1. Module 11: Remote Access Fundamentals
Course 6420A
Module 11: Remote Access Fundamentals
Presentation: 50 minutes
Lab: 60 minutes
Module 11: Remote Access Fundamentals
This module helps students to configure network policies, configure a radius proxy, and troubleshoot Network Policy Server (NPS) as a Remote Authentication Dial-in User Service (RADIUS) proxy.
After completing this module, students will be able to:
Describe the characteristics of remote access methods.
Describe how RADIUS is used.
Describe how to implement network policies on a Network Policy Server.
Describe how to troubleshoot remote access.
Required materials
To teach this module, you need the Microsoft® Office PowerPoint® file 6420A_11.ppt.
Important: It is recommended that you use PowerPoint 2002 or a later version to display the slides for this course. If you use PowerPoint Viewer or an earlier version of PowerPoint, all the features of the slides might not be displayed correctly.
Preparation tasks
To prepare for this module:
Read all of the materials for this module.
Practice performing the demonstrations and the lab exercises.
Work through the Module Review and Takeaways section and determine how you will use this
section to reinforce student learning and promote knowledge transfer to on-the-job performance.
Make sure that students are aware that there are additional information and resources for the module on the Course Companion CD.

2. Module 11: Remote Access Fundamentals
Course 6420A
Module 11: Remote Access Fundamentals
Module 11: Remote Access Fundamentals
Remote Access Overview
RADIUS Overview
Network Policy Server
Troubleshooting Remote Access

3. Lesson 1: Remote Access Overview
Course 6420A
Lesson 1: Remote Access Overview
Module 11: Remote Access Fundamentals
What Is Remote Access?
Discussion: Characteristics of VPN and Dial-up Connections
VPN Protocols
What Is Routing and Remote Access?

4. Remote Computer at Home Remote Computer at Internet Hot Spot
What Is Remote Access?
Remote access is access to corporate resources from outside the corporate network
Remote Access Server
Describe remote access for students. Ask students about the types of resources that clients may want to access for remote access such as or documents. Also talk about scenarios where remote access might be used such as doing work from home and while traveling on business. Mention that there are security concerns when accessing data remotely.
Also consider raising the issue of firewalls. Firewalls are typically located between remote users and the Internet. They are also typically located between the remote access server and the Internet.
Question: What are some examples of security concerns for data that is accessed remotely?
Answer: Concerns for data that is accessed remotely include:
Use of packet sniffers to capture data in transit
Storage of files on remote systems that are not secure
Transmission of usernames and passwords over the Internet
Data stored on mobile devices and laptops that are lost or stolen
Corporate resources
Remote Computer at Home
Wireless Access Point
Remote Computer at Internet Hot Spot
Wireless Clients

5. Discussion: Characteristics of VPN and Dial-up Connections
Course 6420A
Discussion: Characteristics of VPN and Dial-up Connections
Module 11: Remote Access Fundamentals
What are the characteristics of VPN and Dial-up connections?
Lead a discussion with students that compares virtual private network (VPN) remote access and dial-up remote access:
VPN:
Uses encryption to secure communication
Requires an Internet connection
Can be as fast the Internet connection
Slower than internal network access
Latency is still a problem when accessing files and running applications
Dial-up
Connects over phone lines
Available almost anywhere there is a phone
Very slow
Requires additional infrastructure
Explain both VPN and dial-up remote access. Mention to students that it requires a fast Internet connection to access files access over VPNs. Also mention that the additional cost of phone lines and modems makes dial-up remote access unattractive.
Question: What are the characteristics of VPN and dial-up connections?
Answer: A VPN connection uses encryption to secure communication over an Internet connection. VPNs are commonly used over high-speed Internet connections. The faster the Internet connection, the faster it is to access data remotely. However, accessing data remotely is always slower than accessing data over the LAN. Latency is a problem for running applications and browsing files over a remote connection.
A dial-up connection uses a modem and phone line for connectivity rather than a high speed Internet connection. This type of connectivity is very slow: 56 kilobits per second (Kbps) maximum. However, the availability is very good because it works from any location with a phone line. Dial-up connections are awkward to implement because you must configure a dial- up server at the corporate location and phone lines installed to support the dial-up clients.

