Living With NAC - A Report From The .EDU Trenches

As readers of my earlier blog entries will know, SUNY's Purchase College, where I work my day job keeping the network and Servers humming peacefully along, has had a rather checkered past with network admission control systems. This fall we're making our third attempt to implement a NAC system that will keep our student's systems safe from malware without making their lives too miserable.Our initial experience with StillSecure's SafeAccess at the beginning of the 2005-2006 academic year helped us rid the campus of several dozen computers so infected with malware that they would overload our core routers. Unfortunately, StillSecure didn't support inspecting Macintosh or Windows Vista computers and by the fall of 2007 we expected these to make up a substantial fraction of the computers on campus.

So we went off searching for a new NAC solution that could handle all our endpoints, work with our Foundry switches, fit our budget, and be easy enough to use for our arts-oriented student body. After some consideration and, frankly, a discount that made its product fall below the threshold that would require us to issue a formal RFP, we selected Lockdown's Enforcer.

Needless to say, things did not go well. While Lockdown's solution looked good on paper, and in the lab when we had 5-6 PCs to test at a time, when we rolled it out to the real world it left switch ports in limbo without testing the connecting machine. Then Lockdown went belly up, leaving us once again looking for a new NAC solution.

First lesson learned. When you buy a NAC solution, you're buying the whole company behind it. If they don't update the inspection rules when McAfee or Symantec updates the AV signatures, your whole NAC infrastructure is useless. We now have 2 lovely Celeron-based servers left over from the Lockdown fiasco.

Luckily, StillSecure's CSO Alan Shimel read my post on the death of Lockdown and sent me an e-mail both begging for a second chance and offering StillSecure's Assistance to get SafeAccess up and running properly. Since they had fixed our three biggest complaints about the old version, and we were short on both time and money, we decided to take him up on the offer.

Today we have SafeAccess running on some of our dorm networks and while it's not going as well as we hoped, it is going better than we feared.

Next week: How the .EDU NAC experience helps vendors prepare for corporate users, and more lessons learned.