implementing-network-access-control

name	implementing-network-access-control
description	Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configuration to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices. Use when enforcing zero-trust access at the network edge, quarantining non-compliant endpoints, meeting PCI-DSS/HIPAA/SOC 2 access requirements, or onboarding BYOD devices with automated provisioning.
domain	cybersecurity
subdomain	network-security
tags	["network-security","nac","802.1x","radius","packetfence"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]
mitre_attack	["T1046","T1040","T1557","T1071"]

Implementing Network Access Control

When to Use

• Enforcing identity-based network access where only authenticated and compliant devices connect to the network
• Implementing zero-trust networking at the access layer with dynamic VLAN assignment based on user role
• Quarantining non-compliant devices that fail endpoint posture checks (missing patches, disabled AV)
• Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) for network access controls
• Onboarding BYOD devices with automated provisioning and limited network access

Do not use as a standalone security solution without complementary controls, for networks with devices that do not support 802.1X supplicants, or without proper fallback mechanisms for critical infrastructure.

Prerequisites

• RADIUS server (FreeRADIUS, Microsoft NPS, or Cisco ISE) configured with user/device authentication
• Managed switches supporting 802.1X port-based authentication
• Certificate Authority for EAP-TLS certificate distribution (optional but recommended)
• PacketFence or similar NAC platform for posture assessment and remediation
• Active Directory or LDAP directory for centralized user authentication
• DHCP server integration for dynamic IP assignment per VLAN

Workflow

Step 1: Install and Configure FreeRADIUS

# Install FreeRADIUS
sudo apt install -y freeradius freeradius-utils freeradius-ldap

# Configure RADIUS clients (switches that authenticate against RADIUS)
sudo tee /etc/freeradius/3.0/clients.conf << 'EOF'
client switch-core-01 {
    ipaddr = 10.10.100.1
    secret = R4d1u5_S3cr3t_K3y!
    shortname = core-switch
    nastype = cisco
}

client switch-access-01 {
    ipaddr = 10.10.100.10
    secret = R4d1u5_S3cr3t_K3y!
    shortname = access-switch-01
    nastype = cisco
}

client switch-access-02 {
    ipaddr = 10.10.100.11
    secret = R4d1u5_S3cr3t_K3y!
    shortname = access-switch-02
    nastype = cisco
}
EOF

# Configure LDAP module for Active Directory integration
sudo tee /etc/freeradius/3.0/mods-available/ldap << 'EOF'
ldap {
    server = 'ldap://dc01.corp.example.com'
    identity = 'CN=radius-svc,OU=Service Accounts,DC=corp,DC=example,DC=com'
    password = 'ServiceAccountPassword123!'
    base_dn = 

    user {
        base_dn = 
        filter = 
    }

    group {
        base_dn = 
        filter = 
        membership_attribute = 
    }
}
EOF

  -s /etc/freeradius/3.0/mods-available/ldap /etc/freeradius/3.0/mods-enabled/ldap