6. Module 11: Remote Access Fundamentals
Course 6420A
VPN Protocols
Module 11: Remote Access Fundamentals
VPN connections can use various protocols to provide encryption
VPN Protocol
Description
Point-to-Point Tunneling Protocol (PPTP)
Widely supported in clients
Traverses NAT easily
Easy to configure
Layer 2 Tunneling Protocol (L2TP)
Uses IPsec to encrypt data
Increased security over PPTP
More difficult to configure
Secure Socket Tunneling Protocol (SSTP)
Uses Secure Sockets Layer (SSL) to encrypt data
Can pass through proxy servers on port 443
Describe the three available VPN protocols available in Windows Server® Mention that SSTP is new in Windows Server Other points you can mention include:
• IPsec NAT-T must be enabled on the firewall to allow L2TP to traverse NAT correctly
• PPTP is still widely used
• Traveling users will be most likely able to connect by using SSTP from any location, including hotel rooms with firewalls and proxy servers controlling access
Note: SSTP cannot be used for site to site tunneling, only client to server. SSTP is included in Windows Vista® SP1
Firewall configuration:
To configure firewall with rules to open TCP port 1723 for PPTP-based VPN tunnel and opening IP Protocol 47 (GRE).
For L2TP based VPN tunnel over IPsec, to open UDP port 500 and opening IP protocol 50.
In the case of an SSTP-based VPN tunnel, you do not have to have any explicit configuration because, typically, TCP Port 443 (used for HTTPS) is opened by default on the firewall.
Question: Why is SSTP less likely to have problems traversing firewalls than other VPN protocols?
Answer: Port 443 is almost always open on firewall to support accessing secure Web sites. PPTP ports may not be open in environments with higher security. L2TP can have NAT traversal problems, and the necessary ports may not be open on the firewall.
Resources: For more information about SSTP, see The Secure Socket Tunneling Protocol (

7. What Is Routing and Remote Access?
Course 6420A
What Is Routing and Remote Access?
Module 11: Remote Access Fundamentals
Routing and Remote Access is a component that allows Windows Server® 2008 to act as a router and remote access server
Router:
Describe how Routing and Remote Access can be used as a router or remote access server. The remote access server functionality is more commonly used than the routing functionality. However, the routing is useful in smaller environments where the cost of a hardware router cannot be justified. For example, a small manufacturing organization could isolate a manufacturing machine and its controlling workstation on a separate subnet to ensure the main network never affects the manufacturing machine.
For additional scenario information, see the following Routing and Remote Access Help topics:
Common Remote Access Configurations
Common Routing Scenarios
Typically used on small networks
Less expensive than hardware-based routers
Network Address Translation (NAT) for Internet access
Remote Access server:
VPN server
Dial-up server
Demand dial connection to help secure connectivity between two locations

8. Lesson 2: RADIUS Overview
Course 6420A
Lesson 2: RADIUS Overview
Module 11: Remote Access Fundamentals
What Is RADIUS?
How RADIUS Works for Remote Access
How RADIUS Works for 802.1X Connections
Discussion: Benefits of RADIUS
What Is A RADIUS Proxy?

9. Module 11: Remote Access Fundamentals
Course 6420A
What Is RADIUS?
Module 11: Remote Access Fundamentals
Remote Authentication Dial In User Service (RADIUS) is a protocol for controlling authentication, authorization, and accounting
Explain in general how the RADIUS process works. The next two topics cover the details of ports that must be open and specific scenarios.
Process:
A user computer contacts a RADIUS client (such as a remote access server).
The RADIUS client takes credentials from the user computer and passes them to the RADIUS server.
The RADIUS server verifies the credentials against a directory (such as Active Directory)
The RADIUS server informs the RADIUS client of whether the user is allowed or denied access.
The RADIUS client allows or denies the user access.
Network Policy Server (NPS) is the Windows Server 2008 component that functions as a RADIUS server. This replaces Internet Authentication Service (IAS) in Windows Server 2003.
Question: Why is it beneficial to use an open standard such as RADIUS for remote authentication?
Answer: This ensures that products from various vendors are interoperable. For example, you can purchase a remote access server from one vendor and a directory service from another vendor and they will function properly together as part of a RADIUS system.
RADIUS Client
Directory
Server
Remote Access Server
Remote Access Client
RADIUS Server

