Network Access Protection (NAP) : 802.1X

Network Access Protection Deployment Guide is live!

MS NAP Team — Thu, 04 Dec 2008 02:18:00 GMT

Greetings NAP fans!

The Network Access Protection Deployment Guide, authored by our very own technical writer and NAP Forum hero Greg Lindsay, is now live!

http://technet.microsoft.com/en-us/library/dd314175.aspx

The NAP Deployment Guide provides detailed guidance for deploying a specific NAP design that has been determined through your use of the Network Access Protection Design Guide. The NAP Deployment Guide contains checklists and step-by-step procedures for deploying NAP health policy servers, NAP enforcement points, IPsec policies with NAP, NAP certification authorities, and NAP client settings.

You can provide feedback on individual pages of the NAP Deployment Guide by clicking “Click to Rate and Give Feedback” just above the content pane.

A big thanks to Greg.

Enjoy!

Joe Davies

Network Access Protection Design Guide is live!

MS NAP Team — Thu, 09 Oct 2008 23:27:00 GMT

Hey NAP friends!

The Network Access Protection Design Guide, authored by our very own technical writer and NAP Forum hero Greg Lindsay, is now live!

http://go.microsoft.com/fwlink/?LinkId=130154

The NAP Design Guide explains the advantages, disadvantages, requirements, recommendations, and design considerations for deploying NAP for the IPsec, 802.1X, VPN, and DHCP enforcement methods.

The NAP Design Guide contains the following sections:

· Understanding the NAP Design Process

· Identifying Your NAP Deployment Goals

· Mapping Your Deployment Goals to a NAP Design

· Evaluating NAP Design Examples

· Planning a NAP Deployment Strategy

· Planning the Placement of a NAP Health Policy Server

· Planning the Placement of a NAP Enforcement Server

· Planning the Placement of a NAP CA Server

· Planning the Placement of a NAP Remediation Server

· Planning the Placement of a NAP Health Requirement Server

· NAP Capacity Planning

· Additional NAP Resources

· Appendix A: NAP Requirements

· Appendix B: Reviewing Key NAP Concepts

· Appendix C: Documenting Your NAP Design

· Appendix D: NAP-NAC Design

You can provide feedback on individual pages of the NAP Design Guide by clicking “Click to Rate and Give Feedback” just above the content pane.

Huge thanks to Greg for his authoring efforts over the last year and to many NAP product team reviewers for helping to ensure that the content is technically accurate and complete.

Enjoy!

Joe Davies
Senior Program Manager

Selecting PEAP-TLS and other PEAP methods in Windows Vista and Windows Server 2008

MS NAP Team — Tue, 30 Sep 2008 02:52:00 GMT

Windows Vista and Windows Server 2008 support the Protected Extensible Authentication Protocol (PEAP) and the Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) and Transport Layer Security (TLS) authentication methods for PEAP. PEAP can be used in Windows Vista and Windows Server 2008 for remote access VPN connections, 802.1X-authenticated wired connections, and for wireless connections that use the 802.1X, WPA-Enterprise, or WPA2-Enterprise security types. By default, PEAP uses PEAP-MS-CHAP v2. The use of PEAP and a PEAP authentication method is required for the 802.1X and VPN NAP enforcement methods.

For VPN and wireless connections in the Network Connections folder, the list of installed PEAP methods is displayed as a normal drop-down list box from the properties of the Microsoft: Protected EAP (PEAP) network authentication method. There is a different procedure when selecting PEAP types from the following locations:

· The Authentication tab of a wired network connection in the Network Connections folder.

· The Security tab of a Wired Network (IEEE 802.3) Policies policy in Group Policy.

· The Security tab of a Wireless Network (IEEE 802.11) Policies policy in Group Policy.

To select PEAP-TLS or additional PEAP authentication methods from these locations, you must first obtain the properties of the Microsoft: Protected EAP (PEAP) network authentication method. In the Protected EAP Properties dialog box, you must click the down arrow for Select Authentication Method, and then click the small up and down arrows just below the larger down arrow to display the installed PEAP authentication methods. Here is an example.

After the desired PEAP authentication type is displayed, click on its name to select it.

For example, the following procedure selects the PEAP-TLS authentication method:

1. In Select Authentication Method, click the down arrow.

2. For PEAP-TLS, in the drop down list, directly below the down arrow, click the small down arrow to display Smart Card or other certificate, and then click Smart Card or other certificate.

Joe Davies
Senior Program Manager

WinCAT blog post on NAP and 802.1X Enforcement

MS NAP Team — Mon, 25 Aug 2008 20:35:00 GMT

Check out the Windows Server Customer Advisory Team (WinCAT) post Network Access Protection Using 802.1x VLAN’s or Port ACLs – Which is right for you?

