Network Access Protection (NAP) : Partners

HP ProCurve Open Network Ecosystem (ONE) launches with Microsoft as a key member

MS NAP Team — Tue, 27 Jan 2009 19:29:00 GMT

The Hewlett-Packard (HP) ProCurve Open Network Ecosystem (ONE) is a new partner alliance program for ProCurve, the networking division of HP. Microsoft is a key member in ProCurve ONE and an important element of the alliance is interoperability with NAP.

Here is a quote from the NAP team's very own General Manager, Tim Sinclair:

"HP ProCurve ONE will help customers resolve interoperability concerns by delivering an open standards-based solution that is effective and efficient. The combination of the HP ProCurve ONE initiative and Microsoft Network Access Protection (NAP) will provide customers with enhanced security and policy-based access that helps reduce downtime and boosts return on investment."

For more information, see the Newsfactor.com article at http://www.newsfactor.com/news/HP-Launches-ProCurve-Alliance/story.xhtml?story_id=1230040K3ZM9.

Avenda Announces $1 eAgent Introductory Pricing – From now until after the RSA Conference 2009

MS NAP Team — Fri, 09 Jan 2009 20:41:00 GMT

Here is a follow-up guest posting from our NAP Partner Avenda Systems.

Due to the interest in our recent blog entry - Five Ways to Draw More Value from Microsoft NAP Deployments - we’ve decided to help customers kick off 2009 with a little cost savings. The calls and email have been overwhelming and have helped us understand that a lot of you are looking at role-based access and endpoint posture and health validation as a real way to leverage Microsoft’s NAP technology.

With the release of Windows Server 2008, network policy and services is something everyone should be considering to secure 802.1X-based wireless, wired, and VPN deployments. Additionally, the NAP agent for Windows XP is in Service Pack 3, which was released worldwide earlier in 2008. As a result, a NAP client was expected to be available to some 80% or more of Windows laptops, by the end of 2008.

Avenda’s eAgents add the ability to extend Microsoft NAP capabilities and to support non-Microsoft operating systems.

From now until April 30^th, one week after the end of the RSA Conference 2009 in San Francisco, each copy of our eAgents can be purchased for $1 each. This includes the Windows and Linux NAP agents.

Five Ways to Draw More Value from Microsoft NAP Deployments

MS NAP Team — Wed, 07 Jan 2009 03:07:00 GMT

Here is a guest posting from our NAP Partner Avenda Systems.

When the founders of Avenda Systems decided to build a Policy Platform, one of the first stops included Microsoft. NAP was in the works and discussions with other industry experts led us to embrace the idea of creating a product or products that truly allowed for adding value to the NAP platform.

Early discussions with Microsoft centered on the development of extensible NAP agents for the support of Windows and Vista operating systems, as well as delivering agents for client operating systems other than Windows. The plan was to provide supplemental value to allow organizations to easily deploy NAP in heterogeneous operating system environments and take advantage of NAP’s robust endpoint health policy architecture.

Here are five ways that you can get value from the combination of NAP and products from Avenda Systems:

1. No other Policy Server required

The use of Avenda’s eAgents lets organizations use the resources they have already deployed to support NAP. All three functions of Windows Server 2008, Network Policy Server (NPS)—RADIUS server, RADIUS proxy, and NAP health policy server—are leveraged across all access methods, including wireless, wired, and VPNs.

At some point the need to support managed and unmanaged devices in a NAP environment may warrant the use of a complimentary platform, but the addition of intermediary policy servers should not be required when investigating NAP Partner solutions.

2. Extended control beyond Windows Security Center checks
When using the Windows Security Health Validator (WSHV), policy validation checks are performed to verify the existence and status (running or not) of the following; Firewall, Anti-Virus Protection, Spyware Protection, Automatic Updating, and Security Update Protection. Based on a client’s response, a noncompliant result can cause the client to be put into a restricted network until the condition has been corrected. For example, if a client has turned off Anti-Virus for some reason, they will not be allowed full network access until the Anti-Virus software has been turned on again.

