Design and Implementation of a Network Access Control System

Design and Implementation of a Network Access Control System
Abstract
This project presents the design and implementation of a Network Access Control (NAC) system that enforces identity-based and compliance-driven access policies for wired and wireless network infrastructure. The system integrates IEEE 802.1X port-based authentication, MAC Authentication Bypass (MAB) for non-supplicant devices, and RADIUS-based centralized policy management to ensure that only authenticated and authorized endpoints gain network access. The design follows a defense-in-depth architecture spanning identity verification (certificate and credential-based authentication), device profiling (MAC-based device identification), and dynamic policy enforcement (VLAN assignment and access control lists). The implementation leverages Cisco Identity Services Engine (ISE) as the policy decision point, with Cisco Catalyst switches configured as policy enforcement points. Validation through simulation demonstrates successful authentication flows, dynamic VLAN assignment based on user role, and automatic quarantine of non-compliant devices. The project provides a practical, standards-compliant reference architecture for organizations seeking to implement zero-trust network access principles without prohibitively expensive proprietary solutions.
Keywords: Network Access Control, 802.1X, RADIUS, MAC Authentication Bypass, Cisco ISE, Zero Trust
________________________________________
Chapter One: Introduction
1.1 Background of the Study
Traditional network security models relied on perimeter defense—firewalls and intrusion prevention systems at the network edge—to keep threats out. Once a device gained physical access to a network port or associated with a wireless access point, it was implicitly trusted and granted unrestricted access to network resources. This "castle-and-moat" approach has proven inadequate for modern network environments characterized by bring-your-own-device (BYOD) policies, IoT proliferation, and sophisticated threats that bypass perimeter defenses.
Network Access Control (NAC) addresses this gap by enforcing access policies at the point of network connection. NAC ensures that only authenticated and authorized devices gain access, and that those devices are granted only the minimum level of access necessary for their function . The technology is fundamental to zero-trust security architectures, which operate on the principle of "never trust, always verify"—every connection attempt, regardless of origin, must be authenticated and authorized before access is granted .
The IEEE 802.1X standard provides the foundation for port-based network access control, defining a framework for authenticating devices attempting to connect to a network port . When combined with RADIUS (Remote Authentication Dial-In User Service) for centralized authentication and policy management, 802.1X enables organizations to implement granular access control that adapts to user identity, device type, and compliance posture.
1.2 Statement of the Problem
Many organizations continue to operate networks where physical port access equates to full network access. This creates significant security vulnerabilities. An unauthorized individual who connects a laptop to an accessible network port gains the same access as legitimate users. Compromised devices can spread malware laterally across the network. Guest devices, if not properly segregated, can access sensitive corporate resources.
The problem is compounded by device diversity. Modern networks must accommodate managed corporate devices, personal smartphones and laptops, IoT sensors, printers, and IP phones—each with different security capabilities and access requirements. Some devices support 802.1X supplicant software; others do not. Some can present certificates; others cannot. A one-size-fits-all access policy either grants too much access to low-trust devices or blocks legitimate devices from connecting.
Organizations require a NAC system that can: authenticate users and devices using appropriate methods for each device class; enforce access policies based on identity and device posture; provide visibility into what is connecting to the network; and automatically respond to policy violations .
1.3 Aim and Objectives
The aim of this project is to design and implement a Network Access Control system that enforces identity-based and device-aware access policies for enterprise wired and wireless networks.
The specific objectives are:
1. To design a NAC architecture integrating 802.1X authentication, MAC Authentication Bypass, and RADIUS-based centralized policy management.
2. To configure policy enforcement points (switches and wireless controllers) for port-based access control.
3. To implement authentication policies supporting multiple methods: EAP-TLS for managed devices, PEAP-MSCHAPv2 for user authentication, and MAB for non-supplicant devices.
4. To deploy dynamic authorization including VLAN assignment and downloadable ACLs based on authentication results.
5. To validate the system through simulation, demonstrating successful authentication, policy enforcement, and quarantine of unauthorized devices.
1.4 Significance of the Study
This project contributes a practical, standards-based NAC implementation guide that organizations can adapt to their environments. The design demonstrates that comprehensive network access control can be achieved using widely supported standards (802.1X, RADIUS) and commercially available or open-source components. The documentation of authentication flow configuration, MAB fallback for legacy devices, and dynamic VLAN assignment provides network engineers with a validated reference implementation.
1.5 Scope and Limitations
The scope encompasses the design and configuration of NAC for wired switch ports and wireless SSIDs, including 802.1X authentication, MAB for non-supplicant devices, RADIUS integration, and dynamic authorization. The implementation focuses on Cisco ISE as the policy server with Cisco Catalyst switches as enforcement points.
Limitations include the exclusion of endpoint posture assessment (agent-based compliance checking), TrustSec security group tagging, and cloud-based NAC architectures. The design assumes a single RADIUS server deployment and does not address high-availability configurations.
1.6 Definition of Terms
Network Access Control (NAC): A security solution that restricts network access based on device and user compliance with predefined policies, ensuring only authenticated and authorized entities connect .
IEEE 802.1X: A standard for port-based network access control that provides authenticated access to wired and wireless networks through a three-party authentication framework .
RADIUS (Remote Authentication Dial-In User Service): A protocol providing centralized Authentication, Authorization, and Accounting (AAA) services for network access .
Supplicant: Client software on an endpoint that requests network access through 802.1X authentication .
Authenticator: The network device (switch or wireless controller) that controls port access and relays authentication messages between supplicant and authentication server .
MAC Authentication Bypass (MAB): An authentication method that uses a device's MAC address as credentials for devices that do not support 802.1X supplicant software .
Policy Enforcement Point (PEP): The network device that enforces access decisions made by the policy server .
Policy Decision Point (PDP): The RADIUS server that evaluates authentication requests and returns authorization decisions .