HomeSystemLAN - WANIntroduction to Network Access Protection (Part 6)

Introduction to Network Access Protection (Part 6)

Introduction to Network Access Protection (Part 6) Picture 1   Introduction to Network Access Protection (Part 1)
Introduction to Network Access Protection (Part 6) Picture 2   Introduction to Network Access Protection (Part 2)
Introduction to Network Access Protection (Part 6) Picture 3 Introduction to Network Access Protection (Part 3)
Introduction to Network Access Protection (Part 6) Picture 4 Introduction to Network Access Protection (Part 4)
Introduction to Network Access Protection (Part 6) Picture 5 Introduction to Network Access Protection (Part 5)

In the previous articles, I have shown you how to create an authentication policy for both the computer to be checked and without checking. In this article, we will continue the server configuration procedure. The first step in this is to create a default authentication policy that can be applied to any computer that is authenticated through the RRAS server.

Start the process by opening the Network Policy Server window and entering NPS (Local) | Authentication Processing | Authentication Policies. Once entered here, the details window must display any pre-existing audit policies. Delete existing policies by clicking on them and selecting the Delete command from the right-click menu.

Now we create a default authentication policy. To do this, click on the New link in the Actions window, then select the Custom option. Windows will show you the New Authentication Policy properties window as shown in Figure A.

Introduction to Network Access Protection (Part 6) Picture 6
Figure A : Enter RRAS as a policy name and then verify that policy is enabled

Enter RRAS as a policy name and then verify the selected Policy Enabled check box. Next, make sure the Available Sources button is also selected, then select the Remote Access Server (VPN-Dialup) option in the available list of Available Sources.

Now, switch to the Setting tab and select Authentication from the control tree. Select Override Authentication Settings from the Authorization Policy checkbox. After that, a detailed window will appear with a variety of authentication methods, as shown in Figure B. Select the EAP check box and then click the EAP Methods button.

Introduction to Network Access Protection (Part 6) Picture 7
Figure B : Select the EAP check box and then click EAP Methods

Windows will display the Select EAP Providers dialog box. Click the 'Add' button to reveal the list of EAP authentication methods. Select EAP-MSCHAPv2 and Protected EAP (PEAP) from the list and click OK. The selected EAP authentication methods must now be displayed in the Select EAP Providers dialog box as shown in Figure C. Click OK to continue.

Introduction to Network Access Protection (Part 6) Picture 8
Figure C : You must enable authentication for MSCHAPv2 and PEAP

Now go to the Conditions tab. You must select at least one condition for the policy to be enforced. You can set any condition you want, we recommend connecting to Connection Properties | Tunnel Type and then select Point to Point Tunneling Protocol and Layer Two Tunneling Protocol, then click the 'Add' button. By doing so, the new authentication policy will apply to VPN connections. Click OK to save the new authentication policy you just created.

RADIUS client configuration policy

In this type of deployment, the Network Policy Server works as a RADIUS server. Rather, clients are performing a RADIUS authentication directly to the Network Policy Server, RRAS server is executing like a VPN server that will work as a RADIUS client

The last step in the server configuration process involves providing the Network Policy Server with a list of authenticated RADIUS clients. Only when the RADIUS client becomes the VPN server will you enter the VPN server's IP address. When RRAS services are running on the same physical server as the Network Policy Services network policy services, you will use the server's IP address.

To create a RADIUS client configuration policy, in the Network Policy Server, find NPS (Local) | RADIUS Clients. Click the New RADIUS Client link in the Actions window. Windows will launch the New RADIUS Client Wizard.

On the initial screen of the wizard you will have to enter the name and IP address for the new RADIUS client. In a real deployment, you should enter RRAS and the RRAS server's IP address into the space provided. When you call back RRAS will run on the same server in the Network Policy Services. Therefore, enter the server's own IP address into the space provided and click Next.

The wizard will now display an Additional Information window. This window asks you about the client and shared secrets. Select the RADIUS Standard in Client Vendor. For the purposes in the article, enter RRASS in the shared password. Select the Client is NAP Capable check box, as shown in Figure D and click Finish.

