In this section I will look a Network Access
Protection. Network access protection is a system in windows server 2008 that allows
you either to allow or deny computers onto your network based on a number of health checks.
In this video, I will look at what is network access protection or NAP. Next I will look
at the NAP process. This is the process each client go through when it starts up and tries
to access the network. Like most systems on windows server 2008 there are components which
make it work. I will go through each of the NAP components
and explain how they work. With NAP there are a lot of systems that make it work correctly.
Understanding each of these systems provides the foundation for using NAP on your network.
Once you understand the components that make up NAP, I will look at a typical NAP layout.
This NAP layout is only really used on large scale networks. If you have a small network
you may not want or need to go to these lengths, but seeing a network like this does help you
understand the fundamentals of NAP. Lastly I will configure NAP for DHCP.
NAP for DHCP is fairly easy to configure. Once you understand how to configure NAP for
DHCP, you will be able to use NAP on other parts of your network.
NAP, or Network access Protection is a new role in Windows Server 2008. Formally in Windows
Server 2003 it was called network access quarantine control. NAP in a nut shell protects the integrity
of your network. It does this by performing health checks on your computers. Nap can check
your antivirus and spyware is up to date and even check service packs and updates are installed
on the computer. If the computer does not meet the health checks,
NAP can isolate the computer from the rest of the network. This prevents a computer,
for example a computer without antivirus being allowed on the network. I once had an end
user remove the antivirus from her computer because she felt it was slowing the computer
down. If this was to happen with NAP running, you
could isolate the computer from the rest of the network as without antivirus software
the computer could become compromised and infect other computers on the network. With
NAP, you can allow the computer to receive updates so it can pass health checks. For
example have the antivirus software installed. It should be pointed out that NAP does not
offer any protection against malicious users. If you have a dis grunted employee and there
computer passes all the health checks, they can still get on the network can cause a lot
of damage. To understand how NAP works it is a good idea
to understand the process NAP goes through when a computer starts ups. When the computer
start ups it does a health check. You can determine what you want to check for, common
checks include services packs, antivirus and spyware are installed and up to date and a
firewall is enabled. When the computer attempts to access the network,
the health statements is sent to the NAP enforcement point. What is a NAP enforcement point? This
is a point on the network that checks the computers health and determines what parts
of the network that computer will have access to.
There are different type of NAP enforcements points supported by Windows Server 2008. First
there is DHCP server. IP addresses can be allocated to clients based on passing or failing
their health checks. Next there is V P N. When a client connects via a VPN it is first
checked to make sure it passes all the health checks.
A VPN server is an easy place for a network to become infected so it is also a good place
to configure NAP. Next you have the 802.1x access control standard used on network equipment.
If your switches or network devices support it, you can determine which ports are available
to a client depending on if they pass or fail their health checks.
Next you have terminal services gateway. NAP interfaces with terminal services gateway
allowing it to allow or deny clients based on NAP health checks. Nap can also be used
with IP sec. When a computer passes it’s health check it is given a certificate. This
certificate is used with IP sec to make a connection to the server.
When a NAP enforcement point receives a health statement from a client, the statement is
forwarded onto your NAP server. The NAP server can then determine if the health
statement is valid and returns an approve or deny response back to the enforcement point.
This works well to stop a computer accessing the network, but stopping it accessing the
network will also stop it getting any updates and stop it from becoming compliant.
So what do you do when a computer fails it health checks. Firstly you can do nothing.
Simply put, the computer failing the health check is recorded and logged. You can view
the log and see which computers need updates. When you first install NAP on your network
it is recommend that you run NAP in report only mode. The last thing you want to do is
stop a lot of your computers accessing the network when you install NAP.
When you first install NAP, look at the NAP logs and see what needs to be done to bring
your computers up to date. Bring your computers you to date before your starting denying access.
Your end users will thank you for it. In the real world, your end users will probably
will not thank you for it, but in the IT world, no news is often good news. Once you are happy
with your settings you can of course deny access to the network. This can still cause
problems. Denying access to the network means the computer can’t get any updates.
