N4N056: A Wireless NAC Walkthrough

This episode is the third in a series on Network Access Control, with guest JJ Jabush, a network security architect, explaining wireless NAC in transactional detail. The hosts Ethan Banks and Holly Poddelak guide the conversation, which assumes listeners have already heard the prior two episodes on NAC basics and wired NAC.

JJ begins by distinguishing NAC as a broad category of identity, authentication, and authorization mechanisms from 802.1X specifically, which is just a port security protocol. She notes that while wired 802.1X implementations tend to be messy and inconsistent due to vendor deviations from the standard, wireless 802.1X is far more standardized and reliable, making it the preferred first approach for wireless NAC.

The discussion covers WPA2 and WPA3, explaining that Wi-Fi Protected Access standards handle encryption of wireless frames but are not inherently tied to NAC or 802.1X. JJ highlights that WPA3 significantly reduces the ability for users to bypass server certificate validation during 802.1X authentication, which is a major security improvement. In the 192-bit mode used by the federal government, certificate bypass is entirely disabled.

A substantial portion of the episode is devoted to digital certificates in 802.1X. JJ explains that the RADIUS server always presents a certificate to prove its identity, but that endpoints must be configured to validate that certificate — a step frequently skipped or misconfigured, especially in environments with BYOD or non-domain-joined devices. Common failure modes include certificate renewals breaking endpoint trust configurations and overly specific certificate pinning in group policy or MDM profiles.

The hosts walk through the step-by-step wireless association process using 802.1X: the client connects to an SSID configured for 802.1X, EAPoL exchanges occur between the endpoint and the access point (acting as authenticator), the AP proxies authentication to the RADIUS server, and keying material generated from the EAP exchange feeds into the four-way handshake that completes wireless association. JJ notes that the RADIUS client in wireless environments could be the AP, a controller, or a gateway depending on the vendor architecture.

Roaming is discussed in depth. JJ strongly advocates against layer 3 roaming due to its unnecessary complexity, arguing that modern enterprise wireless infrastructure handles broadcast domain concerns well enough that per-floor VLANs are no longer needed. For layer 2 roaming, 802.11r (Fast BSS Transition) is described as essential for 802.1X networks, as it allows the infrastructure to pre-distribute keying material to neighboring APs so clients can roam without repeating the full RADIUS authentication cycle, avoiding disruption to latency-sensitive applications.

Captive portals are discussed as notoriously unreliable, with failures stemming from operating system differences in how Apple, Android, and Windows detect and respond to portal environments, DNS/DHCP redirect mechanisms, MDM settings, VPNs, and even JavaScript on the portal page itself. JJ notes that each OS vendor uses different probe mechanisms to detect captive portals and that the interaction between those mechanisms and the portal hosting infrastructure is highly variable.

On vendor selection for NAC, JJ warns against the assumption that same-vendor ecosystems (e.g., Cisco switching with Cisco ISE, or Aruba with ClearPass) automatically yield the best results, noting that large vendors often have siloed business units with poor internal integration. She recommends requirements-first selection rather than brand loyalty.

Finally, JJ addresses where NAC sits in 2026, arguing that while some peers consider NAC obsolete, it remains a critical component of Zero Trust strategies — particularly for the 30-70% of headless IoT devices on networks that cannot run software agents and must be controlled at the network layer. She expresses hope that within four years, identity-based enforcement with ubiquitous PKI/certificates will replace current NAC approaches, citing the Matter protocol for consumer IoT as proof that certificate-based identity for devices is achievable.