Awards

What is Network Access Control (NAC) for Managed Endpoints?

Network Access Control is the process of filtering access to corporate data, by allowing only legit endpoints to access the data. With Endpoint Central's Network Access Control (NAC) policies, IT administrators can configure settings to quarantine an endpoint from their network when it is found susceptible/doesn't fall under your organization's compliance policy.

The network access control module is available for product build versions 10.0.595 and above

Advantages of Network Access Control policy

Isolating devices help management to prevent the lateral movement of threat actors inside their network.
Increases the security postures while accessing corporate data.
Perceive better visibility on the security standards of your endpoint network.
Regulate access while your endpoints use untrusted/open network.
Proactive measure to eliminate threats.

Workflow of NAC

Network Access Control in Endpoint Central can be achieved by the following flow:

How to implement a Network Access Control policy?

IT administrators can define a compliance policy in the server tool - 'TrustAgent'.
This tool will probe the endpoints to check for the compliance policy standards defined in 'Quarantine policy generator'.
Once identified as a non-compliant device, this endpoint will be quarantined from the network and all its networking resources will be taken down.
IT administration team can remediate the problem by analyzing the cause and error and adhere to the policies defined.
The quarantine policy scan will take place during agent refresh cycle or when an IP address change is detected on endpoints.

Windows
Mac

How to deploy a NAC policy to endpoints?

Download the TrustAgent file from this
Zip (SHA 256 Checksum:2719ED877CFE154DB08666032C0F4EE2FB885798807ADB9249A557C467A97516) and extract it's contents.
Open the Quarantine Policy Generator tool (QuarantinePolicyGenerator.exe) and create policies according to your organization's rules. The policy can be created based on:- software checks, service checks, custom checks, patch checks, Reg path checks. File path checks, and File version checks.
Once the policy is defined, click on 'Generate New Policy' and save the file as quarantine.json.
You can automatically add this file to the TrustAgent_x86.zip and TrustAgent_x64.zip files by clicking 'Yes' (as shown in image) or do it manually.
You can deploy this file to endpoints using custom script configuration. To do so, save a script under the name TADeployer.exe and add TrustAgent_x86.zip and TrustAgent_x64.zip as dependency files during deployment.
When an endpoint is found non-compliant (based on rules defined in quarantine.json), that endpoint will be isolated from the network by the restriction policies defined under quarantine settings.
You can modify the policy using 'Load existing policy', if required.
To generate the reports of the quarantine status, you can deploy a script with EPStatusTester.exe. This will show if an endpoint is quarantined or not along with the remarks.
Note: You can quarantine an endpoint irrespective of the compliance status. To do so, include the -ondemand switch while deploying the above configuration. Though policies are not configured, ensure to upload the quarantine.json for the endpoints to be quarantined.

How to create a compliance policy?

IT admins can create a compliance policy according to various standards supported by Endpoint Central. A policy can be defined when:

A device installs/contains any susceptible software
A device is missing some important patches
A device is running with system level customized problems

Adding Software checks:-

Navigate to Control panel -> Programs and Features
Select an application and choose a keyword to name that application. Ensure the name chosen is a distinct value
Use this keyword in the policy generator tool. (note: Enter the value in lowercase)
Select the type as 'Software' and status either as 'Exists' or 'NotExists'

Adding Patch criteria checks:-

In the tool console, specify the patch details, which includes PatchType, SeverityType, and the number of patches violated the rule. Any endpoint, falling under this criteria will be quarantined.

Adding PatchID checks:-

You can quarantine an endpoint when it is missing important security patches. To do so, define the PatchID in the patch column (In the policy generator tool). An endpoint which is missing the specified patch will be quarantined.

Adding Service checks:-

Open services.msc and select a service
Copy the full name of the service from the 'Name' column
Paste the same in the Name/keyword column in the policy generator
Select the type as 'service' and status as per your requirement.

Adding custom checks:-

Custom tags are used to name/identify the conditions that are checked. These tags can be named according to the user's convenience
The custom tags are treated as individual checks and the system is considered non-compliant even if one of these tags is satisfied
If you wish to run a group check, then specify the various conditions under a single tag

Registry Value Check:

Name the custom tag as per your convenience.
Check Type : Registry Value
Check Path : Registry path (ex: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdventNet\DesktopCentral\DCAgent)
Applicable Check Mode : value equals / Value not Equals / Value Lesser Than / Value Greater Than / Exist / Not Exist
Value : Reg Value.