When using Avenda’s Universal System Health Agent (USHA) and Universal System Health Validator (USHV), administrators gain the ability to create fine-grained policies that extend beyond the verification of the status of the applications and services described above. In addition, the client can be requested to provide version numbers, DAT file and engine revisions and the time the last scan was performed, and automatic remediation can be performed for Anti-Virus and Anti-Spyware applications. The Avenda SHV can also be configured to check for and will start or stop certain services and applications that match specified registry values. For example, clients that have Skype installed can be restricted (as detected by registry values). Once on the network, if Skype is installed again, the next health evaluation can restrict the client.

As the adoption of Windows Server 2008 increases, inquiries regarding our eAgents has really picked up. Customers are attracted to the expanse of additional functionality and our ability to quickly integrate new features. Additional features such as server-side policy checks for latest versions and updates of anti-malware products and data files are available as a portal service from Avenda.

3. Supported Operating Systems
Avenda’s eAgents are available for Windows Vista, Windows XP with Service Pack 3, and Windows Server 2008. In addition, we also have a Linux NAP Agent (with 802.1X enforcement) and a Macintosh NAP Agent is in the works.

4. Dissolvable Agents
Many organizations allow guest and partner access and a common concern has been how to treat unmanaged clients (either lacking or have misconfigured supplicants) that attempt to connect to the network. The addition of Avenda’s eTIPS Policy Server, which interacts with Microsoft NPS, supports this requirement. A fully NAP SoH protocol-compliant dissolvable agent (a Java applet), in simple terms, performs Web authentication and health checks through a captive portal.

For transient users, policies can also determine what level of access is allowed, for what length of time and on which days of the week.

5. Avenda’s competitive advantage

When deploying eAgents in a network (especially for educational institutions, companies that are merging, call centers, etc.), it is important for the agent to support and expect to encounter anti-malware products from multiple vendors. Avenda’s eAgents ship with support for all major anti-malware vendors.

NAP clients for Linux and Macintosh are available

MS NAP Team — Wed, 17 Dec 2008 01:36:00 GMT

NAP Clients for Linux and Macintosh are available from Avenda and UNETsystem, Inc.

Avenda

The Avenda Linux NAP Agent includes 802.1X enforcement, the Avenda System Health Agent (SHA), and the Avenda Linux NAP Agent System Health Validator (SHV), which you install on your NAP health policy server. For more information, see the Linux Agent tab of the Avenda NAP Agents Web page.

For the datasheet on the Avenda Linux NAP Agent, click here.

UNETsystem

UNETsystem, Inc. provides both a Linux and Macintosh NAP client.

The UNETsystem Linux NAP Client includes 802.1X and DHCP enforcement, the UNET SHA, and the UNET SHV to install on your NAP health policy server. To download it, click here.

The UNETsystem Macintosh NAP Client also includes 802.1X and DHCP enforcement, the UNET SHA, and the UNET SHV to install on your NAP health policy server. To download it, click here.

For more information, see the datasheet available here.

Download, install, play, and enjoy!

Joe Davies

How to install Cisco's EAP-FAST method, from the EAP product team

MS NAP Team — Fri, 12 Dec 2008 19:16:00 GMT

The Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling (EAP-FAST) EAP type from Cisco Systems, Inc. has been certified for compatibility with Windows Vista with Service Pack 1 and Windows Server 2008 and is now available from Windows Update.

EAP-FAST is needed for computers running Windows Vista with Service Pack 1 or Windows Server 2008 to participate in the Microsoft NAP and Cisco Network Admission Control (NAC) Framework interoperability solution, also known as NAP-NAC. For more information about NAP-NAC, click here.

The EAP product team has posted instructions on how to install the EAP-FAST method. See http://blogs.msdn.com/eapteam/archive/2008/10/17/how-do-i-install-cisco-eap-fast-on-my-computer.aspx.

