Network Access Protection (NAP) : Troubleshooting

What is NAP traffic?

MS NAP Team — Tue, 06 Jan 2009 03:59:00 GMT

Here is a question posed by a member of the NAP community:

· What new traffic will there be on the network when I deploy NAP?

A NAP deployment can have the following additional sets of network traffic:

· Traffic between the NAP client and the NAP enforcement point. The nature of this traffic depends on the NAP enforcement method.

o For IPsec enforcement, the NAP client communicates to the HRA using HTTP or HTTPS to indicate its identity and health state and to receive the system health evaluation results and the health certificate.

o For 802.1X enforcement, the NAP health evaluation is done over PEAP-TLV, resulting in a small amount of additional EAPOL traffic to send the health state and health evaluation results between the NAP client and the switch or wireless access point.

o For VPN enforcement, the NAP health evaluation is done over PEAP-TLV, resulting in small amount of additional PPP traffic to send the health state and health evaluation results between the NAP client and the VPN server.

o For DHCP enforcement, the NAP health evaluation is done using the same DHCP messages that are already being used for DHCP address allocation, resulting in larger payloads for some DCHP messages, but not additional messages.

o For TS Gateway enforcement, the NAP health evaluation is done over the Remote Procedure Call (RPC) over HTTP protocol that is used for connections to a TS Gateway server, resulting in a small amount of additional traffic to send the health state from the TS Gateway client and the TS Gateway server.

· Traffic between the NAP enforcement point and the NAP health policy server. This is RADIUS traffic, consisting of one or multiple exchanges of RADIUS request and response messages. RADIUS traffic is UDP-based and adds minimal additional traffic on your network.

· Traffic between the NAP enforcement point and other servers. The most obvious example is the traffic between the Health Registration Authority (HRA) and an Active Directory domain controller and a certification authority (CA) to authenticate the NAP client and obtain a health certificate.

· Traffic between the NAP health policy server and health requirement servers. This traffic depends on the SHVs running on the NAP health policy server. The Windows Security Health Validator (WSHV) does not require communication with health requirement servers.

Joe Davies
Senior Program Manager

Network Access Protection Troubleshooting Guide is live!

MS NAP Team — Mon, 22 Dec 2008 18:39:00 GMT

Hey citizens of New NAP City!

The Network Access Protection Troubleshooting Guide, authored by our very own technical writer and NAP Forum hero Greg Lindsay, is now live! This completes the product documentation set for NAP in Windows Server 2008.

http://technet.microsoft.com/en-us/library/dd348515.aspx

The NAP Troubleshooting Guide provides provides task-oriented information to help you identify and resolve NAP-related problems quickly for the Windows Server 2008, Windows Vista, and Windows XP with Service Pack 3 operating systems. This guide can assist you when performing root-cause analysis of incidents and problems with the components of a NAP infrastructure.

This guide contains the following sections:

· Introduction to Troubleshooting NAP

· A-Z List of Problem Topics for NAP

· Things to Check Before Troubleshooting NAP

· Quick Fixes for NAP

· Tools for Troubleshooting NAP

· Troubleshooting NAP Problems

You can provide feedback on individual pages of the NAP Troubleshooting Guide by clicking “Click to Rate and Give Feedback” just above the content pane.

A big thank you to Greg for his authoring efforts and to NAP product team reviewers.

Enjoy!

Joe Davies

The Cable Guy Troubleshooting NAP Enforcement

JeffSigman — Wed, 07 May 2008 00:53:00 GMT

The Cable Guy, Mr. Joseph Davies, wrote a great article in the April issue of TechNet magazine - Troubleshooting NAP Enforcement. I just recently created a new tag on this blog to highlight the troubleshooting posts we’ve had so far. I hope to post many more as I continue to learn what can go wrong in NAP deployments happening around the world.

