WINDOWS SERVER 2008 NETWORKING AND NETWORK ACCESS PROTECTION (NAP)
TABLE OF CONTENTS PART I ADDRESSING AND PACKET FLOW INFRASTRUCTURE CONCEPTS NETWORK LAYERS IPV4 ADDRESSING PRIVATE IPV4 ADDRESSES AUTOMATIC PRIVATE IP ADDRESSING (APIPA) MULTICAST ADDRESSES NETWORK ADDRESS TRANSLATION LAYER 2 AND LAYER 3 ADDRESSING LAYER 4 PROTOCOLS: UDP AND TCP PLANNING AND DESIGN CONSIDERATIONS DESIGNING YOUR INTERNET CONNECTION CREATING AN IPV4 ADDRESSING SCHEME PLANNING HOST ADDRESSES USING VPNS PLANNING REDUNDANCY USING MULTIHOMED COMPUTERS TABLE OF CONTENTS DEPLOYMENT STEPS MANUALLY CONFIGURING IPV4 CLIENTS CONFIGURING CLIENT BEHAVIOR WHEN A DHCP SERVER IS NOT AVAILABLE ADDING ROUTES TO THE ROUTING TABLE ONGOING MAINTENANCE TROUBLESHOOTING ARP IPCONFIG NETSTAT PATHPING PERFORMANCE MONITOR PING TASK MANAGER WINDOWS NETWORK DIAGNOSTICS CHAPTER SUMMARY ADDITIONAL INFORMATION IPV6 CHANGES FROM IPV4 TO IPV6 IPV6 ADDRESSING IPV6 AUTOCONFIGURATION DHCPV6 NEIGHBOR DISCOVERY IPV6 SECURITY IPV6 TRANSITION TECHNOLOGIES MIGRATING TO IPV6 ACQUIRING IPV6 ADDRESSES PLANNING NETWORK INFRASTRUCTURE UPGRADES PLANNING FOR IPV6 TRANSITION TECHNOLOGIES DEPLOYMENT STEPS HOW TO DISABLE IPV6 HOW TO MANUALLY CONFIGURE IPV6 HOW TO CONFIGURE IPV6 FROM A SCRIPT HOW TO ENABLE ISATAP TABLE OF CONTENTS HOW TO ENABLE 6TO4 HOW TO ENABLE TEREDO HOW TO CONFIGURE A COMPUTER AS AN IPV6 ROUTER NETSH NSLOOKUP TROUBLESHOOTING TEREDO DYNAMIC HOST CONFIGURATION PROTOCOL THE DHCP ADDRESS ASSIGNMENT PROCESS DHCP LIFE CYCLE DHCP SERVERS DHCP RELAY AGENTS DHCP LEASE DURATIONS DESIGNING SCOPES SERVER CLUSTERING FOR DHCP DYNAMIC DNS DHCP CLIENT CONFIGURATION MONITORING DHCP SERVERS MANUALLY BACKING UP AND RESTORING A DHCP SERVER TROUBLESHOOTING DHCP CLIENTS TROUBLESHOOTING DHCP SERVERS USING AUDIT LOGGING TO ANALYZE DHCP SERVER BEHAVIOR TABLE OF CONTENTS WINDOWS FIREWALL WITH ADVANCED SECURITY FILTERING TRAFFIC BY USING WINDOWS FIREWALL PROTECTING TRAFFIC BY USING IPSEC PLANNING WINDOWS FIREWALL POLICIES PROTECTING COMMUNICATIONS WITH IPSEC FIREWALL SETTINGS WITH GROUP POLICY IPSEC CONNECTION SECURITY RULES WINDOWS FIREWALL LOGGING MONITORING IPSEC SECURITY ASSOCIATIONS USING NETWORK MONITOR POLICY-BASED QUALITY OF SERVICE THE CAUSES OF NETWORK PERFORMANCE PROBLEMS HOW QOS CAN HELP QOS FOR OUTBOUND TRAFFIC QOS FOR INBOUND TRAFFIC QOS IMPLEMENTATION SETTING QOS GOALS PLANNING DSCP VALUES PLANNING TRAFFIC THROTTLING HARDWARE AND SOFTWARE REQUIREMENTS PLANNING GPOS AND QOS POLICIES QOS POLICIES FOR MOBILE COMPUTERS