Revision Summary Date Revision History Revision Class Comments 3/30/2012 1.0 New Released new document. 7/12/2012 1.0 None No changes to the meaning, language, or formatting of the technical content. 10/25/2012 1.0 None No changes to the meaning, language, or formatting of the technical content. 1/31/2013 1.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 2.0 Updated and revised the technical content. 11/14/2013 2.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 2.0 None No changes to the meaning, language, or formatting of the technical content.
5/15/2014 2.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 2.0 None No changes to the meaning, language, or formatting of the technical content. 10/16/2015 2.0 None No changes to the meaning, language, or formatting of the technical content. 9/26/2016 2.0 None No changes to the meaning, language, or formatting of the technical content.
The following figure depicts the server-side NAP architecture for an NPS. Figure 14: Server-side NAP architecture for NPS Relevant Standards The NAP protocols use and extend the following standards: Dynamic Host Configuration Protocol PPP EAP TLS Authentication Protocol Security Architecture for the Internet Protocol and The Internet Key Exchange (IKEv2) , X.509 Certificates IEEE Standard for and Metropolitan Area Networks - Port-Based Network Access Control and EAPoL Remote Authentication Dial In User Service (RADIUS) Protocol Bindings for SoH adopted by the Trusted Computing Group (TCG) as an interoperable implementation of the Trusted Network Connect Protocol IF-TNCCS [TNC-IF-TNCCSPBSoH] Relationship Between Standards and Microsoft Extensions For details about these relationships, refer to the Normative References section of the individual protocol technical documents. DHCP Extensions for NAP : Details the DHCP vendor-specific options used for transport of the SoH request and NAP data and how the SoH response (SoHR) is transported over DHCP. Details the DHCP options used for transport of remediation information. RADIUS Protocol Extensions for NAP : Details the RADIUS attributes used by NAP on a per-scenario Details the RADIUS attributes used to transport the SoH request. Details the RADIUS attributes used to transport remediation information to a NEP from the NPS. Health Certificate Enrollment Protocol : Details the certificate enrollment protocol and X.509 certificates used by NAP for IPsec-protected networks. Protected Extensible Authentication Protocol : Details a TLS protected end to end authentication method between client and NPS that is implemented as an EAP method . Protocol Summary The following tables provide a comprehensive list of the NAP member protocols, where the protocols are grouped according to their primary purpose for NAP deployment.
The following protocols enable NAP for IP Configuration access. Protocol name Description name Dynamic Host Configuration Protocol (DHCP) Extensions for Network Access Protection (NAP) DHCP is used by clients to configure IP stack including address, DNS hosts, and so on. Microsoft Dynamic Host Configuration Protocol (DHCP) Server Management Protocol As previously mentioned, DHCP is used by clients to configure their IP stack including their IP address, DNS servers, gateways, and so on. This document details extensions and implementation decisions made by Microsoft. The following protocols enable NAP for VPN access and LAN access. Protocol name Description Short name Protected Extensible Authentication Protocol (PEAP) PEAP specifies the EAP method for EAP between the client/NEP and NPS . The following protocols enable NAP for IPsec access. Protocol name Description name Health Certificate Enrollment Protocol (HCEP) HCEP details how the client enrolls for a health certificate based on its SoH. This
certificate is then used by the IPsec layer to perform network access enforcement. Internet Key Exchange Protocol This document details extensions to and differences from the IETF IKE standards as made by Microsoft. The following protocols enable NAP for Remote Desktop access. Protocol name Description Short name Remote Desktop Gateway Server Protocol Remote Desktop is a Microsoft Protocol that allows thin clients to run displays from a terminal server supporting many clients. The following protocols are used by NAP policy servers (NPS). Protocol name Description Short name RADIUS Attributes for Network Access Protection (NAP) Data Structure (RADIUS) RADIUS allows for NAP communication to NAP policy servers. The following protocols enable SoH communication.
Index A 31 24 18 26 C 30 40 31 25 26 25 26 18 Considerations 31 31 D Dependencies 26 25 Design intent 27 26 29 28 E 25 30 Examples 32 35 Extensibility 39 30 30 25 F 18 Functional requirements - overview ( 4, 18) G 12 H 30 Health validation 27 I 39 31 15 26 4 M 39 O Overview 24 18 4 P 26 39 R 15 Remediation 29 Request network access 28 Requirements 31 30 18 26 S 31 18 25 26 25 30 4 24 System requirements - overview ( 4, 18) System use cases 27 26 29 28 T 24 40 U 26 27 29