Re: NAC RFI/RFP

[Jeff Kell <jeff-kell () UTC EDU>]

NAC is a "very diverse" term these days, and very difficult to translate
into a truly open RFI/RFP process unless you are truly open to
potentially replacing your network infrastructure, security policy, and
accumulated knowledge base.

If your requirements dictate that "existing infrastructure" must be
retained, you have eliminated some players.

If you really need layer-2 isolation upon the point of admission and/or
quarantine/remediation, you have eliminated some others.

If you choose an inline solution, can you afford to replicate it on all
of the required layer-2 segments of your network?

If you choose dot-1X, is all of your network infrastructure really
dot-1X aware, and truly interoperable?

Will your NAC cover wireless?  VPN? 

In our case, we were replacing Perfigo/CCA and had some lessons learned
that we cared not to repeat that somewhat directed our goals.

If you are starting from ground zero, you may be open to a more diverse
study.

Jeff