Symantec's endpoint-based NAC software performs what the company calls peer-to-peer NAC - a way to limit the damage that infected endpoints might inflict.

Symantec NAC enforcement is located in its endpoint software, so each endpoint contains knowledge of its own configuration-compliance status.

With peer-to-peer NAC, groups of endpoints fitted out with Symantec’s NAC software can be restricted to talking only to other endpoints in their group and only of those endpoints meet NAC requirements. The peer-to-peer NAC software does not restrict what servers endpoints can reach.

When a protected endpoint receives TCP or UDP connection attempts from another device in its group, the initiating device must declare its NAC status. If the initiating device is out of NAC compliance, the connection is denied (Compare NAC products).

NAC doesn’t guarantee that devices are free of infections, just that their configurations comply with network NAC policies. This mitigates risk.

By requiring that peer devices also comply with NAC configuration policies, peer-to-peer NAC can reduce the chances that machines will become infected via peer devices.

These peer groups are set up in Symantec’s policy manager, and the policies within the group deal with incoming traffic only.

The big limit of this feature is that it can apply only to machines that are managed and have the Symantec NAC client. So guest machines and those owned by consultants would not support this feature, and they would have to be isolated via other means.

Even so, this peer-to-peer feature is another layer of protection on the risk-mitigation side of the equation, which can’t hurt.

Tim Greene is senior editor at Network World.