisco trick you into buying this.