Home › Services › Managed and co-managed NAC
Managed and co-managed NAC
Network access control on Cisco ISE or Meraki Access Manager, designed, enforced, and run by engineers who do this every day. Nothing connects until it proves it belongs there.
No pitch, no contract. The intro call is for understanding your situation, not selling you a solution.
If you cannot say what is on your network right now, neither can your firewall.
A contractor's laptop, a personal phone on the staff Wi-Fi, a printer someone bought on a company card, an old desktop nobody decommissioned. Each one is a way in that no one is watching.
Network access control makes the network itself the checkpoint. Every connection, wired or wireless, is authenticated and placed on the right segment automatically. We specialize in the two platforms that do this best on Cisco networks: Cisco ISE for environments that need full policy depth, and Meraki Access Manager for Meraki shops that want cloud-managed NAC without a server to run. We operate either one entirely for you, or share the console with your IT team.
What's included
Platform selection and design
Cisco ISE where you need posture, TACACS+, pxGrid integrations, and complex policy. Meraki Access Manager where you run Meraki switching and wireless and want NAC managed from the same dashboard. We tell you which fits and why, then design it for your sites and growth.
Deployment in stages
Monitor-only mode first so nothing breaks on day one, then low-impact, then closed mode, with exit criteria at each step and your sign-off before anything is enforced.
User and device authentication
Staff authenticate with certificates or directory credentials through 802.1X. Printers, cameras, and phones that cannot log in are identified by profiling and admitted by policy, not by exception.
Dynamic segmentation
Access decided at connection time: finance laptops land on the finance segment, cameras on the camera segment, unknown devices in quarantine. On Cisco ISE this includes TrustSec security group tags; on Meraki, adaptive policy and group policies.
Certificates, upgrades, and lifecycle
The expirations and version upgrades that take NAC deployments down are tracked, scheduled, and tested before they become incidents. This is the part most in-house deployments never keep up with.
Ongoing operation and reporting
Policy changes, guest and contractor onboarding, posture checks, troubleshooting, and reports on who and what connected for auditors, insurers, and your own peace of mind.
What you get
A live inventory
Every device on the network, identified, at any moment, on either platform.
Departures handled once
Disable the account and the person's devices lose network access everywhere, wired and wireless.
Proof for auditors
Authenticated, logged access decisions that answer the "who had access to what" question for HIPAA, PCI DSS, CMMC, and cyber insurance.
What happens next
- A 30-minute intro call. You tell us about your business, your network, and what prompted the call. We ask questions, listen, and tell you honestly whether we're the right fit.
- A scoped, priced proposal. For most clients that starts with a fixed-scope assessment. You see the price and the deliverables before you commit to anything.
- Work begins on an agreed date. Changes are staged with a rollback plan, and you get a written summary of what was done.
Free guide: Who's really on your network?
Why NAC is essential, why it stalls, and how to get it enforced without building it yourself.
Common questions
Cisco ISE or Meraki Access Manager: which one do we need?
If your switching and wireless are Meraki and your policy needs are mainly identity, device type, and segmentation, Meraki Access Manager gives you NAC from the dashboard you already use, with nothing to host. If you need posture assessment, TACACS+ device administration, pxGrid integrations with your firewall and EDR, or you run a mixed Cisco estate, ISE is the right platform. The intro call is where we learn enough about your environment to say which, and we're not paid differently either way.
What does co-managed mean?
Your IT team keeps day-to-day access to the platform and handles routine changes. We handle design, upgrades, certificates, complex policy, and escalation, and we are on call when something is wrong. The split is written down so nothing falls between us.
Will deploying NAC take down the network?
Not if it is done in stages. We start in monitor-only mode, learn what is really connecting, build policy from that, and enforce segment by segment with your sign-off at each step.
We already own ISE but it's stuck in monitor mode. Can you take it over?
Yes. We start from your existing deployment, licenses, and policies. No rip-and-replace. Most takeovers begin with a health and readiness review that tells you plainly where enforcement stands and what it will take to finish.
Do we need new switches or access points?
Most business-grade Cisco and Meraki gear from the last several years supports 802.1X. We check your inventory during the assessment, which is scoped and priced up front, and tell you exactly what, if anything, needs replacing.
Book my 30-minute callHave a question that isn't here? Bring it to the intro call.
You might be thinking…
Running and enforcing are different things. Most ISE deployments we see are in monitor mode, watching traffic they were bought to control. If yours is in closed mode with a certificate calendar and someone who can troubleshoot an 802.1X failure at 8 a.m. on a Monday, you don't need us. If not, the intro call is worth thirty minutes.
It was. Meraki Access Manager puts 802.1X, device profiling, and segmentation in the dashboard you already use, with nothing to host. The hard part is still the policy, the certificates, and the rollout, and that's what we do.
When to call now rather than later
"Anyone can plug in" is the wrong answer for HIPAA, PCI DSS, CMMC, and most cyber policies. ISE or Access Manager is how you produce the right one, and the questionnaire has a due date.
That person has vacations and a resignation letter in their future. Co-managed NAC removes the single point of failure before it becomes an outage.
Certificate expiration on ISE takes the whole building offline. Find the date before it finds you.
Book a call, or ask us to call you
A 30-minute intro call. We ask about your business, your network, and what prompted you to reach out, then tell you honestly whether we're the right fit. If an assessment makes sense, we scope it and price it before any work starts. If something is broken right now, call us.
Malvern, PA 19355