Network Access Protection (NAP)

Released : Windows SDK for Windows 7

MS NAP Team — Mon, 24 Aug 2009 08:57:00 GMT

The RTM release of SDK samples for Windows 7 is now available for download. The samples can be downloaded in ISO format or Web Setup format. This release contains some updates to the NAP SDK samples over the Win7 SDK samples RC release.

Thanks

Ravi

“NAP on the Internet” article by The Cable Guy published

MS NAP Team — Mon, 08 Jun 2009 06:22:00 GMT

The Cable Guy article in the June 2009 issue of TechNet Magazine online, titled “NAP on the Internet,” is now available. Network Access Protection (NAP) on the Internet is an extension of the Internet Protocol security (IPsec) enforcement method to include mobile computers that are connected to the Internet. Learn how you can use NAP on the Internet to evaluate and automatically correct system health on your managed and roaming computers.

For a listing of the most recent The Cable Guy articles, click here.

NAP Product Team

Updated NAP SDK samples released

MS NAP Team — Thu, 14 May 2009 00:08:00 GMT

Windows 7 SDK RC has been released to the public. The web setup format can be accessed at http://www.microsoft.com/downloads/details.aspx?familyid=F75F2CA8-C1E4-4801-9281-2F5F28F12DBD&displaylang=en

and the ISO format can be accessed at http://www.microsoft.com/downloads/details.aspx?FamilyID=6db1f17f-5f1e-4e54-a331-c32285cdde0c&displaylang=en. This release contains the revised NAP SDK samples for win 7 SDK RC release.

Thanks

Ravi

See NAP at TechEd 2009

MS NAP Team — Tue, 12 May 2009 03:53:00 GMT

Hey NAP Fans!

If you are attending TechEd 2009 in Los Angeles this week, be sure to stop by the NAP booth in the Microsoft Technical Learning Center (TLC). It is a great opportunity to meet and speak with NAP team members and learn about some of the enhancements and new scenarios in Windows® 7 and Windows® Server 2008 R2.

Also there are at least two breakout sessions that would be useful for anyone interested in learning more about NAP deployments. Both are on Friday May 15th:

WSV206 Windows Clients and Windows Server 2008 NAP: Why They Are Better Together

Presenter: Jay Ferron

Fri 5/15 | 9:00 AM-10:15 AM | Room 502A

WSV305 Deploying NAP: Best Practices and Lessons Learned

Presenters: Venkatesh Gopalakrishnan, Lambert Green

Fri 5/15 | 2:45 PM-4:00 PM | Room 403B

Hope to see you there,

The NAP Team

New blog for the Windows Server User Assistance Networking writing team

MS NAP Team — Tue, 07 Apr 2009 19:04:00 GMT

There is a new blog being published by the Windows Server User Assistance Networking (WSUAN) writing team:

http://blogs.technet.com/wsnetdoc/default.aspx

The IT Pro and Developer writers on the WSUAN writing team are using this blog to describe the improvements that they are making to networking documentation for Windows Server and to share technical tips and tricks.

Check it out.

The NAP Product Team

SHV Multi-Config in Windows Server 2008 R2

MS NAP Team — Thu, 02 Apr 2009 00:14:00 GMT

In Windows Server 2008, a system health validator (SHV) installed on the NPS server can be configured in a single way. This works well if your system health requirements are the same for all of your NAP enforcement methods and all of your computers. However, some deployments require different sets of health requirements for different enforcement methods and different groups of computers. For example, you might want to specify that desktop computers must have their anti-virus software enabled and VPN-connected computers must have their anti-virus software enabled and signature file up-to-date.

In Windows Server 2008 R2, the NAP platform supports SHVs in multiple configurations to support these more advanced configurations, a feature known as SHV multi-config. Existing SHVs must be updated to take advantage of this new feature and new SHVs should be written to use this feature. The Windows Security Health Validator (WSHV) provided with Windows Server 2008 R2 supports SHV multi-config. For more information, see the new INapComponentConfig3 API at http://msdn.microsoft.com/en-us/library/dd392506(VS.85).aspx.