Our very own Pat Fetty, whom many of you have seen presenting NAP talks at industry conferences, discusses the two ways that you can configure IEEE 802.1X-based switches and wireless access points for NAP using virtual LANs (VLANs) and access control lists (ACLs). Pat then compares the two approaches with their respective pros and cons.

This is very valuable information to review prior to beginning your 802.1X enforcement deployment.

Thanks Pat!

Joe Davies
Senior Program Manager

This posting is provided "AS IS" with no warranties, and confers no rights.

NAP 802.1X Configuration Walkthrough – Part 3

JeffSigman — Sun, 22 Jun 2008 21:02:00 GMT

This is a continuation from Part 1 and Part 2.

Step 3 – NAP Clients, it’s just too easy

NAP can be configured from the command-line, the MMC (except on XP SP3) and of course Group Policy (GP). Since this is a workgroup scenario, I am going to skip GP – but the principles below are the same.

· Start the services snap-in and locate these two services – “Network Access Protection Agent” (NAPAgent) and “Wired AutoConfig” (dot3svc).

· Start NAPAgent and Dot3svc; set both to “Automatic” startup.

sc config NAPAgent start= auto
net start NAPAgent
sc config Dot3Svc start= auto
net start Dot3Svc

· Start the NAP Client Configuration snap-in; click on the “Enforcement Clients” link.

· Enable the “EAP Quarantine Enforcement Client” by double-clicking on it and selecting “Enable this enforcement client”.

netsh NAP client set enforcement ID = "79623" ADMIN = "ENABLE"

· Click on the “User Interface Settings” link; double-click on the “User Interface Settings” entry to configure text to be displayed to users when NAP is unable to (or in progress of) auto-remediate a problem on the computer.

netsh NAP client set userinterface TITLE = "I regret to inform you that you have been NAP'd!!" TEXT = "Please logoff and go home, do not collect $200"

· You may export / import these settings if you wish.

netsh NAP client export FILENAME = "c:\NapCfg.xml"
netsh NAP client import FILENAME = "c:\NapCfg.xml"

· Start the Network Connections folder; right-click on your network interface and select “Properties”.

· Since you started the “Dot3Svc”, you will now see the “Authentication” tab; Enable 802.1X and caching; Make sure PEAP is selected; Clicks “Settings”.

· In the “Protected EAP Properties” dialog, un-check “Validate server certificate”; Select MS-CHAPv2; Check “Enable Quarantine checks”; Click “Configure”.

· In the “EAP MSCHAPv2 Properties” dialog, un-check the auto-use credentials setting – this is because we are in a workgroup – if you were in a domain you would want to leave this enabled so the domain user would automatically use his domain credentials.

· After you “OK” all of those dialogs, the 802.1X client should now attempt to authenticate to the switch port; if not, simply enable/disable or unplug/plug the NIC; you should get prompted for credentials; type the user / password.

· If everything works you should see something like this; any failures usually show “authentication failed”.

· Thankfully, you can also use the command-line to export/import these settings too.

netsh lan export profile FOLDER = "c:\\"
netsh lan add profile FILENAME = "c:\LANProfile.xml"

Hopefully you now have end-to-end NAP 802.1X working. If not, my next installment includes troubleshooting! :->

Jeff

NAP 802.1X Configuration Walkthrough – Part 2

JeffSigman — Fri, 20 Jun 2008 19:59:00 GMT

NAP 802.1X Configuration Walkthrough – Part 2

This is a continuation from Part 1.

Step 2 – Windows Server 2008 NPS, the heart of NAP

I am going to take a slightly different approach than the 802.1X step-by-step guide. Feel free to follow either method, whatever gets it done for you!

My configuration assumes a “WORKGROUP”, not domain joined. Again, for simplicity of building a demonstration, I prefer to remove the AD component.

· Open “Server Manager”, just in case it didn’t open for you on logon. :->

· Add our NAP role – “Network Policy and Access Services”.

· Add our role service – “Network Policy Server (NPS)”.

*Tip* - if you also install the “Health Registration Authority (HRA)”, this is used only if you are doing NAP + IPsec, it may save you a bit of pain getting 802.1X to work. It has an option to create a “self-signed certificate” for the server. NPS / EAP require a server certificate to do 802.1X NAP.

· This is an important step, in case you are skipping the previous steps on installing the stuff. You should clear ALL EXISTING CONFIGURATION. Even on a default install, I clear it all out for my own sanity. Clean slate baby; easier to debug.

The four nodes to clear are 1.) RADIUS Clients 2.) Connection Request Policies 3.) Network Policies 4.) Health Policies.

· Now that we have a clean configuration, let’s run the spiffy wizard. Click on the top “NPS” node within the tree-view. You should then see a “Configure NAP” link on the “Getting Started” page.

