NAP Deployment in my Office

hi all,

 

i have assigned task deploy nap in our office. let me describe scenario,

i want computer (workgroup) not part of domain when connect network, first check health status visitor's laptop, vendor's desktop computer or wifi mobiles , redirect them subnet (different dhcp server) can ip , start using internet. network , domain resources disabled them if 1 have domain user id , password. 

2ndly when computer joins domain. first check health requirement , if not meet redirect other subnet (different dhcp server , remediation server), after remediation joins domain.

also want joined domain clients should health checked , remediated automatically. complete report can generate.

currently 1 dhcp server running in network.

hope have understood scenario.

kindly guide me how design , deploy

 

thanks in advance.

naeem

 

 

 

 

hi,

there couple of basic concepts must understand before proceed.

first, nap not typically remediate guest or vendor computers. because not have correct settings enabled such nap agent, nap enforcement client, or specific 802.1x authentication settings. way health check on non-domain joined computers (which not recieve group policy) configure requried settings locally. can done script if desired, need supplied individually each workgroup computer.

second, there some settings must implement on switch achieve your desired scenario. when workgroup computer connects switch has 802.1x authentication enabled, you have 2 possible situations:

1) 802.1x enabled on workgroup computer correct settings.

in case, user prompted domain user credentials. if entered successfully, can redirected unique vlan or given partical network access using acl. if wish implement this kind of authentication, user must supplied restricted domain user account that they pass 802.1x authentication. you can create "vendor" account in active directory (for example user:vendor password:vendorpass) and use network policy on nps send computer authenticates account vendor vlan. dhcp server can supply ip , gateway from unique scope these computers. keep in mind here sharing domain credentials, can security risk.

2) 802.1x either not enabled, or enabled incorrect settings on workgroup computer.

in case, if port computer connects has 802.1x enabled, authentication fail. switches have ability redirect instances of failed authentication guest vlan automatically. not done via radius (nps) policy setting. if switch not have capability, or haven't configured yet, port typically drops line protocol. if computer not pass 802.1x authentication (whether or not have guest vlan configured), cannot evaluate these computers using 802.1x-based policy on nps. in order use 802.1x nap computer must first pass 802.1x authentication. you evaluate them using dhcp-nap based policy if wish, or ipsec-nap policy.

for vendor computers, bottom line sounds need configure switch guest vlan , redirect computers fail 802.1x authentication vlan. guest vlan can provide internet access. don't need nap this.

if have computer newly joining domain, issue becomes little more complicated. don't think can achieve process described. reasonable computer join domain first, recieve group policy settings (including nap settings), evaluated health same domain computers. trying computer join domain after health evaluated require set scenario similar 1 mentioned above first redirect computer unique vlan can have health evaluated dhcp-based nap policy.

let me know if have more questions,

-greg

Windows Server  >  Network Access Protection