To see the SHV multi-config support for the WSHV, use the Network Policy Server snap-in and open Network Access Protection-System Health Validators-Windows System Health Validator-Settings. The following figure shows an example.

For a larger version of this figure, click here.

There is a default configuration that you can configure if you only need a single configuration of the WSHV settings. This default configuration cannot be deleted or renamed. When you create health requirement policies with the NAP wizard, it will configure your health policies to use this default configuration.

To create another configuration for the WSHV, do the following:

1. Right-click Settings, and then click New.

2. In the Configuration Friendly Name dialog box, type a name for the new configuration, and then click OK.

3. In the Windows Security Health Validator dialog box, specify the system health requirements and then click OK.

The following figure shows an example of a new WSHV configuration with the name WSHV Settings for DHCP.

For a larger version of this figure, click here.

To specify the use of a non-default configuration for the WSHV in the Network Policy Server snap-in, open Policies-Health Policies, and then double-click the name of the health policy that you want to modify. On the Settings tab, in the SHVs used in this health policy list, click the drop-down arrow in the Setting column for the Windows Security Health Validator SHV to see a list of configurations. The following figure shows an example.

Click the desired configuration of the WSHV, and then click OK.

NAP Product Team

TechNet online chat for NAP and NPS is this Thursday, March 26th at 1:00 PM PST!

MS NAP Team — Tue, 24 Mar 2009 20:16:00 GMT

Heads up NAP and NPS fans!

This Thursday continues our series of online chats on Technet. Here is the description:

Microsoft’s Network Access Protection (NAP) with Network Policy Server (NPS) Open Forum
Join the NAP and NPS experts for a live chat session. Use this time to ask questions about the NAP platform or NPS and provide your feedback and thoughts on the product. This is your chance to speak directly with the experts. You can learn more at http://www.microsoft.com/nap.

March 26, 2009
1:00 - 2:00 P.M. Pacific Time

You can join the chat from http://technet.microsoft.com/en-us/cc719754.aspx.

Hope to see you there!

NAP Product Team

Example of using the new NPS templates feature in Windows Server 2008 R2

MS NAP Team — Thu, 26 Feb 2009 23:16:00 GMT

In a previous NAP blog entry, we described the new NPS templates feature in Windows Server 2008 R2. In this blog entry, we show an example of using a template for a RADIUS shared secret.

Templates for RADIUS shared secrets allow users to specify a shared secret that can be reused when configuring RADIUS clients and remote RADIUS servers in the Network Policy Server snap-in. To create and use a RADIUS shared secret template, do the following:

1. From the Network Policy Server snap-in, open the Templates Management node.

2. In the console tree, right-click Shared Secrets, and then click New.

3. In Template Name, type a name for the shared secret template, and then either manually specify the shared secret or have NPS automatically generate one.

4. Click OK to save changes.

To use the RADIUS shared secret template, configure a RADIUS client, a remote RADIUS server, or a remote RADIUS server template and specify the template name for the shared secret, rather than manually configuring a shared secret or having NPS generate one. The following figure shows an example.

To view which RADIUS clients, remote RADIUS servers, and remote RADIUS server templates use a specific RADIUS shared secret template, right click the name of the RADIUS shared secret template, and then click View Usage.

NAP Product Team

NPS templates in Windows Server 2008 R2

MS NAP Team — Tue, 17 Feb 2009 21:45:00 GMT

NPS templates, the flagship feature of NPS in Windows Server 2008 R2, provides a huge reduction in cost of ownership and deployment for all NPS environments. NPS templates separate common RADIUS configuration elements such as RADIUS shared secrets and RADIUS clients from the configuration running on the server. When referenced, the NPS setting inherits the values configured in the specified template. A change in the template changes the corresponding value in all of the places in which the template is referenced. For example, a single RADIUS shared secret template can be referenced for multiple RADIUS clients and remote RADIUS servers. When you change the RADIUS shared secret template, the change is inherited by all of the RADIUS clients and remote RADIUS servers in which that RADIUS shared secret template is referenced.