· The first page of the wizard is figuring out which scenario of NAP enforcement you want to configure. For this walkthrough, I am discussing “IEEE 802.1X (Wired)”.

· Time to configure a RADIUS client (i.e. 802.1X switch). You will have to remember the IP address and shared secret that you configured on the switch itself in Part 1. Click the “Add” button. Fill in a nice friendly name for the switch (maybe a model# and physical location and such – it will be displayed in the logs later), the IP address of the switch (use the management VLAN 1 IP interface) and the shared secret.

· Since this is a workgroup, the next page can be skipped. This is where you can specify what machines and users should be included in your NAP deployment. This is pretty cool in that you can roll out NAP at your own pace throughout a domain.

· As I mentioned in the *tip* above, NAP + 802.1X needs a certificate on the server-side to function. A self-signed cert is a quick and easy way to get this going for a workgroup.

I am going to be discussing user-based NAP 802.1X – thus you only need to enable PEAP-MS-CHAPv2. If you were in an AD, you could deploy auto-enrolled machine certificates and get 802.1X machine authentication working. It is pretty slick.

·         Alrighty then, this is the fun bit – configuring the VLANs. It is relatively painless. This can sometimes vary depending on the switch. I will say that all seven of the switches I configured for RSA needed the same exact settings in here.

The “Organization network VLAN” is what I am calling the Compliant VLAN. Obviously the “Restricted network VLAN” is the Non-Compliant VLAN.

Compliant VLAN settings:
Tunnel-Type             = Virtual LANs (VLAN)
Tunnel-Medium-Type = 802 (includes all 802 media ...)
Tunnel-Pvt-Group   = 2

Non-Compliant VLAN settings:
Tunnel-Type             = Virtual LANs (VLAN)
Tunnel-Medium-Type = 802 (includes all 802 media ...)
Tunnel-Pvt-Group   = 3

· The “Health” settings that are available to you without any additional software are around the Windows Security Center. In NAP, this component is called on the NAP client “Windows Security System Health Agent” – and on the NAP server “Windows Security System Health Validator”.

You will notice in my screenshot that I have other stuff in there. These are plug-ins to NAP I was showing off at TechEd 2008 Orlando. You should be able to accept the defaults on this page and party on.

· The wizard is done!

· You should verify that the wizard added the configuration in the following nodes - 1.) RADIUS Clients 2.) Connection Request Policies 3.) Network Policies 4.) Health Policies.

· Navigate to the “System Health Validators” node in the tree and double-click the “Windows Security Health Validator”. Click the “Configure” button. I recommend starting small and just check for the Windows Firewall at first.

Nicely done! On to the client in the next installment!

Jeff

NAP 802.1X Configuration Walkthrough – Part 1

JeffSigman — Thu, 19 Jun 2008 20:08:00 GMT

I just got back from TechEd 2008 North America (Orlando) where I presented two “breakout” sessions on NAP. It went off with a bang and most people really loved the sessions / demos. I have blogged a couple times in the past that I would document exactly how I made it all work and now I want to come through on that promise.

Back in April of this year I created a cool 802.1X NAP Interoperability Showcase for the RSA show – it was two mobile racks (guitar racks actually) full of vendor 802.1X wired gear. I had devices from Cisco, D-Link, Enterasys, Extreme, Foundry, HP ProCurve and Nortel. I got it all working flawlessly with NAP / NPS / Server 2008! It was quite a thing to get working being a guy who deals chiefly in Windows OS’s (and not much networking hardware). After getting it all working I felt some serious love for the scenario – it is definitely my favorite flavor of the 6 NAP enforcement methods we support (DHCP, IPsec, 802.1X, VPN, TSG and Cisco NAC).

Before I head to Windows configuration, we need to talk GEAR. Here are the devices I got working in the showcase rack. I included links to my configuration files from the first five (I need to dig up the other guys too):

1. HP ProCurve 2626

2. Cisco Catalyst 3550

3. D-Link xStack DES-3828

4. Extreme Summit X450-24t

5. Foundry FastIron Edge 4802-POE

6. Enterasys 2G4072-52

7. Nortel BayStack 5520-24T-PWR

I also saved off a copy of the Network Policy Server (NPS) XML configuration file if you want to refer to it. Use caution when using these files. I don’t want you to frakk your switch! For the purposes of this walkthrough, I am going to discuss the specifics of the HP ProCurve 2626. It is a switch that is near and dear to my heart as it is the first one I ever got working. :-> Some things may vary on your brand / model.

