Network Access Control (NAC)

Network access control (NAC) scans clients connecting to an SSID to check to see if they are running anti-virus software to ensure that the network is protected from infected machines. To enable this feature, either Splash Pages or Sign-On Splash Page must be enabled on the SSID. Meraki NAC is enabled on a per-SSID basis.

The scan is done by a Java applet in the browser. If supported anti-virus software is detected as running on the client machine, the client will be allowed onto the network. If not, the client will be quarantined behind to a walled garden where they can be remediated by downloading anti-virus software.

Clients running Windows XP, 7 or Vista will be scanned for supported anti-virus software. Non-Windows clients are not scanned.

If a device fails the scan, they will be quarantined by the AP’s policy firewall and sent either to a standard splash page that allow them to download Microsoft Security Essentials, or to a remediation page. The remediation page is a custom URL that the administrator can set to allow non-compliant clients to download other anti-virus software. This could be an internal website or a public website from an anti-virus software vendor. If selecting a custom URL, the IP of the host must be added to the walled garden as well.

With Network Access Control enabled, network operators gain another level of security by ensuring users have an anti-virus solution enabled. This is particularly valuable in a Bring Your Own Device environment, in which network operators cannot maintain the security of all devices on their WLAN. By allowing Cisco Meraki to enforce this policy, instances of viruses or other malicious software can be minimized.