RUNNING WINDOWS VISTA HOW TO CONFIGURE QOS BY USING GROUP POLICY HOW TO CONFIGURE SYSTEM-WIDE QOS SETTINGS REMOVING QOS POLICIES TABLE OF CONTENTS EDITING QOS POLICIES MONITORING QOS ANALYZING QOS POLICIES VERIFYING DSCP RESILIENCE ISOLATING NETWORK PERFORMANCE PROBLEMS SCALABLE NETWORKING TCP CHIMNEY OFFLOAD RECEIVE-SIDE SCALING NETDMA IPSEC OFFLOAD EVALUATING NETWORK SCALABILITY TECHNOLOGIES LOAD TESTING SERVERS MONITORING SERVER PERFORMANCE CONFIGURING TCP CHIMNEY OFFLOAD CONFIGURING RECEIVE-SIDE SCALING CONFIGURING NETDMA CONFIGURING IPSEC OFFLOAD TROUBLESHOOTING TCP CHIMNEY OFFLOAD TROUBLESHOOTING IPSEC OFFLOAD PART II NAME RESOLUTION INFRASTRUCTURE DOMAIN NAME SYSTEM DNS HIERARCHY DNS ZONES DNS RECORDS TABLE OF CONTENTS DYNAMIC DNS UPDATES DNS NAME RESOLUTION DNS SERVER PLACEMENT DNS ZONE REPLICATION DNS SECURITY THE GLOBALNAMES ZONE DNS SERVER CONFIGURATION DHCP SERVER CONFIGURATION DNS CLIENT CONFIGURATION CONFIGURING REDUNDANT DNS SERVERS ADDING RESOURCE RECORDS MAINTAINING ZONES AUTOMATED MONITORING PROMOTING A SECONDARY ZONE TO A PRIMARY ZONE EVENT LOGS USING NSLOOKUP DEBUG LOGGING AT THE SERVER USING DNSLINT USING DCDIAG WINDOWS INTERNET NAME SERVICE HISTORY NETBIOS NAMES WINS NAME RESOLUTION WINS CLIENT REGISTRATIONS WINS SERVER PLACEMENT WINS REPLICATION CONFIGURING A WINS SERVER CONFIGURING WINS REPLICATION WINS CLIENT CONFIGURATION BACKING UP THE WINS SERVER DATABASE COMPACTING THE WINS DATABASE PERFORMING CONSISTENCY CHECKING MONITORING A WINS SERVER ADDING A STATIC WINS RECORD DELETING A WINS RECORD TROUBLESHOOTING WINS SERVERS TROUBLESHOOTING WINS CLIENTS PART III NETWORK ACCESS INFRASTRUCTURE AUTHENTICATION INFRASTRUCTURE ACTIVE DIRECTORY DOMAIN SERVICES PUBLIC KEY INFRASTRUCTURE GROUP POLICY RADIUS ACTIVE DIRECTORY PKI DEPLOYING ACTIVE DIRECTORY DEPLOYING PKI RADIUS SERVERS USING RADIUS PROXIES FOR CROSS-FOREST AUTHENTICATION USING RADIUS PROXIES TO SCALE AUTHENTICATIONS TABLE OF CONTENTS ONGOING MAINTENANCE TROUBLESHOOTING TOOLS IEEE 80211 WIRELESS NETWORKS SUPPORT FOR IEEE 80211 STANDARDS WIRELESS SECURITY COMPONENTS OF 80211 WIRELESS NETWORKS WIRELESS SECURITY TECHNOLOGIES WIRELESS AUTHENTICATION MODES INTRANET INFRASTRUCTURE WIRELESS AP PLACEMENT WIRELESS CLIENTS 8021X ENFORCEMENT WITH NAP DEPLOYING PROTECTED WIRELESS ACCESS DEPLOYING CERTIFICATES CONFIGURING ACTIVE DIRECTORY FOR ACCOUNTS AND GROUPS CONFIGURING NPS SERVERS DEPLOYING WIRELESS APS CONFIGURING WIRELESS CLIENTS MANAGING USER AND COMPUTER ACCOUNTS MANAGING WIRELESS APS UPDATING