Step 1 – Configure that switch baby

This step caused me some serious pain for a number of reasons. I was handed 7 switches with NO power cables, NO terminal cables NOR any instruction manuals. Whoa ho! “Good luck” was something I was thinking at the time. I hope you aren’t in the same boat here. :->

The ProCurve wasn’t bad at all once I found a female-to-female DB9 cable (i.e. Radio Shack). Being a Microsoft guy, I felt obligated to use Hyper Terminal (some Linux guys later informed me about PuTTY, which is pretty cool). Since Hypertrm disappeared from Vista (huh?!?), I went to my XP SP3 box and copied the required files to my memory stick (hypertrm.chm, hypertrm.dll, hypertrm.exe, hypertrm.hlp).

To get connected to the ProCurve I used 8-N-1 @ 115,200 with Xon/Xoff and VT100 emulation. Boy, this brought me back to my modem days. After hitting “connect” and enter a couple times, you should be presented with this.

By the way, you can use HP’s web based configuration interface for some stuff, like configuring VLANs, but it isn’t able to handle RADIUS configuration – which made me move right over to terminal for everything.

Here is a simple diagram of what every switch looked like. 3 VLANs total:

· VLAN 1: Management VLAN. Each of the seven switches had an IP address on the 10.x network. This is so they could do two things – authenticate to the NPS via RADIUS + relay the DHCP/BOOTP traffic to the DHCP server running on Windows Server 2008.

· VLAN 2: Compliant VLAN. AKA – the “healthy network”. Clients on this network are compliant with your policy.

· VLAN 3: Non-Compliant VLAN – AKA – the “unhealthy network”. Clients on this network are not compliant with your policy. They should not be able to contact clients in Compliant VLAN. It is also advisable to restrict what they can reach on the Management VLAN – only resources required to get them fixed up as well as infrastructure (e.g. AD).

Let’s take a look at the ProCurve configuration I am using:

Startup configuration:

; J4900B Configuration Editor; Created on release #H.10.45

hostname "HP ProCurve 2626"

ip routing

vlan 1

name "Management"

untagged 2,4,6,8-26

ip address 10.0.0.2 255.0.0.0

no untagged 1,3,5,7

exit

vlan 2

name "Compliant"

ip address 20.0.0.1 255.255.0.0

ip helper-address 10.0.0.1

exit

vlan 3

name "NonCompliant"

untagged 1,3,5,7

ip address 30.0.0.1 255.255.0.0

ip helper-address 10.0.0.1

exit

aaa authentication port-access eap-radius authorized

radius-server host 10.0.0.1 key secret

primary-vlan 3

aaa port-access authenticator 1,3,5,7

aaa port-access authenticator active

aaa port-access 1,3,5,7

Since I have multiple IP segments, I needed to enable IP Routing on the switch. This line makes that happen:

ip routing

Here are the VLANs. The names are self-evident. I only wanted 4 ports available for clients to authenticate with 802.1X (ports 1,3,5,7). I am not using 802.1X’s notion of port tagging the Ethernet frames, which I won’t go into here. I was going for simplicity, so I treated all seven of the switches like a completely separate network (non-routable between each switch).

vlan 1

name "Management"

untagged 2,4,6,8-26

ip address 10.0.0.2 255.0.0.0

no untagged 1,3,5,7

exit

vlan 2

name "Compliant"

ip address 20.0.0.1 255.255.0.0

ip helper-address 10.0.0.1

exit

vlan 3

name "NonCompliant"

untagged 1,3,5,7

ip address 30.0.0.1 255.255.0.0

ip helper-address 10.0.0.1

exit

We need to enable 802.1X on a port by port basis, as well as tell the switch how we intend to authenticate these ports. This is where we point the switch at the Windows Server 2008 machine running Network Policy Server (NPS). The shared secret I am using in this example is complex – it is “secret”. :->

aaa authentication port-access eap-radius authorized

radius-server host 10.0.0.1 key secret

primary-vlan 3

aaa port-access authenticator 1,3,5,7

aaa port-access authenticator active

aaa port-access 1,3,5,7

Make sure you commit the configuration to memory!

HP ProCurve 2626# write memory

Got more coming at you tomorrow! Stay tuned.

Jeff

NAP @ TechEd Podcast

JeffSigman — Wed, 11 Jun 2008 23:14:00 GMT

NAP - with Jeff Sigman and Others

Jeff Sigman – Microsoft
Chris Boscolo - Napera Networks, Inc.
Alex Chalmers - Ball State University
Pattabhi Attaluri - Avenda Systems

In this podcast from Tech·Ed NA 2008 IT Pro, Jeff Sigman talks about Network Access Protection (NAP). Alex Chalmers of Ball State University shares his experiences rolling out a large NAP deployment. Chris Boscolo (Napera Networks, Inc.) and Pattabhi Attaluri (Avenda Systems) talk about products their companies provide to add value to a NAP environment.

PowerPoint from the session.