To solve this problem, NAP allows the computer to access a remediation network. When the
client connects to the network it fails its health check and is denied access to the main
network. The client is however allow access to the remediation network when it can access
updates. Once the computer is up to date, it will then
be allowed to access the main network. NAP is very configurable and depending on the
solution you put in place and your needs will determine if you put a remediation network
into place. It is not uncommon for the remediation network to be part of the main network.
In this scenario the computer is allowed access to the network while it is in the process
of being updated. In some NAP configurations you can have both the remediation and main
network on the same network. For example if you using IP Sec for enforcement.
With IP sec, the certificate is allocated only once the health check is passed. Without
the certificate, the client can’t create an IP sec connection. With IP sec, you change
the servers configuration to only allow NAP IP sec connections.
When deploying NAP, consider if you want to isolate the client on their own network or
simply deny them access to parts of the network till they are compliant.
There are many different components that make NAP work. On the client there is a system
health agent or sha. The sha reports the health of the client to a enforcement point. For
example, if you use NAP with DHCP, when the client requests an IP address off the DHCP
server, the DHCP will receive a health statement from the client.
The agent that provides this health statement comes already installed on windows server
2008, windows 7, windows Vista and windows X P with service pack 3. There is room however
for 3rd parties to develop their own sha’s. These 3rd party sha’s could add additional
checks or run on additional operating systems. Once the client has provided a health statement,
this is passed onto a system health validator or shv. The shv is part of the network policy
server component and must be installed on windows server 2008.
With the shv you can also get it to work with radius. This is useful for example if you
want to use 802 dot one X. The last part of a NAP deployment is remediation servers. These
are optional on your network, but if you did install them they would provide things like
updates to antivirus and windows updates through services like w SUS.
As you can see, there is a lot of components to NAP and there are many different ways you
can configure NAP depending on your needs. Let’s have a look at a typical NAP lay out
that may be used in a large company. On this network, when a computer connects
up to the network, one of 3 things happen. Firstly if the computer meets it’s health
requirements it is allow access to the production network. For the computer to do this, it must
support NAP and NAP must also be correctly configured.
If the computer supports NAP but fails it’s heath checks, it is given access to the remediation
network. Since the computer does not meet health checks, it may have a virus on it and
thus makes it potentially dangerous to have on the production network.
To reduce the risk, a read only domain controller can be deployed on the remediation network.
The computer should be able to get updates from this network but since the network is
isolated, should not be able to infect any of the computers in the production network.
Finally is the computer does not support NAP, it is transferred to a guest network. This
may be the case if you have visitors from another company plugging in to your network.
If this is the cases you want them to have access to basic services from your network
like accessing the company web site and internet but nothing else.
To do this, a web proxy could be installed so they can access information but can’t
access any confidential data or any other company systems. As you can see, there are
many different ways you can configure NAP, it all depends on how many servers and networks
you want to set up. To start using NAP you need to decide on what
type of enforcement you want to use. I will start by looking at configuring NAP for DHCP
as configuring NAP for DHCP is very simple to set up and a good way to get your feet
wet. When a client connects to the network, if
they a compliant, they will get full IP configuration and access to the network. If the computer
is not compliant, you have the option to give the client limited IP configuration. When
this occurs, you can add entries to the client routing table so it can access computers on
the network. For example a redemption server. NAP for DHCP is simple to set up and use,
but offers the least amount of security. This is because it does not stop a user manually
setting their own IP address. If an end user has enough I T knowledge, they can manually
set their own IP address and by pass NAP completely. Let’s have a look, how to configure NAP
for DHCP. To run DHCP Nap enforcement on your network,
you first need to installed Network Policy Server. This is essentially the heart of NAP.
To do this, run server manager and then select the option add roles.
The component that I require is part of network policy and Access Services, select network
policy and access server from the list and move on. The component that we require from
network policy and access services is Network policy server.
In this example I will install Network Policy Server on a different server than DHCP. It
is easier for you to install DHCP and network policy server on the same server. It is easier
to run and less steps to configure it, but on larger networks you may need to separate
the two. Network policy server is a fairly fast install,
it should only take a minute or two. Once installed I need to configure it by running
the Network policy admin tool from administrative tools under the start menu.
The first thing that I need to configure is the system health validator. This will determine
what needs to be configured on the client for it to pass it’s health check. To do
this, go down to Network access and protection and expand downwards until you get to settings.