10. How RADIUS Works for Remote Access
Course 6420A
How RADIUS Works for Remote Access
Module 11: Remote Access Fundamentals
For remote access, RADIUS:
Enables an ISP to authenticate users against a corporate directory such as Active Directory® Domain Services
Enables accounting for all remote access to centralized in a single location
The graphic for this slide shows how an ISP can use RADIUS to authenticate corporate users. The users log on with their corporate username and password.
Accounting is performed at the RADIUS server. If multiple RADIUS clients are accepting client requests, then all accounting is centralized at the RADIUS server.
Ports used by RADIUS:
• 1812 RADIUS authentication
• 1813 RADIUS accounting
Note: Some non-Microsoft RADIUS servers use User Datagram Protocol (UDP) port 1645 for authentication and UDP port 1646 for accounting. These are the ports originally used for RADIUS but are not the ports defined in RFC 2865 Remote Authentication Dial In User Service ( and RFC RADIUS Accounting (
Question: How must a firewall be configured to allow communication between a RADIUS client and RADIUS server?
Answer: The RADIUS client uses a randomized port number for communication. Therefore, the port number for RADIUS clients cannot be defined in firewall rules. However, the IP address of RADIUS clients can be defined in firewall rules.
ISP
Corporate Office
RADIUS Client
Domain Controller
Remote Access Client
RADIUS Server

11. How RADIUS Works for 802.1X Connections
Course 6420A
How RADIUS Works for 802.1X Connections
Module 11: Remote Access Fundamentals
For 802.1X, RADIUS:
Authenticates network connections
Can be used for wired or wireless connections
Explain that RADIUS is used as part of the 802.1X standard for authenticating computers before allowing them to access wireless and wired networks. This is an easier system to implement than controlling network access based on the Media Access Control (MAC) address of network cards. Workstation credentials are used for the authentication in most cases.
For the highest level of security, this can be combined with controlling network access based on the MAC address of network cards.
Question: Describe a scenario where 802.1X could prevent a network problem?
Answer: Using 802.1X will prevent consultants and sales people from connecting to the corporate network before the computers are authorized. This allows you to verify the computer is appropriately configured before it is connected to the network. Appropriate configuration can include items such as current antivirus software.
References: For more information about 802.1X, see Deployment of Protected Networks Using Microsoft Windows at
RADIUS Client
Clients
Domain Controller
RADIUS Server

12. Discussion: Benefits of RADIUS
Course 6420A
Discussion: Benefits of RADIUS
Module 11: Remote Access Fundamentals
What are the benefits of using RADIUS?
Explain why the RADIUS benefits are important:
• Easier for users to log on
• Passwords can be reset by corporate help desk rather than ISP
• Centralized logging simplifies management and troubleshooting
Question: What are the benefits of using RADIUS?
Answer: The benefits of RADIUS vary depending on the scenario. These are some of the benefits of using RADIUS:
Simplified logon for dial-up users through an ISP. The ability to log on at an ISP by using corporate user credentials means that the user only needs to remember a single password.
Passwords for dial-up users through an ISP can be reset by the corporate help desk. This allows users to deal with a single help desk for all of their computer problems.
Enforce access policies for dial-up users through an ISP. When RADIUS is used, you can enforce all of the same access policies as you can by operating you own dial-up server.
Centralized logging for multiple Routing and Remote Access servers. All accounting information can be forwarded to a single server for simplified troubleshooting. This is particularly useful when multiple Routing and Remote Access servers are used in a network load balancing cluster.
Centralized authentication rules for multiple Routing and Remote Access servers. One set of rules can be configured on a RADIUS server to control authentication. These rules are in addition to user-based rules, such as time of day, available for log on.
Increased network security when used for 802.1X authentication. The 802.1X protocol increases network security by preventing unauthorized devices from connecting to the network.

13. Module 11: Remote Access Fundamentals
Course 6420A
What Is a RADIUS Proxy?
Module 11: Remote Access Fundamentals
A RADIUS proxy distributes RADIUS requests to the appropriate RADIUS server
RADIUS
Server
Explain why there may be multiple RADIUS servers:
• An ISP will have multiple clients
• An organization many have different departments that are managed separately.
Question: Why is using a RADIUS proxy simpler than using a separate RADIUS client for each RADIUS server?
Answer: In the case of an ISP, it may not be practical to maintain a dial-up server for each corporate client. Also, using a RADIUS Proxy prevents the need to direct different users to different dial-up servers.
ISP
CompanyB
RADIUS Client
RADIUS Proxy
RADIUS
Server
Remote Access Client
Company A

14. Lesson 3: Network Policy Server
Course 6420A
Lesson 3: Network Policy Server
Module 11: Remote Access Fundamentals
What Is Network Policy Server?
What Is Network Access Protection?
What Are Connection Request Policies?
What Are Network Policies?
Demonstration: Configuring NPS Policies

