Using NAP/NAC to Protect Network Resources

Question

Hello,
I'm intending to create ACL in a Layer3 Switch to project our network resources and enhancing the security of our network resources.
Instead of creating plenty of ACLs in the switch, is it possible to use NAP/NAC to protect these resources and allow only certain resources available to our users?
Regards,

Answer 1

Hi,
DHCP NAP can be used to modify the routing table, so you could limit access to an IP address, but you can't use it to limit access to specific ports (i.e. web services on 80 and 443). This requires a firewall or ACL.
I think that for what you want you will need to configure an extended ACL on the switch.
Please read the link I gave above (http://technet.microsoft.com/en-us/library/dn425037.aspx). This shows how to assign specific IP addresses to certain types of client devices. You can
then use the ACL on the switch, or a firewall, to filter access based on source IP address.
You might also went to spend time making a list of all the devices on your network, including the type of network access (wired, wireless, or both) they have, and the users (staff, student, other) that have these devices. If possible, group the devices into
2 or 3 basic groups and decide what kind of network resources they should have access to.
If you want to filter based on user group, you will need to implement some kind of authentication method, such as 802.1X with PEAP/MSCHAP v2 or PEAP/TLS. If you don't understand these methods yet and haven't been using 802.1X you should spend some
time reading about it.
http://technet.microsoft.com/en-us/network/bb545365.aspx
I hope this helps,
-Greg