WIRELESS XML PROFILES TABLE OF CONTENTS TROUBLESHOOTING WIRELESS TROUBLESHOOTING TOOLS IN WINDOWS TROUBLESHOOTING THE WINDOWS WIRELESS CLIENT TROUBLESHOOTING THE WIRELESS AP TROUBLESHOOTING THE AUTHENTICATION INFRASTRUCTURE IEEE 8021X–AUTHENTICATED WIRED NETWORKS COMPONENTS OF WIRED NETWORKS WITH 8021X AUTHENTICATION WIRED AUTHENTICATION METHODS WIRED AUTHENTICATION MODES WIRED CLIENTS DEPLOYING 8021X-AUTHENTICATED WIRED ACCESS CONFIGURING 8021X-CAPABLE SWITCHES CONFIGURING WIRED CLIENTS MANAGING 8021X-CAPABLE SWITCHES UPDATING WIRED XML PROFILES WIRED TROUBLESHOOTING TOOLS IN WINDOWS TROUBLESHOOTING THE WINDOWS WIRED CLIENT TROUBLESHOOTING THE 8021X-CAPABLE SWITCH REMOTE ACCESS VPN CONNECTIONS COMPONENTS OF WINDOWS REMOTE ACCESS VPNS VPN PROTOCOLS AUTHENTICATION METHODS VPN SERVERS INTERNET INFRASTRUCTURE CONCURRENT INTRANET AND INTERNET ACCESS FOR VPN CLIENTS VPN CLIENTS VPN ENFORCEMENT WITH NAP ADDITIONAL SECURITY CONSIDERATIONS STRONG LINK ENCRYPTION VPN TRAFFIC PACKET FILTERING ON THE VPN SERVER FIREWALL PACKET FILTERING FOR VPN TRAFFIC MULTI-USE VPN SERVERS BLOCKING TRAFFIC ROUTED FROM VPN CLIENTS CONCURRENT ACCESS UNUSED VPN PROTOCOLS DEPLOYING VPN-BASED REMOTE ACCESS CONFIGURING INTERNET INFRASTRUCTURE CONFIGURING ACTIVE DIRECTORY FOR USER ACCOUNTS AND GROUPS CONFIGURING RADIUS SERVERS DEPLOYING VPN SERVERS CONFIGURING INTRANET NETWORK INFRASTRUCTURE DEPLOYING VPN CLIENTS MANAGING USER ACCOUNTS MANAGING VPN SERVERS UPDATING CM PROFILES TROUBLESHOOTING REMOTE ACCESS VPNS TABLE OF CONTENTS CHAPTER SUMMARY SITE-TO-SITE VPN CONNECTIONS DEMAND-DIAL ROUTING OVERVIEW COMPONENTS OF WINDOWS SITE-TO-SITE VPNS VPN ROUTERS SITE NETWORK INFRASTRUCTURE DEPLOYING SITE-TO-SITE VPN CONNECTIONS DEPLOYING THE ANSWERING ROUTERS DEPLOYING THE CALLING ROUTERS CONFIGURING SITE NETWORK INFRASTRUCTURE CONFIGURING INTERSITE NETWORK INFRASTRUCTURE MANAGING VPN ROUTERS TROUBLESHOOTING SITE-TO-SITE VPN CONNECTIONS PART IV NETWORK ACCESS PROTECTION INFRASTRUCTURE NETWORK ACCESS PROTECTION OVERVIEW THE NEED FOR NETWORK ACCESS PROTECTION MALWARE AND ITS IMPACT ON ENTERPRISE COMPUTING PREVENTING MALWARE ON ENTERPRISE NETWORKS TABLE OF CONTENTS THE ROLE OF NAP BUSINESS BENEFITS OF NAP COMPONENTS OF NAP SYSTEM HEALTH AGENTS AND SYSTEM HEALTH VALIDATORS ENFORCEMENT CLIENTS AND SERVERS NPS ENFORCEMENT METHODS IPSEC ENFORCEMENT 8021X ENFORCEMENT VPN ENFORCEMENT DHCP ENFORCEMENT HOW NAP WORKS HOW IPSEC ENFORCEMENT WORKS HOW 8021X ENFORCEMENT WORKS HOW VPN ENFORCEMENT WORKS HOW DHCP