15. What Is Network Policy Server?
Course 6420A
What Is Network Policy Server?
Module 11: Remote Access Fundamentals
Network Policy Server is a role service that can function as a:
RADIUS server
RADIUS proxy
Network Access Protection server
Explain the role of Network Policy Server (NPS) to students. They should be familiar with the RADIUS roles from the previous lesson. Network Access Protection server controls computer access to the network based on client health. NAP is discussed further in the next topic.
Question: What component in Windows Server® 2003 had similar functionality to NPS?
Answer: Windows Server 2003 included Internet Authentication Service (IAS). IAS functioned as a RADIUS server and RADIUS proxy in Windows Server However, it did not function as a INSERT Network Access Protection (NAP) server. The NAP server is new functionality in Windows Server 2008.
Network Policy Server replaces Internet Authentication Service (IAS) from earlier versions of Microsoft® Windows®

16. What Is Network Access Protection?
Course 6420A
What Is Network Access Protection?
Module 11: Remote Access Fundamentals
Network Access Protection is a system that:
Enforces client health before it allows access to the network
Does not block intruders or malicious users
Has various enforcement mechanisms
Enforcement mechanisms include:
IPsec
802.1X
VPN
DHCP
RADIUS
Explain that each of the enforcement mechanisms must be enabled for NAP and will control network access based on client health characteristics such as updated antivirus software or update levels. These requirements are contained in health policies. The enforcement mechanism must be supported by the client.
At this time there is support for Windows Vista.
Enforcement mechanism Description
IPsec The ability to create and IPsec connection can be limited.
802.1X Access to the network can be restricted.
VPN Access to a VPN connection can be limited.
DHCP Computers not meeting heath requirements can be issued an IP address on a restricted network.
RADIUS Any device using RADIUS authentication can be integrated with NAP.
Question: Which NAP enforcement method would you use to ensure that remote access users have the most recent operating system updates installed?
Answer: The VPN enforcement method is the simplest to use for remote access users. Alternatively, RADIUS could also be used as an enforcement method if the RADIUS is used to authenticate remote access requests.

17. What Are Connection Request Policies?
Course 6420A
What Are Connection Request Policies?
Module 11: Remote Access Fundamentals
Are part of the RADIUS proxy functionality in NPS that:
Determine whether authentication of connection requests is performed locally or passed to another RADIUS server.
Contain conditions and settings
Must be configured for NAP with 802.1X or VPN even when it is processed locally
Some potential conditions:
Explain to students that connection request policies are part of the RADIUS proxy functionality in NPS. Describe how the conditions could be used to forward requests to the appropriate RADIUS server.
User names for a specific department could be appended with a specific string to identify them.
The settings for a connection request policy allow you to modify some characteristics of the connection. For example, if the user name is appended with –ENGR, in order to be properly routed to the appropriate RADIUS server, the settings can search for and remove that string before being passed to the RADIUS server.
Question: Why would you use settings in a connection request policy?
Answer: Settings modify the information that is passed on to the RADIUS server. They are used when you want to provide additional information to the RADIUS server or modify the data that is passed to the RADIUS server.
User Name
Client IPv4 address
Service Type
Client Vendor
Tunnel Type
Called Station ID
Day and Time Restrictions

18. What Are Network Policies?
Course 6420A
What Are Network Policies?
Module 11: Remote Access Fundamentals
Network policies control remote access requests, replacing remote access policies in earlier versions of Windows
Explain to students how network policies are different from connection request policies because they only apply when authentication is being performed locally. Describe each of the network policy components. Note that the options are different for conditions and settings in a network policy than in a connection request policy.
Question: How do network policies differ from network connection policies?
Answer: Network connection policies are used to deliver RADIUS authentication requests to the appropriate RADIUS server. Network policies are used to perform authentication on NPS servers acting as RADIUS servers and Routing and Remote Access servers.
Network Policy component
Description
Conditions
Determine whether this policy is used to evaluate a connection request
Access permission
Determine whether access is allowed, denied, or determined by user dial-in properties
Authentication methods
Determine the authentication methods that can be negotiated.
Constraints
Limits on the connection such as idle time or maximum connection time
Settings
Set characteristics of the connection such as encryption or IP filters

19. Demonstration: Configuring NPS Policies
Course 6420A
Demonstration: Configuring NPS Policies
Module 11: Remote Access Fundamentals
In this demonstration, you will see how to configure:
A connection request policy
A network policy
Ensure that the NYC-DC1 virtual machine is running.
In this demonstration:
On NYC-DC1, add the Network Policy and Access Services role and NPS role service
Create a network policy and explain the options
Create a connection request policy and explain the options
Question: Are the options for conditions and settings in network policies the same as the options for conditions and settings in connection request policies?
Answer: No. Each type of policy has unique options for conditions and settings. For example, a network policy can set characteristics of the connection such as the type of encryption to be used. While a network connection policy can only set values of variables that describe the connection to the RADIUS server.