You can also use NPS templates to assist in configuration with referencing them. For example, you can create a RADIUS client template that contains common settings (such as the vendor type or shared secret) for a specific group of RADIUS clients (such as all wireless APs from a specific vendor). When you create a new RADIUS client, you can select the RADIUS client template to obtain the common settings. When you unselect the template, the inherited settings remain and you can configure individual settings, such as the RADIUS client’s IP address.

Note Template settings are not supported by commands in the netsh nps context. Using netsh nps commands will remove the reference to the template and change the configuration element specified in the command.

NPS template settings can also be easily migrated and synchronized across multiple NPS servers.

The following types of configuration elements use templates:

· RADIUS shared secret

· RADIUS clients

· Remote RADIUS servers

· IP filters

· Health policies

· Remediation server groups

You can configure templates for these configuration elements from the Templates Management node of the Network Policy Server snap-in. The following figure shows an example.

For a larger version of this figure, click here.

Individual templates can be added, edited, duplicated, or deleted. After they are configured, they can be referenced and de-referenced in the appropriate dialog boxes in the Network Policy Server snap-in.

The following table lists the different types of templates and where they are used in the Network Policy Server snap-in.

Template	Where it is used
RADIUS shared secret	When creating or configuring RADIUS clients, remote RADIUS server group members, RADIUS client templates, or remote RADIUS server templates
RADIUS clients	When creating or configuring RADIUS clients
Remote RADIUS servers	When creating or configuring remote RADIUS server group members
IP filters	When configuring IP Filters settings for a network policy
Health policies	When creating or configuring health policies
Remediation server groups	When creating or configuring remediation server groups

NAP Product Team

Changes to the NAP user experience in Windows 7

MS NAP Team — Mon, 09 Feb 2009 20:42:00 GMT

Windows 7 and Windows Server 2008 R2 are now available as public betas. In Windows 7, the NAP client user interface (UI) has been integrated into the Windows Action Center (previously known as the Windows Security Center). For example, Network Access Protection notifications appear in the list of messages when you click the Action Center message in the notification area of the Windows 7 desktop.

The following figure shows an example of how a noncompliant NAP client running Windows 7 displays its status in the Windows Action Center.

For a larger version of this figure, click here.

When you click View Solution, Windows 7 displays the Network Access Protection status dialog box (also known as the Napstat UI).

NAP Product Team

Network Access Protection Design Guide wins big at Society of Technical Communication (STC) awards!

MS NAP Team — Thu, 05 Feb 2009 02:47:00 GMT

Greg Lindsay (writer) and Allyson Adley (editor) won the Online Best of Show award for the NAP Design Guide at the Puget Sound Chapter of the Society for Technical Communication (STC) awards ceremony on January 29th.

Congratulations Greg and Allyson for the fantastic technical documentation on NAP!

NAP Product Team

TechNet online chat for NAP and NPS is today (Jan 29) at 1:00 PM PST!

MS NAP Team — Thu, 29 Jan 2009 19:19:00 GMT

Heads up NAP fans!

Today is our first in a series of online chats on Technet! Here is the description:

January 29, 2009
1:00 - 2:00 P.M. Pacific Time

You can join the chat from http://technet.microsoft.com/en-us/cc719754.aspx.

Hope to see you there!

What other networking experts have written about NAP

MS NAP Team — Thu, 29 Jan 2009 00:10:00 GMT

Greg Lindsay, our NAP product documentation writer, and I are not the only ones writing about NAP. NAP is also being described by Thomas Shinder and Brien M. Posey. Check out the following content by these industry experts.