Registry Path Check

Name the custom tag as per your convenience.
Check Type : Registry Path
Check Path : Registry Path (ex: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdventNet\DesktopCentral\DCAgent)
Applicable Check Mode : Exist / Not Exist

File Path Check

Name the custom tag as needed
Check Type : File path
Check Path : File path (ex : C:\Program Files (x86)\DesktopCentral_Agent) if you are using Endpoint Central below 11.2.2309.01 and file path( ex : C:\Program Files (x86)\UEMS_Agent)if you are using Endpoint Central 11.2.2309.01 and above
Applicable Check Mode : Exist / Not Exist

File Version Check

Name the custom tag as needed.
Check Type : File Version
Check Path : file Path (ex: C:\Program Files (x86)\DesktopCentral_Agent\dcconfig.exe) if you are using Endpoint Central below 11.2.2309.01 and file Path (ex: C:\Program Files (x86)\UEMS_Agent\dcconfig.exe) if you are using Endpoint Central 11.2.23090.1 and above
Applicable Check Mode : Value equals / Value not Equals / Value Lesser Than / Value Greater Than
value : File Version

Quarantine Settings

If the system is found non-compliant, the following quarantine measures can be undertaken.

You can choose to block all network access (Internet/Intranet) or choose to block the Intranet access in the range that you desire.
You can also set the domains or IP addresses that you wish to allow the quarantined machine to access.
Further you can also set to automatically revoke the quarantine, when the quarantined machine loses connectivity to all the heartbeat machines (Machines that establish connectivity and forms a network).

How to revoke a deployed quarantine policy?

Create a new configuration with the script TAUninstaller.exe
Deploy it to the machines that have been quarantined
The remarks section in the configuration will show the results of revoking the quarantine.

Points to remember:-

This feature is supported for Windows 10 and above versions of the OS.
If you are running this module on Windows Server 2016 systems, it should have 'secure boot' disabled.
If a request to a URL shortener service is made, via proxy, it is blocked.
System wide proxy settings are automatically applied.
Any application-specific proxy that is to be allowed must be added to the list.

Due to privacy reasons, Endpoint Central will not fetch the Personally Identifiable Information (PII) or browsing data by default.

NAC Policy Deployment Guide for macOS

How to Deploy a NAC Policy to Endpoints

Download the provided NetworkAccessControlForMac.zip file and extract it. It will contain a zip file named dcNacFirewall.zip and MacQuarantinePolicyGenerator.exe.
Use the MacQuarantinePolicyGenerator.exe to generate the policy to be applied to the corresponding Mac machine.
The policy can be created based on the following checks:
- Software checks
- Custom checks
- Patch checks
- File path checks
- Application version checks
Save the encrypted policy JSON file, which can be used later to import and modify the policy for future use.
Secondly, the deployable zip generation window will open. Provide "yes" to create the deployable zip file. The zip file will be created in the extracted folder, named TrustAgentMac.zip.
You can deploy this file to endpoints using custom script configuration.
On the EC server, navigate to the Configurations -> Script repository -> Templates. Select TrustAgentMacScript.sh and add it to the script repository. Then using the TrustAgentMacScript.sh script, create Computer Configuration. Attach the deployable zip file (TrustAgentMac.zip) as the dependency file.
Use the --load argument to deploy the configuration. (For initial setup, prerequisite required for NAC in macOS, refer to configure pre-requisites for Network Access Control in Mac).
When an endpoint is found non-compliant (based on rules defined in the policy), that endpoint will be isolated from the network by the restriction policies defined under quarantine settings.
To update the quarantine policy, re-execute the configuration with the updated deployable zip file (TrustAgentMac.zip) as the dependency file.

Note:

If no compliance rules are defined, the machine will be quarantined based on the quarantine rules without checking for compliance.
To verify that the installation is complete, use the --installationStatus argument and deploy the configuration to the required machines along with the deployable zip file (TrustAgentMac.zip) as the dependency file.

How to configure pre-requisites for Network Access Control in Mac?

Type 1: Configure pre-requisites via MDM

1. To complete the prerequisites, you can utilize an MDM solution. Download the

Once the system extension has been allowed, the second prompt will open to seek access for "Filter Network Content." The user must allow this. If the user neglects or ignores it, the prompt will be shown during the next installation attempt.

How to create a compliance policy

IT admins can create a compliance policy according to various standards supported by Endpoint Central. A policy can be defined when:

A device installs/contains any susceptible software.
A device is missing some important patches.
A device is running with system-level customized problems.

Adding Software Checks

Specify the exact installation location of the application on your Mac that needs to be checked. Select the type as 'Software' and status either as 'Exists' or 'NotExists'.

Adding Patch Criteria Checks

In the tool console, specify the patch details, which include PatchType, SeverityType, and the number of patches that violated the rule. Any endpoint falling under this criteria will be quarantined.

Adding PatchID Checks

You can quarantine an endpoint when it is missing important security patches. To do so, define the PatchID in the patch column (In the policy generator tool). An endpoint that is missing the specified patch will be quarantined.

Adding Custom Checks

Custom tags are used to name/identify the conditions that are checked. These tags can be named according to the user's convenience. The custom tags are treated as individual checks, and the system is considered non-compliant even if one of these tags is satisfied. If you wish to run a group check, then specify the various conditions under a single tag.