NAC Posture Assessment & Dynamic VLAN Quarantine (2D)

NAC Policy

Compliance threshold 80

Quarantine threshold 40

Device onboarding rate 1 / 2s

Continuous posture re-check

Posture Dynamics

Patch decay rate 1.5/tick

Remediation recovery 6.0/tick

Device Profile Mix

AV active probability 75%

Firewall-on probability 80%

Cert-valid probability 70%

Live Status

Devices online

Avg posture score

Compliant %

Quarantined

Corporate VLAN — full access Remediation VLAN — patch server only Quarantine VLAN — isolated

How it works

Every onboarding device is scored against four posture checks, exactly like a real NAC engine (Cisco ISE, Aruba ClearPass) evaluating an 802.1X supplicant before it is switched onto a VLAN:

score = 0.35·patchLevel + 0.25·avActive·100
      + 0.25·firewallOn·100 + 0.15·certValid·100

score ≥ complianceThreshold   → Corporate VLAN (full access)
quarantineThreshold ≤ score
      < complianceThreshold  → Remediation VLAN (patch server only)
score < quarantineThreshold   → Quarantine VLAN (isolated)

NAC is not a one-time gate: with continuous re-check enabled, every device's patch level drifts down slowly over time (unpatched CVEs accumulate) unless it sits in the Remediation VLAN, where the patch server pushes updates and its patch level climbs back up. The switch re-evaluates every device's score on each check cycle (~0.4s) and migrates it to whichever VLAN its current score maps to — a compliant laptop that goes unpatched for too long gets dropped straight into quarantine, and a quarantined device that finishes remediation graduates back out.

Compliance / Quarantine thresholds — move the score cut points that decide VLAN placement.
Onboarding rate — how often a freshly-connecting device (fresh random posture) joins the network.
Continuous posture re-check — toggles the patch-drift / remediation loop; switch it off to see devices freeze in their first-assigned VLAN forever, like a NAC that only checks posture at connection time.
Patch decay / Remediation recovery — how fast patch level falls outside remediation vs. how fast the patch server pulls it back up inside remediation.
AV / Firewall / Cert probabilities — the odds a freshly-onboarded device already satisfies each binary check, letting you simulate a well-managed fleet vs. a chaotic BYOD one.
Drag the topology view to pan, scroll/pinch to zoom — it's a live map, not a static diagram.

Corporate Remediation Quarantine

drag to pan · scroll to zoom

Avg score history

Zone census