Thomas Shinder’s articles on deploying NAP IPsec

Part 1: http://www.windowsecurity.com/articles/Deploying-IPsec-Server-Domain-Isolation-Windows-Server-2008-Group-Policy-Part1.html

Part 2: http://www.windowsecurity.com/articles/Deploying-IPsec-Server-Domain-Isolation-Windows-Server-2008-Group-Policy-Part2.html

Part 3: http://www.windowsecurity.com/articles/Deploying-IPsec-Server-Domain-Isolation-Windows-Server-2008-Group-Policy-Part3.html

Part 4: http://www.windowsecurity.com/articles/Deploying-IPsec-Server-Domain-Isolation-Windows-Server-2008-Group-Policy-Part4.html

Thomas Shinder’s articles on deploying NAP DHCP

Part 1: http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part1.html

Part 2: http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part2.html

Part 3: http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part3.html

Part 4: http://www.windowsecurity.com/articles/Using-Group-Policy-Filtering-Part4.html

Brien M. Posey’s article series on NAP

Part 1: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part1.html

Part 2: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part2.html

Part 3: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part3.html

Part 4: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part4.html

Part 5: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part5.html

Part 6: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part6.html

Part 7: http://www.windowsnetworking.com/articles_tutorials/Network-Access-Protection-Revisited-Part7.html

Joe Davies
Senior Program Manager

HP ProCurve Open Network Ecosystem (ONE) launches with Microsoft as a key member

MS NAP Team — Tue, 27 Jan 2009 19:29:00 GMT

The Hewlett-Packard (HP) ProCurve Open Network Ecosystem (ONE) is a new partner alliance program for ProCurve, the networking division of HP. Microsoft is a key member in ProCurve ONE and an important element of the alliance is interoperability with NAP.

Here is a quote from the NAP team's very own General Manager, Tim Sinclair:

"HP ProCurve ONE will help customers resolve interoperability concerns by delivering an open standards-based solution that is effective and efficient. The combination of the HP ProCurve ONE initiative and Microsoft Network Access Protection (NAP) will provide customers with enhanced security and policy-based access that helps reduce downtime and boosts return on investment."

For more information, see the Newsfactor.com article at http://www.newsfactor.com/news/HP-Launches-ProCurve-Alliance/story.xhtml?story_id=1230040K3ZM9.

TechNet online chat for NAP and NPS is rescheduled for Thursday, Jan 29 at 1:00 PM PST

MS NAP Team — Sat, 24 Jan 2009 01:36:00 GMT

Hey NAP fans!

Our first in a series of online chats on Technet has been rescheduled for Thursday, January 29 at 1:00 PM PST.

Here is the description:

January 29, 2009
1:00 - 2:00 P.M. Pacific Time

You can join the chat from http://technet.microsoft.com/en-us/cc719754.aspx.

Put it on your schedule and we will see you there!

NAP Product Team

Today's (Jan 22) TechNet online chat for NAP and NPS to be rescheduled

MS NAP Team — Fri, 23 Jan 2009 00:22:00 GMT

Oops!

Sorry for the inconvenience, but the TechNet online chat for NAP and NPS scheduled for today is not happening due to backend authentication difficulties.

We are in the process of rescheduling this chat and will let you know in a future NAP blog post.

NAP Product Team

TechNet online chat for NAP and NPS is today (Jan 22) at 1:00 PM PST!

MS NAP Team — Thu, 22 Jan 2009 01:22:00 GMT

Heads up NAP fans!

Today is our first in a series of online chats on Technet! Here is the description:

January 22, 2009
1:00 - 2:00 P.M. Pacific Time

You can join the chat from http://technet.microsoft.com/en-us/cc719754.aspx.

Hope to see you there!

