- Network Access Protection
-
Network Access Protection (NAP) is a Microsoft technology for controlling network access of a computer host based on the system health of the host, first introduced in Windows Server 2008.
With Network Access Protection, system administrators of an organization's computer network can define policies for system health requirements. Examples of system health requirements are whether the computer has the most recent operating system updates installed, whether the computer has the latest version of the anti-virus software signature, or whether the computer has a host-based firewall installed and enabled. Connecting or communicating computers have their health status evaluated. Computers that comply with system health requirements have full access to the network. Administrators can configure health policies that make it possible to ensure that computers not in compliance with system health requirements have restricted access to the network.
Contents
Overview
NAP clients are computers that report system health to a NAP enforcement point. A NAP enforcement point is a computer or network access device that can require the evaluation of a NAP client’s health state and optionally provide restricted network access or communication. NAP enforcement points can be IEEE 802.1X-capable switches or VPN servers, DHCP servers, or Health Registration Authorities (HRAs) that run Windows Server 2008 or Windows Server 2008 R2. The NAP health policy server is a computer running the Network Policy Server (NPS) service in Windows Server 2008 or Windows Server 2008 R2 that stores health requirement policies and provides health evaluation for NAP clients. Health requirement policies are configured by the administrator and can include settings that require that NAP client computers have the latest antivirus definitions and security updates installed, a personal firewall enabled, and other settings.
Network Access Protection was created by Nick Tardibone.
When a NAP-capable client computer contacts a NAP enforcement point, it submits its current health state. The NAP enforcement point sends the NAP client’s health state to the NAP health policy server for evaluation using the RADIUS protocol. The NAP health policy server can also act as a RADIUS-based authentication server for the NAP client.
The NAP health policy server can use a health requirement server to validate the health state of the NAP client or to determine the current version of software or updates that need to be installed on the NAP client. For example, a health requirement server might track the latest version of an antivirus signature file.
If the NAP enforcement point is an HRA, it obtains health certificates from a certification authority for NAP clients that are determined to be compliant with health requirements. If the NAP client is determined to be noncompliant with health requirements, it can optionally be placed on a restricted network. The restricted network is a logical subset of the intranet and contains resources that allow a noncompliant NAP client to correct its system health. Servers that contain system health components or updates are known as remediation servers. A noncompliant NAP client on the restricted network can access remediation servers and install the necessary components and updates. After remediation is complete, the NAP client can perform a new health evaluation in conjunction with a new request for network access or communication.
NAP client support
A NAP client ships with Windows Vista and later Windows client operating systems. NAP client support is also included in Windows XP Service Pack 3 albeit with some limitations - no MMC snap-in (command line netsh only), no integration with Windows Security Center and no AuthIP-based IPsec enforcement (IKE-based only). Microsoft partners provide NAP clients for other operating systems such as Mac OS X and Linux. [1]
See also
- Access control
- Network Admission Control
- Network Access Control
- Network security
- Computer security
- PacketFence - The leading Free and Open Source NAC solution
References
External links
- Microsoft's Network Access Protection Web page
- Microsoft's Network Access Protection Web page on Microsoft Technet
- NAP Blog on Microsoft Technet
- Microsoft's Network Access Protection Design Guide on Microsoft Technet
- Microsoft's Network Access Protection Deployment Guide on Microsoft Technet
- Microsoft's Network Access Protection Troubleshooting Guide on Microsoft Technet
Categories:- Microsoft Windows security technology
- Windows Server
Wikimedia Foundation. 2010.