With windows Server 2008 R 2 you can create additional configurations. For example you
could create a different set of requirements to access the companies intranet. In this
case I will modify the default configuration since I only want one set of NAP settings.
In the properties section I can configure what NAP will check for. To demonstrate this
product I will switch off some of the features like spyware and windows update. The only
settings that I will leave on are the windows firewall and antivirus.
Now that I have configured the settings I want NAP to check for, I will add some remediation
servers. These are the servers that the client will be able to access if it fails it’s
health check. In this case I will add my W SUS server so the client can retrieve windows
updates. Have a careful think about what servers you
add here. With DHCP enforcement, these are the only servers the client will be able to
access. You should also consider adding a domain controller and better still a read
only domain controller is you have one. Remember that without access to a domain controller,
the client will not be able to access group policy and other active directory services
which may stop it from becoming compliant. Now that we have the health policy and remediation
server set up, I need to now run the NAP configuration wizard to configure the rest of NAP.
To launch the wizard, all I need to do is select the server at the top of the screen
and then select the option configure NAP. As you can see, the dialog box is quiet large.
To allow it to fit on the screen I will select the option auto hide start bar.
This wizard can be used for any enforcement type that NAP supports. Since we are using
DHCP in this example, I will select dynamic host configuration protocol from the pull
down list. By default, the wizard will also enter in a name for the policy.
If your DHCP server is installed on a different server, you will need to add the DHCP server
as a radius client, in my case I will add my DHCP server called DHCP 1. In order for
the radius server to communicate with the radius client, you need to have a radius secret
set up which is common between the two. If I select the option generate and press
the generate button, windows will generate a rather long shared secret for you to use.
This will give you greater security, but you still need a way to copy the shared secret
from this server. The longer key means you now need some way
of managing the key which may mean storing the key on devices like U S B sticks or even
e-mailing the key to transfer between servers. Having a large key like this does impose more
difficultly in the management of keys but gives you greater security.
A shorter key is often a lot easier to manage and can even just be memorized. In this case,
I will simply manually enter in a key. On this screen, you need to enter in the DHCP
scopes that you are planning on using NAP enforcement on.
In this case, I have already created a scope on the DHCP server called desktop computers.
If you did not enter in a scope on this screen, NAP enforcement would apply to all scopes
installed on that DHCP server. Next you need to decide what computers this
policy will apply to. If you do not enter in any computers or groups of computers in
here, the policy will apply to all computers. On this screen you can set up a remediation
sever group. The remediation server group simply means
the client can access these servers if they fail their health check. On this screen, you
can also enter in a troubleshooting URL. This URL will be shown to the users and should
contain information on how the user can get their computer up to date.
For example, the U R L may have a link for the user to download virus software. You will
also notice here that the windows security health validtor has been selected and will
be used to determine the health of the client. An important setting to take note of is the
setting, enable auto redemption of client computers. This option means that NAP will
attempt to fix any problems on the client when it fails a health check.
For example, if NAP was checking to see if your firewall was running and found it was
off, with auto redemption enabled, NAP will re enable the firewall. Down the bottom of
the screen, you will notice the option, what to do if a NAP ineligible client tries to
access the network. If a computer that does not support NAP, for
example a windows 2000 computer were to attempt to access the network. By default, these types
of computers will be denied access to the network and will only be able to access the
remediation servers. In some environments you may want to give
these computers full access to the network. For example, if you have a few legacy computers
on the network that you are planning to phase out. Setting this setting to allow will still
give them access to the network until you can retire them.
Once IPress finish, the wizard will create the required polices to run NAP with DHCP
on your network. NAP is now configured, but before it can be used with DHCP, DHCP needs
to be configured. To do this, I now need to switch to my DHCP
server. The Network Policy Server setting for NAP are not on my DHCP server, but in
order to access them Network Policy Server needs to be installed locally on the DHCP
server. I have all ready completed the install for
network policy server, to run it, go to administrative tools under the start menu and run Network
policy server. In order for the two Network Policy servers to communicate, the remote
server must be added to the Remote RADIUS server groups.
