Файловый архив студентов. Файловый архив студентов.
1269 вузов, 4660 предметов.
/ Регистрация
FAQ Обратная связь Вопросы и предложения
Добавил:
Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Алматинский университет энергетики и связи
Предмет:
[НЕСОРТИРОВАННОЕ]
Файл:

20411B-ENU-TrainerHandbook

.pdf
Скачиваний:
237
Добавлен:
01.05.2015
Размер:
16.48 Mб
Скачать
☆

Administering Windows Server® 2012

MCT

9-13

 

Considerations for DHCP enforcement

 

When considering the DHCP NAP enforcement method, consider the following points:

 

• DHCP enforcement is easy to implement, and can apply to any computer with a dynamic IP address.

•

DHCP enforcement is easy to circumvent. A client can circumvent DHCP enforcement by using a

USE

 

 

static IP address. Additionally, a noncompliant computer could add static host routes to reach servers

 

that are not remediation servers.

 

• DHCP enforcement is not possible for IPv6 clients. If computers on your network use IPv6 addresses

 

to communicate, DHCP enforcement is ineffective.

PROHIBITED USE STUDENT .ONLY

 

 

9-14 Implementing Network Access Protection

Lesson 3

MCT

Configuring NAP

USE

If you want your NAP deployment to work optimally, it is important that you understand what each of

the NAP components does, and how they interact to protect your network. If you want to protect your

 

network by using NAP, you need to understand the configuration requirements for the NAP client, as well as how to configure NPS as a NAP health policy server, configure health policies and network policies, and configure the client and server settings. It also is important to test the NAP before using it.

Lesson Objectives

After completing this lesson, you will be able to:

• Describe System Health Validators (SHVs).

.ONLY

•

Explain the use of a health policy.

 

 

• Discuss the use of remediation server groups.

 

 

• Describe the NAP client-configuration requirements.

 

 

• Explain how to enable and configure NAP.

 

STUDENT

What Are System Health Validators?

 

System Health Agents (SHAs) and System

 

 

 

 

Health Validators (SHVs) are NAP infrastructure

 

 

components that provide health-state status

 

 

and validation. Windows 8 includes a Windows

 

 

Security Health Validator SHA that monitors the

 

 

Windows Security Center settings. Windows Server

 

 

2012 includes a corresponding Windows Security

 

 

 

 

USE

Health Validator SHV.

 

 

The design of NAP makes it very flexible and

 

 

extensible, and it can interoperate with any

 

 

vendor’s software that provides SHAs and

 

 

SHVs that use the NAP API. An SHV receives a

 

PROHIBITED

statement of health (SoH), and then compares the system health-status information in the SoH with the

required system health state. For example, if the SoH is from an antivirus SHA, and it contains the last

version number for the virus-signature file, then the corresponding antivirus SHV can check with the

antivirus health requirement server for the latest version number to validate the NAP client’s SoH.

The SHV returns a SoH response (SoHR) to the NAP Administration Server. The SoHR can contain

remediation information about how the corresponding SHA on the NAP client can meet current system-

health requirements. For example, the SoHR that the antivirus SHV sends could instruct the NAP client’s

antivirus SHA to request the latest version, by name or IP address, of the antivirus signature file from a

specific antivirus signature server.

 

 

 

 

Administering Windows Server® 2012

MCT

 

9-15

 

What Is a Health Policy?

 

 

Health policies consist of one or more SHVs and

 

 

 

 

USE

other settings that you can use to define client-

computer configuration requirements for the

 

 

NAP-capable computers that attempt to connect

 

 

to your network.

 

 

When NAP-capable clients attempt to connect

 

 

•Rejects the connection request. ONLY.

•Places the NAP client on a restricted network, where it can receive updates from remediation serversSTUDENT that bring the client into compliance with health policy. After the NAP client achieves compliance and resubmits its new health state, NPS enables it to connect.