Enjoy!

Joe Davies

"Nortel and Microsoft Discuss Network Access Control" Webcast now available

MS NAP Team — Fri, 21 Nov 2008 04:01:00 GMT

Greetings practitioners of NAPinetics!

The "Nortel and Microsoft Discuss Network Access Control" Webcast that I recorded with Matt Oshida and Terry Singleton of Nortel is now available for viewing at:

http://www2.nortel.com/go/events_detail.jsp?cat_id=-8005&oid=100247172&block=8&locale=en-US

Click "View the Webcast".

Thanks to Matt and Terry for letting me participate. I gave an overview of NAP and NAP architecture to pave the way for a detailed explanation of the combined Nortel and NAP integration architecture.

Enjoy!

Joe Davies
Program Manager

"Nortel and Microsoft Present Secure Network Access 2.0" Webcast on Tuesday

MS NAP Team — Fri, 14 Nov 2008 20:26:00 GMT

Greetings NAP fans!

I will be teaming up with Nortel to present "Nortel and Microsoft Present Secure Network Access 2.0" on Tuesday, November 18, from 9:30 to 10:30 AM (Pacific Time).

See http://www.nortel.com/products/01/contivity/collateral/nn123373.pdf for an overview of Nortel Secure Network Access (SNA) and NAP integration.

Joe Davies
Senior Program Manager

Standing room only for the NAP and Unified Secure Access presentation at McAfee’s Focus 08

MS NAP Team — Thu, 23 Oct 2008 19:14:00 GMT

On Tuesday, Dan Wolff, George Younan, and I delivered the “Microsoft and McAfee: Implementing Network Access Control in Microsoft Environments” breakout session at McAfee’s Focus 08 Security Conference. Dan Wolff is a Group Solution Marketing Manager and George Younan is a Senior Security Consultant with McAfee.

The room filled up quickly and even after bringing in more chairs, there were people standing at the back. I spent about 35 minutes presenting a technical overview of NAP and how McAfee’s Network Access Control 3.0 product fit into the NAP architecture. Dan finished the presentation with information about the joint solution using NAP with McAfee’s Unified Secure Access and George gave a great demo showing virtualized DHCP enforcement using the McAfee SHA and SHV.

All in all, a well–presented and received session and an indication of the rising interest in NAC solutions using third-party products for health assessment capabilities and NAP as the enforcement mechanism.

Thanks Dan and George for the assist!

Joe Davies
Program Manager

System Health Agents (SHAs) and System Health Validators (SHVs) that are available from NAP partners

MS NAP Team — Tue, 30 Sep 2008 23:21:00 GMT

In my previous blog post, System Health Agents (SHAs) that are available from Microsoft, I described the SHAs (and their corresponding system health validators [SHVs]) that you can use with Windows Security Center in Windows Vista and Windows XP with Service Pack 3, Microsoft System Center Configuration Manager (SCCM), and Microsoft Forefront Client Security (FCS).

Here is the list of SHAs and SHVs that are available from NAP partners (as of 10/6/08).

Partner	Product	Status	Links
Avenda Systems	Windows Universal SHA/SHV	Shipping	Location Datasheet
Blue Ridge Networks	Secure EdgeGuard, which includes an EdgeGuard SHA and SHV	Shipping	Location
Computer Associates	CA Threat Manager r8.1, which includes an eTrust SHA and SHV	Shipping	Location Press Release
Kaspersky Lab	Kaspersky Administration Kit 7.0, which includes a Kaspersky Lab SHA and SHV	In Beta testing	Location Press Release
McAfee	McAfee Network Access Control (MNAC) 3.0, which includes a McAfee SHA and SHV	Shipping	Location
Nortel	Nortel Secure Network Access (SNA), which includes an SNA SHA and SHV	Shipping	Location More Information
Symantec	Symantec Network Access Control 11.0, which includes a SHA and SHV for Symantec NAC	Shipping	Location
UNETsystem	UNET SHA, which includes a UNET SHA and SHV	Shipping	Location

The momentum is building…

Enjoy!

