Exemption Policy in .1x Enforcement
i need creat 1 exemption policy based on below criteria -
1.clients non-nap capable
2.must have .1x enabled
3.only windows os
4.no user credential required authentication
all above criteria must checked.
in our environment have enabled .1x check on switch itself. if pc not have .1x enabled moved restricted vlan.
your kind highly appreciated.
rakesh kumar
are looking exempt clients meet these 4 criteria single nps policy? i'm not sure possible or if best approach here's information may you.
to handle no. 1 case, can create nps policies utilize the "nap-capable computers" condition.
for no. 2, looks have covered switch configuration. nps isn't aware of whether or not client authenticating using 802.1x. aware of authentication method being used (typically p/eap in 802.1x case). authenticator (your 1x switch) acting intermediary between client , radius server.
no. 3 doesn't have solution. there isn't way determine client os radius attribute information provided in access-request sent the network access server (nas) (your 1x switch in case) unless provides information in custom vendor specific attribute (vsa). place i'm aware of information being provided in nap statement of health (soh) included in access-request nap capable machines and not non-nap capable machines.
for no. 4, you'll want use peap-tls instead of peap-mschapv2 since peap-mschapv2 username/password based , peap-tls certificate based.
this technet forum post provided "as is" no warranties, , confers no rights. entry reflects own personal views , not reflect view of employer.
Windows Server > Network Access Protection
Comments
Post a Comment