•Allows the NAP client to connect to the network despite its noncompliance with health policy.What Are Remediation Server Groups?to the network, the client computer sends a

A remediation server group is a list of restricted network servers that provide resources that bring noncompliant NAP-capable clients into

compliance with your defined client health policy.

A remediation server hosts the updates that a NAP agent can use to bring noncompliant client computers into compliance with health policy, as NPS defines. For example, a remediation server can host antivirus signatures. If a health policy requires that client computers have the latest antivirus definitions, then the following work together to update noncompliant computers:

•An antivirus SHA

•An antivirus SHV

•An antivirus policy server

•The remediation server

PROHIBITED USE

9-16 Implementing Network Access Protection

NAP Client Configuration

Remember these basic guidelines when you configure NAP clients:

•Some NAP deployments that use Windows Security Health Validator require that you enable Security Center. Security Center is not included with Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012.

•You must enable the Network Access Protection Client service when you deploy NAP to NAP-capable client computers.

•You must configure the appropriate NAP enforcement clients on the NAP-capable computers.

Enable Security Center in Group Policy

.ONLY USE MCT

1.Open the Group Policy Management console. STUDENT

2.In the console tree, double-click Local Computer Policy, double-click Computer Configuration, double-click Administrative Templates, double-click Windows Components, and then double-click

Security Center.

3.Double-click Turn on Security Center (Domain PCs only), click Enabled, and then click OK. USEValidatorcapableYou can use the Enable the Network Access Protection Service on Clients procedure to enable and

configure NAP service on NAP-capable client computers. When you deploy NAP, enabling this service is required.

Note: To complete this procedure, you must be a member of the Domain Admins group, the Enterprise Admins group, or the Administrators group on the local computer.

To enable the Network Access Protection service on client computers:

1.Open Control Panel, click System and Security, click Administrative Tools, and then double-click Services.

2.In the services list, scroll down to, and double-click, Network Access Protection Agent.

3.In the Network Access Protection Agent Properties dialog box, change Startup Type to

Automatic, and then click OK.

PROHIBITED

Administering Windows Server® 2012 9-17

Enable and Disable NAP Enforcement Clients

 

You can use the Enable and Disable NAP Enforcement Clients procedure to enable or disable one or more

NAP enforcement clients on NAP-capable computers. These clients can include:

MCT

USE

•

DHCP Enforcement Client

• Remote Access Enforcement Client

•

EAP Enforcement Client

 

 

• IPsec Enforcement Client (also used for DirectAccess connections)

ONLY

• Terminal Services Gateway (TS Gateway) Enforcement Client

To enable and disable NAP Enforcement Clients:

 

 

1.Open the NAP Client Configuration console (NAPCLCFG.MSC).

2.Click Enforcement Clients. In the details pane, right-click the enforcement client that you want to enable or disable, and then click Enable or Disable.

 

 

.

 

Note: To perform this procedure, you must be a member of the Administrators group on

STUDENT

 

 

 

the local computer, or you must have been delegated the appropriate authority. If the computer

 

is joined to a domain, members of the Domain Admins group might be able to perform this

 

procedure. As a security best practice, consider performing this procedure by using the Run as

 

command.

 

Demonstration: Configuring NAP

 

This demonstration shows how to:

 

•

Install the NPS server role.

 

•

Configure NPS as a NAP health policy server.

USE

•

Configure health policies.

 

•

Configure network policies for compliant computers.

 

•

Configure network policies for noncompliant computers.

 

•

Configure the DHCP server role for NAP.

PROHIBITED

•

Configure client NAP settings.

 

•

Test NAP.

 

Demonstration Steps

 

Install the NPS server role

 

1.

Switch to LON-DC1, and sign in as a domain administrator.

 

2.

Open Server Manager, and then install the Network Policy and Access Services role.

 

Configure NPS as a NAP health policy server

 

1.

Open the Network Policy Server console.

 

2.

Configure the Windows Security Health Validator to require that all Windows 8 computers are

 

 

running a firewall.

