NAC Implementation maturity process

carl_townshend — Thu, 03 Dec 2020 08:37:39 GMT

Hi Guys

Can any of the NAC experts on here give me a walkthrough of what a good implementation looks like.

For example, in my head I would have

1.Define what policies you want to implement

2.Discovery, how long would you leave it to discover, a few months ?

3.Iron out and identify any unknown devices

4.Switch on controls

5.Start to segment Corporate from OT/IoT

6.Start to look at remediation and integration with AV/Windows etc

This is my idea, what is everyone else doing? and in what timeline?

Re: NAC Implementation maturity process

Marvin Rhoads — Thu, 03 Dec 2020 11:15:18 GMT

There are more steps - several books and many Cisco Live presentations cover ISE deployments so it doesn't make sense to try to condense them here.

Design is an important step to combine with your requirements. Only with those in hand can you create policies in the NAC (ISE).

Discovery can last anywhere from days for a small network to months for a large one.

We typically move from Monitor mode to Low Impact and then to Closed. Many organizations stop with Low impact mode.

Your step 6 assumes Posture (e.g. ISE Apex). Not everybody chooses to go that far as their requirements are met with a Base level of functionality.