20411B-ENU-TrainerHandbook

Administering Windows Server® 2012 9-3

How to Use NAP

• To validate the health state. When a computer attempts to connect to the network, NAP validates

computers have their health state evaluated, and NAP logs the compliance state of each computer for analysis. In a limited access environment, computers that comply with the health-requirement policies have unlimited network access. Computers that do not comply with health-requirement policies could find their access limited to a restricted network.

• To enforce health-policy compliance. You can help ensure compliance with health-requirement

policies by choosing to update noncompliant computers automatically with missing software ONLY updates or configuration changes through management software, such as Microsoft® System Center Configuration Manager. In a monitoring-only environment, NAP will ensure that computers update

their network access before they receive required updates or configuration changes. In a limited

access environment, noncompliant computers have limited access until the updates and configuration . changes are complete. In both environments, computers that are compatible with NAP can become

• To limit network access. You can protect your networks by limiting the access of noncompliant

compliant automatically and you can define exceptions for computers that are not NAP compatible.STUDENT USE

computers. You can base limited network access on a specific amount of time, or on what resources that the noncompliant computer can access. In the latter case, you define a restricted network that contains health update resources, and the limited access will last until the noncompliant computer comes into compliance. You also can configure exceptions so that computers that are not compatible with NAP do not have limited network access.

Roaming Laptops

Portability and flexibility are two primary advantages of a laptop, but these features also present a system health threat. Users frequently connect their laptops to other networks. While

exposure to unprotected networks, such as the Internet, could introduce security-related threats to the laptops. NAP allows you to check any laptop’s health state when it reconnects to the organization’s

network, whether through a virtual private network (VPN), a Windows 8 DirectAccess connection, or the workplace network connection.

9-4 Implementing Network Access Protection

Desktop Computers

Visiting Laptops

Unmanaged home computers that are not a member of the company’s Active Directory® domain can connect to a managed company network through VPN. Unmanaged home computers provide an

additional challenge because you cannot physically access these computers. Lack of physical access makes enforcing compliance with health requirements, such as the use of antivirus software, more difficult. However, NAP enables you to verify the health state of a home computer every time it makes a VPN connection to the company network, and to limit its access to a restricted network until it meets system health requirements.

• Institute of Electrical and Electronics Engineers (IEEE) 802.1X–authenticated network connections. IEEE 802.1X enforcement requires that a computer is compliant to obtain unlimited network access through an IEEE 802.1X–authenticated network connection. Examples of this type of network connection include an authenticating Ethernet switch or an IEEE 802.11 wireless access point (AP).

Administering Windows Server® 2012 9-5

• Dynamic Host Configuration Protocol (DHCP) address configurations. DHCP enforcement requires that a computer is compliant to obtain an unlimited access Internet Protocol version 4 (IPv4) address configuration from a DHCP server. For noncompliant computers, network access is restricted with an

•Between a NAP client and a DHCP server MCT

The NAP client, also the DHCP client, communicates with the DHCP server to obtain a valid IPv4

address configuration and to indicate its current system health state.

The DHCP server allocates an IPv4 address configuration for the restricted network, and then providesUSE remediation instructions (if the DHCP client is noncompliant), or it allocates an IPv4 address

configuration for unlimited access (if the DHCP client is compliant).

.ONLY

•IP address

•Transmission Control Protocol (TCP) port number

•User Datagram Protocol (UDP) port number

IPsec enforcement restricts communication to compliant computers after they have connected successfully and obtained a valid IP address configuration. IPsec enforcement is the strongest form of limited network access or communication in NAP.

The HRA obtains X.509 certificates for NAP clients when the clients prove that they are compliant. These health certificates then authenticate NAP clients when they initiate IPsec-protected communications with other NAP clients on an intranet.

IPsec enforcement limits communication for IPsec-protected NAP clients by dropping incoming communication attempts sent from computers that cannot negotiate IPsec protection by using health certificates. Unlike 802.1X and VPN enforcement, in which enforcement occurs at the network entry point, each individual computer performs IPsec enforcement. Because you can take advantage of IPsec policy settings, the enforcement of health certificates can be done for any of the following:

PROHIBITED

•All computers in a domain

•Specific computers on a subnet

9-10 Implementing Network Access Protection

•VPN enforcement is best suited in situations in which you are using VPN already. It is unlikely that PROHIBITED you will implement VPN connections on an internal network to use VPN enforcement.

•Use VPN enforcement to ensure that staff members connecting from home computers are not introducing malware to your network. Users often do not maintain their home computers correctly,

and they can represent a high risk. Many users do not have antivirus software, or do not apply Windows updates regularly.appliestothroughVPNpackets

9-12 Implementing Network Access Protection

address to 255.255.255.255 so that there is no route to the attached subnet.