re: TechEd NAP and SCCM Session Question

Anthony - YourASP — Mon, 13 Aug 2007 08:05:22 GMT

Hey Michael, what software where you using to manage your VM's?

It looked pretty handy.

re: TechEd NAP and SCCM Session Question

mkleef — Mon, 13 Aug 2007 08:49:48 GMT

I was actually using Windows Server Virtualisation (hypervisor) which has its own MMC console. If youre using Virtual Server R2 theres now a decent management tool called VMRCPlus that enhances the management experience of Virtual Server. You can search for that on the download center of Microsoft.com/downloads

re: TechEd NAP and SCCM Session Question

Anthony - YourASP — Mon, 13 Aug 2007 08:59:43 GMT

Thanks. I am using VMRCPlus at the moment..it's impressive in it's own right.

I'll be patient and wait for WSV to come out in some form. :)

re: TechEd NAP and SCCM Session Question

Rob — Fri, 17 Aug 2007 02:58:07 GMT

Hi Michael, I work with Jan so I thought I might add a bit of detail to the question. The advice from Cisco really just covers whats in the standard in Appendix B1 at http://standards.ieee.org/getieee802/download/802.1X-2004.pdf

The real problem occurs when you configure the cisco switches to use auth fail vlans, and guest vlans. These are designed to place computers which fail authentication into an administrator designated vlan. The interface command s would be something like this.

switchport access vlan 900

switchport mode access

dot1x pae authenticator

dot1x port-control auto

dot1x control-direction in

dot1x guest-vlan 999

dot1x auth-fail vlan 999

Now when a port has this type of config and the computer is turned off there is a very brief link state transition which causes the port to become unauthenticated. The switch will attempt to start authentication a number of times before timing out and placing the port into the guest vlan.

Now the crux of the problem is this. The SMS records for the computer have an IP address from the authenticated access vlan (900 in the example). The wake on lan packet will never be received by the computer because it is in the unauthenticated vlan.

The obvious solution is to modify the SMS records to reflect an IP address and subnet in the guest vlan as well. I've used a modified version of the example at http://www.microsoft.com/technet/prodtechnol/sms/sms2003/opsguide/ops_64m9.mspx?mfr=true to generate the DDR and this seems to work ok. There is also an option to replace data using the ADDPROP_FULLREPLACE flag.

Does SCCM send wakeup packets to each subnet in the SMS discovery record or just the first? Can SCCM exec a script to update the discovery records prior to executing the wakeup?

Hope that makes our issues a little bit clearer.