Network Enforcement Device—The network device has the responsibility to initiate the queries to the end station and then relay the responses to the policy server. Today NAC is supported in Cisco routers running 12.3(8)T or later as well as the VPN 3000 concentrator running software 4.7 or later. In late summer 2005, this capability will be extended to LAN switches and, following that, WLAN access points. For the turnkey approach, Cisco Clean Access (CCA) appliances can be added to your existing network in either inline our out-of-band mode to perform the end system checks.