Special thanks to Kevin Remde for making this podcast happen!

NAP Showcases Microsoft Interoperability

JeffSigman — Wed, 07 May 2008 23:53:00 GMT

I’d like to welcome a new guest blogger to the NAP Blog – Chris Edson. Chris is a senior engineer on NAP, and a huge resource to the team. If you have met him, you know what I am talking about. He just returned from his trip down to Las Vegas/Interop and wanted to share his experience! Go NAP!

Hello! Chris Edson here on the NAP team. Interop is a worldwide set of technology conferences that allow companies that do business in the networking space to come together and show how well they can work together. I recently took a trip down to Las Vegas to staff a station in the Microsoft pavilion at Interop, and I must say the experience was very positive!

Over the last several years, the NAP team at Microsoft has been busy building not only a platform to support and drive NAP, but a partner ecosystem that allows many other companies in the networking space and beyond to leverage the NAP platform to provide value to their own customers. One of the neat things about Interop is that, due to the focus of the show, it really allows us to showcase the work we’ve down with our partners – not just by pointing to their pavilions, but by including some of their displays within our own pavilion.

In addition to those partners that build on ‘top’ of the NAP platform (SHV/SHA creators), we were also able to showcase the fact that NAP, as an enforcement mechanism, works across many types of network hardware. The booth I helped run demonstrates that NAP 802.1x EAP-based enforcement works across a wide variety of switches by utilizing various combinations of standard RADIUS attributes to help control client access based upon the NAP assessments.

Apart from the Microsoft pavilion and those of our partner companies, there were also the Interop Labs activities – this is something that has been conducted at Interop over the last several years, but I think it has really grown in the number of participants, judging by the amount of hardware that was integrated into the lab environment. The Interop Labs had a section dedicated to Network Access Control technologies – of which NAP is a leading solution. The team behind Interop Labs took it upon themselves to put together a showcase environment that allowed participants to really get hands on with various NAC solutions (including NAP) and that hardware and software behind them. I had many visitors to the Microsoft pavilion who had spent time in the Interop Labs and overall the impressions were good.

In fact, NAC as a technology area is becoming so important; Interop has dedicated an entire day’s worth of workshop time to the topic!

But perhaps the most enjoyable part of working at the NAP station in the Microsoft pavilion was the excitement and anticipation people displayed when they came by the booth to discuss NAP. Many had very good questions about how NAP works, how it interoperates with the hardware on display, how it interoperates with Cisco’s NAC, how the two solutions compare, what other choices for enforcement they have, and how partners can get ‘plugged in’ to the NAP solution. The interest in NAP was stronger than we sometimes realize when we are hard at work on the product – it is energizing to be reminded how big of an impact this project is really going to have!

Many visitors told me they would be returning home to try out NAP, either in test labs or in real world deployments – and many were quite excited when they realized that the full set of NAP platforms is now available (Windows Server 2008, Windows Vista, and Windows XP SP3)!

So I’ll remind all the readers again that the NAP Platform is ready to go! Go get your copy of Windows Server 2008, and your client(s) of choice (Windows Vista or Windows XP SP3), and check out Network Access Protection – we have tons of information, including detailed step-by-step test lab guides, located at our portal.

May all your networks be healthy!

- Chris Edson

NAP Engineering Team

Enterprise Security Group

ProCurve Networking by HP Strengthens Network Security Through Integration with Microsoft NAP Technology

JeffSigman — Tue, 06 May 2008 21:31:00 GMT

A great NAP Partner of ours, ProCurve Networking, recently announced even greater support of NAP in their suite of products. I am posting the meat of the announcement below. I hope to get a personal demo of this soon and get some video of it up on the blog!

PALO ALTO, Calif., April 21, 2008 – ProCurve Networking by HP today announced with Microsoft a solution to protect networks with open, secure, standards-based interoperability that integrates ProCurve’s trusted infrastructure, policy management system and Microsoft’s Network Access Protection (NAP) technology.

ProCurve Identity Driven Manager (IDM) policy management tool is now compatible with Microsoft® NAP technology, providing customized network access policies for admission of users and clients across both wired and wireless environments.

“Having ProCurve switches, access points and IDM complement Microsoft’s NAP architecture provides customers with robust network security,” said Mauricio Sanchez, chief security architect, ProCurve Networking by HP. “Through this integration, ProCurve continues to deliver on its ProActive Defense strategy, which combines access control and network immunity with trusted architecture to defend against potential security threats.”

Calvin Choe, director of Technical Business Development in the Enterprise Networking Group at Microsoft, said, “The integration of Microsoft Network Access Protection and ProCurve networking products provides customers with a network security solution to protect their information assets.”

