70-411: Administering Windows Server 2012 Chapter 4 Configure a Network Policy Server Infrastructure

Objective 4.1: Configuring a Network Policy Server

RADIUS Terms Network Policy Server (NPS): Microsoft’s RADIUS server. Authorization: The process that determines what a user is permitted to do on a computer system or network. RADIUS client: A server or device that forwards RADIUS requests to a RADIUS server. Access client: A computer or device that contacts or connects to a RADIUS client, which requires authentication and authorization to connect. © 2013 John Wiley & Sons, Inc.

RADIUS servers and clients A Network with RADIUS RADIUS servers and clients © 2013 John Wiley & Sons, Inc.

Configuring RADIUS Server Infrastructures Multiple RADIUS server configurations: Primary RADIUS server and alternate RADIUS servers A RADIUS proxy located between the RADIUS server and the RADIUS clients © 2013 John Wiley & Sons, Inc.

Configuring RADIUS Clients The standard configuration includes: RADIUS server for dial-up or VPN connections RADIUS server for 802.1X wireless or wired connections NAP policy server © 2013 John Wiley & Sons, Inc.

Managing RADIUS Templates Are designed to reduce the amount of time and cost that it takes to configure RADIUS on one or more servers Creating a RADIUS template does not affect the functionality of NPS. A RADIUS template affects only the NPS server when the template is selected and applied when configuring RADIUS. © 2013 John Wiley & Sons, Inc.

Configuring RADIUS Accounting NPS Server Generates an Accounting-Start message RADIUS Accounting Server Sends an acknowledgment RADIUS Client Generates an Accounting-Stop message © 2013 John Wiley & Sons, Inc.

Understanding NPS Authentication Methods Authentication is usually broken down into the following categories: Password-based credentials Certificate-based credentials © 2013 John Wiley & Sons, Inc.

Using Password-Based Authentication The network access server passes the username and password to the NPS server. The NPS server verifies the credentials against the user account database. Processed from the most secure (Microsoft Challenge-Handshake Authentication Protocol v2 or MS-CHAPv2) to the least secure (unauthenticated access) of those enabled options. For stronger security, use certificate authentication or multi-factor authentication. © 2013 John Wiley & Sons, Inc.

Using Certificates for Authentication Much stronger than password-based authentication methods Certificates are: Customized using certificate templates Issued using a Certificate Authority If smart cards are used, certificates must include: Smart Card Logon purpose Client Authentication purpose © 2013 John Wiley & Sons, Inc.

Using Certificates for Authentication Digital certificate required and NPS server must use a server certificate for: Protected Extensible Authentication Protocol Microsoft Challenge-Handshake Authentication Protocol v2 (PEAP-MS-CHAP v2) Protected Extensible Authentication Protocol Transport Layer Security (PEAP-TLS) Extensible Authentication Protocol Transport Layer Security (EAP-TLS) © 2013 John Wiley & Sons, Inc.

Objective 4.2: Configuring NPS Policies

Network Policy Server (NPS) Policies Connection Request Specifies which RADIUS servers perform authentication, authorization, and accounting Network Specifies who is authorized to connect to the network and circumstances under which they can or cannot connect Health Establishes system health validators (SHVs) and other settings that define client computer configuration requirements for NAP-capable computers © 2013 John Wiley & Sons, Inc.

Configuring Connection Request Policies Connection request polices are based on a range of factors such as: The time of day and day of the week The realm name in the connection request The type of connection requested The IP address of the RADIUS client © 2013 John Wiley & Sons, Inc.

Configuring Connection Request Policies When you create a connection request policy, you define these parameters: Type of network access server such as remote access server (VPN dial-up) Condition that species who or what can connect to the network based on one or more RADIUS attributes Settings that are applied to an incoming RADIUS message such as authentication, accounting, and attribute manipulation © 2013 John Wiley & Sons, Inc.

Configuring Connection Request Policies Connection request policy conditions: Are one or more RADIUS attributes that are compared to the attributes of the incoming RADIUS Access-Request message. If there are multiple conditions, all of the conditions in the connection request message and in the connection request policy must match in order for the policy to be enforced by NPS. © 2013 John Wiley & Sons, Inc.

Configuring Network Policies An NPS network policy evaluates remote connections based on these three components: Conditions Constraints Settings © 2013 John Wiley & Sons, Inc.

Multilink and Bandwidth Allocation ISDN includes multiple channels, which allow simultaneous voice and data communications. With multilink and Bandwidth Allocation Protocol (BAP) settings, you can specify: Whether multiple connections form a single connection to increase bandwidth How BAP determines when these extra lines are dropped © 2013 John Wiley & Sons, Inc.

