Setting up policy based networking on an NT domain

I have been tasked with researching possible ways to setup a policy based network.  Our network is seeing more and more corporate visitors and currently they are given an ethernet cable and off they went.  We are on an NT domain that is locked down quite tightly, however would like to take it a step further by limiting guest access to port 80 only (possibly 110, 25, etc) no matter what physical port they are connected with.  Eventually, I would also like to be able to restrict network access even for authenticated users that do not have current virus DAT files.  However, that's down the pipe yet.  

Thanks for the suggestions,

Who is Participating?
are you using a switch?  a firewall? what model?
mgrassAuthor Commented:
I'm running three Dell PowerConnect 3348s for switches and a Linux based firewall.  I have used ISA 2000 in the past but wasn't happy with it.  I've loaded up ISA 2004 from my MSDN subscription on an older workstation box to play with, but haven't had the time.  If I recall correctly, it was the proxy portion of ISA that bothered me the most.
I'm not sure what the 3348s can do but one solution would be to place another firewall between all the client machines and your servers. This way you can only allow port 80 through and nothing else.

If you had cisco switches you could also configure Vlans for your servers and then setup access lists on your router to only allow certain traffic between vlans.

Perhaps it would be worth holding off a while until Cisco get their new products out. They are working towards Layer 2 authentication. So as soon as you plug a device into a port on a switch you need to provide some credentials before you even get a physical link. Then you can have the deviced moved into a separate VLan if the antivirus isn't up to date.

Cisco call it self-defending networks.

the problem is that you would like to control access based on windows user account.  I don't know if ISA can do this, but if it can, I bet it's the only solution.  After the DC authenticates your session, all internet traffic travels directly to your gateway/firewall.  This means that it doesn't really pass through any hardware that can test for credentials.  ISA server being a microsoft product has Active-Directory Integration and LDAP-connectivity, so I assume you would be able to do it that way, but I'm not positive.

Any other solution would involve a physical or logical seperation of computers from the rest of the domain.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.