ProCurve IDM provides network administrators with the ability to centrally define and apply policy-based network access rights that allow the network to adapt automatically to the needs of users and devices as they connect, thereby enforcing network security while providing appropriate access to network users and devices.

Microsoft NAP is a policy enforcement technology built into the Windows Vista® and Windows® Server 2008 operating systems that allows customers to better protect network assets from unhealthy computers by enforcing compliance with network health policies. Microsoft NAP technology also will be available with Windows XP SP3.

“ProCurve is making network access control easier to integrate in enterprise networks and the beauty of Microsoft’s NAP is in the simplicity of deployment,” said Joel Snyder, senior partner at Opus One, a consulting and information services company based in Tuscon, Ariz. ”ProCurve’s IDM integrates cleanly with Microsoft’s NAP and provides security without complicating the deployment. Together it’s a win-win situation.”

Microsoft and ProCurve Networking by HP are longtime collaborators. Their work includes defining the IEEE 802.1X standard and their involvement within the Trusted Computing Group to develop and promote open, vendor-neutral, industry-standard specifications. In addition, HP and Microsoft’s relationship includes collaborative product engineering and development that equips customers with high-quality and cost-effective solutions.

“The combination of Microsoft NAP with ProCurve secure networking products provides customers with more choices to select interoperable solutions that improve information security, network resiliency and overall business efficiency,” said Greg Huza, Enterprise Systems Consultant at Heartland Business Systems based in Neenah, Wis. “We’re extremely excited about the opportunities this opens for us to reach a broader base of customers and increase sales.”

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

The World on {NAP}

JeffSigman — Mon, 05 May 2008 21:31:00 GMT

In case you haven’t noticed, {NAP} is being deployed across the globe! It is an exciting time with Windows Server 2008, Vista and XP SP3 NAP released and available to the world. Check out the great things 13 of our customers are saying below.

The full details of these customer deployments are in this word document. Check it out!!

City of Uppsala

Size
6,000 employees

Vertical
Government – Local

Country/Region
Sweden

PCL Constructors

Size
3,000 employees

Vertical
Building and Construction

Country/Region
Canada

Continental Airlines

Size:
44,000 employees

Vertical:
Aviation

Country/Region
United States

Rijksmuseum Amsterdam

Size:
420 employees

Vertical:
Museums

Country/Region
Netherlands, The

Fulton County

Size:
5,000 employees

Vertical:
Government - Central IT

Country/Region
United States

Microsoft Corporation

Size:
77,000 employees

Vertical:
Software Engineering

Country/Region
United States

La Trobe University

Size:
3,000 employees

Vertical:
Higher Education Institutions

Country/Region
Australia

KoçSistem

Size:
900 employees

Vertical:
IT Services

Country/Region
Turkey

Petron Corporation

Size:
1,300 employees

Vertical:
Oil & Gas

Country/Region
Philippines

University of Hradec Králové

Size:
800 employees

Vertical:
Universities

Country/Region
Czech Republic

City of Helsinki

Size:
40,000 employees

Vertical:
Government - Local

Country/Region
Finland

Government of Alberta

Size:
30,000 employees

Vertical:
Government - Regional / State

Country/Region
Canada

“With Windows Server 2008 Network Access Protection, all of our users will be able to access whatever network resources they need, regardless of their physical location or the state of their computers.”

Maurice Moes

Senior Architect and Project Manager, BRAIN FORCE

BRAIN FORCE

Size:
1,400 employees

Vertical:
Information Technology

Country/Region
Netherlands, The

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

NAP Partner Brief from Foundry Networks

JeffSigman — Fri, 25 Apr 2008 02:06:00 GMT

Recently, I was able to get my hands on a product from Foundry Networks while building out my NAP 802.1X Interoperability Showcase for RSA. Specifically, I was able to get the “Foundry FastIron Edge 4802-POE” 802.1X switch working flawlessly with NAP enforcement. I plan to make a follow-up blog post explaining exactly how I made this happen (including switch configurations).

I wanted to share a brief from Foundry Networks on what the Foundry – Microsoft NAP partnership is all about. Here is a quick excerpt from the full PDF document:

THE CHALLENGE

The proliferation of viruses and the threats they pose to enterprise networks makes the presence of antivirus software a network mandate. But even antivirus software is only as good as the timely installation of operating system updates, which can be a time and resource consuming challenge. Networks can be compromised when a computer requesting access to a network, or a device operating on the network, fails to meet the necessary health policy to prevent threats from propagating, such as operating system or antivirus updates.