NPS enhancements in Windows Server 2008 R2

MS NAP Team — Mon, 19 Jan 2009 20:06:00 GMT

As you are already aware, the beta version of Windows Server 2008 R2 is now available to the public for beta testing. See http://www.microsoft.com/windowsserver2008/en/us/R2-Beta.aspx for more information and the link to download the beta.

Here is the section from the Windows Server 2008 R2 Reviewer's Guide that describes the changes to the Network Policy Server (NPS) service in the beta release of Windows Server 2008 R2:

Improved Protection of Intranet Resources

The Network Policy Server (NPS) is a Remote Authentication Dial-In User Service (RADIUS) server and proxy and Network Access Protection (NAP) health policy server. NPS evaluates system health for NAP clients, provides RADIUS authentication, authorization, and accounting (AAA), and provides RADIUS proxy functionality.

NAP is a platform that includes both client and server components to enable fully extensible system health evaluation and authorization for a number of network access and communication technologies, including:

· Internet Protocol security (IPsec)-protected communication

· 802.1X-authenticated access for wireless and wired connections

· Remote access virtual private network (VPN) connections

· Dynamic Host Configuration Protocol (DHCP) address allocation

· Terminal Service (TS) Gateway access

The improvements to NPS in Windows Server 2008 R2 include:

· Automated NPS SQL logging setup. This new feature automatically configures a SQL database, required tables, and store procedure for NPS accounting data, which significantly reduces the NPS deployment effort.

· NPS logging improvements. The logging improvements enable NPS to simultaneously log accounting data to both a file and a SQL database, support failover from SQL database logging to file logging, and support logging with an additional file format that is structured similar to SQL logging.

· NAP multiple configurations of a system health validator (SHV), When you configure a health policy, you can select an SHV in a specific configuration. This allows you to specify different sets of health requirements based on a specific configuration of the SHV. For example, you can create a network policy that specifies that intranet-connected computers must have their anti-virus software enabled and a different network policy that specifies that VPN-connected computers must have their anti-virus software enabled and anti-malware installed.

· NPS templates. NPS templates separate common RADIUS configuration elements such as RADIUS shared secrets, IP filters, RADIUS clients, and others from the configuration that is running on the server. When referenced, the NPS setting inherits the values configured in the specified template. A change in the template changes the corresponding value in all of the places in which the template is referenced. For example, a single RADIUS shared secret template can be referenced for multiple RADIUS clients and servers. When you change the RADIUS shared secret template, the change is inherited by all of the RADIUS clients and servers in which that RADIUS shared secret template is referenced. NPS template settings can easily be synchronized across multiple NPS servers running Windows Server 2008 R2.

· Migration of Windows Server 2003 Internet Authentication Service (IAS) servers. This feature allows you to migrate the configuration settings of an IAS server running on Windows Server 2003 to an NPS server running on Windows Server 2008 R2.

__________________________________________________________________________________________________

The last bullet item is the same Iasmigreader.exe tool that I described in a previous NAP blog entry. I will publish more detailed descriptions of these features in future NAP blog posts.

Check out these new features. For ongoing beta support for NPS, post your question in the Windows Server 2008 R2 Networking TechNet forum.

Let the beta games begin!

Joe Davies
Senior Program Manager

Tool for migrating IAS configuration settings to NPS is now available!

MS NAP Team — Thu, 15 Jan 2009 21:57:00 GMT

Configuration settings for the Internet Authentication Service (IAS) in Windows Server 2003 are stored in .MDB files. Configuration settings for Network Policy Server (NPS) in Windows Server 2008 are stored in .XML files. If you install Windows Server 2008 on a computer already running Windows Server 2003 (known as an in-place upgrade), the configuration settings are automatically migrated from the .MDB to the .XML format.

When Windows Server 2008 shipped, there was no capability to export the configuration settings of an IAS server to a format that can be imported on a different NPS server. For example, if you wanted to replace an IAS server with an NPS server running on different computer, there was no direct way to migrate the settings of the IAS server to the new NPS server. IAS supports the export of its settings with the netsh aaaa show config > path\file.txt command. However, the format of the exported text file could not be used by the netsh nps import path\file.txt command on an NPS server.

