微软技术大会-精美PPT参考模板-Day1_Session1_SVR322_Michael_Kleef.pptVIP

What Is NPS Used For? NPS provides policy definitions and enforcement; it is not an authentication source When an access request comes to the NPS it assesses it against its policies, then uses Active Directory to authenticate the user or device VPN Device Wired Network Wireless Network Dial-Up Network Policy Server Simple NPS Authentication Workflow Architecture IAS.xml .…… dnary.xml ………… Data Store Server Data Access SDO SDO Helper Netsh MMC Policy Engine IAS Helper Radius Server Dllhost.exe Process boundary RW configuration data Dictionary of NPS attributes Abstracts XML files to all processes (COM server) Abstracts SDO, simplifying end user interface points Server Data Objects; Implements COM API Policy Processing IAS Policies are sequential, rule-ordered policies One and only one policy applies to an access request Policy 1: Healthy If: Machine is healthy, allow full access Else: Go to next policy If: Machine is unhealthy, put in restricted network and push updates Else: Go to next policy Policy 2: Unhealthy If: Machine is downlevel, put in restricted network Else: Go to next policy Policy 3: Downlevel Default If: No other policy applies, deny the network access Users thinking they know better Policy Enforcement NAP - Enforcement Options Enforcement Healthy Client Unhealthy Client DHCP Full IP address given, full access Restricted set of routes VPN (Microsoft and 3rd Party) Full access Restricted VLAN 802.1X Full access Restricted VLAN IPsec Can communicate with any trusted peer Healthy peers reject connection requests from unhealthy systems Complements layer 2 protection Works with existing servers and infrastructure Flexible isolation Exemption AnalysisWho gets a “pass”? Basic Exemptions will be supplied by default (OS Level and type) Exemptions need to manageable Work up an exemption documentation process - eventually you will want to know where the holes are! Mitigation plans for the exemptions Can we isolate them through other means? IP Segmentation VLA