Network access control and segmentation - NAC, TrustSec, guest and BYOD

Requirement / business driver

Admit the right devices/users to the right segment with the right policy - dynamically, across wired and wireless, at scale.

The pieces

• NAC (e.g., Cisco ISE) ties 802.1X/MAB (AAA and identity - RADIUS, TACACS+, 802.1X) to authorization results: dynamic VLAN, dACL, or SGT assignment per identity/posture.
• TrustSec / SGT is the scalable enforcement: tag traffic by group at ingress, enforce with SGACLs anywhere - policy follows identity, not topology (Infrastructure segmentation).
• Guest / BYOD - web-auth/guest portals, device onboarding/provisioning, posture checks; isolate guest into its own segment.

One mechanism explains why group-based policy scales where ACLs drown: label compression in hardware. Object-group and security-group ACLs map prefixes or endpoints to a label in an exact-match table, and the TCAM then holds only the permit/deny lines per group pair - identical entries are even reused across policies - so policy cost stops scaling with address count and scales with the number of group relationships instead. That is the TCAM arithmetic behind "SGT segmentation without topology or VLAN change", and it is why the same intent stated as source/destination prefixes can be orders of magnitude more expensive in hardware than stated as groups.

Classification - who assigns the tag, and which source wins

The tag has to come from somewhere, and the split of sources is a design decision. Dynamic classification rides the authorization result (802.1X, MAB, WebAuth, or Passive-ID user-to-IP learning) and fits people and mobile endpoints - the binding follows the session wherever it authenticates. Static classification - IP or subnet to SGT, VLAN, port, or L3-interface mappings - fits servers, infrastructure, and topology-anchored policy, where identity is a property of placement rather than of a login; port/VLAN mappings additionally need the endpoint's MAC learned before they classify (suiting classification-only access platforms), while IP/subnet mappings resolve on the L3 lookup. A real estate mixes all of these, so two rules keep the outcome deterministic: bindings live in one IP-to-SGT table per VRF (the fact SXPv5 later exploits), and when several sources claim the same endpoint a fixed precedence resolves it - broadly most authoritative and most specific first: an inline tag on the wire beats a locally learned dynamic binding, which beats SXP-learned, which beats interface, host, subnet, and finally VLAN mappings. Plan classification so precedence stays a safety net, not a load-bearing mechanism (Infrastructure segmentation).

What keeps NAC dynamic - CoA - and what erodes it - random MACs

Authorisation is only as good as the ability to change it mid-session. RADIUS CoA (Change of Authorization) is the server-initiated push that re-authorises, quarantines, or bounces an existing session the moment context changes - posture drops, a threat feed flags the endpoint (rapid threat containment via pxGrid), a guest completes the portal. Without CoA the network enforces stale decisions until the next reauthentication; with it, the session transitions (guest pre-portal -> authorised, healthy -> quarantine VLAN/SGT) happen in seconds. Design check: every flow that promises "dynamic" - guest onboarding, posture, quarantine - has CoA on its critical path, so the RADIUS return path to every NAD must stay open and monitored. A second RADIUS side-channel carries the same weight: when ISE distributes IP-to-SGT bindings over SXP, the binding is created by Accounting-Start, kept alive by interim updates, and removed by Accounting-Stop (an unrefreshed binding is purged after ~5 days) - accounting is not audit plumbing but a control-plane dependency of segmentation: lose it and the IP-SGT truth the fabric enforces goes stale (Infrastructure segmentation).

Client MAC randomisation quietly breaks every design that treats the MAC as identity. Modern endpoints present a different, locally administered MAC per SSID by default - some rotate it periodically or per-association - so MAB, returning-guest recognition, MAC allow-lists, profiling, location analytics, and forensic trails all degrade from stable identifiers to guesses. The design response is to move identity up the stack: certificate-bound identity (EAP-TLS) or portal/IdP identity for people, per-device keys (identity PSK) provisioned at onboarding for IoT, and MDM policy that pins or disables randomisation on managed fleets. Treat MAB as a last resort with a shrinking lifespan, and never anchor security policy or audit on a MAC surviving tomorrow.

Deploying NAC without an outage - the mode ladder

The safe 802.1X rollout is phased, not flipped. Monitor mode runs first: ports stay authentication-open, so every authentication executes and is logged but nothing is enforced - the window in which profiling builds the endpoint inventory, the MAB exception list gets populated, and you learn exactly what would have failed before anyone is denied. The end state is then a choice between two philosophies. Low-impact mode keeps the port open but places a pre-authentication port ACL granting only minimal access (DHCP, PXE/imaging, thin-client boot - the classes that must talk before any supplicant can), then overrides it per session with the dACL/VLAN/SGT the authorisation returns; tighten the results gradually rather than day one. Closed mode is the 802.1X default - nothing but EAP (and CDP/LLDP) passes until authentication succeeds - maximum assurance, zero tolerance for pre-auth dependencies. Stage the migration per network device group, moving one site/switch population at a time up the ladder; the rollback is a policy change, not a re-cable.