HOW FOUNDRY AND MICROSOFT NETWORK ACCESS PROTECTION (NAP) HELP YOU MEET THE CHALLENGE

Network Access Protection (NAP) is a new platform and solution that controls access to network resources based on a client computer’s identity and compliance with corporate governance policy. Foundry Networks, a longstanding Microsoft Technology Partner, is delivering NAP interoperability for Foundry switches, which perform in conjunction with Microsoft Windows-based clients and the Microsoft Network Policy Server (NPS) to manage policies that restrict client access to network resources based on the health of the system. Joint customers of Microsoft and Foundry now have a standards-based tool to validate client health and secure network access without resorting to costly and potentially less effective proprietary networking technologies.

…continued in the full PDF document.

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

NAP Partners @ RSA

JeffSigman — Wed, 16 Apr 2008 00:21:00 GMT

A couple of people emailed me today and asked that I highlight the NAP Partners who were in the video and participated in the NAP Partner Pavilion @ RSA. Check it out below!

Avenda Systems	Avenda Systems delivers comprehensive, end-to-end Trust and Identity Policy Management solutions for enterprises. Avenda solutions enable enterprises to securely manage who and what can access the network, and from where, when and how that access can occur. Its solutions focus on helping enterprises to proactively and reactively secure their networks and computers from threats. The solution leverages standard and vendor-defined NAC architectures designed to take advantage of embedded security features in network and server infrastructure, thus providing comprehensive and flexible policy control by assessing all endpoints across all access methods. Avenda solutions are designed to interoperate with Cisco’s NAC, Microsoft’s NAP and TCG’s TNC frameworks.
Blue Ridge Networks	Blue Ridge Networks, a Microsoft NAP Partner, and endpoint security solutions provider, delivers impenetrable security solutions for government and private industry. The company's products have a proven ability to secure internet transactions and are relied upon by hundreds of large enterprises and security-sensitive government agencies.
D-Link	Founded in 1986, D-Link is a global leader in the design, manufacture and marketing of advanced networking, broadband, digital, voice and data communications solutions. Following our company motto, "Building Networks for People", D-Link continually meets the global networking and connectivity needs of digital home consumers, small office professionals, small- to medium-sized businesses, and enterprise environments.
Enterasys	Enterasys Networks is the Secure Networks Company, providing enterprise customers with innovative network infrastructure products, services, and solutions that deliver the security, productivity, and adaptability benefits required by Global 2000 organizations. The company's full line of Secure Networks products include multilayer switches, core routers, WAN routers, wireless LANs, network management, and intrusion defense systems.
Extreme Networks	Extreme Networks, a world leader in networking, delivers an effective applications and services infrastructure by creating networks that are faster, simpler, and more cost-effective. Founded in 1996 and based in Santa Clara, California, Extreme Networks pioneered the silicon-based approach to networking to enhance performance with Quality of Service and bandwidth management. Extreme Networks provides enhanced scalability, security, and availability for converged IP applications, including voice and video, with an open-standards approach, its global partnerships, and a complete family of intelligent and highly functional Ethernet switches. Extreme Networks addresses the network from the core to the edge with products ranging from high-end, carrier class data center and core switches, to simple, Layer 3 edge switches. Extreme Networks Unified Access architecture delivers ubiquitous access at the Enterprise edge with secure, manageable wired and wireless network connectivity from a single, integrated solution.
Foundry Networks	Foundry (Nasdaq: FDRY) is a leading provider of high-performance enterprise and service provider switching, routing, and Web traffic management solutions including Layer 2/3 LAN switches, Layer 3 Backbone switches, Layer 4-7 Web switches and Metro Routers. Foundry's 7,500 customers include the world's premier Internet service providers, Metro service providers, and enterprises such as e-commerce sites, universities, entertainment, health and wellness, government, financial, and manufacturing companies. Foundry's IronShield Security encompasses network-level features that Foundry has deployed in its full range of Layer 2-7 switches, routers, and intelligent traffic management devices to implement secure networks. The focus is on using networking devices as policy enforcement points that do not compromise performance.
Juniper Networks	Juniper Networks (NASDAQ:JNPR) transforms the business of networking by creating competitive advantage for our customers with superior networking and security solutions. Juniper Networks is dedicated to customers who derive strategic value from their networks, including global network operators, enterprises, government agencies, and research and educational institutions. Juniper's portfolio of networking and security solutions supports the complex scale, security, and performance requirements of the world's most demanding mission-critical networks.
McAfee	McAfee, Inc. (NYSE:MFE) creates best-of-breed computer security solutions that prevent intrusions on networks and protect computer systems from the next generation of blended attacks and threats. Through collaboration with Network Access Protection technology from Microsoft, users of McAfee VirusScan Enterprise 8.0i and 7.x can enforce policy compliance on all systems connecting to Microsoft networks, ensuring that malicious code threats, such as the Bagle and Lovegate worms, are prevented from entering networks.