To address this migration issue, the NPS product team is proud to announce the availability of a Windows Server 2008 hotfix that contains Iasmigreader.exe, a command-line tool that exports the configuration settings of IAS on a computer running Windows Server 2003 to an Ias.txt file. Ias.txt is in a format that can be imported on an NPS server running Windows Server 2008 with the netsh nps import path\ias.txt command.

See Microsoft Knowledge Base article 955995 for the hotfix and more information.

Download, export, import, and enjoy!

Joe Davies
Senior Program Manager

Schedule of TechNet chats for NAP and NPS

MS NAP Team — Tue, 13 Jan 2009 23:37:00 GMT

Greetings fellow NAPologists!

To get a better pulse on how things are going in the wild, the NAP product team has scheduled a series of TechNet online chats. This is your chance to speak directly with the experts, ask questions about the NAP platform or NPS, and provide your feedback and thoughts about how the NAP product team can improve NAP and NPS going forward.

The first in this series of chats will be on Jan 22, 2009, from 1:00 to 2:00 P.M. Pacific Time. There are additional chats for:

· March 26, 2009, 1:00 - 2:00 P.M. Pacific Time

· May 28, 2009, 1:00 - 2:00 P.M. Pacific Time

Use the following links to see and join the upcoming NAP/NPS chat sessions:

· http://technet.microsoft.com/en-us/cc719754.aspx

· http://www.microsoft.com/communities/chats/default.mspx

Hope to see you there!

Joe Davies
Senior Program Manager

Avenda Announces $1 eAgent Introductory Pricing – From now until after the RSA Conference 2009

MS NAP Team — Fri, 09 Jan 2009 20:41:00 GMT

Here is a follow-up guest posting from our NAP Partner Avenda Systems.

Due to the interest in our recent blog entry - Five Ways to Draw More Value from Microsoft NAP Deployments - we’ve decided to help customers kick off 2009 with a little cost savings. The calls and email have been overwhelming and have helped us understand that a lot of you are looking at role-based access and endpoint posture and health validation as a real way to leverage Microsoft’s NAP technology.

With the release of Windows Server 2008, network policy and services is something everyone should be considering to secure 802.1X-based wireless, wired, and VPN deployments. Additionally, the NAP agent for Windows XP is in Service Pack 3, which was released worldwide earlier in 2008. As a result, a NAP client was expected to be available to some 80% or more of Windows laptops, by the end of 2008.

Avenda’s eAgents add the ability to extend Microsoft NAP capabilities and to support non-Microsoft operating systems.

From now until April 30^th, one week after the end of the RSA Conference 2009 in San Francisco, each copy of our eAgents can be purchased for $1 each. This includes the Windows and Linux NAP agents.

Five Ways to Draw More Value from Microsoft NAP Deployments

MS NAP Team — Wed, 07 Jan 2009 03:07:00 GMT

Here is a guest posting from our NAP Partner Avenda Systems.

When the founders of Avenda Systems decided to build a Policy Platform, one of the first stops included Microsoft. NAP was in the works and discussions with other industry experts led us to embrace the idea of creating a product or products that truly allowed for adding value to the NAP platform.

Early discussions with Microsoft centered on the development of extensible NAP agents for the support of Windows and Vista operating systems, as well as delivering agents for client operating systems other than Windows. The plan was to provide supplemental value to allow organizations to easily deploy NAP in heterogeneous operating system environments and take advantage of NAP’s robust endpoint health policy architecture.

Here are five ways that you can get value from the combination of NAP and products from Avenda Systems:

1. No other Policy Server required

The use of Avenda’s eAgents lets organizations use the resources they have already deployed to support NAP. All three functions of Windows Server 2008, Network Policy Server (NPS)—RADIUS server, RADIUS proxy, and NAP health policy server—are leveraged across all access methods, including wireless, wired, and VPNs.

