Extreme Platform ONE Security

NAC/ZTNA ZTNA

Extreme Platform ONE Security represents a fundamental shift in zero-trust architecture by unifying cloud-native Network Access Control (NAC) and Zero Trust Network Access (ZTNA) under a single identity-based policy engine. Unlike fragmented point solutions, this unified approach eliminates the traditional divide between campus and remote access security, delivering what Extreme positions as "the ZTNA for everyone" democratizing zero trust across all organization sizes and device types through both agent-based and agentless deployment options.

Overview

How to position

Microsoft-Focused Resellers and CSPs

Why Target: Microsoft Entra ID partners represent the highest-velocity opportunity. These resellers already sell identity solutions but face a critical gap: Microsoft lacks Cloud NAC and integrated campus ZTNA.

Positioning angle:

• "Extend Entra ID investment to network access control"
• Upsell from MS365/Entra ID licensing to unified network + application security
• Pre-built SCIM sync and Conditional Access integration eliminates deployment friction

Managed Security Service Providers (MSSPs)

Why Target: MSSPs seek recurring revenue streams and differentiated offerings. Extreme's MSP partner program delivers predictable OPEX-based revenue

Positioning angle:

• Cloud-native delivery eliminates hardware refresh cycles
• Per-user subscription model aligns with MSSP billing practices
• Single console for network + application security reduces operational complexity
• "ZTNA for everyone" enables MSSPs to serve SMB through enterprise segments

Network Infrastructure Resellers with Security Ambitions

Why Target: Traditional networking resellers face commoditization pressure. Platform ONE Security provides natural adjacency to existing Extreme networking deals.

Positioning angle

• Add security revenue to infrastructure projects
• Unified Platform ONE console spans networking and security
• Avoid competitive overlap with pure-play security vendors

Profiles to target

• Existing Extreme networking partners seeking security expansion
• Cisco/HPE Aruba resellers frustrated with ISE/ClearPass complexity
• VAR/system integrators with campus networking expertise

Compliance and GRC-Focused Consultancies

Why Target: NIS2 compliance drives mandatory security investments across 18 sectors. Belgium alone expanded from approximately 1000 to 10.000-12.000 entities in scope

Positioning angle

• Platform ONE Security addresses NIS2 access control requirements
• Unified audit logging simplifies compliance reporting
• Cloud NAC + ZTNA covers both network and application access mandates

Deployment scenarios and supported environments

Hybrid Workforce Access

Unified policies for on-premises employees, remote workers, branch offices, and contractors - all within single policy engine

BYOD and Guest Networks

Agentless portal enables contractor/guest access without:

• Agent installation
• Device enrollment
• MDM requirements
• Complex onboarding Non-compliant guests isolated to quarantine VLANs.

IoT and Headless Devices

MAC authentication and device classification enable access for:

• Printers and scanners
• Network cameras
• Embedded systems
• Specialized equipment
• Devices incapable of running agents

Integration with Extreme Fabric

Microsegmentation and just-in-time services at fabric layer ensure consistent security policy end-to-end, whether accessing campus network, branch resources, or remote data centers.

Core Features

Unified Policy Engine Architecture

Extreme Platform ONE Security operates as a dual-access framework within a single cloud-managed policy engine. The architecture bifurcates into two complementary security layers that operate transparently to end users:

• Remote Access Path: ZTNA with continuous authentication, encrypted tunneling (IPsec/Wireguard), and application-level access controls for users outside the campus network
• Campus Access Path: Cloud NAC providing network-layer authentication (802.1X, MAC authentication) and device posture validation before granting wired/wireless network access

Both paths converge on the same identity-based policy decisions: "Who is this user?" "What devices are they using?" "Are those devices compliant?" One policy definition satisfies all three questions across network and application layers

Cloud-Native NAC (Network Access Control)

Traditional on-premises NAC appliances required specialized hardware, VLAN engineering, and complex Radius configurations. Extreme's Cloud NAC eliminates infrastructure burden:

• RadSec Proxy: Secures RADIUS authentication over untrusted networks (encrypted RADIUS tunneling). Minimal footprint: 2vCPU, 4GB RAM, deployed on Ubuntu or containerized Docker environments
• Instant Secure Port: One-click port provisioning on Extreme Universal switches that automatically installs certificates, RADIUS/RadSec configuration, and authentication methods without manual CLI commands
• Dynamic Policy Enforcement: Network policies are applied in real-time via RADIUS VSAs (Vendor Specific Attributes) and dynamic ACLs: no static VLANs or port profiles required