Microsoft ForeFront	Protecting clients and servers is one of the toughest challenges in IT today. Administrators must establish and enforce security policies that provide robust protection while being flexible enough to accommodate the connectivity needs of a growing number of internal and external users, device types, system configurations, and network connection types. Together, Microsoft Forefront and Windows Server 2008 deliver a next generation security solution with integrated protection, advanced access control, and simplified management that helps IT professionals maximize control over their security infrastructure.
Napera	Napera provides network solutions that enable small and medium enterprises to build safe, secure and healthy networks. Napera solutions defend against unauthorized access and prevent the spread of malicious software. Our products are easy to deploy, use, and support. For smaller enterprises, Napera makes network health easy.
Nortel	Nortel has teamed with Microsoft to support the Microsoft NAP program through high-performance, interoperable network designs based on industry standards. Nortel specializes in protecting IP multimedia communications with a layered approach to network defense. As part of NAP, Nortel will provide critical access technology based on the award-winning Nortel VPN Gateway and Secure Routing Technology portfolios. Nortel's VPN solutions include products that ensure end-users are compliant with the broader enterprise security policies, with the ability to deny or restrict network access accordingly or to force end-user compliance with subscription-styled updates. Nortel helps enterprises and service providers control critical business processes by building standards-compliant, open security solutions that integrate into today's IT environment and adapt to tomorrow's security threats. Nortel solutions actively respond to even unforeseen security threats by building resiliency and adaptability into every solution and network plan.
ProCurve Networking	The ProCurve Networking business unit of HP delivers enterprise networking solutions comprising wired and wireless LAN and WAN networking products and services, and security through the ProCurve ProActive Defense. The ProCurve Adaptive EDGE Architecture strategy is the industry’s only comprehensive and inclusive network design strategy that is adaptable, scalable and completely interoperable for achieving command from the center with control to the network edge. ProCurve was positioned in the challenger quadrant in research and advisory firm Gartner, Inc.’s 2006 Magic Quadrant Report for Global Campus LANs.
SkyRecon Systems	Founded in 2003, SkyRecon Systems is the first European vendor of distributed behavioral security software solutions. Our mission is to ensure that each member of staff of our clients enjoys the continuity of work at his/her personal computer. Our products preserve the integrity of the data and the reliability of the applications on each PC. SkyRecon Systems thus allows every organization to protect itself efficiently against the denials of service and the theft or the destruction of critical information caused by viruses, piracy actions or hardware failures. SkyRecon Systems is an innovating company. Our technology relies on state-of-the-art research on kernel programming and artificial intelligence. This work led to the deposit of two patents, the support of the French National Agency for Innovation (ANVAR) and numerous European awards. In 2006, SkyRecon Systems signed a strategic partnership with Microsoft to support SkyRecon's engineering, sales and marketing activities. The head office of SkyRecon Systems is in Paris, France.
UNETsystem	UNETsystem provides security solutions including 802.1X wireless LAN security, Network Access Control, Public Key Infrastructure and Network Behavior Analysis solutions. Managed Security and Security Outsourcing services are also a major business area. UNETsystem developed the first Korea Network Access Control solution and is the leading provider of this area in Korea. UNETsystem, established in 2003 and located in Seoul, has four technology patents about Network Access Control and Network Behavior Analysis technologies. UNETsystem is providing security services for many customers including government agencies, public organizations, financial institutions, telecommunications, logistics, IT companies, cooperatives and business partners. UNETsystem recently developed an integration module for Microsoft NAP to accelerate the interoperability of Microsoft NAP.

As I said in this post, if you are interested in any of the 802.1x switch configurations from the show, just shoot me an email.

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Video: NAP World Tour @ RSA 2008 San Francisco

JeffSigman — Tue, 15 Apr 2008 18:56:00 GMT

I just got back from San Francisco where I was speaking to anyone who would listen about how NAP is changing the world. :-> I wanted to share the video I put together of the trip to give you a flavor of what it was like to be there.

My effort leading up to the show was putting together the 802.1x NAP Interoperability Showcase, which you will see in the video. If you are interested, I also discuss it here in my personal blog about the whole trip.

Hope you enjoy!

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

NAP demos from Down Under

MS NAP Team — Fri, 15 Feb 2008 01:29:00 GMT

I just recently met Michael Kleef, a Microsoft Technology Advisor from Australia, at a Server 2008 field readiness event here in Seattle. Very cool guy who loves NAP. I instantly liked him. :->

I was poking around on his blog and found some great content. Check out his NAP + IPsec sceencasts as well as his awesome NAP + 802.1x blogcast (using Cisco switches). Very nice!

Looks like I have some competition from down under. Go NAP!

Jeff Sigman
Senior Program Manager
Network Access Protection (NAP)

Please check out the NAP Blog, FAQ, Forum, MSDN and Site.