It's useful to regard NAC as a personal firewall that uses more comprehensive parameters in making access decisions than a traditional firewall does.

Where a stateful, Layer 3 firewall makes such determinations based on source and destination IP addresses and what port is being used, NAC can go much further.

It ties the access decision to a person rather than to just a machine where it connects to the network. These additional factors include how the user is connecting, whether via VPN, wireless access point or over the LAN. It can include where they are connecting from - home vs. a branch office vs. a gate at an airport.

It can include whether the machine is managed or not and whether the device meets health-check requirements set by the business. These can include patches on operating systems (Compare Patch and Vulnerability Management products), antivirus software updated and turned on (Compare antivirus products), encryption turned on and the like.

NAC can also weigh destination IP addresses and ports, just as a firewall does.

Beyond that it can continuously monitor what the admitted machine/user pair is doing while it’s on the network and apply policies to what is and is not allowed

This lengthy list of what NAC can do makes it a very granular control method that could result in policies that are crafted per user.

The more detailed the controls, the more sophisticated the management of these policies need to be. The ability to effectively manage these policies can make or break a NAC deployment, particularly a large complex one.

Be sure to give the management platform a workout when weighing which NAC product to buy (Compare NAC products).

Tim Greene is senior editor at Network World.