To add the server, right click on Remote radius servers and select new. In this dialog I need
to enter in the name of my remote server, in this case the servers name is NAP. If I
now go to the authentication and accounting screen, I need to enter in the shared secret
I set up on the other NPS server. Once I close the dialog the NAP server will
be added as a remote server. This will allow the two servers to communicate with each other,
however by design they won’t. In order to have this network policy server pass on requests
to be authentication on the other network policy server a policy must be created to
tell the server to do this. To do this, right click on connection request
policies and select new. For the policy name I will enter in forward NAP request and select
the type of network access server as DHCP server. I want this server to only forward
on NAP traffic, so to do this, press add and then go than the list until you get to identity.
Add identity and then select health checks only. This means, this rule will only forward
NAP health checks onto the other Network policy server. On the next screen is where you need
to specific where to send the NAP requests. In this case I will select the group that
I created earlier. On the next screen, I can configure additional options. This is more
for when you are using 3d party RADIUS servers. In this case I don’t need to add anything.
Once I reach the end of the wizard and press finish the new policy will be created. Whenever
creating network policies , pay careful attention to the order of the polices. In this case,
I want to forward NAP requests to be the first policy.
If anther policy matches before forward NAP requests than my forward NAP requests will
be ignored. That’s all the configuration that is required for the network policy server
installed on the DHCP server. I can now close network policy server and
open the DHCP admin tool from administrative tools under the start menu. Once inside the
DHCP admin, I need to expand down to IP version 4 right click and select properties.
From the properties, select the tab network access protection. You will notice that by
default, DHCP will grant full access to the network when the network policy server in
unavailable. Otherwise you can set it to restricted access or drop client packets which means
ignore the client completely. If you change the default server behavior,
this means that if your network policy server is not contactable for any reasons, no client
will be able to access your production network till it is back up again.
If you change the option, you would probably at the minimum want to make sure that you
have at least two network policy servers configure on your network for redundancy. The only time
you could get away having one would be when your network policy server and DHCP are stored
on the same server. If IPress the button enable on all scopes,
network access protection will be enabled on all scopes on the DHCP server. If you want
more control, you can expand down to IP version 4 and select the scope that you want to enable
NAP on. Selecting the scope and accessing the properties,
I can again go into the network access protection tab, but this time the settings will only
apply to this scope. To enable NAP on this scope I need to select the option “enable
for this scope” In this particular case I will use the default
network access protection profile, but if you need to you could set up different network
access protection profiles for different scopes. To configure network access protection further,
you need to set some scope options. If I now go into the scope options and then
select the tab advanced, I can select “default network access protection class”. This will
give me the settings that the DHCP server will allocate to the client when it fails
it’s health checks. You can set as many or as few options as you
want in here. You can also set options that are completely different to the main options,
for example I could set a completely different DNS server. This different DNS server will
be allocated only to client who fail their health checks.
If I go back into scope options, you will notice the setting I just added and also you
will also notice the class is shown on the far right hand side. The other two settings
with a class of none will be allocate to clients that pass their health checks. This concludes
the server set up, now let’s have a look what needs to be configure on the client.
In order for the client to start using NAP there are a number of things that need to
be set. Luckily for us these can be set using group policy. Firstly you need to enable the
security center. Be aware that in Windows 7 the security center has changed to the action
center. Next I need to go into computer configuration
in group policy and then into windows settings and security settings and set two settings.
First is enable the NAP service. Without the NAP service running, the client will not be
able to issue a health statement to the enforcement point. The second setting tells NAP the enforcement
type or types that we will be using. Let’s have a look at how to set this up on a windows
7 client using group policy. First of all I need to create a group policy
for NAP on my domain controller. To do this, run group policy management from administrative
tools under the start menu. In this example, I will create a new group policy for my domain
by right click on the domain and selecting create new G P O in this domain and link it
here. In your domain, since there are own a few
settings that need to be set, you may want to just modify and existing group policy.
Once I have create the group policy called DHCP NAP, I need to edit it. Expand down in
group policy through administrative templates, Windows components and down to security center.
Even though security center has change in windows 7 to action center, the group policy
setting remains the same. All I need to do here is change the settings to enable. The
next settings I need to change are not under administrative templates so I will reduce
administrative templates and go into windows settings and then into security settings.
