locked
NAP DHCP Enforcement Inquiry RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi All,

    First of all Sorry for so many questioned ask by me, I'm very new to this and given a minimum time to deploy this NAP thing.

    I have AD server that also have DNS and DHCP role, and I have this RADIUS server which where I will setup as NAP Server also. And planning to deploy a NAP DHCP Enforcement. Is it possible that may NAP is different server from my DHCP? Because my Boss doesn't want me to use AD Server as my NAP Server.

    Thank you.

    Thursday, May 19, 2016 6:23 AM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    So two questions there.

    Check the deployment guide, the DHCP server does not have to be the NPS server.

    This bit

    All NAP enforcement methods can be implemented using a minimum of one computer running Windows Server 2008 R2 or Windows Server 2008. All enforcement methods require that NPS is installed on this computer and configured to evaluate the health of NAP clients. Additional required services depend on the enforcement method. For example, IPsec, VPN, and DHCP enforcement methods require a NAP enforcement server running Windows Server 2008 R2 or Windows Server 2008. The 802.1X enforcement method requires network hardware that supports the 802.1X authentication method and is capable of controlling port characteristics using RADIUS tunnel attributes. For more information, see NAP Configuration Overview.

    The DHCP requires an NPS server AND a NAP server.Hope that helps

    And no IPsec needs firewalls.

    Please mark as an answer if helpful

    Yours

    Ed


    Thursday, May 19, 2016 3:10 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi spideynok,

    NPS must be running on the DHCP server, but it can be configured as a proxy. You aren't required to have the health policies on the DHCP server, but you do need to at least configure a connection request policy to foward authentication requests to a remote RADIUS server group (that contains the NPS server with your health policies).

    Checklist: Configure NAP Enforcement for DHCP

    https://technet.microsoft.com/en-us/library/cc772356(v=ws.10).aspx

    ________________________________________
    Best Regards,
    Cartman
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Friday, May 20, 2016 2:50 AM

All replies

  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi Spideynok

    Have a look at the NAP deployment guide for detailed answers.

    https://msdn.microsoft.com/en-us/library/dd314175(v=ws.10).aspx

    BE AWARE

    NAP DHCP Enforcement is deprecated and may well be removed form Windows Server 2016.

    Server 2012 R2 deprecated the feature

    https://technet.microsoft.com/en-us/library/dn303411.aspx

    Server  2016 Technical Preview

    https://technet.microsoft.com/en-us/library/dn765482.aspx

    Note the DHCP server no longer supports NAP in the preview so one can assume it not support it in the RTM version.

    Check with you boss he may wish to use a different method for NAP or think of a different solution.

    Yours

    Ed

    Please mark this as an answer if it was helpful

    Thursday, May 19, 2016 7:50 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Ed,

    Thank you for the fast reply and the remainder, this is a big help for us.

    But it's possible that my DHCP Server is different server from NPS server?

    By the way, I consider building DHCP NAP because IPsec Enforcement uses firewall to configure the Connectivity rule, w/c is not possible on our side because the default policy on our company is to keep those firewalls off managed by SEPM. Is there a way I can deploy IPsec without requiring those users computers on turning their Firewall ON?

    Thank you!

    Thursday, May 19, 2016 9:28 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    So two questions there.

    Check the deployment guide, the DHCP server does not have to be the NPS server.

    This bit

    All NAP enforcement methods can be implemented using a minimum of one computer running Windows Server 2008 R2 or Windows Server 2008. All enforcement methods require that NPS is installed on this computer and configured to evaluate the health of NAP clients. Additional required services depend on the enforcement method. For example, IPsec, VPN, and DHCP enforcement methods require a NAP enforcement server running Windows Server 2008 R2 or Windows Server 2008. The 802.1X enforcement method requires network hardware that supports the 802.1X authentication method and is capable of controlling port characteristics using RADIUS tunnel attributes. For more information, see NAP Configuration Overview.

    The DHCP requires an NPS server AND a NAP server.Hope that helps

    And no IPsec needs firewalls.

    Please mark as an answer if helpful

    Yours

    Ed


    Thursday, May 19, 2016 3:10 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi spideynok,

    NPS must be running on the DHCP server, but it can be configured as a proxy. You aren't required to have the health policies on the DHCP server, but you do need to at least configure a connection request policy to foward authentication requests to a remote RADIUS server group (that contains the NPS server with your health policies).

    Checklist: Configure NAP Enforcement for DHCP

    https://technet.microsoft.com/en-us/library/cc772356(v=ws.10).aspx

    ________________________________________
    Best Regards,
    Cartman
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Friday, May 20, 2016 2:50 AM