Joe Davies
Senior Program Manager

Spotlight on NAP Partners: Napera Networks

MS NAP Team — Tue, 23 Sep 2008 23:50:00 GMT

This is the first in a series of NAP blog entries to shine a light on the efforts of our NAP partners to develop and deliver integrated products and solutions for the NAP platform.

In this entry, Margaret Dawson, Vice President of Marketing for Napera Networks and former Group Product Manager with the Microsoft Forefront security team, describes the history of Napera’s partnership with the NAP development team and their current NAP-integrated products. Napera recently demonstrated its N24 appliance at TechEd 2008 in Orlando.

When the founders of Napera first started putting ideas on paper, they knew they wanted to help small and medium sized enterprises (SMEs) succeed at network security. These companies had invested a lot of money in firewalls, anti-malware solutions, and other security products but were still seeing security breaches, malware attacks, and compliance issues. This was mostly due to the increased mobility of the workforce and the ubiquity of wireless, in addition to the fact that SMEs typically do not have security or networking specialists on staff.

We identified an opportunity around network access control (NAC). The SME market is underserved in the network security space in general and specifically with NAC solutions, as all the products and architectures on the market were complex, expensive, and tended to require complicated infrastructure. Napera solutions were created to provide all the value of NAC in an easy and cost-effective fashion.

Early on, we talked to the Microsoft NAP engineering team to understand how we could work with the NAP platform. As a result of that partnership, Napera is one of the few vendors who licenses Microsoft's protocols to create a highly integrated solution around NAP. Many companies are compatible with NAP, but the Napera 24 appliance goes beyond compatibility and communicates directly with the NAP Agent service in Windows Vista and Windows XP with Service Pack 3 for fast and easy health reporting and policy enforcement.

Napera builds on the value the Microsoft NAP platform provides to deliver a single solution that combines device health enforcement for both Windows and Macintosh-based computers, identity enforcement with Active Directory or a local database, and guest access to the Internet and printers. To further smooth the rollout of NAP in smaller companies, Napera moved all of the 'heavy lifting' around management into the cloud with the MyNapera.com online service, which provides logging, reporting, and alerting and enables easy back-up configuration services.

The Napera N24 appliance deploys like a switch in just ten minutes. An IT administrator can quickly start monitoring their network and understanding the health and identity of devices. It’s been interesting to see the response from customers, with one saying it was just like having a microscope on his network. Another customer found virtual machines he didn’t even realize were on the network, and a third customer had not realized that employees were using their iPhones to access the Internet via the corporate network, which he wanted to block.

We are on an aggressive product innovation path, delivering incremental software releases every two to three months. Earlier this month, we released Napera version 1.2, which extended our capabilities to Wi-Fi environments, making it easy to integrate WPA/WPA2-Enterprise authentication. The Napera N24 now works with new or existing 802.11 deployments for secure, user-based wireless access. With this launch, our customers can use a single wireless access point for both guests and employees, managing health and authentication requirements and controlling network access. This latest release greatly simplifies the configuration of WPA/WPA2 Enterprise with Active Directory and removes the poor security and shared passwords of WEP and WPA-Personal authentication in wireless deployments.

We are working with Microsoft to create additional momentum for NAP in smaller enterprises. As Microsoft builds more capability into the NAP platform, we will continue to look for ways to integrate and leverage those technologies to provide our customers with added value and a solution that is easy to buy and deploy.

Margaret Dawson

margaret.dawson@napera.com

Vice President of Marketing Napera Networks

New case study for Blue Ridge Networks published

MS NAP Team — Mon, 08 Sep 2008 23:35:00 GMT

Salutations, fellow NAP fans!