The result: campus network security onboarding completed in hours rather than weeks

Agentless Access Portal

The agentless component addresses a persistent zero-trust barrier: not all devices can or should run security agents. Extreme's browser-based portal enables application access without agents:

• Zero installation friction: End users simply receive a portal link, authenticate via Entra ID, and see all authorized applications: no client software, no device compliance profiles, no certficate management
• Device posture validation: Browser-side checks validate OS, browser version, and basic security configurations without requiring full MDM integration
• Transparent Tunneling: Portal translates user clicks into encrypted tunnels to backend resources, masking network complexity

This democratizes zero trust access to contractors, partners, and legacy systems that cannot support agent installation fulfilling the "ZTNA for everyone" positioning.

Feature Overview

Core Architecture and Access Paths

Remote Access Path

Leverages ZTNA continuous authentication, encrypted tunneled application sessions, and direct-to-cloud routing for users accessing resources from any location

On-Campus Access Path

Combines Cloud NAC and ZTNA capabilities to control network access (wired/wireless) and application access for both headed and headless devices

Access Model Flexibility

Supports both agent-based and agentless access simultaneously within the same policy framework. Agent-based provides rich telemetry and granular device posture checks; agentless portal enables BYOD and contractor access without software installation

Authentication and Authorization

Identity Provider Integration

• Microsoft Entra ID (OIDC + SAML)
• Google Workspace (OIDC + SAML)
• Okta
• Local users (max 100)

User and group provisioning

SCIM (System for Cross-domain Identity Management) syncs users and groups automatically from identity providers, eliminating manual provisioning and deprovisioning workflows

Device Posture and Compliance

Device Classification

• Operating system validation
• Patch level and security update compliance
• Antivirus/endpoint protection status
• Device encryption validation
• Jailbreak/root detection
• Browser security checks (for agentless access)

MDM Integration

Native integration with Microsoft Intune for

• Device enrollment verification
• Compliance policy validation
• Real-time device health assessment
• Non-disruptive network sensing for all device types (managed and unmanaged)

Continuous Posture Reassessment

Device compliance is evaluated not just at initial access but throughout the session. If a device falls out of compliance during an active session, access can be revoked or restricted immediately.

Application Access Control

Private IP applications

• TCP-based internal application accessed via agents
• RDP, SSH, custom TCP services
• Tunneled via IPsec or WireGuard encryption
• Full application visibility to authorized users only

Web-Based Applications

• HTTPS-based internal applications (portals, dashboards)
• Agentless browser portal access
• No direct network visibility required

IaaS (Infrastructure-as-a-Service) Applications

• Cloud-hosted internal resources (VMs, databases, file servers)
• Private cloud and public cloud deployments
• Accessed via service connectors for transparent access

Contextual Access Policies

Dimension	Factors	Example Use Case
Identity	User role, department, job function	Only HR staff access payroll systems
Device	OS, patch level, encryption, antivirus	Unpatched devices denied access to sensitive apps
Location	Geographic location, trusted networks	Restrict access from high-risk countries
Time	Time-of-day, business hours	Block access to databases during off-hours

Least Privilege Enforcement

Users receive only the minimum access necessary for their role, eliminating broad network or application visibility.

Licensing Tiers and Subscription Model

Secure Tier (Cloud NAC - RADIUS)

• Network Access Control and RADIUS as a Service
• Minimum 50 user identities
• Per-user-identity, per-year SaaS pricing

Secure Plus Tier (Complete Cloud NAC - RADIUS + ZTNA)

• Full ZTNA capabilities
• Network access + application access
• Cloud NAC + ZTNA in single policy engine
• Minimum: 50 user identities
• Per-user-identity, per-year SaaS pricing

Conclusion

Extreme Platform ONE Security executes on its "ZTNA for everyone" positioning by solving three distinct customer problems simultaneously:

1. For Microsoft-centric organizations: Close the Cloud NAC gap that Entra Private Access leaves open, delivering unified policy across network and application layers. It's also a lot easier to setup and manage.
2. For all organization sizes: Elminate the "agent or nothing" dichotomy. The agentless portal enables access for device types and scenarios where agents are impractical
3. For IT Operation Teams: Shifting from managing multiple disconnected security tools to a single cloud-native policy engine with AI-assisted configuration

The agentless ZTNA portal is not a second-class access path; it's a first-class delivery mechanism for organizations where device control is limited but security requirements are not. Combined with Cloud NAC's device discovery and compliance enforcement, Extreme delivers a genuinely universal zero-trust model that scales from one-person contractors to enterprise deployments.