AO TECHNOLOGIESTechnology. Beginning to end.

Network Access Control

Know every device. Control every port.

Identity-based access with Cisco ISE or Aruba ClearPass: 802.1X and profiling for every user and device, and TACACS+ for every admin login.

Cisco ISE or Aruba ClearPass802.1X, MAB and profilingTACACS+ device administration
Ask about the AO ExperienceSee our work
ISE / CLEARPASS EMPLOYEES802.1X · CORPVOICEPHONES · VOICEIoT & OTPROFILED · IoTGUESTSINTERNET ONLYCONTRACTORSLIMITED ACCESSNETWORK ADMINSTACACS+ · ROLES RADIUS / 802.1XTACACS+

The problem

Anyone who plugs in is on your network.

Most networks we assess have the same four gaps. Here is what we find, what it costs you, and how we fix it.

The problem
What it costs you
How we fix it
Open switch ports and shared Wi-Fi passwords
Anyone who plugs in or has the password is on your network, with no record of who they are.
802.1X on every wired port and SSID, using certificates or user credentials
IoT, HVAC, cameras and medical devices that can't run 802.1X
These devices get waved through, and they are often the easiest way in.
Profiling and MAB, so each device is identified and gets only the access it needs
Flat networks
One compromised device can reach payroll, servers and everything else.
Identity-based segmentation with VLANs, downloadable ACLs or security group tags
Shared admin logins on switches, routers and firewalls
When auditors ask who changed a rule or who is on the network, nobody can answer.
TACACS+ device administration with per-user roles and a full command log

How it works

One policy cluster for every connection and every login

Switches and access points ask the cluster who each device is over RADIUS. Network devices ask who each admin is over TACACS+. Both use the same identity source.

ENDPOINTSACCESS LAYERPOLICY CLUSTERIDENTITY 802.1XMAB + profiling RADIUSRADIUS ISE OR CLEARPASS CLUSTERED POLICY NODES RETURNSVLAN · ACL · SGTadmin role + commandsevery login logged EMPLOYEEIP PHONECAMERA / IoTGUEST ACCESS SWITCH WIRELESS AP ACTIVE DIRECTORYLDAP · CERTIFICATES ENGINEER SSH login SWITCHROUTERFIREWALL TACACS+ RADIUS · network access TACACS+ · device admin

Network access: RADIUS and 802.1X

  1. A user or device connects to a switch port or SSID.
  2. It signs in with 802.1X, or with MAB and profiling if it can't run 802.1X.
  3. The switch or AP sends a RADIUS request to the nearest policy node.
  4. The cluster checks Active Directory and certificates, then returns the right VLAN, ACL or security group tag.

Device administration: TACACS+

  1. An engineer logs in to a switch, router or firewall.
  2. The device sends a TACACS+ request to the cluster.
  3. The cluster checks the engineer's AD group and returns a role and the commands they can run.
  4. Every command is logged, so you can show auditors who changed what.
Policy nodes are clustered across sites, so logins keep working if a node or a data center goes down.

What we transform

What we deliver

ISE and ClearPass

Cisco ISE and Aruba ClearPass architecture and implementation.

802.1X everywhere

Authentication for wired and wireless users and managed devices.

Profiling

Device authentication and profiling, including non-802.1X devices.

Segmentation

Identity-based segmentation and policy enforcement.

Zero Trust

Identity at the edge, segmentation in the fabric and WAN, enforcement at the firewall.

Visibility

Operations tie-in through SolarWinds, syslog and ServiceNow.

Why NAC projects fail

The risk isn't the policy server. It's locking out the business.

  • Discover and profile every endpoint before enforcing anything
  • Monitor mode first, then low-impact, then closed mode
  • Site-by-site enforcement with tested fallbacks
  • Exceptions designed in, not bolted on

This is the same phased, backout-ready method we use for data center and WAN cutovers.

Proof

Segmentation that already works

From our 80-site program

A segment model built and proven

Guest, voice, IoT, HVAC, physical security, management and medical/vendor segments. NAC puts each device into the right one automatically, across wired, wireless and SD-WAN.

Read the case →
Platforms

Cisco ISE and Aruba ClearPass

We design and implement both, and fit them into the firewall, fabric and WAN policy you already run.

How it runs

Engagement path

Discovery

Endpoint discovery and profiling.

Design

Policy and segment design.

Pilot

Lab and pilot validation.

Monitor

Monitor-mode rollout with no enforcement.

Enforce

Phased enforcement, site by site.

Hand off

Operational handoff and runbooks.

Work with us

Start with visibility

Begin with an endpoint visibility assessment. Senior engineers and one point of contact from first call to final handoff.

Email usSee our work
THE AO
EXPERIENCESenior engineers, one point of contact and full documentation on every engagementStart a project