Right now there are devices on your network that nobody on your team can name. A printer, a camera, a contractor's laptop, a smart TV in a conference room. On a network without access control, each of them can reach far more than it should.

Network access control (NAC) is the fix. It makes the network itself the checkpoint: every connection, wired or wireless, has to prove who or what it is before it gets anywhere. Cisco ISE is the platform most organizations choose for it, and Meraki Access Manager now brings the same idea to Meraki networks without a server to run.

Yet most NAC deployments we assess have one thing in common. They're switched on, licensed, and sitting in monitor mode, watching traffic they were bought to control. Nobody made a bad decision. NAC is simply one of the hardest systems in IT to finish.

Here are the six places it stalls.

1. Design decisions that are expensive to undo

Before a single port is enforced, someone has to decide node roles, sizing, high availability across sites, and where each policy node sits relative to the switches it serves. Licensing tiers decide which features you can even use. Get these wrong and you redeploy later, under production load.

What it costs you: rework while the business is running on it, or features you paid for and can't use.

2. Certificates are the silent prerequisite

Certificate-based 802.1X is the right answer, and it means building or fixing an internal PKI. Every managed laptop needs a machine certificate. ISE needs its own certificates, trusted by every endpoint. One misconfigured trust chain means a building full of users who can't connect.

What it costs you: a single expired or untrusted certificate can lock an entire site out of the network.

3. Supplicants are inconsistent across the fleet

Windows, macOS, iOS, and Android all handle 802.1X differently. Machine versus user authentication, and how they chain, decides whether a laptop gets on the network before anyone logs in. The edge cases are endless.

What it costs you: your executives and frontline staff become the test group, one help desk ticket at a time.

4. The devices that can't authenticate

Printers, cameras, badge readers, and medical gear can't present a certificate. They fall back to MAC authentication, which is only as safe as your profiling. Building accurate profiles means tuning probes and validating thousands of devices. Many organizations discover hundreds of devices no one can identify.

What it costs you: unknown devices either get blanket exceptions, which defeat the purpose, or enforcement never happens.

5. Switch and wireless configuration at scale

Every access switch needs consistent AAA, RADIUS, change-of-authorization, and per-port 802.1X configuration. Different platforms and software versions behave differently. Hundreds of switches and thousands of ports have to be touched, tested, and kept consistent.

What it costs you: a single inconsistent port becomes an outage or a security hole, and you find out at the worst possible moment.

6. The phased rollout that never finishes

The safe path to enforcement runs through three modes: monitor, low-impact, closed. Protection only begins in the last one. Each step demands log review, exception handling, and sign-off from every business unit. Many in-house deployments stall at phase one, where the network is watched but nothing is blocked.

What it costs you: paying for NAC while getting visibility, not protection.

And then day two never ends

Once enforcement is on, NAC becomes part of the critical path for every connection in the company. Certificate expirations are outages on a timer. Upgrades touch every node. "My laptop won't connect" tickets need someone who can read live logs and switch port state. Policy drifts as urgent exceptions pile up. And the whole thing usually depends on the one person who built it.

The most expensive NAC deployment is the one that is fully licensed and never enforced.

How to tell if this is you

Check the statements that are true today.

If you don't have NAC: you couldn't produce a complete list of every device on the network right now; anyone who plugs into an open wall jack can reach internal systems; guests and personal devices share the network with production; an auditor or insurer asked how you control network access and you struggled to answer.

If you already run Cisco ISE: the deployment has been in monitor mode for more than six months; you're more than one major release behind; there's no documented calendar of certificate expiration dates; only one or two people can troubleshoot an 802.1X failure.

Two or more checked, and your access control is likely costing more than it protects.

What getting to enforcement actually takes

Not a bigger license. A defined plan with exit criteria at each phase, certificates and upgrades tracked before they become incidents, and engineers who have done it enough times to know where the edge cases are. That's what we do for clients on Cisco ISE and Meraki Access Manager, either running it entirely or sharing the console with your IT team.

If you already own ISE, we start from your existing deployment. There's no rip-and-replace.