Understanding Network Access Protection (NAP) in Windows Server 2008

Network Access Protection (NAP) is a platform you can install in Windows Server 2008 for enforcing computer system health requirements on Client machine before they are allowed to access network resources. NAP can ensure that the system complies with a particular update level and configuration requirements such as firewall state, malware removal tools, windows update and Antivirus.

Microsoft also recommends integrating third party tools with existing systems architecture to verify health status of computer systems. NAP includes a set of APIs that you can use to incorporate other tools for health policy validation, controlling access to the network, remediation, and ongoing compliance. With the release of Windows Server 2008, Microsoft introduces Network Policy Server (NPS) as Remote Authentication Dial-In User Service (RADIUS) and VPN server. It replaces Internet Authentication Server (IAS) in Windows Server 2003. NPS performs health evaluation and determines what access to grant NAP clients. When an access request is received, NPS extracts the client’s statement of health (SoH) and forwards it to the NAP Administration Server. Based on the Statement of Health Requests (SoHRs) from the System Health Validators (SHVs) and the health policies, NPS creates a System Statement of Health Response (SSoHR) that states whether the client complies. Every client must demonstrate that they comply with rules of NAP Administration Server. IPSec, IEEE802.1x, VPN, Terminal Server gateway and DHCP are available for enforcing network restrictions on noncompliant hosts.

System Health Validator and Agents

A System Health Validator (SHV) is an element on the NAP client that can be matched to a System Health Agent (SHA). An SHA corresponds to one or more health requirement servers. Health requirements are windows firewall, antivirus, antispyware and windows update.

NAP Scenarios

Desktop computers can pose a threat to the network if they are missing updates, are configured poorly, or have become infected by malware.

Roaming Laptops can be missing updates or the most recent antivirus signatures because the user has not connected the laptop to the corporate network for several weeks. A laptop faces potential attack when used in wireless networks, or when left unattended in a place accessible by untrustworthy individuals. With NAP, administrators can verify the health state of laptops each time they reconnect to the organization’s network, whether via a VPN or when the user returns to the office.

Some organizations allow their users to connect to the corporate network through a VPN using their own home computers. These computers are not under the control of the organization and unmanaged. With NAP, however, network administrators can inspect the health state of these systems every time they establish a VPN connection, and limit access if the systems do not meet health requirements.

Businesses allow all sorts of people to visit their premises: Consultants, partners, friends of employees, recruits and vendors may all ask for access to your network. Administrators can evaluate those computers and isolate them on a restricted network like a separate VLAN. Presumably the restricted network would include Internet access to enable the visitors to access their own e-mail accounts and other outside resources.

Further Study:

How to configure NAP (RADIUS)

How to configure VPN Server

How to configure WSUS

McAfee e-policy Orchestrator

Understanding Windows Firewall for Windows Server 2008 and Windows 7

The best way to justify a local firewall in windows server 2008 and windows 7 is to put another layer of security in place and to make your computer happy to maintain communication with internet. In ordinary terms, windows firewall is in place to protect you from bad guys in internet and allow good stuff in your computer. Windows firewall is greatly improved for both home users and enterprise user even though home user will not be able customize windows firewall because this is a bit geeki stuff. However, default firewall will be in place and UAC will pop up asking consent whether you want to allow/disallow this or that to happen. Here, I am going to talk about enterprise users who will consider deploying windows firewall to protect themselves from malicious software, spyware and attacks from internet.

The new graphical interface is for managing the Windows Firewall locally and through Active Directory group policies. Another improvement, I would like to mention here is windows services control through Windows Firewall. I had nightmare with conficker virus that spread faster then rocket using port 135-139 and use windows services to run it continuously in windows SP SP2 and disable active directory account policy. In conficker virus situation, scvhost was compromised. Windows Service Hardening will help to reduce the impact in several ways: The firewall will block abnormal behaviour such as a service that does not need to access the network trying to send out HTTP traffic. Microsoft Windows Server 2008 and Windows 7 make intelligent use of outbound filtering by blocking system services from initiating network connections except for what they require to function properly. Inbound filtering is what will stop malicious network traffic such as Nimda, Slammer, Sasser, conficker, Blaster, or anything else that sends unwanted network traffic or suspicious traffic to windows server. New Windows firewall also integrates with Active Directory users, group and computers and support IPSec and tcp/ip version6. To manage the new Windows Firewall via Group Policy, simply open Group Policy management>select specific group policy object>right click>click edit then navigate to Computer Configuration>Windows Settings>Security Settings>Windows Firewall with Advanced Security in the Group Policy.

Windows Firewall Screenshots: