NAP 802.1X Configuration Walkthrough – Part 3

Interesting Links – 6/24/2008

Matt Johnson's Technical Adventures — Tue, 24 Jun 2008 17:14:48 GMT

Ask the Directory Services Team : Custom Certificate Request in Windows Vista Microsoft Security Development

re: NAP 802.1X Configuration Walkthrough – Part 3

jpc — Tue, 24 Jun 2008 23:36:58 GMT

Hi Jeff - How would you setup NAP on a XP SP3 client?

Thanks!.../pat

re: NAP 802.1X Configuration Walkthrough – Part 3

JeffSigman — Wed, 25 Jun 2008 00:22:58 GMT

Hey Pat - command-line is the best way to get it done on XP SP3 (if you aren't using GP). I ported the "netsh.exe NAP" commands over to XP and they work great. I believe we also supplied the "netsh lan" command there as well.

Jeff

re: NAP 802.1X Configuration Walkthrough – Part 3

Popeman — Wed, 25 Jun 2008 10:05:25 GMT

Hi,

We have another issue, we have different users assigned to different VLANs, and network filtering today.

What we want is what we understood NAC to be from the beginning:

Unauthenticated devices stays in a guest LAN. Machine authenticated devices goes to a remediation VLAN, and when a user logs on, the VLAN is changed to the user VLAN.

How would we do this ? From what I can see on the Internet, XP does not support this "Dynamic VLAN", and Vista implements it badly. Can we get some of the same effect using NAP ? Possible together with something else ?

re: NAP 802.1X Configuration Walkthrough – Part 3

JeffSigman — Wed, 25 Jun 2008 18:11:47 GMT

It's all about the switch in my experience. Take a Cisco Catalyst - 3550. It has a notion of a "guest VLAN". It can dump people who aren't able to auth at all (i.e. guests) into a VLAN. For people who can auth, you can create policies within our Network Policy Server (NPS on Server 2008 – aka our RADIUS server) which puts "machines" in a VLAN and users in another (however you like). It is based on Active Directory groups. Try this out in a lab (using this walkthrough) and feel free to jump on our forums if you have any troubles - we will help ya!

http://forums.technet.microsoft.com/en-US/winserverNAP/threads

Jeff