Network World - In testing 12 NAC products, we discovered an incredible variety of management styles. To organize our results, we broke things up into three main categories: overall management, separation of control and high availability.
Related: NAC: What went wrong?
If we just awarded prizes based on simplicity, Cisco NAC Appliance, ForeScout CounterACT and HP NAC would immediately jump to the top of the list, because all of them have easy to use, easy to learn interfaces that get you up and running quickly and offer strong visibility into what is happening.
Other products were more complex, but more powerful, as well . For example, when we started learning to use Juniper UAC, we spent an entire hour one morning drawing a picture trying to put all the pieces together. It's a complicated set of products. There are central management tools, individual device management interfaces, intrusion-prevention systems, and on top of that, the UAC Web-based GUI itself. Bringing it all together is tough, but it doesn't seem fair to knock Juniper down because it's product has a lot of optional pieces.
Avenda eTIPS is another good example of a product that does a lot, and because of that, you end up with a complicated user interface. In Avenda's case, the management system is as simple as it could be — but still offer all the power that we needed.
In the end, we looked at products with two management criteria in mind: how hard it was to use, and how much visibility it gave us into the NAC status of our network.
Some of the products have serious flaws. Alcatel-Lucent's SafeNAC is not really a single product; it's a bunch of features of their management system, their switches and InfoExpress' CyberGatekeeper that together act as a NAC solution. It certainly works well together, but the management is very un-integrated.
Bradford Network Sentry's management system is similarly disappointing. A few minutes into configuration, we found ourselves lost in pop-up windows, new tabs and sub-windows. Sometimes, we'd click on something and get a new page in the same window. Other times, we'd get a new tab in the same window, and other times we'd get an entirely different window. We expected better than that from one of the oldest NAC products in our test.
Are these issues that can be worked around? Certainly. A badly designed GUI is not a reason to throw out a good product. In the case of NAC, badly designed management systems are more the norm than the exception.
A more significant issue in NAC management comes under the general term of "visibility": how much information is quickly and easily available to the network manager about what is happening, NAC-wise, on the network.
Free Insider GuideCopyright © 1994 - 2012 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