Encryption Options Basic Encryption (MPPE 40-Bit): For dial-up and PPTP-based VPN connections, MPPE is used with a 40-bit key. For L2TP/IPsec VPN connections, 56-bit DES encryption is used. Strong Encryption (MPPE 56-Bit): For dial-up and PPTP VPN connections, MPPE is used with a 56-bit key. For L2TP/IPsec VPN connections, 56-bit DES encryption is used. Strongest Encryption (MPPE 128-Bit): For dial-up and PPTP VPN connections, MPPE is used with a 128-bit key. For L2TP/IPsec VPN connections, 168-bit Triple DES encryption is used. No Encryption: This option allows unencrypted connections that match the remote access policy conditions. Clear this option to require encryption. © 2013 John Wiley & Sons, Inc.

IP Addressing IP settings include these options: Server Must Supply An IP Address Client May Request An IP Address Server Settings Determine IP Address Assignment (the default setting) Assign A Static IP Address © 2013 John Wiley & Sons, Inc.

Managing NPS Templates NPS template types available in Templates Management: Shared Secrets RADIUS Clients Remote RADIUS Servers IP Filters Health Policies Remediation Server Groups © 2013 John Wiley & Sons, Inc.

Objective 4.3: Configuring Network Access Protection (NAP)

Network Access Protection (NAP) NAP is Microsoft’s software for controlling network access for computers based on the health of the host. NAP can be used on any computer that runs Windows and supports NAP. Types of computers that connect to a network: Desktop computers Roaming laptops Unmanaged home computers Visiting laptops © 2013 John Wiley & Sons, Inc.

NAP Built-In Enforcement Methods DHCP IPsec VPN 802.1x Remote Desktop Gateway (RD Gateway) © 2013 John Wiley & Sons, Inc.

DHCP Enforcement To control network access, DHCP enforcement sets the following: DHCP Router option is set to 0.0.0.0 so noncompliant computers do not have a configured default gateway. Subnet mask is set to 255.255.255.255 so that there are no routes to the attached subnet. © 2013 John Wiley & Sons, Inc.

NAP Architecture Components NAP client-side components NAP enforcement points NAP health policy server System Health Agents (SHAs) © 2013 John Wiley & Sons, Inc.

NAP Architecture Components (cont.) Statement of Health (SoH) NAP Agent Health Registration Authority (HRA) Health requirements server Remediation servers © 2013 John Wiley & Sons, Inc.

Installing Network Access Protection Because NAP is offered through NPS, the installation is similar to installing NPS However, you want to add HRA, which is used to issue health certificates to NAP client computers that are compliant with network health requirements. For HRA to function, you need to have a CA available. © 2013 John Wiley & Sons, Inc.

System Health Validators System Health Validators (SHVs) settings define the requirements for client computers that connect to your network. You configure SHVs using the Network Policy Server console. Windows 8 includes a Windows Security Health Validator SHA that monitors the Windows Security Center settings. Windows Server 2012 includes a corresponding Windows Security Health Validator SHV. © 2013 John Wiley & Sons, Inc.

Configuring System Health Validators SHV options: Firewall Settings Antivirus Settings Spyware Protection Settings Automatic Updates Settings Security Updates Settings © 2013 John Wiley & Sons, Inc.

Configuring Health Policies Health policies consist of one or more system health validators and other settings that enable you to define client computer configuration requirements for the NAP-capable computers that attempt to connect to your network. Health policy pairs: NAP-compliant NAP-noncompliant © 2013 John Wiley & Sons, Inc.

Configuring Health Policies NAP enforcement settings: • NAP DHCP-compliant: Allow full network access. • NAP DHCP-noncompliant: Allow limited access. • NAP DHCP nonNAPcapable properties: Allow full network access. © 2013 John Wiley & Sons, Inc.

Configuring Isolation and Remediation If a computer is noncompliant, it should be isolated from production network. When you configure NAP, you can configure either a monitor only policy or an isolation policy. © 2013 John Wiley & Sons, Inc.

Configuring Isolation and Remediation Remediation servers typically consist of: • DHCP servers to provide IP configuration • Naming servers including DNS servers and WINS servers • Active Directory domain controllers (read-only domain controllers are recommended to minimize security risks) • Internet proxy servers so that noncompliant NAP clients can access the Internet © 2013 John Wiley & Sons, Inc.

Configuring Isolation and Remediation Remediation servers typically consist of (continued): • HRAs so that noncompliant NAP clients can obtain a health certificate for the IPsec enforcement method • Web server that contains the troubleshooting URL server, so users can access information on compliance • Anti-virus/anti-malware servers to retrieve updated anti-virus/anti-malware updates • Software update servers so that clients can get Windows updates © 2013 John Wiley & Sons, Inc.

Configuring NAP Client Settings You can use the Enable Security Center in the Group Policy procedure to enable Security Center on NAP-capable clients using Group Policy. Some NAP deployments that use Windows Security Health Validator require Security Center. Open the Services console to start and set the startup type to Automatic in the Network Access Protection Agent service. © 2013 John Wiley & Sons, Inc.