In security settings I can go into system services. In system services, you can enable
and disable services on the client computer. The network access protection service agent
shown here is disabled by default on windows clients. To enable any NAP enforcement this
service needs to be running. I will select automatic so the services will
always be running. To configure the type of NAP enforcement I want to use, I need to leave
system services and go into Network access protection. Under network access protection
I need to select NAP client configuration and select enforcement clients.
You can see in here all the different types of NAP enforcement that could be used. Since
I am using DHCP enforcement, I will enable DHCP quarantine enforcement client. You could
if you wished enable multiple enforcements types if you wished.
These are all the settings that need to be enabled on the client side. I have used a
domain wide group policy to set them, however I could have quiet easily set the settings
on the client. If I now switch to my windows 7 computer, we can see NAP in operation.
(Switch to windows 7 DHCP Nap demo.swf) First of all I want to see the status of NAP
enforcement on this computer. To do this on windows 7, I need to open the action center.
After I open the control panel I need to select the option review your computers status under
System and security. You can see that Network access protection
has been added to the action center. The action center is telling us also that this computer
is not meeting the security standards for NAP. To get some more information about the
problem, press the button view solution. If I scroll down to the bottom, you can see
that NAP did not detect any antivirus software on this computer and thus this is why the
computer did not pass the health check. While in this state, the computer will only be able
to access servers in the remediation group. To see which servers it can access, open a
command prompt from the start menu and run route print. I have added the minus 4 switch
so I only get IP version 4 routes. You can see the first route 10 dot 0 dot 0 dot two
with the subnet mask 255 dot 255 dot 255 dot 255.
This means that any traffic for that IP address will be sent to that server directly. This
IP address is the address of the DHCP server. The next address is the IP address of the
W Sus server which I added into the redemption server group.
Those who understand routing tables really well will quickly see that there is no route
to the 10 dot 0 dot 0 network where this computer is currently located. This means, this computer
can only access other computers on the 10 dot 0 dot 0 network when a route to that computer
is added. This example shows an important fact when
setting up NAP. Notice that my domain controller is not contactable and also D N S servers
and this computer does not have access to the internet. You can also see that DHCP enforcement
is a weak form of protection because a person with I T knowledge could either add their
own routes to the routing table or assign a static IP address to the computer and thus
by pass NAP completely. When you set up DHCP NAP enforcement, make
sure you add servers the computer needs access to, for example domain controllers. Without
access to a domain controller, the computer cannot access group policy which may make
important changes the computer. If I now run an IP config slash all, you will
see that the system quarantine state is set as restricted. This is another way of determining
what the status of NAP is without having to go into the action or security center. To
make this computer compliant I am going to install virus software.
I have accelerated the install to the end as installing virus software is not the focus
of this training video. Once the virus software is installed the computer should be able to
pass a NAP health check. If I now go back to my command prompt and run IP config slash
all, you will see that system quarantine state has changed to not restricted.
If your state does not change straight away, you may need to run an IP config slash renew
to refresh your IP address settings. There is one more feature that I want to demonstrate.
If I open the control panel and then open system and security, I can than open the windows
firewall settings. If now select the option to switch the firewall
settings off, this is one of the checks that NAP does in its health check. Since I Put
the option on for auto remediation, windows will attempt to fix problems that cause a
computer to fail a health check. As you can see, windows has switched the firewall
back on again. This is why auto remediation is a great feature to leave on and will mean
a few less calls to your helpdesk. In summary, there is a lot of planning you
should do before installing NAP on your network. NAP decides on who get’s access to the network
and who get’s denied. I would suggest running NAP in logging mode first. Work out who is
failing there health checks and why. If you can fix these problems before you deny
computers to the network or place them in separate networks you will have a lot less
angry phone calls to the help desk. NAP has its fair share of acronyms. The two most important
are system health agent and system health validator otherwise known as SHA and SHV.
Remember, the agent or SHA issues a statement of health which is inspected by the SHV or
system health validator. Microsoft supplies a SHV, but 3rd party vendors can create their
own. Remember that NAP is very customizable and thus can start becoming very complicated
very quickly. Carefully planning is the key to a good NAP deployment.