Introduction to Network Access Protection (Part 6) Picture 9
Figure D : Enter the shared password and select the Client is NAP Capable check box

Client configuration

We have finished configuring the Network Policy Server, which is when configuring the client to connect to the server. Remember that the technique I introduced for you will only work on clients running Windows Vista.

For the purposes of this article, we are assuming that the client is running Windows Vista and that it is configured with a static IP address. As you know, Windows Vista is designed to run IPv6 by default. Network Access Protection must be IPv6 supported, but Windows Longhorn Server is still in beta and it seems that IPv6 is not currently supported when it comes to Network access protection. In that case you must disable IPv6 on the computer's network configuration. When Longhorn Server is released, we plan to write an upgrade to this series aimed at using IPv6 as well as anything that has changed compared to the Beta.

The client must also be configured as a member of the domain that has the Network Policy Server. In addition, the domain must contain a user account that you can use to log into the created Routing and Remote Access Server.

Now create a Virtual Private Network connection that you will use to check the Network Access Protection server. To do this, open the Control Panel and click your mouse on the Network and Internet link, so that is the Network Center link. When Network Center is opened, click the Set up a Connection or Network link. You must look on the screen asking what kind of connection you want to create. Click on the Connect to a Workplace option and then click Next.

Select the connection option via VPN and you will have to enter the Internet address and destination name. Enter the IP address of the RRAS server into the Internet Address field. You can enter anything you want in the Destination Name field. Select Allow Other People to use the Connection check box, then click Next. Now enter the user name and password for the user, who is allowed to login to the RRAS server as well as the domain name that you will log into.

Click the Connect button, Vista will connect to your RRAS server. When you receive the message that the wizard cannot connect to your destination, click the Setup a Connection Anyway icon. This will save the settings so we can stop customizing them in the next part of this series.

Conclude

In this article, I have shown you how to configure the Network Policy Server and start configuring a client. In the next section, I will continue the discussion by showing you how to complete client configuration.

Introduction to Network Access Protection (Part 6) Picture 10   Introduction to Network Access Protection (Part 7)

5 ★ | 1 Vote
servernetworkpolicyclick

You should read it

May be interested

  • Learn about the ISA Firewall Client (Part 1)Photo of Learn about the ISA Firewall Client (Part 1)
    client firewall software (firewall client) is a software installed on windows operating systems to provide enhanced security and access.
  • Managing Windows Networks Using Scripts - Part 1: Basic ConceptsPhoto of Managing Windows Networks Using Scripts - Part 1: Basic Concepts
    this is the first part in a series of articles about windows scripting networks. this section covers the most basic concepts of scripting techniques (script writing techniques) in networks running windows operating systems. the rest of the series will go to you
  • Combine Windows XP and Vista machines on the same networkPhoto of Combine Windows XP and Vista machines on the same network
    on small business networks or home networks, some machines have been upgraded to windows vista and some have windows xp operating systems. usually they work with each other like 'cats and dogs'. with a role
  • Manage Windows networks using scripts - Part 2: Complete scriptsPhoto of Manage Windows networks using scripts - Part 2: Complete scripts
    in the previous section we have learned some basic concepts of scripting techniques such as objects, methods, properties and writing a simple scritp that changes the ip address assigned to adapters. in this second part, we will implement variable definition, error control, use input data and confirm the output data we need to add to get a scr.
  • Efficiently exploit printers in Windows Server 2003 (Part 3)Photo of Efficiently exploit printers in Windows Server 2003 (Part 3)
    in the previous article of this series, i have shown you the most effective way to manage a network printer is to create print queues on one of the network servers and force all print jobs to be go through that queue. in the second part of this series, we introduced some basic techniques for this
  • Managing Windows networks using scripts - Part 3: Understanding WMIPhoto of Managing Windows networks using scripts - Part 3: Understanding WMI
    in the first two parts of this series we learned how to change the ip address of a network adapter on a windows computer using vbscript. this section will introduce you to the principles of windows management instrumentation (wmi) how it can be scriped using vbscript.

LAN - WAN