 

9-18 Implementing Network Access Protection

Configure health policies

1.Create a health policy called Compliant in which the condition is that Client passes all SHV checks.

2.Create another health policy called Noncompliant in which the condition is that Client fails one or more SHV checks.

Configure network policies for compliant computers

1.Disable the two existing network policies. These would interfere with the processing of the policies you are about to create.

2.Create a new network policy called Compliant-Full-Access that has a condition of the Compliant health policy. Computers are granted unrestricted access.

Configure network policies for noncompliant computers

•Create a new network policy called Noncompliant-Restricted that has a condition of the Noncompliant health policy. Computers are granted restricted access.

Configure the DHCP server role for NAP

1.Open the DHCP console.

2.Modify the properties of the IPv4 scope to support Network Access Protection.

3.Create a new DHCP policy that allocates appropriate DHCP scope options to noncompliant computers. These options assign a DNS suffix of restricted.Adatum.com.

Configure client NAP settings

1.Enable the DHCP Quarantine Enforcement Client on LON-CL1.

2.Start the Network Access Protection Agent service.

3.Use the local Group Policy Management console to enable the Security Center.

4.Reconfigure LON-CL1 to obtain an IP address from a DHCP server.

Test NAP

1.Verify the obtained configuration by using ipconfig.

2.Disable and stop the Windows Firewall service.

3.In the System Tray area, click the Network Access Protection pop-up warning. Review the information in the Network Access Protection dialog box. Click Close.

4.Verify the obtained configuration by using ipconfig.

5.Notice that the computer has a subnet mask of 255.255.255.255 and a DNS Suffix of restricted.Adatum.com. Leave all windows open.

PROHIBITED USE STUDENT .ONLY USE MCT

Demonstration: Configuring NAP Tracing

Administering Windows Server® 2012 9-19

Lesson 4

MCT

Monitoring and Troubleshooting NAP

 

 

Troubleshooting and monitoring NAP is an important administrative task because of different technology

levels, including varied expertise and prerequisites, for each NAP enforcement method. Trace logs are

USE

available for NAP, but are disabled by default. These logs serve two purposes: troubleshooting and

evaluating a network’s health and security.

 

 

 

Lesson Objectives

 

 

After completing this lesson, you will be able to:

.ONLY

• Describe how NAP tracing can help monitor and troubleshoot NAP.

• Explain how to configure NAP Tracing.

• Troubleshoot NAP with Netsh.

•

Use the NAP event log to troubleshoot NAP.

What Is NAP Tracing?

 

 

Aside from the preceding general guidelines,

 

 

 

 

STUDENT

you can use the NAP Client Configuration

 

console to configure NAP tracing. Tracing

 

records NAP events in a log file, and is useful for

 

troubleshooting and maintenance. Additionally,

 

you can use tracing logs to evaluate your

 

network’s health and security. You can configure

 

three levels of tracing: Basic, Advanced, and

 

Debug.

 

Enable NAP tracing when:

 

 

 

•

Troubleshooting NAP problems.

 

 

 

 

USE

•

Evaluating the overall health and security of your organization’s computers.

 

 

In addition to trace logging, you can view NPS accounting logs. These logs could contain useful NAP information. By default, NPS accounting logs are located in %systemroot%\system32\logfiles.

The following logs might contain NAP-related information:

•IASNAP.LOG. This contains detailed data about NAP processes, NPS authentication, and NPS authorization.

•IASSAM.LOG. This contains detailed data about user authentication and authorization.

Two tools are available for configuring NAP tracing. The NAP Client Configuration console is part of the Windows user interface, and netsh is a command-line tool.

PROHIBITED

9-20 Implementing Network Access Protection

Using the Windows User Interface

You can use the Windows user interface to enable or disable NAP tracing and to specify the level of recorded detail by performing the following steps:

1.Open the NAP Client Configuration console by running napclcfg.msc.

2.In the console tree, right-click NAP Client Configuration (Local Computer), and then click

Properties.

