Solved

Blocking non domain computers with Fixed IP

Posted on 2012-12-31
4
59 Views
Last Modified: 2016-04-05
Hi All,

I have implemented NAP using IPsec with HRA and it seems to be working fine for computers failing health check for both domain and non domain computers. But when the computers use Static IP address, the whole thing gets bypassed.

Any ideas with regards to this would be welcome.

regards,

Arun.
0
Comment
Question by:arunaci
4 Comments
 

Accepted Solution

by:
loaganathan earned 200 total points
ID: 38734098
If you choose a NAP enforcement method, then all domain computers will need to be running the NAP agent service. Computers that are not running this service can't be evaluated for domain membership because the FQDN for the computer is sent as part of the NAP packet (the statement of health). The exception to this is 802.1X with NAP where the SoH isn't needed to evaluate domain membership.

For example, you could use NAP with DHCP enforcement, which is the simplest to configure. You would then create a policy that requires a computer to be a member of "domain computers" to be granted access. Other computers will be denied access. However, a non-domain computer can still configure a static IP address if they guess the correct range and gain access this way.

If you deploy IPsec enforcement you will need a certificate infrastructure (a PKI). In this case, non-domain computers will not be given a certificate and computers without certificates can be blocked with IPsec policies.

The other method you can use is 802.1X. You can also use NAP here, but it isn't necessary. Just create a policy that evaluates computers based on domain membership. An 802.1X access request contains the computer's domain so it isn't necessary here to run NAP agent
0
 

Author Comment

by:arunaci
ID: 38734388
If you deploy IPsec enforcement you will need a certificate infrastructure (a PKI). In this case, non-domain computers will not be given a certificate and computers without certificates can be blocked with IPsec policies.

The other method you can use is 802.1X. You can also use NAP here, but it isn't necessary. Just create a policy that evaluates computers based on domain membership. An 802.1X access request contains the computer's domain so it isn't necessary here to run NAP agent

Shall try this and get back

Thank u for pointing me in a direction

Regards,

Arun
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Using in-flight Wi-Fi when you travel? Business travelers beware! In-flight Wi-Fi networks could rip the door right off your digital privacy portal. That’s no joke either, as it might also provide a convenient entrance for bad threat actors.
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question