网络安全

零信任与网络准入控制 (NAC)

借助 802.1X 和 NAC，在接入前验证每个用户和设备。插上网口不再等于能访问服务器。

现场常见问题

In many organizations anyone can plug into a meeting-room LAN port or join Wi-Fi and see the servers immediately. Personal phones, IP cameras and printers share a network with the accounts system. An attacker who gets in at one point can walk everywhere.

Zero Trust means "trust nobody by default, verify every time" and grant only the access that's needed. On the network, we make that real with NAC (network access control).

What NAC does

Authenticates with 802.1X on wired and wireless. Our preference is certificate-based EAP-TLS. PEAP with AD passwords works too, but server-certificate validation must be enforced or credentials can be harvested.
Profiles devices that can't do 802.1X, such as cameras, printers and IoT, and admits them via MAB with restricted access. MAC addresses are easy to spoof, so MAB must be paired with profiling and a tightly scoped VLAN.
Checks posture: no EDR or missing patches means the quarantine VLAN.
Assigns access dynamically: VLAN, ACL or security group tag by role, not by which port was used.

Rolling out without locking anyone out

We run in monitor mode for several weeks to build a full device list. Every time, we find devices nobody knew about. Then we enforce group by group. Segmentation between groups, CCTV versus finance for example, is enforced by internal firewalls. NAC also underpins guest Wi-Fi and BYOD onboarding.

功能

Wired and wireless 802.1X

Certificate-based EAP-TLS, or securely configured PEAP with AD.

IoT profiling

Recognises cameras, printers and other devices automatically.

Posture checks

Machines that fail go to quarantine until fixed.

Role-based access

Any port, same rights, following the person and device.

Guest and BYOD onboarding

Structured registration and approval of new devices.

Micro-segmentation

Restricts traffic between groups so attacks can't spread.

设计与实施

1
Inventory devices and group them by role
2
Deploy NAC/RADIUS with AD/Entra ID and PKI
3
Enable 802.1X in monitor mode on switches and Wi-Fi
4
Write policies and pilot with one group
5
Enforce group by group and add segmentation

适用场景

Banks keeping unknown devices off branch networks
Hospitals with many connected medical devices
Universities with student-owned devices
Ministries separating internal and visitor networks

常见系统规模

Foundation

适用于: One site, up to 300 devices

802.1X for staff Wi-Fi
Separate IoT/CCTV/guest VLANs
RADIUS tied to AD

获取报价

Full NAC

适用于: 300–3,000 devices

NAC platform with profiling
Wired and wireless 802.1X
Guest portal and BYOD

获取报价

Zero Trust

适用于: High-risk multi-site organizations

Posture tied to EDR/MDM
Micro-segmentation via internal firewalls
ZTNA for remote users

获取报价

我们供货并安装的品牌

Cisco HPE Aruba Networking Fortinet Juniper Networks Huawei Microsoft Palo Alto Networks

所有品牌名称和商标归其各自所有者所有。除非另有明确说明，提及某品牌并不代表与其存在合作关系。产品均通过正规分销渠道采购。

常见问题

What about cameras and printers without 802.1X?

Use MAC Authentication Bypass (MAB) with profiling and put them in a VLAN that can reach only the NVR or print server. If someone spoofs a camera's MAC, all they reach is the NVR.

Will staff get locked out?

It's a real risk if you switch everything on in one day. We start in monitor mode, enforce one group at a time and have a rollback plan at each step.

Will our existing switches work?

Most managed switches support 802.1X and RADIUS. Advanced features like dynamic ACLs or CoA need checking model by model. Unmanaged switches won't work.