NPS and NAP restricted network
I have a question about computers that are non compliant and go to the restricted network?
What all does that computer have access to with the filtered IP address? With the DHCP NAP setting of 06 DNS and 015 Domain Name, is that computer allowed to communicate with the DNS on the LAN to get to the internet to download updates and definitions? In the video, it showed the non compliant computer with a /30 address. Will that allow the computer to communicate with the DNS server on a /24 network?
The Quarantined device with a /30 will not have access to the the regular network but only access to it's own remediation network or the internet for that device get it's remediation done. This is the proper function.
Cordially,
Ronnie Wong
Edutainer, ITProTV
*if the post above has answered the question, please mark the topic as solved.
**All "answers" and responses are offered "as is" and my opinion. There is no implied support or guarantee by the ITProTV team.
So would it be best practice to have the restricted network it's own subnet?
If my production network is a 192.168.1.0/24 network, can I have NAP place non compliant computers into a 192.168.100.0/24 network with it's own router and DNS server?
I know I'll have guest computers that will always be non compliant, so I would want them in a network where they will have internet access, just not access to the production network.
I'm going to say it's possible. I haven't tried it with NAP but there are other products that do something similar that will allow it. This may involve a bit more complexity than using the DHCP NAP setup...
I"m going to have to rely on someone else here to add some more info. I'll check with the guys tomorrow. But hopefully some of our learned members may give you the answer you're looking for!
Cordially,
Ronnie Wong
Edutainer, ITProTV
*if the post above has answered the question, please mark the topic as solved.
**All "answers" and responses are offered "as is" and my opinion. There is no implied support or guarantee by the ITProTV team.
Ok, I'm hoping you can shed some light on this. I think I found a way using 802.1x without using NAP.
So my goal is to have guests on a different wired network. I found this article https://integratingit.wordpress.com/2012/07/05/configuring-dynamic-vlan-assignment-on-procurve-switches/
What I want to do that is different is have AD users placed in VLAN1 and guest computers placed in VLAN5.
I made a network policy just like what was show in the article for VLAN1. For VLAN5, since the guests will not have an AD account, I made a time restriction policy with no authentication (the box second from the bottom).
My question is, because the additional steps require that services be turned on for 802.1x, what happens to a computer that does not have that service turned on?
@Nathan-Guidry said:
802.1x is a method to allow for remote authentication. There are three parts: supplicant (Client), authenticator (Switch) and Authentication Server (RADIUS). If you've setup the authenticator (switch) and authentication server (RADIUS), then there must be a supplicant. If no supplicant, then RADIUS will not allow a remote user to access your network.
Cordially,
Ronnie Wong
Edutainer, ITProTV
*if the post above has answered the question, please mark the topic as solved.
**All "answers" and responses are offered "as is" and my opinion. There is no implied support or guarantee by the ITProTV team.
Thanks for the explanation Ronnie.
We're trying to get a network policy in place for wired connections. Our client has a wireless solution, but we're trying to get it so that when a guest plugs into a network jack, they are placed in a different VLAN than the office workers.
So Wired AutoConfig has to be running on the client computer or they won't be able to get on the network at all through an 802.1X port.
Is there a way to do dynamic vlan assignment without 802.1x while still only using a MS server or do I need 3rd party software to accomplish this?
