VoIP presents its own set of NAC problems that can be overcome, but need to be up front in the minds of people making NAC decisions.

One difficulty VoIP presents to NAC is that VoIP phones don’t support NAC agents, permanent or dissolvable. That means limited testing of the devices.

Often times VoIP phones are plugged into PCs that are plugged into switches, making it difficult to enforce NAC by simply shutting off a port. Shutting down the port to isolate the phone shuts down the PC and ignites unhappiness among users.

A PC spoofing a phone can let the operator of that PC run amok on the network if the device is unchecked.

There’s not much NAC can do about checking whether a VoIP phone is infected, so the best it can do is identify the device as a phone via a white list of MACs, IPs or a combination. If it flunks that test, it should be kept off the network altogether.

If it passes, then keeping an eye on what the device does once it is admitted becomes important. If it starts doing FTP downloads or pinging IP addresses at random, it’s probably not a phone and should be isolated. NAC products can do that.

NAC is also capable of limiting what resources a device can access, so VoIP phones can operate under policies that restrict their access to call servers, for instance. If a device that successfully spoofs being a phone sets off a denial-of-service attack, it’s not going to hit the rest of the network.

For those who use VoIP and are considering NAC, quiz your vendors about how they handle IP phones.

Tim Greene is senior editor at Network World.