NAC and firewall in wireless

[Leftz]

Hi, Network access control, NAC, is solutions to support network visibility and access management through policy enforcement on devices and users of corporate networks.

I can get some of info of NAC as below. Firewall can also do that. what is difference between NAC and general firewall? Thanks

NAC for guests/contractors
Whether accounting for contractors, visitors, or partners, organizations use NAC solutions to make sure that non-employees have access privileges to the network that are separate from those of employees.

NAC for BYOD
The exponential growth in mobile devices has liberated the workforce from their desks and given employees freedom to work remotely from their mobile devices. NAC for BYOD ensures compliance for all employee owned devices before accessing the network.

[Arshad Safrulla]

To simply say Firewall can see only traffic passing through it or hitting one of it's interfaces, it cannot control what device is physically connected to the network and given access to the Internal resources. NAC will make sure that the user is authenticated and Authorized as per the defined policies before access is granted to the network at Access Layer. Same theory applies to NAC in Wireless as well.

Summary - Firewall is for perimeter and NAC is for you can say Access Layer.

[Leftz]

Thank you very much for your reply. Can you give an example to simply explain how NAC work in wireless? 

[Arshad Safrulla · Accepted solution]

NAC will authenticate the Wireless client against an identity source (AD, LDAP etc.) before given access to the network, you can research on DOT1X, EAP-TLS,EAP-PEAP,EAP-TEAP etc. Also NAC can scan your PC to check for certain parameters like updates, AV, certificates before given access to the network and if you do the right integrations you can even have scenarios such as if a virus,cnc or malware found on ur pc to take your wireless client to a quarantine VLAN or deny access to the network (research on COA). Most importantly correctly configured Wireless and NAC will make sure that your wireless traffic is less vulnerable for snooping. Also you can have the NAC dynamically assign VLAN's based on the posturing state, User group or Identity source (research on dynamic vlan assignment using radius)

https://medium.com/tech-jobs-academy/radius-server-access-control-12e6c9381183

Most of the above listed cannot be done by Firewall alone.

[Leftz]

Thank you very much!