At some point the need to support managed and unmanaged devices in a NAP environment may warrant the use of a complimentary platform, but the addition of intermediary policy servers should not be required when investigating NAP Partner solutions.

2. Extended control beyond Windows Security Center checks
When using the Windows Security Health Validator (WSHV), policy validation checks are performed to verify the existence and status (running or not) of the following; Firewall, Anti-Virus Protection, Spyware Protection, Automatic Updating, and Security Update Protection. Based on a client’s response, a noncompliant result can cause the client to be put into a restricted network until the condition has been corrected. For example, if a client has turned off Anti-Virus for some reason, they will not be allowed full network access until the Anti-Virus software has been turned on again.

When using Avenda’s Universal System Health Agent (USHA) and Universal System Health Validator (USHV), administrators gain the ability to create fine-grained policies that extend beyond the verification of the status of the applications and services described above. In addition, the client can be requested to provide version numbers, DAT file and engine revisions and the time the last scan was performed, and automatic remediation can be performed for Anti-Virus and Anti-Spyware applications. The Avenda SHV can also be configured to check for and will start or stop certain services and applications that match specified registry values. For example, clients that have Skype installed can be restricted (as detected by registry values). Once on the network, if Skype is installed again, the next health evaluation can restrict the client.

As the adoption of Windows Server 2008 increases, inquiries regarding our eAgents has really picked up. Customers are attracted to the expanse of additional functionality and our ability to quickly integrate new features. Additional features such as server-side policy checks for latest versions and updates of anti-malware products and data files are available as a portal service from Avenda.

3. Supported Operating Systems
Avenda’s eAgents are available for Windows Vista, Windows XP with Service Pack 3, and Windows Server 2008. In addition, we also have a Linux NAP Agent (with 802.1X enforcement) and a Macintosh NAP Agent is in the works.

4. Dissolvable Agents
Many organizations allow guest and partner access and a common concern has been how to treat unmanaged clients (either lacking or have misconfigured supplicants) that attempt to connect to the network. The addition of Avenda’s eTIPS Policy Server, which interacts with Microsoft NPS, supports this requirement. A fully NAP SoH protocol-compliant dissolvable agent (a Java applet), in simple terms, performs Web authentication and health checks through a captive portal.

For transient users, policies can also determine what level of access is allowed, for what length of time and on which days of the week.

5. Avenda’s competitive advantage

When deploying eAgents in a network (especially for educational institutions, companies that are merging, call centers, etc.), it is important for the agent to support and expect to encounter anti-malware products from multiple vendors. Avenda’s eAgents ship with support for all major anti-malware vendors.

What is NAP traffic?

MS NAP Team — Tue, 06 Jan 2009 03:59:00 GMT

Here is a question posed by a member of the NAP community:

· What new traffic will there be on the network when I deploy NAP?

A NAP deployment can have the following additional sets of network traffic:

· Traffic between the NAP client and the NAP enforcement point. The nature of this traffic depends on the NAP enforcement method.

o For IPsec enforcement, the NAP client communicates to the HRA using HTTP or HTTPS to indicate its identity and health state and to receive the system health evaluation results and the health certificate.

o For 802.1X enforcement, the NAP health evaluation is done over PEAP-TLV, resulting in a small amount of additional EAPOL traffic to send the health state and health evaluation results between the NAP client and the switch or wireless access point.

o For VPN enforcement, the NAP health evaluation is done over PEAP-TLV, resulting in small amount of additional PPP traffic to send the health state and health evaluation results between the NAP client and the VPN server.

o For DHCP enforcement, the NAP health evaluation is done using the same DHCP messages that are already being used for DHCP address allocation, resulting in larger payloads for some DCHP messages, but not additional messages.

o For TS Gateway enforcement, the NAP health evaluation is done over the Remote Procedure Call (RPC) over HTTP protocol that is used for connections to a TS Gateway server, resulting in a small amount of additional traffic to send the health state from the TS Gateway client and the TS Gateway server.

