<p>Den här rapporten beskriver en experimentell studie av Microsoft Network Protection (NAP) och är ämnad för att utvärdera hur mogen tekniken är för att implementeras i en aktiv nätverksmiljö. För att göra studien tog vi hjälp av gymnasieskolan John Bauer i Kalmar. Tester har utförts med DHCP-framtvingning och 802. 1x-framtvingning, dessa är två av NAPs fyra olika framtvingande funktioner. En mindre analys av skolans switchkonfigurationer och interna säkerhet har även gjorts på John Bauers begäran. Testerna har visat att DHCP-framtvingning är en bra och enkel lösning för John Bauers trådade klienter. NAP-funktionen 802. 1x- framtvingning var en större utmaning dock, och blev inte lyckad. Utbudet av information om NAP är än för knapphändig och vi anser därför att inte bara 802.1x framtvingning inte är redo för implementation, utan även framtvingning med DHCP.</p>

Den här rapporten beskriver en experimentell studie av Microsoft Network Protection (NAP) och är ämnad för att utvärdera hur mogen tekniken är för att implementeras i en aktiv nätverksmiljö. För att göra studien tog vi hjälp av gymnasieskolan John Bauer i Kalmar. Tester har utförts med DHCP-framtvingning och 802. 1x-framtvingning, dessa är två av NAPs fyra olika framtvingande funktioner. En mindre analys av skolans switchkonfigurationer och interna säkerhet har även gjorts på John Bauers begäran. Testerna har visat att DHCP-framtvingning är en bra och enkel lösning för John Bauers trådade klienter. NAP-funktionen 802. 1x- framtvingning var en större utmaning dock, och blev inte lyckad. Utbudet av information om NAP är än för knapphändig och vi anser därför att inte bara 802.1x framtvingning inte är redo för implementation, utan även framtvingning med DHCP.

<p>This thesis presents a comparative study of four Network Access Control (NAC) technologies; Trusted Network Connect by the Trusted Computing group, Juniper Networks, Inc.’s Unified Access Control, Microsoft Corp.’s Network Access Protection, and Cisco Systems Inc.’s Network Admission Control. NAC is a vision, which utilizes existing solutions and new technologies to provide assurance that any device connecting to a network policy domain is authenticated and is subject to the network’s policy enforcement. Non-compliant devices are isolated until they have been brought back to a complaint status. We compare the NAC technologies in terms of architectural and functional features they provide.</p><p>There is a race of NAC solutions in the marketplace, each claiming their own definition and terminology, making it difficult for customers to adopt such a solution, resulting in much uncertainty. The NAC paradigm can be classified into two categories: the first category embraces open standards; the second follows proprietary standards. By selecting these architectures, we cover a representative set of proprietary and open standards-based NAC technologies.</p><p>This study concludes that there is a great need for standardization and interoperability of NAC components and that the four major solution proposals that we studied fall short of the desired interoperability. With standards, customers have the choice to adopt solution components from different vendors, selecting, what is commonly referred to as the best of breed. One example for a standard technology that all four NAC technologies that we studied did adopt is the IEEE’s 802.1X port-based access control technology. It is used to control endpoint device access to the network.</p><p>One shortcoming that most NAC architectures (with the exception of Trusted Network Connect) have in common, is the lack of a strong root-of-trust. Without it, clients’ compliance measurements cannot be trusted by the policy server whose task is to assess each client’s policy compliance.</p>

This thesis presents a comparative study of four Network Access Control (NAC) technologies; Trusted Network Connect by the Trusted Computing group, Juniper Networks, Inc.’s Unified Access Control, Microsoft Corp.’s Network Access Protection, and Cisco Systems Inc.’s Network Admission Control. NAC is a vision, which utilizes existing solutions and new technologies to provide assurance that any device connecting to a network policy domain is authenticated and is subject to the network’s policy enforcement. Non-compliant devices are isolated until they have been brought back to a complaint status. We compare the NAC technologies in terms of architectural and functional features they provide. There is a race of NAC solutions in the marketplace, each claiming their own definition and terminology, making it difficult for customers to adopt such a solution, resulting in much uncertainty. The NAC paradigm can be classified into two categories: the first category embraces open standards; the second follows proprietary standards. By selecting these architectures, we cover a representative set of proprietary and open standards-based NAC technologies. This study concludes that there is a great need for standardization and interoperability of NAC components and that the four major solution proposals that we studied fall short of the desired interoperability. With standards, customers have the choice to adopt solution components from different vendors, selecting, what is commonly referred to as the best of breed. One example for a standard technology that all four NAC technologies that we studied did adopt is the IEEE’s 802.1X port-based access control technology. It is used to control endpoint device access to the network. One shortcoming that most NAC architectures (with the exception of Trusted Network Connect) have in common, is the lack of a strong root-of-trust. Without it, clients’ compliance measurements cannot be trusted by the policy server whose task is to assess each client’s policy compliance.