20. Lesson 4: Troubleshooting Remote Access
Course 6420A
Lesson 4: Troubleshooting Remote Access
Module 11: Remote Access Fundamentals
What Is NPS Accounting?
Common Remote Access Issues
Process for Troubleshooting Remote Access Issues

21. Module 11: Remote Access Fundamentals
Course 6420A
What Is NPS Accounting?
Module 11: Remote Access Fundamentals
NPS Accounting is an administration tool that:
Is used for logging
Applies only to locally authenticated connections
Can be used for connection analysis and billing
Can be used for security investigation
Can store data in a file or a Microsoft SQL Server® Database
Describe NPS accounting to students. Note for students that larger environments with multiple NPS servers can use a single SQL Server database as a central location for logging information. Multiple NPS servers can be configured to use the same SQL Server database.
When logging to file, you can control:
• File location
• Format
• When a new log file is created
• Deletion of old log files
Question: In what situation would you not enable the When disk is full delete older log files option?
Answer: This option keeps a disk from running out of disk space when space is limited. If this option is enabled, an intruder could fill the logs to remove references to their access. Do not use this option if you require a complete record of all auditing information.

22. Common Remote Access Issues
Course 6420A
Common Remote Access Issues
Module 11: Remote Access Fundamentals
Some common remote access issues are:
Client configuration
Firewall configuration
Network Policy configuration
Ask students for examples of common remote access issues. Some examples include:
• Hotel firewall is blocking virtual private network (VPN) connections
• Client is configured to use an incorrect phone number or IP address for remote access
• Incorrect user name or password
• Network Policies are denying access to a user that should be allowed due to incorrect configuration or incorrectly ordered policies

23. Discussion: Process for Troubleshooting Remote Access Issues
Course 6420A
Discussion: Process for Troubleshooting Remote Access Issues
Module 11: Remote Access Fundamentals
What are some methods used to troubleshoot remote access issues?
Ask students for some ideas about how to troubleshoot remote access issues. Consider referring to the “How RADIUS Works for Remote Access and How RADIUS Works for 802.1X” section in this course to show the flow of information and where communication could be interrupted.
Some things to consider are:
Enable client logging
Review accounting logs
Verify connectivity between Routing and Remote Access and the NPS server
Verify network policies
Check firewall logs
Question: What methods can help you troubleshoot remote access issues?
Answer: Some methods to consider are:
Enabling client logging
Reviewing accounting logs
Verifying connectivity between Routing and Remote Access and the NPS server
Verifying network policies
Checking firewall logs

24. Lab: Implementing Remote Access
Course 6420A
Course 6421A
Lab: Implementing Remote Access
Module 12: Configuring and Managing Storage Technologies
Module 11: Remote Access Fundamentals
Exercise 1: Implementing a VPN server
Exercise 2: Implementing a RADIUS server
Exercise 3: Implementing a RADIUS proxy
Lab objectives:
Configure a VPN server
Configure a RADIUS server
Configure a RADIUS proxy
Scenario:
You are the remote access administrator for Woodgrove Bank. The bank does not currently have a remote access infrastructure and will build a new infrastructure using Windows Server 2008.
Exercise 1: Implementing a VPN server
Exercise 2: Implementing a RADIUS server
Exercise 3: Implementing a RADIUS proxy
Logon information
Virtual machine
NYC-DC1, NYC-RAS NYC-CL1
User name
Administrator
Password
Pa$$w0rd
Estimated time: 60 minutes 24