Check out this new case study for Blue Ridge Networks that was published today.

This case study describes how Blue Ridge Neworks, a NAP partner, used Solution Accelerators to integrate NAP, Microsoft Forefront Client Security, and their EdgeGuard product. The study details the situation, the solution, and the benefits of the resulting integration.

Enjoy.

Joe Davies
Senior Program Manager

This posting is provided "AS IS" with no warranties, and confers no rights.

Whatever happens off-enterprise may not stay off-enterprise!

MS NAP Team — Wed, 30 Jul 2008 22:09:00 GMT

Here is a guest post from Eirik Iverson of Blue Ridge Networks. Thanks Eirik!

Whatever happens off-enterprise may not stay off-enterprise! That’s the basis for the whole network admission control (NAC) concept. It’s quite an understatement actually.

Malware infestations have become so sophisticated as to be practically invisible to typical administrators and the tools they can use proficiently. “Stuff” happens on PCs when no one from IT is looking, particularly off-enterprise, that lead to helpdesk trouble tickets or data leaks. Prevention is critical, but not fool-proof. However, part-time policy enforcement is proof of foolishness. The old refrain is familiar: no anti-virus protection, no access to networked resources in the enterprise. But compliance on-enterprise does not guarantee compliance off-enterprise. A reliable software agent on each host can monitor them and enforce policies.

Beyond anti-virus, there are many other controls and monitors that an enterprise employing best practices would ideally implement on- and off-enterprise (i.e., continuous monitoring and enforcement). Anti-spyware, personal firewall, disk encryption, and other client security agents must be running properly. Another control includes enforcing registry settings that harden a PC from hackers, malware, and user mistakes. Add to that application and device monitoring and controls over what software may/must/must-not run on a PC and what a user may do with removable media (e.g., thumb drives, DVD writers, etc.). The controls must also make PCs safe from whatever USB thumb drives end-users insert. ESET Inc. recently reported that roughly 10% of their malware detections originated from thumb drives.

Even with all of these monitors and controls in place, the job is not done because the risk space is not static. Today’s vulnerability/exploit report on a software application found on many off-enterprise laptops may require a workaround such as a registry change regarding an ActiveX kill-bit (when implemented, this disables a specific ActiveX applet that could be exploited by a hacker) or maybe rendering that software “unstartable” until a patch is available. Some risks may not fall neatly into an existing policy category and can only be assessed or countered through a custom script. Therefore, the policy enforcement agent must be capable of doing the unexpected, receiving policy updates, and returning log files when off-enterprise.

Because endpoints are often off-enterprise and because IT organizations are often understaffed, many end-users are endowed with administrative privileges so they possess the flexibility they insist is required. Many of these users operate their PCs on a daily basis in this mode, increasing its susceptibility to malware infestations and increasing trouble ticket volume. Endpoint policies should not only reduce security risks but also prevent avoidable trouble tickets. End-users with administrative privileges, however, can circumvent endpoint policies. Such users warrant a hardier agent for administrators to employ, which can render a critical application, such as Windows Defender, unstoppable, despite the end-user’s administrative privileges.

Administrators can avoid finding themselves utilizing four different monitoring and control systems for endpoints on-enterprise, off-enterprise, using Wi-Fi, or using remote access VPN. Tight integration between Blue Ridge/Secure EdgeGuard™ and Microsoft's Network Access Protection (NAP) delivers a unified solution. This was demonstrated at InterOp Labs 2008. Check out this white paper posted on the SecureIT Alliance Web site to learn more about it. Additionally, you can learn more about other EdgeGuard capabilities, such as its defense against zero-day malware, on the Blue Ridge Networks Web site as well as many other information security challenges on our blog.

