Question

Describe a scenario where an organization will need to use NAP? What are the benefits of using NAP?

please provide sources

Answer 1

Network access protection is used to secure the network.

While IDS may protect an entity from outside threats,it does not protect it from internal breaches in security due to large number of "unhealthy" clients accessing a company's internal resources.

Portable network devices like flash drives,cell phones ,tablets and PC laptops provide a large security risks with in an organization internet security that cannot be mitigated with traditional firewalls and intrusion detection.

NAP has both server and client servers

NAP is a function of Network Policy server(NPS) and controls access to network resources based on clients identity and compliance with security policies such as updates ,firewall configurations and antivirus definitions etc.

NAP makes use of enforcement methods.

• DHCP enforcement: if NAP client is out of compliance or forces the DHCP server to give client an alternative configuration that limits access to network resources until the client is brought into compliance.
• IPsec enforcement :with out these certificates clients are denied participation in IPsec secures communication
• VPN enforcement :restricts network access to VPN clients based on their compliance with network security policies.

Example scenario

Guests are denied full network access:

A consultant from another company connects his laptop into the corporate network. The guest sees that his computer has limited network access and that remediation on the restricted network has failed. He contacts the Help Desk.

This behavior is by design. Because this computer does not have a Configuration Manager client installed, the System Health Validator point cannot validate whether the computer is compliant or non-compliant. In this scenario, the Configuration Manager System Health Validator on the Network Policy Server is configured to give the computer a non-compliant health state, and automatic remediation is not possible.

The Help Desk confirms that their procedure in this scenario is to explain to the guest that full network access is not possible, but that they can use the Web proxy server on the restricted network. The guest uses the proxy Web server for Internet access and a VPN connection to his own corporate network.

Hope this will help