Network access control intent-based policy configuration

A method comprising:

• obtaining, by a cloud-based network access control (NAC) system, one or more intent-based NAC policies of an organization from a network management system (NMS) configured to manage a plurality of multi-vendor, network access server (NAS) devices associated with the organization, wherein the one or more intent-based NAC policies comprise one or more sets of normalized match rules associated with corresponding sets of abstracted policy results that are vendor-agnostic;
• receiving, by the NAC system, an authentication request for an enterprise network of the organization from a NAS device;
• identifying, by the NAC system, a vendor of the NAS device based on the authentication request;
• matching, by the NAC system, one or more incoming attributes included in the authentication request from the NAS device to a set of normalized match rules of an intent-based NAC policy of the one or more intent-based NAC policies;
• translating, by the NAC system, a set of abstracted policy results corresponding to the set of normalized match rules of the intent-based NAC policy into a vendor-specific set of return attributes based on the vendor of the NAS device;
• and
• sending, by the NAC system, the vendor-specific set of return attributes to the NAS device to enable the NAS device to access the enterprise network of the organization.

A computer-readable storage medium storing instructions that, when executed, cause one or more processors to:

• obtain, by a cloud-based network access control (NAC) system, one or more intent-based NAC policies of an organization from a network management system (NMS) configured to manage a plurality of multi-vendor, network access server (NAS) devices associated with the organization, wherein the one or more intent-based NAC policies comprise one or more sets of normalized match rules associated with corresponding sets of abstracted policy results that are vendor-agnostic;
• receive an authentication request for an enterprise network of the organization from a NAS device;
• identify a vendor of the NAS device based on the authentication request;
• match one or more incoming attributes included in the authentication request from the NAS device to a set of normalized match rules of an intent-based NAC policy of the one or more intent-based NAC policies;
• translate a set of abstracted policy results corresponding to the set of normalized match rules of the intent-based NAC policy into a vendor-specific set of return attributes based on the vendor of the NAS device;
• and
• send the vendor-specific set of return attributes to the NAS device to enable the NAS device to access the enterprise network of the organization.