Blocking non domain computers with Fixed IP
Hi All,
I have implemented NAP using IPsec with HRA and it seems to be working fine for computers failing health check for both domain and non domain computers. But when the computers use Static IP address, the whole thing gets bypassed.
Any ideas with regards to this would be welcome.
regards,
Arun.
I have implemented NAP using IPsec with HRA and it seems to be working fine for computers failing health check for both domain and non domain computers. But when the computers use Static IP address, the whole thing gets bypassed.
Any ideas with regards to this would be welcome.
regards,
Arun.
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
If you choose a NAP enforcement method, then all domain computers will need to be running the NAP agent service. Computers that are not running this service can't be evaluated for domain membership because the FQDN for the computer is sent as part of the NAP packet (the statement of health). The exception to this is 802.1X with NAP where the SoH isn't needed to evaluate domain membership.
For example, you could use NAP with DHCP enforcement, which is the simplest to configure. You would then create a policy that requires a computer to be a member of "domain computers" to be granted access. Other computers will be denied access. However, a non-domain computer can still configure a static IP address if they guess the correct range and gain access this way.
If you deploy IPsec enforcement you will need a certificate infrastructure (a PKI). In this case, non-domain computers will not be given a certificate and computers without certificates can be blocked with IPsec policies.
The other method you can use is 802.1X. You can also use NAP here, but it isn't necessary. Just create a policy that evaluates computers based on domain membership. An 802.1X access request contains the computer's domain so it isn't necessary here to run NAP agent
For example, you could use NAP with DHCP enforcement, which is the simplest to configure. You would then create a policy that requires a computer to be a member of "domain computers" to be granted access. Other computers will be denied access. However, a non-domain computer can still configure a static IP address if they guess the correct range and gain access this way.
If you deploy IPsec enforcement you will need a certificate infrastructure (a PKI). In this case, non-domain computers will not be given a certificate and computers without certificates can be blocked with IPsec policies.
The other method you can use is 802.1X. You can also use NAP here, but it isn't necessary. Just create a policy that evaluates computers based on domain membership. An 802.1X access request contains the computer's domain so it isn't necessary here to run NAP agent
If you deploy IPsec enforcement you will need a certificate infrastructure (a PKI). In this case, non-domain computers will not be given a certificate and computers without certificates can be blocked with IPsec policies.
The other method you can use is 802.1X. You can also use NAP here, but it isn't necessary. Just create a policy that evaluates computers based on domain membership. An 802.1X access request contains the computer's domain so it isn't necessary here to run NAP agent
Shall try this and get back
Thank u for pointing me in a direction
Regards,
Arun
The other method you can use is 802.1X. You can also use NAP here, but it isn't necessary. Just create a policy that evaluates computers based on domain membership. An 802.1X access request contains the computer's domain so it isn't necessary here to run NAP agent
Shall try this and get back
Thank u for pointing me in a direction
Regards,
Arun
Premium Content
You need an Expert Office subscription to comment.Start Free Trial