NAP with IPsec enforcement - deny noncompliant computers

-

dears,

i have done several nap dhcp enforcement, , easy assign non compliant computers isolated subnet.

now doing nap ipsec enforcement only, , not able isolate non compliant computers.

on client can see:

unfortunately, client still able access everything, resources..., below shows nps policy:

when changed "nap ipsec hra noncompliant" network policy access type "grant access" "deny access", clients shows compliant...

 

so please advice, sick , confused of status.... , have isolate non compliant...

hi,

concern 1: servers support nap ipsec. exempted health check. in other words, servers behave if have health certificate. "health certificate" have more permanent certificate not deleted if server doesn't have latest windows update, etc.

you can think of server healthy client computer. 2 healthy client computers can communicate, unhealthy 1 cannot connect healthy one. in same way, client computer doesn't have health certificate cannot connect server has exemption certificate, assuming place server in secure network. server placed in boundary network can communicate noncompliant computers, because needed remediation.

concern 2: explained in first answer. sha on nap client controls whether or not computer keeps health certificate or deletes it. when client unhealthy according sha, sha remove health certificate. not happen if certificate exemption certificate, however. certificate remains on computer , sha has no effect, doesn't matter server doesn't have wsha installed if give exemption certificate.  since server has certificate, clients able communicate it.

-greg

p.s. ipsec zones shown below. zone computer in dependent on ipsec policies applied , whether or not has certificate. computers in secure network have certificates. certificate either exemption certificate (for servers) or health certificate (for nap clients).

computers in boundary network have different ipsec policy applied , may or many not have certificates. these computers servers , have exemption certificates. difference allowed contacted unhealthy (noncompliant) nap clients, client can remediate, example might wsus servers. 

computers in restricted network typically nap clients unhealthy (noncompliant).



Windows Server  >  Network Access Protection



Comments

Post a Comment

Popular posts from this blog

Error: 0x800f080c - Feature name NetFX3 is unknown

-
i trying install .net framework 3.5 on windows server 2012 standard using command below: ps c:\users\administrator> dism.exe /online /enable-feature /featurename:netfx3 /source:f:\sources deployment image servicing , management tool result: version: 6.2.9200.16384 image version: 6.2.9200.16384 error: 0x800f080c feature name netfx3 unknown. a windows feature name not recognized. use /get-features option find name of feature in image , try command again. the dism log file can found @ c:\windows\logs\dism\dism.log option install .net framework not appear in server manager. how can .net framework 3.5 install? seems impossible install .net framework 3.5 have tried suggested solutions dism /online /cleanup-image /restorehealth, without success.  have run get-windowsfeature , .net framework 3.5 not appear: display name                                ...
Read more

Checkedlist box

-
hi all, i tired creating checkedlistbox allow users selecting multiple inputs simultaneously. trying perform on check/check activity starting displaying selected item user. below sample code created. code not working believe have not selected correct onclick activity. great if can suggest me correction. $colourlistbox = new-object system.windows.forms.checkedlistbox $colourlistbox.location = new-object system.drawing.size(1,20) $colourlistbox.size = new-object system.drawing.size(140,50) $colourlistbox.sorted = $true $colourlistbox.backcolor = "lightgray" $colourlistbox.forecolor = "blue" $colourlistbox.checkonclick = $true $colourlistbox.height = 50                                         [void] $colourlistbox.items.add("red")   ...
Read more

schannel

-
que tal. checando nuevamente en mi visor de sueceso e aparece el siguiente error: el certificado recibido del servidor remoto fue emitido por una autoridad certificadora de confianza. debido esto, ninguno de los datos contenidos en el certificado puede ser validado. la solicitud de conexión ssl ha fallado. los datos adjunto contiene el certificado de servidor. tengo un server 2003 alguien me puede ayudar para saber de donde proviene este error. gracias debes describir la situación, acá no podemos adivinar cómo, cuándo, con qué sistema, qué aplicación, cuando haces qué, etc. etc.   guillermo delprato - buenos aires, argentina mvp-mct-mcse-mcsa mcitp: enterprise/server administrator mcts: active directory/network/applications configuration este mensaje se proporciona "como está" sin garantías de ninguna clase. usted asume todos los riesgos. ...
Read more