Riddle of the day: What do you get when you mash up IPS, LDAP and a firewall?

WonderNAC of course.  My friend Dominic over at Nevis has been on a bit of a tirade lately about the great things his companies products are capable of.  Reading it, you can almost believe that they are actually selling any of it, almost anyway.  First I was wrong, now Mike Fratto is wrong, who will be next?  Seems everybody is wrong, except the Nevis folks (OK, I bet they think ConSentry is right too, on second thought not really, after all ConSenty competes with them too.)

To hear Dominic tell it, pre-connect posture checks and such are useless.  After all, if you put their wonderbox in line and pray that it doesn't go down and bring your network down with it, it is going to find and stop anything bad anyway.  And using their latest innovation in technology, they can actually control where people go on the network, better then switches, VLANs, ACLs and everything else can. In spite of the billions of dollars that the leading network infrastructure companies have put into this, Nevis would try to have us believe they have something better. What is this new feat of technology you ask?  Why a firewall of course.  Lets face it, what Nevis and their ilk are really trying to push on us is yet another expensive black box that has a firewall, an IPS and integrates with LDAP.  Plain and simple that is it.  Oh yeah you can buy it in a switch form factor too.  That is because they realized trying to sell it as a stand alone appliance just increased the amount of hardware you need to run your network by a factor of 2. 

So what do you get with the wonderbox/switch?  Is the IPS that is claimed to work at line speed as good as the best IPS's?  Is it a Tipping Point, an Intrushield, an ISS Proventia?  Is it an IPS you ever heard of?  Or is it a vanilla Snort clone using 30 day old signatures? Dominic would you really have us believe that it is going to catch all malicious attacks and traffic, whether intentional or not? Come on Dom come clean, what kind of IPS would you have us bet the house on?  And the firewall?  Checkpoint? Pix? Sidewinder?  Or is it a hacked up IP tables and what is the rule limit on it before it brings the black, wonderbox to its knees.  Of course you don't worry about how much throughput the box can handle, because the limitation on the number of firewall rules will kick in and choke things way before that anyway.

What about it's switching capabilities?  Does it have the advanced features of the latest Cisco, Extreme, HP ProCurve or Foundry gear?  Can it handle the kind of throughput that Force 10 can? Of course not. Its switch capabilities are closer in performance to a decent linksys or d-link box.  Great for your home network, but are you going to trust your enterprise to it?

Lets look at this from another angle.  If I asked you to invest in a new company that is going to replace Cisco, HP and the rest of the switch vendors out there, as well as replace the leading IPS's with a wonderbox. That has neither new switching technology nor superior IPS functionality, how much would you write a check for?  At best they can hope to be bought by a switch company and have thier technology incorporated into a real switch.  If the switch vendors don't do it themselves first that is.

So what do we really get with the wonderbox?  We get a mash up of yesterdays technology on an expensive box made to look like a switch.  It doesn't do IPS as well as an IPS.  Doesn't do firewall as well as a real firewall and doesn't do switching as well as a real switch.  So what does it do?  Well it doesn't even do what NAC started off doing (yeah thats right Dom, I was there and that is what NAC was supposed to do, not sure where you were then), namely checking devices before they come on the network. Is it any wonder that this is what Cisco NAC, Microsoft NAP and the TCG/TNC do. They all do pre-connect posture checks. This element of NAC is frankly a weak spot in the wonderbox model, so the spinmiesters would have us believe it is of limited or little value.  Well, pre-connect health and re-occurring posture checks are still what is driving the NAC market, despite what Dom would have us believe and I think the sales numbers back that up. Dom and his brethren will tell you that this is the difference between Network Admission Control and Network Access Control.  They blame Cisco for the confusion.  So Dom let me give you a little history lesson.  Cisco's NAC framework was originally called Network Admission Control. It was the folks at Gartner that co-opted NAC to mean Network Access Control.  You have made it a holy war, but it is still about checking devices to make sure they are not introducing anything bad into the network.  The identity based access and IPS functionality are bolt ons. 

That is not to say that identity based access control and IPS like functionality as well as remediation (how are you doing remediation without some kind of agent BTW Dom?) are not valuable capabilities that a NAC solution should sport.  The product category is still evolving.  But make no mistake, mashing up a second rate IPS, firewall with integrated LDAP on an expensive box/switch does not a NAC make.