ENFORCEMENT WORKS PREPARING FOR NETWORK ACCESS PROTECTION EVALUATION OF YOUR CURRENT NETWORK INFRASTRUCTURE INTRANET COMPUTERS NETWORKING SUPPORT INFRASTRUCTURE NAP HEALTH POLICY SERVERS HEALTH REQUIREMENT POLICY CONFIGURATION COMPONENTS OF A HEALTH REQUIREMENT POLICY HOW NAP HEALTH EVALUATION WORKS PLANNING AND DESIGN CONSIDERATIONS FOR HEALTH REQUIREMENT POLICIES REMEDIATION SERVERS REMEDIATION SERVERS AND NAP ENFORCEMENT METHODS PLANNING AND DESIGN CONSIDERATIONS FOR REMEDIATION SERVERS UNDERSTANDING IPSEC ENFORCEMENT IPSEC ENFORCEMENT LOGICAL NETWORKS COMMUNICATION INITIATION PROCESSES WITH IPSEC ENFORCEMENT CONNECTION SECURITY RULES FOR IPSEC ENFORCEMENT HRAS IPSEC POLICIES NAP CLIENTS DEPLOYING IPSEC ENFORCEMENT CONFIGURING ACTIVE DIRECTORY CONFIGURING PKI CONFIGURING HRAS CONFIGURING NAP HEALTH POLICY SERVERS CONFIGURING REMEDIATION SERVERS ON THE BOUNDARY NETWORK CONFIGURING NAP CLIENTS IPSEC ENFORCEMENT DEPLOYMENT CHECKPOINT FOR REPORTING MODE CONFIGURING AND APPLYING IPSEC POLICIES ADDING A NAP CLIENT ADDING A NEW SHA AND SHV MANAGING NAP CAS MANAGING HRAS TROUBLESHOOTING IPSEC ENFORCEMENT OVERVIEW OF 8021X ENFORCEMENT USING AN ACL USING A VLAN TABLE OF CONTENTS PLANNING AND DESIGN CONSIDERATIONS SECURITY GROUP FOR NAP EXEMPTIONS 8021X AUTHENTICATION METHODS TYPE OF 8021X ENFORCEMENT 8021X ACCESS POINTS DEPLOYING 8021X ENFORCEMENT CONFIGURING A PEAP-BASED AUTHENTICATION METHOD CONFIGURING 8021X ACCESS POINTS CONFIGURING REMEDIATION SERVERS ON THE RESTRICTED NETWORK 8021X ENFORCEMENT DEPLOYMENT CHECKPOINT FOR REPORTING MODE TESTING RESTRICTED ACCESS CONFIGURING THE NETWORK POLICY FOR NONCOMPLIANT NAP CLIENTS FOR DEFERRED ENFORCEMENT CONFIGURING NETWORK POLICY FOR ENFORCEMENT MODE MANAGING 8021X ACCESS POINTS TROUBLESHOOTING 8021X ENFORCEMENT UNDERSTANDING VPN ENFORCEMENT USE OF NETWORK ACCESS QUARANTINE CONTROL TYPES OF PACKET FILTERING VPN AUTHENTICATION METHODS TABLE OF CONTENTS DEPLOYING VPN ENFORCEMENT CONFIGURING VPN SERVERS CONFIGURING REMEDIATION SERVERS VPN ENFORCEMENT DEPLOYMENT CHECKPOINT FOR REPORTING MODE CONFIGURING DEFERRED ENFORCEMENT TROUBLESHOOTING VPN ENFORCEMENT UNDERSTANDING DHCP ENFORCEMENT HEALTH REQUIREMENT POLICIES FOR SPECIFIC DHCP SCOPES DHCP OPTIONS FOR NAP CLIENTS DHCP ENFORCEMENT BEHAVIOR WHEN THE NAP HEALTH POLICY SERVER IS NOT REACHABLE DEPLOYING DHCP ENFORCEMENT CONFIGURING DHCP SERVERS DHCP ENFORCEMENT DEPLOYMENT CHECKPOINT FOR REPORTING MODE TABLE OF CONTENTS TESTING RESTRICTED ACCESS TROUBLESHOOTING DHCP ENFORCEMENT