· Traffic between the NAP enforcement point and the NAP health policy server. This is RADIUS traffic, consisting of one or multiple exchanges of RADIUS request and response messages. RADIUS traffic is UDP-based and adds minimal additional traffic on your network.

· Traffic between the NAP enforcement point and other servers. The most obvious example is the traffic between the Health Registration Authority (HRA) and an Active Directory domain controller and a certification authority (CA) to authenticate the NAP client and obtain a health certificate.

· Traffic between the NAP health policy server and health requirement servers. This traffic depends on the SHVs running on the NAP health policy server. The Windows Security Health Validator (WSHV) does not require communication with health requirement servers.

Joe Davies
Senior Program Manager

The no enforcement design for NAP

MS NAP Team — Tue, 23 Dec 2008 02:20:00 GMT

Although NAP can be used to enforce restricted access for noncompliant NAP clients and non-NAP-capable clients, NAP can also be used to provide you with information about the overall level of health compliance on your network and correct system health problems automatically without notifying the user or restricting their access. This latter configuration of a NAP deployment is known as the no enforcement design and consists of deploying NAP in reporting mode with autoremediation enabled.

The value of the no enforcement design was echoed to me by attendees at a recent McAfee regional security event, where I helped present an overview of NAP and McAfee Network Access Control 3.0 integration to IT staff and security architects (this is the same presentation that I gave at McAfee’s FOCUS 08 event). Some attendees said that they were very interested in the no enforcement design of NAP because they did not want their users notified of noncompliance (via the NAP notification message) and definitely did not want their users’ access to be restricted. They would rather determine and fix any system health issues in the background without disturbing their users. One of the benefits of the no enforcement design is that you do not have to set up a restricted network with remediation servers.

To configure a no enforcement design, use the Configure NAP wizard in the Network Policy Server snap-in for the appropriate NAP enforcement method. On the Define NAP Health Policy page, select the Enable Auto-Remediation of Client Computers check box and specify that NAP ineligible computers are allowed full access. After the Configure NAP wizard is complete, modify the network policy for noncompliant NAP clients by selecting Allow Full Network Access for the NAP Enforcement settings.

Note For the 802.1X enforcement method, specify the same VLAN or ACL settings for both full access and restricted access on the Configure Virtual LANs (VLANs) page of the Configure NAP wizard.

For more information, see the No Enforcement Design topic in Greg Lindsay’s excellent NAP Design Guide.

Joe Davies

Network Access Protection Troubleshooting Guide is live!

MS NAP Team — Mon, 22 Dec 2008 18:39:00 GMT

Hey citizens of New NAP City!

The Network Access Protection Troubleshooting Guide, authored by our very own technical writer and NAP Forum hero Greg Lindsay, is now live! This completes the product documentation set for NAP in Windows Server 2008.

http://technet.microsoft.com/en-us/library/dd348515.aspx

The NAP Troubleshooting Guide provides provides task-oriented information to help you identify and resolve NAP-related problems quickly for the Windows Server 2008, Windows Vista, and Windows XP with Service Pack 3 operating systems. This guide can assist you when performing root-cause analysis of incidents and problems with the components of a NAP infrastructure.

This guide contains the following sections:

· Introduction to Troubleshooting NAP

· A-Z List of Problem Topics for NAP

· Things to Check Before Troubleshooting NAP

· Quick Fixes for NAP

· Tools for Troubleshooting NAP

· Troubleshooting NAP Problems

You can provide feedback on individual pages of the NAP Troubleshooting Guide by clicking “Click to Rate and Give Feedback” just above the content pane.

A big thank you to Greg for his authoring efforts and to NAP product team reviewers.

Enjoy!

Joe Davies