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

NAP FAQ: Logging baby, logging

JeffSigman — Sun, 27 Apr 2008 00:17:00 GMT

A colleague of mine pointed out an AMAZING blog post on the Windows Server Customer Advisory Team (WinCAT) team blog - The Definitive Guide to NAP Logging. This is a kick butt troubleshooting post! Very useful when trying to track down what is wrong between NAP Client and Server.

Much thanks Pete Rivera (the author), John Morello (the all-around cool guy) and Louis Hardy (for pointing it out to me)!

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Debugging NAP Errors (part 1)

MS NAP Team — Wed, 20 Feb 2008 09:15:00 GMT

I’ve heard from a lot of folks who set up NAP in a lab who would love to have more information on all the great data that Network Policy Server (NPS) writes into the audit log. If you haven’t checked out our auditing, go to Server Manager and click on the main node for our role (Network Policy and Access Services). You will see all related NAP server events at the top of the right hand pane. This will be part 1 in a series of “Debugging NAP” posts. I decided to kick it off by examining the messages / errors which come from our Windows Security Center NAP integration piece (included in XP SP3, Vista and Server 2008). It is called the Windows System Health Agent on the client (or WSHA) and the Windows System Health Validator on the server (or WSHV). ......(read more)

NAP troubleshooting content on TechNet

MS NAP Team — Thu, 08 Nov 2007 23:00:00 GMT

Hi NAP bloggers!

I’ve been working on some NAP troubleshooting content lately that should interest you. The content is for a new type of event-based help that is integrated into Windows Vista and Windows Server 2008. To access the content, just view any event in Event Viewer, and click the Event Log Online Help link. You will be directed to troubleshooting information specific to the event. For NAP, I’ve been working on server-side troubleshooting for the Health Registration Authority (HRA) role service and client-side system health agent (SHA) and NAP events. There will be event-based troubleshooting content for all server roles and services, including those commonly used with NAP, such as NPS, 802.1X, remote access, DHCP, and others.

You don’t have to click an event to view the troubleshooting content. If you’d like to browse some troubleshooting information that is already available, check out Windows Server 2008 Troubleshooting. NAP and HRA content should be available soon as part of Network Policy and Access Services troubleshooting.

We hope this content will provide the break-fix information you need to resolve problems quickly. The content will also be integrated into Microsoft Operations Manager to provide status of the applications you are monitoring and resolution steps to any problems that are found.

Greg Lindsay

Technical Writer

------------------------

Updated: 11/16/2007 - NAP content published; updated links - Jeff

------------------------

Updated NAP step-by-step guides for Longhorn Beta 3

MS NAP Team — Thu, 26 Apr 2007 23:30:00 GMT

Hi everyone! My name is Greg Lindsay, and I’m a technical writer on the Windows Server User Assistance team. I’ve been lucky to be assigned the task of writing about NAP, and just published 4 new step by step guides for Beta 3. I’ve enjoyed working on these, and would love to hear your feedback. One thing I want to mention is that there is a new feature in Beta 3 for configuring NAP with a wizard. This is demonstrated in the IPsec guide. The other guides currently use the manual method for configuring policies, but please try the wizards for 802.1X, VPN, and DHCP too. It is easy to check the policies and settings that are created against the manual steps described in the step by step guide. The NAP TechNet forum is a great place to post if you run into problems or have questions. I check the forum regularly, as do all the technical experts on the NAP team. Please feel free to email me if you have comments on the step by step guides, or thoughts about other documentation that is needed for NAP.

If you don’t see the updated Beta 3 version of the document, you may need to refresh the download page a few times. These new documents are still in the process of propagating to all the download servers.

FYI - I’m also planning to add a NAP virtual lab to the Longhorn TechNet Virtual Labs soon. I will post again when this is available.

Greg Lindsay

Technical Writer

Greg.Lindsay@online.microsoft.com *

* Remove the "online" to actually email me.

** This posting is provided "AS IS" with no warranties, and confers no rights.