Context beyond credentials - profiling, posture, and guest tiers

Three context machines turn "authenticated" into "correctly authorised." Profiling classifies endpoints from traffic artefacts - DHCP options, HTTP user-agent, SNMP, NetFlow, RADIUS attributes - and assigns a profile when the accumulated certainty factor crosses the profile's threshold; the profile group then feeds authorisation, which is what turns naked MAB into classified least-privilege for the printers and IoT that cannot speak 802.1X, with a re-profile driving CoA the moment a device turns out to be something else. Probe choice is a placement/cost decision: SPAN and NetFlow collection mean heavy central plumbing, while the device sensor on the NAD gathers DHCP/CDP/LLDP locally and ships it inside RADIUS accounting - profiling at the edge for free. Posture adds the compliance dimension: an agent (or a one-shot temporal agent) reports firewall/patch/registry/application state, non-compliant sessions are redirected to remediation and promoted by CoA on success - the machine that keeps "healthy" a continuously enforced property rather than an onboarding memory. Guest tiers are an assurance-vs-friction ladder: hotspot (AUP click, MAC recorded - zero identity), self-registered (own or social credentials - an audit trail, weak accountability), sponsored (an employee vouches and credentials are issued - the CWA-backed norm where accountability matters). Pick the tier from the accountability requirement, not the portal aesthetics.

PxGrid Direct - the CMDB as a policy attribute source

The asset system of record (a CMDB such as ServiceNow) usually already knows what a device is, who owns it, and even which segment it belongs in - PxGrid Direct lets that knowledge drive authorization without a live query in the authentication path. ISE syncs the external records on a schedule (default weekly, floor 12 hours, with on-demand sync) into local dictionaries, joined to the endpoint by a correlation identifier (typically the MAC), with a unique identifier as tie-breaker for duplicates and a version identifier to detect changed records. Authorization conditions can then match CMDB attributes (owner, department, lifecycle state) and authorization results can return them - including an SGT stored as an asset attribute - so segmentation intent lives in the CMDB and the network merely enforces it. The trade is explicit: the per-authentication external dependency (latency, availability) is replaced by a staleness window equal to the sync interval - a decommissioned or re-classed asset keeps its old authorization until the next sync. Governance moves with the attribute: whoever can edit the CMDB record now edits network policy, so the CMDB change process joins the security review (Zero Trust and ZTNA - context-driven policy is the zero-trust direction of travel).

BYOD onboarding - single vs dual SSID

Self-service onboarding (ending in certificate-based EAP-TLS plus a My Devices lifecycle portal for register/lost/revoke) comes in two wireless shapes. Dual SSID: the device joins an open provisioning SSID, web-authenticates, gets provisioned, then the user manually reconnects to the corporate SSID, where authorisation checks the device's registration. Simpler to reason about and no supplicant needed up front - but it adds a standing open SSID (airtime and attack surface) and a manual hop where users fall off. Single SSID: the device joins the corporate SSID with the user's credentials (PEAP), the unregistered state triggers a redirect to provisioning, and a CoA promotes the same session to full access - no reconnect, and the device ends on EAP-TLS. Better experience and one less SSID, at the price of a hard CoA dependency and provisioning traffic riding the production SSID. Choose by the accountability and UX requirement: single SSID where CoA paths are solid and user friction matters; dual SSID where the provisioning flow must be isolated from the production WLAN (Wireless security for the SSID security modes themselves).

Recommendation / justification

Pair NAC (identity + posture) with TrustSec SGTs for scalable microsegmentation rather than chasing VLAN/ACL sprawl; carve guest/BYOD into separate enforced segments. This is the on-ramp to zero trust (Zero Trust and ZTNA). Justify by segment count and the need for policy that follows users/devices anywhere.

What would change this (mid-scenario twist)

• Many segments / dynamic workforce -> SGT-based policy over per-VLAN ACLs.
• BYOD/guest growth -> onboarding portal + posture + isolated segment.

Validation checks

• Does authorization assign least-privilege (VLAN/dACL/SGT) per identity+posture?
• Is guest/BYOD isolated and posture-checked, with sane failure/fallback?

IPv6 / dual-stack note

SGTs/dACLs must enforce v6 as well as v4; a guest segment open on v6 is a real-world miss.

Related

• AAA and identity - RADIUS, TACACS+, 802.1X
• Infrastructure segmentation
• Zero Trust and ZTNA

Spaced repetition

Sources

• Cisco Live BRKSEC-2154 (2024 deck, user-supplied PDF; full pass 2026-07-26) - classification taxonomy and precedence, per-VRF binding tables, accounting-maintained SXP bindings, PxGrid Direct identifiers and sync model.
• Cisco Live BRKENS-2500 (S. Wargo, J. Matela), Advanced Campus Network Design (2026 deck, user-supplied PDF; all 197 pages passed 2026-07-26) - OGACL/SGACL exact-match label compression and TCAM economy.
• Cisco Press, Cisco ISE for BYOD and Secure Unified Access (Woland/Heary; 1st-edition artifact) - single-vs-dual-SSID onboarding flows.
• Cisco Press, CCNP Security SISE 300-715 OCG - deployment modes, profiling probes/device sensor/certainty, posture flow, guest portal tiers.
• Cisco Live BRKEWN-2104 (Krischer, 2024): CoA-driven dynamic flows, MAC-randomisation impact and responses.
• Cisco Press, SCOR; Cisco TrustSec and ISE design guides.

domain: Core · blueprint-ref: Core 6.5 Network control and identity management · type: design-decision · status: complete · tags: [core, core/security, tradeoff/security, tradeoff/scale]