Eirik Iverson
Product Management
Blue Ridge/Secure EdgeGuard

NAP Showcases Microsoft Interoperability

JeffSigman — Wed, 07 May 2008 23:53:00 GMT

I’d like to welcome a new guest blogger to the NAP Blog – Chris Edson. Chris is a senior engineer on NAP, and a huge resource to the team. If you have met him, you know what I am talking about. He just returned from his trip down to Las Vegas/Interop and wanted to share his experience! Go NAP!

Hello! Chris Edson here on the NAP team. Interop is a worldwide set of technology conferences that allow companies that do business in the networking space to come together and show how well they can work together. I recently took a trip down to Las Vegas to staff a station in the Microsoft pavilion at Interop, and I must say the experience was very positive!

Over the last several years, the NAP team at Microsoft has been busy building not only a platform to support and drive NAP, but a partner ecosystem that allows many other companies in the networking space and beyond to leverage the NAP platform to provide value to their own customers. One of the neat things about Interop is that, due to the focus of the show, it really allows us to showcase the work we’ve down with our partners – not just by pointing to their pavilions, but by including some of their displays within our own pavilion.

In addition to those partners that build on ‘top’ of the NAP platform (SHV/SHA creators), we were also able to showcase the fact that NAP, as an enforcement mechanism, works across many types of network hardware. The booth I helped run demonstrates that NAP 802.1x EAP-based enforcement works across a wide variety of switches by utilizing various combinations of standard RADIUS attributes to help control client access based upon the NAP assessments.

Apart from the Microsoft pavilion and those of our partner companies, there were also the Interop Labs activities – this is something that has been conducted at Interop over the last several years, but I think it has really grown in the number of participants, judging by the amount of hardware that was integrated into the lab environment. The Interop Labs had a section dedicated to Network Access Control technologies – of which NAP is a leading solution. The team behind Interop Labs took it upon themselves to put together a showcase environment that allowed participants to really get hands on with various NAC solutions (including NAP) and that hardware and software behind them. I had many visitors to the Microsoft pavilion who had spent time in the Interop Labs and overall the impressions were good.

In fact, NAC as a technology area is becoming so important; Interop has dedicated an entire day’s worth of workshop time to the topic!

But perhaps the most enjoyable part of working at the NAP station in the Microsoft pavilion was the excitement and anticipation people displayed when they came by the booth to discuss NAP. Many had very good questions about how NAP works, how it interoperates with the hardware on display, how it interoperates with Cisco’s NAC, how the two solutions compare, what other choices for enforcement they have, and how partners can get ‘plugged in’ to the NAP solution. The interest in NAP was stronger than we sometimes realize when we are hard at work on the product – it is energizing to be reminded how big of an impact this project is really going to have!

Many visitors told me they would be returning home to try out NAP, either in test labs or in real world deployments – and many were quite excited when they realized that the full set of NAP platforms is now available (Windows Server 2008, Windows Vista, and Windows XP SP3)!

So I’ll remind all the readers again that the NAP Platform is ready to go! Go get your copy of Windows Server 2008, and your client(s) of choice (Windows Vista or Windows XP SP3), and check out Network Access Protection – we have tons of information, including detailed step-by-step test lab guides, located at our portal.

May all your networks be healthy!

- Chris Edson

NAP Engineering Team

Enterprise Security Group

ProCurve Networking by HP Strengthens Network Security Through Integration with Microsoft NAP Technology

JeffSigman — Tue, 06 May 2008 21:31:00 GMT

A great NAP Partner of ours, ProCurve Networking, recently announced even greater support of NAP in their suite of products. I am posting the meat of the announcement below. I hope to get a personal demo of this soon and get some video of it up on the blog!

PALO ALTO, Calif., April 21, 2008 – ProCurve Networking by HP today announced with Microsoft a solution to protect networks with open, secure, standards-based interoperability that integrates ProCurve’s trusted infrastructure, policy management system and Microsoft’s Network Access Protection (NAP) technology.

ProCurve Identity Driven Manager (IDM) policy management tool is now compatible with Microsoft® NAP technology, providing customized network access policies for admission of users and clients across both wired and wireless environments.

