Start with one appliance.
An EasyNAC physical appliance or virtual machine brings discovery, profiling, policy and enforcement together. For a standalone office, connect it to the network you want to protect and configure its IP address. You do not need to introduce 802.1X switch authentication or roll out a dedicated NAC agent to every device for this approach.
Authorized devices continue to use their normal network path. EasyNAC applies access controls to devices that require restriction. The appliance needs the appropriate visibility and reach for each protected subnet; plan the connections when extending beyond the first network.
Discover, then establish context.
EasyNAC observes DHCP and ARP activity to discover devices using dynamic or static IP addresses. Profiling combines available network characteristics with information from supported integrations. Active scans can provide additional detail where appropriate.
A profile helps identify a likely device type. Directory membership and endpoint-security records provide different evidence about whether a device is managed. Use the checks relevant to your environment rather than trusting a device solely because its operating system or MAC address looks familiar.
Use AD and XDR in Auto Trust Policy.
Connect Active Directory and a supported XDR platform to recognize managed devices. Auto Trust Policy can use the AD joined machine and XDR managed machine checks to automatically authorize devices that meet your configured rules.
Devices that do not meet the selected trust criteria receive the configured restricted access. Define how guests, printers and other equipment should be approved, and test both permitted and restricted access before expanding enforcement.
Apply the access decision.
EasyNAC uses ARP-based enforcement on protected IPv4 network segments. Traffic involving a restricted device is directed through EasyNAC, where an access control list determines what is allowed. A configured captive portal can provide a registration or remediation path.
This method does not require an 802.1X rollout or a quarantine VLAN redesign. EasyNAC can also work alongside existing 802.1X authentication. The technical whitepaper explains the packet flow and enforcement examples.
Extend protection to branches.
For suitable smaller remote networks, deploy a software Enforcer Sensor on a supported host. The sensor connects to the EasyNAC appliance and extends discovery and enforcement to its local network. Policy and control remain with the appliance.
For larger regional deployments, use EasyNAC appliances at the regions. Configure the head-office EasyNAC first, then use an optional Central Visibility Manager (CVM) to distribute configuration and policy to the regional appliances. CVM is not required for a standalone pilot.
Review subnet coverage, connectivity and capacity with your deployment plan. Compare the appliance, Enforcer Sensor and CVM options →
See how EasyNAC fits your network.
Use the standalone Evaluation Kit for practical tests, a deployment checklist and an editable scorecard. Bring your network questions to the EasyNAC team.