NAC Posture Assessment & Dynamic VLAN Quarantine

NAC Policy

Compliance threshold 80

Quarantine threshold 40

Device onboarding rate 1 / 2s

Continuous posture re-check

Live Status

Devices online

Avg posture score

Compliant %

Quarantined

Corporate VLAN — full access Remediation VLAN — patch server only Quarantine VLAN — isolated

How it works

Every onboarding device is scored against four posture checks, exactly like a real NAC engine (Cisco ISE, Aruba ClearPass) evaluating an 802.1X supplicant before it is switched onto a VLAN:

score = 0.35·patchLevel + 0.25·avActive·100
      + 0.25·firewallOn·100 + 0.15·certValid·100

score ≥ complianceThreshold   → Corporate VLAN (full access)
quarantineThreshold ≤ score
      < complianceThreshold  → Remediation VLAN (patch server only)
score < quarantineThreshold   → Quarantine VLAN (isolated)

NAC is not a one-time gate: with continuous re-check enabled, every device's patch level drifts down slowly over time (unpatched CVEs accumulate) unless it sits in the Remediation VLAN, where the patch server pushes updates and its patch level climbs back up. The switch re-evaluates every device's score on each check cycle and migrates it to whichever VLAN its current score maps to — a compliant laptop that goes unpatched for too long gets dropped straight into quarantine, and a quarantined device that finishes remediation graduates back out.

Compliance / Quarantine thresholds — move the score cut points that decide VLAN placement.
Onboarding rate — how often a freshly-connecting device (fresh random posture) joins the network.
Continuous posture re-check — toggles the patch-drift / remediation loop; switch it off to see devices freeze in their first-assigned VLAN forever, like a NAC that only checks posture at connection time.

Corporate Remediation Quarantine

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.