“Having ProCurve switches, access points and IDM complement Microsoft’s NAP architecture provides customers with robust network security,” said Mauricio Sanchez, chief security architect, ProCurve Networking by HP. “Through this integration, ProCurve continues to deliver on its ProActive Defense strategy, which combines access control and network immunity with trusted architecture to defend against potential security threats.”

Calvin Choe, director of Technical Business Development in the Enterprise Networking Group at Microsoft, said, “The integration of Microsoft Network Access Protection and ProCurve networking products provides customers with a network security solution to protect their information assets.”

ProCurve IDM provides network administrators with the ability to centrally define and apply policy-based network access rights that allow the network to adapt automatically to the needs of users and devices as they connect, thereby enforcing network security while providing appropriate access to network users and devices.

Microsoft NAP is a policy enforcement technology built into the Windows Vista® and Windows® Server 2008 operating systems that allows customers to better protect network assets from unhealthy computers by enforcing compliance with network health policies. Microsoft NAP technology also will be available with Windows XP SP3.

“ProCurve is making network access control easier to integrate in enterprise networks and the beauty of Microsoft’s NAP is in the simplicity of deployment,” said Joel Snyder, senior partner at Opus One, a consulting and information services company based in Tuscon, Ariz. ”ProCurve’s IDM integrates cleanly with Microsoft’s NAP and provides security without complicating the deployment. Together it’s a win-win situation.”

Microsoft and ProCurve Networking by HP are longtime collaborators. Their work includes defining the IEEE 802.1X standard and their involvement within the Trusted Computing Group to develop and promote open, vendor-neutral, industry-standard specifications. In addition, HP and Microsoft’s relationship includes collaborative product engineering and development that equips customers with high-quality and cost-effective solutions.

“The combination of Microsoft NAP with ProCurve secure networking products provides customers with more choices to select interoperable solutions that improve information security, network resiliency and overall business efficiency,” said Greg Huza, Enterprise Systems Consultant at Heartland Business Systems based in Neenah, Wis. “We’re extremely excited about the opportunities this opens for us to reach a broader base of customers and increase sales.”

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

NAP Partner Brief from Foundry Networks

JeffSigman — Fri, 25 Apr 2008 02:06:00 GMT

Recently, I was able to get my hands on a product from Foundry Networks while building out my NAP 802.1X Interoperability Showcase for RSA. Specifically, I was able to get the “Foundry FastIron Edge 4802-POE” 802.1X switch working flawlessly with NAP enforcement. I plan to make a follow-up blog post explaining exactly how I made this happen (including switch configurations).

I wanted to share a brief from Foundry Networks on what the Foundry – Microsoft NAP partnership is all about. Here is a quick excerpt from the full PDF document:

THE CHALLENGE

The proliferation of viruses and the threats they pose to enterprise networks makes the presence of antivirus software a network mandate. But even antivirus software is only as good as the timely installation of operating system updates, which can be a time and resource consuming challenge. Networks can be compromised when a computer requesting access to a network, or a device operating on the network, fails to meet the necessary health policy to prevent threats from propagating, such as operating system or antivirus updates.

HOW FOUNDRY AND MICROSOFT NETWORK ACCESS PROTECTION (NAP) HELP YOU MEET THE CHALLENGE

Network Access Protection (NAP) is a new platform and solution that controls access to network resources based on a client computer’s identity and compliance with corporate governance policy. Foundry Networks, a longstanding Microsoft Technology Partner, is delivering NAP interoperability for Foundry switches, which perform in conjunction with Microsoft Windows-based clients and the Microsoft Network Policy Server (NPS) to manage policies that restrict client access to network resources based on the health of the system. Joint customers of Microsoft and Foundry now have a standards-based tool to validate client health and secure network access without resorting to costly and potentially less effective proprietary networking technologies.

…continued in the full PDF document.

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}