Network Access Control
every device authenticates. Every port knows what's plugged into it.
NAC design and deployment across SoCal — corporate, healthcare, higher ed, K-12, manufacturing, government. Aruba ClearPass. Cisco ISE. FortiNAC. Forescout. 802.1X. IoT segmentation. Guest access. BYOD. Dynamic VLAN.
Network access control — the policy layer between the device and the network
Network access control is the discipline of knowing what's on your network at any moment, what it's allowed to do, and what changes when its posture shifts. NIST 800-53 AC-3 mandates access enforcement; cyber insurance underwriting increasingly requires it. The unmanaged switch port that worked fine for years is exactly where the breach starts.
The scope: platform selection (Aruba ClearPass, Cisco ISE, FortiNAC, Forescout), 802.1X rollout planning, supplicant strategy for managed endpoints, MAC authentication bypass for printers and IoT, certificate authority integration, dynamic VLAN assignment, posture assessment, guest portal design, BYOD onboarding, and integration with the existing identity provider and SIEM.
Pairs with networking for the switch and wireless infrastructure, wireless for SSID design, cybersecurity for the broader posture, and managed services for ongoing policy operations. Start with a free assessment.
Three patterns that leave the network wide open
Most enterprise networks have unlabeled switch ports, an IoT fleet nobody documented, and a guest network that bridges to corporate by accident. NAC closes those gaps.
Unmanaged ports are the breach
Every conference room jack, every printer drop, every empty cube the contractor used last year — they're all live unless something denies them. The unmanaged switch port is the most common initial-access vector documented in incident response. 802.1X plus MAB closes it.
IoT lives on the corporate VLAN
Cameras, badge readers, building automation, medical devices, manufacturing PLCs, vending machines — they end up on the corporate VLAN because nobody designed where they should live. One compromised device with corporate-network adjacency becomes a pivot point. Dynamic segmentation puts every device class on its own VLAN.
BYOD trusts the user, not the device
The personal laptop joined the corporate WiFi with someone's credential. The device posture is unknown. The patch level is unknown. Anti-malware is unknown. Posture assessment plus dynamic VLAN turns "joined the network" into "joined a known segment with known restrictions."
Why choose WCC for network access control
NAC is platform expertise + 802.1X rollout discipline + identity integration + segmentation design + ongoing policy operations. WCC handles all five.
CSLB C-7 · C-10 · C-28
Active California contractor license. Switch infrastructure, structured cabling, and electronic systems all under one license stack.
ClearPass · ISE · FortiNAC · Forescout
Multi-platform expertise. Vendor-neutral selection driven by existing switch / wireless stack and identity posture, not vendor preference.
Azure AD · Okta · AD CS
Identity provider integration including Azure AD / Entra ID, Okta, on-prem Active Directory, and certificate authority (AD CS or third-party PKI).
Phased 802.1X
Monitor-mode rollout phase, exception-list curation, supplicant troubleshooting playbook, then enforce-mode cutover. The order matters — enforce-first deployments fail.
The six NAC capability areas
Each capability scopes to existing infrastructure, identity posture, and segmentation goals.
Authentication Server
Aruba ClearPass for Aruba-heavy networks. Cisco ISE for Cisco-heavy. FortiNAC for Fortinet stacks or IoT-heavy. Forescout for the agentless, broad-visibility use case. Selection driven by infrastructure, not preference.
Authentication Rollout
Phased rollout: monitor-mode discovery, exception-list build, supplicant configuration on managed endpoints, MAB for printers and IoT, then enforce-mode cutover. Documented per-port action.
Device Profiling + Segmentation
Device profiling via DHCP fingerprint, MAC OUI, behavioral signatures. Dynamic VLAN assignment per device class. IoT-only segments for cameras, building automation, medical devices, manufacturing.
Guest Portal + Sponsor
Self-service guest portal with sponsor approval workflow. Time-bounded access. Bandwidth limits. Sponsor portal for reception or IT staff. SMS or email credential delivery. AUP click-through.
BYOD Onboarding + Posture
BYOD onboarding workflow with certificate provisioning. Posture assessment (OS version, patch level, anti-malware presence, disk encryption). Dynamic VLAN per posture state. Quarantine for non-compliant devices.
SIEM + Identity
SIEM forwarding (Splunk, Sentinel, Chronicle, QRadar). Identity integration with Azure AD / Entra ID, Okta, on-prem AD. Certificate authority integration. Policy synchronization with existing security stack.
Network access control — common questions
Driven by the existing switch and wireless infrastructure plus the identity stack. Aruba ClearPass for Aruba-heavy networks — tightest native integration. Cisco ISE for Cisco-heavy — same. FortiNAC for Fortinet-centric or heavy IoT environments. Forescout for the agentless, broad-visibility use case across mixed infrastructure. WCC scopes platform selection in the first assessment week.
Phased. Monitor-mode discovery runs first — nothing is denied, everything is logged. Exception list gets built from real traffic (printers, IoT, legacy systems that won't supplicant). Managed endpoints get supplicant configuration via GPO or MDM. Once the exception list is stable and supplicant deployment hits target coverage, enforce mode flips on a per-switch or per-VLAN basis. Enforce-first deployments break things; phased deployments don't.
MAC authentication bypass (MAB) covers them. The device MAC gets profiled (DHCP fingerprint, MAC OUI, behavioral signatures) and assigned to the appropriate VLAN. Cameras go to the camera VLAN. Building automation to its own segment. Medical devices to a HIPAA-aware segment. MAB plus profiling is the standard pattern for IoT — the device doesn't supplicant, the platform identifies it and segments accordingly.
No — the firewall enforces between segments, NAC enforces what goes into which segment. They're complementary. A device authenticates through NAC, gets a VLAN, then talks to other VLANs through the firewall with whatever policy that segment is allowed. NAC is access control at Layer 2; firewall is access control at Layer 3 / 4. Both matter.
Increasingly, cyber insurance carriers ask about NAC posture in renewal questionnaires — specifically 802.1X coverage, IoT segmentation, and BYOD policy enforcement. Coverage without NAC often carries higher premiums or sublimit restrictions. A documented NAC posture with measurable enforcement coverage materially affects premium negotiations. WCC produces the underwriting-ready documentation from the deployment.
Platform license: ClearPass $30-90 per endpoint perpetual or subscription; ISE $50-150 per endpoint depending on tier; FortiNAC $25-60 per endpoint; Forescout $40-100 per endpoint. Deployment services: $40K-100K for single-site enterprise (500-2,500 endpoints), $100K-400K for multi-site or 5,000+ endpoint enterprise, $400K-1.5M+ for higher-ed campus or hospital system with full IoT segmentation.
NAC deployments across Southern California
WCC designs and deploys network access control across all six SoCal counties — corporate, healthcare, higher ed, K-12, manufacturing, government. Chino HQ.
NAC is the policy layer that turns "joined the network" into "joined a known segment."
WCC designs and deploys network access control: platform selection across Aruba ClearPass, Cisco ISE, FortiNAC, Forescout. 802.1X phased rollout. IoT profiling and segmentation. Guest portal. BYOD onboarding with posture. Identity integration with Azure AD / Okta / AD. SIEM forwarding. CSLB C-7 / C-10 / C-28.