3.In the NAP Client Configuration (Local Computer) Properties dialog box, select Enabled or Disabled.

Note: To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. As a security best practice, consider performing this operation by using the Run As command.

4.If Enabled is chosen, under Specify the level of detail at which the tracing logs are written, select Basic, Advanced, or Debug.

Using a Command-Line Tool

To use a command-line tool to enable or disable NAP tracing and specify the level of recorded detail, perform the following steps:

1.Open an elevated command prompt.

2.To enable or disable NAP tracing, do one of the following:

o To enable NAP tracing and configure for basic or advanced logging, type: netsh nap client set tracing state=enable level =[advanced or basic]

o To enable NAP tracing for debug information, type: netsh nap client set tracing state=enable level =verbose

o To disable NAP tracing, type: netsh nap client set tracing state=disable

Note: To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. As a security best practice, consider performing this operation by using the Run As command.

Viewing Log Files

To view the log files, navigate to the %systemroot%\tracing\nap directory, and then open the particular trace log that you want to view.

Demonstration

This demonstration shows how to:

•Configure tracing from the GUI.

•Configure tracing from the command line.

PROHIBITED USE STUDENT .ONLY USE MCT

 

Administering Windows Server® 2012

MCT

 

9-21

 

Demonstration Steps

 

 

Configure tracing from the GUI

USE

1.

On LON-CL1, open the NAPCLCFG – [NAP Client Configuration (Local Computer)] console.

 

 

2.

From the NAP Client Configuration (Local Computer) properties, enable Advanced tracing.

 

 

Configure tracing from the command line

•At the command prompt, type netsh nap client set tracing state = enable, and then press Enter.

Troubleshooting NAP

You can use the following tools to troubleshoot

NAP.

Netsh Commands

Use the netsh NAP command to help troubleshoot NAP issues. The following command displays the status of a NAP client, including the following:

•Restriction state

•Status of enforcement clients

•Status of installed SHAs

•Trusted server groups that have been configured

netsh NAP client show state

The following command displays the local configuration settings on a NAP client, including:

•Cryptographic settings

•Enforcement client settings

•Settings for trusted server groups

•Client tracing settings that have been configured

netsh NAP client show config

The following command displays the Group Policy configuration settings on a NAP client, including:

•Cryptographic settings

•Enforcement client settings

•Settings for trusted server groups

•Client tracing settings that have been configured

netsh NAP client show group

PROHIBITED USE STUDENT .ONLY

9-22 Implementing Network Access Protection

Troubleshooting NAP with Event Logs

NAP services record NAP-related events into the Windows event logs. To view these events, open Event Viewer, select Custom Views, select Server Roles, and then select Network Policy and Access Services. The following events provide information about NAP services that are running on an NPS server:

•Event ID 6272. Network Policy Server granted access to a user.

Occurs when a NAP client authenticates successfully, and, depending on its health state, obtains full or restricted access to the network.

•Event ID 6273. Network Policy Server denied access to a user.

Occurs when an authentication or authorization problem arises, which is associated with a reason code.

•Event ID 6274. Network Policy Server discarded the request for a user.

Occurs when a configuration problem arises, or if the RADIUS client settings are incorrect or NPS cannot create accounting logs.

•Event ID 6276. Network Policy Server quarantined a user.

Occurs when the client access request matches a network policy that is configured with a NAP enforcement setting of Allow limited access.

•Event ID 6277. Network Policy Server granted access to a user, but put it on probation because the host did not meet the defined health policy.

Occurs when the client access request matches a network policy that is configured with a NAP enforcement setting of Allow full network access for a limited time when the date specified in the policy has passed.

•Event ID 6278. Network Policy Server granted full access to a user because the host met the defined health policy.

Occurs when the client access request matches a network policy that is configured with a NAP enforcement setting of Allow full network access.

PROHIBITED USE STUDENT .ONLY USE MCT

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]
Помощь Обратная связь Вопросы и предложения Пользовательское соглашение Политика конфиденциальности