25. Module 11: Remote Access Fundamentals
Course 6421A
Course 6420A
Lab Review
Module 11: Remote Access Fundamentals
Module 12: Configuring and Managing Storage Technologies
Does the NPS service role of the Network Policy and Access Services role have to be installed to create network policies?
Why were the policies created during this lab moved to be evaluated first?
Why did a network policy have to be created on NYC-DC1 when one already existed on NYC-SRV1?
Question: Does the NPS service role of the Network Policy and Access Services role need to be installed to create network policies?
Answer: No, when you install Routing and Remote Access as a remote access server, you can create network policies that are used by Routing and Remote Access without installing the NPS service role of the Network Policy and Access Services role.
Question: Why were the policies created during this lab moved to be evaluated first?
Answer: After a matching policy is located, no further processing is performed. The default policies are very broad and encompass all users. For example, the default network policies deny access to all users. If the default policies were evaluated first, the new policies created during the lab would never be evaluated.
Question: Why did a network policy need to be created on NYC-DC1 when one already existed on NYC-SRV1?
Answer: After NYC-SRV1 was configured to use NYC-DC1 as a RADIUS server, the local network policies are no longer evaluated. The only network policies that are evaluated are those on the RADIUS server. 25

26. Module Review and Takeaways
Course 6420A
Module Review and Takeaways
Module 11: Remote Access Fundamentals
Review Questions
Real-world Issues and Scenarios
Tools
Review Questions
Point the students to the appropriate section in the course so that they are able to answer the questions presented in this section.
Question: Which VPN protocol uses IPsec for encryption? Answer: L2TP uses IPsec as an additional protocol to perform encryption. This makes L2TP more difficult to configure than other VPN protocols included in Windows Server 2008.
Question: What type of devices or servers can be RADIUS clients? Answer: for remote access the remote access server acts as a RADIUS client. For 802.1X authentication, the switch or wireless access point acts as a RADIUS client.
Question: Which RADIUS roles does NPS perform? Answer: NPS functions as a RADIUS server and a RADIUS proxy. Connection request policies are used to control the RADIUS proxy functionality. Network policies are used to control the RADIUS server functionality.
Question: Which logging location supports multiple NPS servers writing information to the same location? Answer: Only a SQL Server database support multiple NPS servers storing authentication and accounting data in a single location.
Real-world Issues and Scenarios
You can either discuss possible solutions for the scenarios at the end of the module or assign these scenarios as homework for the students. If you assign the scenarios as homework, you should provide some high-level hints that might help the students solve the problem stated in the scenarios. You can also do a follow-up debriefing the following day on some of the scenarios that have been assigned as homework to students.
Scenario: Your organization is implementing the Routing and Remote Access service as a VPN server. All remote client computers that will be connecting to the VPN server will be running Windows Vista. To minimize problems with firewalls, which VPN protocol should you use? Answer: You should use SSTP to minimize problems with firewalls. SSTP uses SSL on port 443 to encrypt communication. Most locations, such as hotels, allow port 443 through their firewall.
Scenario: Your organization wants to use the Routing and Remote Access service to help secure communication between two locations over the Internet. However, there are concerns about how the connection will be started after the Routing and Remote Access server in either location is restarted. Which feature in the Routing and Remote Access service can be used to reconnect the VPN between two locations? Answer: You can configure demand-dial connections on each of the Routing and Remote Access servers. After a server restart, the connection will automatically be re-established if data is destined for the remote network.
Scenario: There has recently been a problem in your organization with an unauthorized computer being connected to the corporate network. A consultant came in and connected a laptop infected with a virus to the network. There was no protection on the network and the virus attempted to spread to computers on the network. Fortunately the antivirus software on the network computers was up to date and the virus was unsuccessful in replicating itself. Which features in Windows Server 2008 can prevent this from happening again? Answer: Windows Server 2008 can act as a RADIUS server for 802.1X authentication. This will prevent unauthorized devices from connecting to the network. With 802.1X implemented on switches and wireless access points, all devices must authenticate before they connect to the network. Additionally, Windows Server 2008 includes NAP which can prevent computers that do not meet health requirements from accessing the network.
Scenario: Your organization is implementing Windows Server 2008 as a RADIUS server. There is some confusion among the staff as to the relationship between network policies and network connection policies. Explain the difference between the network policies and network connection policies. Answer: Network connection policies determine where authentication is performed by a RADIUS server. The default network connection policy authenticates all requests locally. If you want NPS to function as a RADIUS proxy, you must configure additional rules to redirect authentication requests to the appropriate RADIUS server. Network policies are used to authenticate users. The network policies in NPS are used by the Routing and Remote Access service servers performing local authentication and RADIUS servers
Tools
Point out the location from which each key tool can be installed. Let students review the function and usage of each tool on their own. Remind students that they can use this as a master list to help them gather all the tools required to facilitate their application support work.