<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-network-access-control
description: >-
  Design and enforce network access control policies using 802.1X, RADIUS, TACACS+,
  NAC agents, VLAN assignment, and posture assessment to restrict unauthorized devices
  and enforce least-privilege network segmentation.
domain: cybersecurity
subdomain: network-security
tags:
  - nac
  - 802.1x
  - radius
  - tacacs
  - vlan
  - zero-trust
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557", "T1200", "T1133"]
  nist-csf: ["PR.AC-1", "PR.AC-5", "PR.AC-7"]
  uuid: a1b2c3d4-1001-4a00-b001-f00d00000001
---

# Implementing Network Access Control

## Overview

Network Access Control (NAC) ensures only authenticated, authorized, and compliant
devices connect to network resources. This skill covers 802.1X port-based authentication,
RADIUS/TACACS+ configuration, dynamic VLAN assignment, posture assessment, and MAC
Authentication Bypass (MAB) for non-802.1X devices.

Mode: `[MODE: ARCHITECT]` for design; `[MODE: BLUE]` for enforcement and monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| FreeRADIUS 3.x or ISE/ClearPass deployment | Required |
| Managed switches supporting 802.1X (Cisco, Juniper, Aruba) | Required |
| Certificate authority for EAP-TLS | Required |
| VLAN infrastructure planned (quarantine, production, guest) | Required |
| Zeek or Suricata for monitoring authentication events | Required |

## Key Concepts

### 802.1X Authentication Flow

```
Supplicant (client)  →  Authenticator (switch)  →  Authentication Server (RADIUS)
      EAP Identity   →    RADIUS Access-Request  →  Credential Verification
      EAP Challenge   ←    RADIUS Access-Challenge ←  Policy Lookup
      EAP Response    →    RADIUS Access-Request  →  Posture Check
      EAP Success     ←    RADIUS Access-Accept   ←  VLAN Assignment
```

### FreeRADIUS Configuration

```bash
# /etc/freeradius/3.0/clients.conf — switch as RADIUS client
client switch-core-01 {
    ipaddr     = 10.0.0.1
    secret     = $(cat /etc/freeradius/secrets/switch-core-01)
    nastype    = cisco
    shortname  = core-sw-01
}

# /etc/freeradius/3.0/sites-enabled/default — authorize section
authorize {
    filter_username
    preprocess
    eap {
        ok = return
    }
    files
    sql
    pap
}

# Dynamic VLAN assignment policy
# /etc/freeradius/3.0/policy.d/vlan-assignment
policy vlan_assign {
    if (&User-Name =~ /^admin/) {
        update reply {
            Tunnel-Type := VLAN
            Tunnel-Medium-Type := IEEE-802
            Tunnel-Private-Group-Id := "10"
        }
    }
    elsif (&User-Name =~ /^guest/) {
        update reply {
            Tunnel-Type := VLAN
            Tunnel-Medium-Type := IEEE-802
            Tunnel-Private-Group-Id := "99"
        }
    }
}
```

### Switch Port Configuration (Cisco IOS)

```
interface GigabitEthernet0/1
 description 802.1X Enabled Port
 switchport mode access
 switchport access vlan 100
 authentication port-control auto
 authentication order dot1x mab
 authentication priority dot1x mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 mab
 authentication violation restrict
 spanning-tree portfast
 spanning-tree bpduguard enable
```

### Posture Assessment with nmap

```bash
# Scan device for compliance indicators
nmap -sV -O --script=smb-os-discovery,ssl-cert \
  -oX /tmp/posture_scan.xml 10.10.10.50

# Check for required services
nmap -p 445,5985 --script=smb2-security-mode 10.10.10.50

# Verify endpoint agent is running
nmap -sV -p 8834,4118 10.10.10.50
```

### Zeek Monitoring for Auth Events

```zeek
# monitor-radius.zeek — track authentication events
@load base/protocols/radius

event radius_message(c: connection, result: RADIUS::Message) {
    if ( result$code == RADIUS::Access_Reject ) {
        local msg = fmt("RADIUS reject: user=%s nas=%s",
                        result$attributes$User_Name,
                        c$id$resp_h);
        NOTICE([$note=RADIUS::Auth_Failure,
                $msg=msg,
                $conn=c]);
    }
}
```

## Workflow

### Step 1: Plan VLAN Architecture

Define VLANs for production, quarantine, guest, and IoT segments with ACLs between them.

### Step 2: Deploy RADIUS Server

```bash
# Install FreeRADIUS
apt install freeradius freeradius-utils

# Test configuration
freeradius -XC

# Start in debug mode
freeradius -X

# Test authentication
radtest testuser password 127.0.0.1 0 testing123
```

### Step 3: Configure Switch Ports

Enable 802.1X globally and per-port. Configure MAB fallback for printers and IoT.

### Step 4: Define Authorization Policies

Map user groups to VLANs and ACLs via RADIUS attributes.

### Step 5: Monitor and Enforce

```bash
# Monitor RADIUS logs
tail -f /var/log/freeradius/radius.log | grep -E 'Accept|Reject'

# Parse Zeek RADIUS logs
zeek-cut -d ts uid id.orig_h username result < radius.log
```

## Detection

```yaml
title: Network Access Control Detection
id: 895ee185-901a-421e-be3b-da37829c69ff
status: experimental
description: Detects suspicious activity related to implementing network access control techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1200
  - attack.t1133
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Access Control Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557, T1200, T1133 |

## Verification

- [ ] 802.1X supplicant authenticates and receives correct VLAN
- [ ] MAB fallback works for non-802.1X devices
- [ ] Unauthorized device lands in quarantine VLAN
- [ ] RADIUS failover tested (primary down → secondary)
- [ ] Dynamic VLAN assignment verified per policy
- [ ] Posture assessment blocks non-compliant devices
- [ ] Authentication logs captured in SIEM

## References

- [FreeRADIUS Documentation](https://freeradius.org/documentation/)
- NIST SP 800-153: Guidelines for Securing WLANs
- CIS Controls v8 — Control 6: Access Control Management
- IEEE 802.1X-2020 Standard
