If you have configured remote HRA servers as RADIUS proxies to forward connection requests to the local server running NPS for evaluation, then the local server running NPS must have a corresponding RADIUS client entry for each remote HRA server. NAP with IPsec enforcement does not require RADIUS clients if all HRA servers are also NAP health policy servers. If you are using HRA servers that have NPS configured as a RADIUS proxy, use the following procedure to verify that RADIUS clients are configured correctly on the local server running NPS so that it can process client connection requests received by remote HRA servers.

To verify RADIUS clients

1. Click Start, click Run, type nps.msc, and then press ENTER.

2. In the NPS console tree, double-click RADIUS Clients and Servers, and then click RADIUS Clients.

3. In the details pane, double-click the friendly name of a RADIUS client corresponding to an HRA server with NPS installed and configured as a RADIUS proxy. If no RADIUS client entry is present, use the following procedure to create a new RADIUS client. This procedure applies only if you have remote HRA servers configured to forward connection requests to the local server running NPS.

   1. Right-click RADIUS Clients, and then click New.
      
      
   2. Under Friendly name, type a name for the RADIUS client (for example, HRA-1).
      
      
   3. Under Address (IP or DNS), type the IP address or DNS name of the remote HRA server, click Verify, and then click Resolve.
      
      
   4. Confirm that the IP address displayed corresponds to the correct remote HRA server, and then click OK.
      
      
   5. Under Shared secret and Confirm shared secret, type the secret that is configured in remote RADIUS server group settings on the remote HRA server.
      
      
   6. If the remote HRA server has enabled the message authenticator attribute in its remote RADIUS server group configuration settings, then select the Access-Request messages must contain the Message-Authenticator attribute check box. If this option is not enabled on the remote HRA, then verify that this check box is cleared.
      
      
   7. Select the RADIUS client is NAP-capable check box, and then click OK.
      
      
   8. Resume the current procedure to validate configuration of the new RADIUS client.
      
      

4. In the Properties window, verify that the Enable this RADIUS client check box is selected.

5. Verify that the RADIUS client is NAP-capable check box is selected.

6. If the remote HRA server is configured to require that access requests contain the message authenticator attribute, then verify that the Access-Request messages must contain the Message-Authenticator attribute check box is selected. Otherwise, verify that this check box is cleared.

7. Next to Vendor name, verify that RADIUS Standard is selected.

8. Under Address (IP or DNS), confirm that the DNS name or IP address listed corresponds to the correct remote HRA server, and then click Verify.

9. In the Verify Client dialog box, click Resolve.

10. Under IP address, confirm that the IP address listed corresponds to an HRA server that has been configured to forward requests to the local server running NPS, and that the local server running NPS has network connectivity to this IP address.

11. Click OK. If a shared secret mismatch is suspected, type the secret next to Shared Secret and Confirm shared secret, and then click OK.

12. Repeat this procedure for each HRA server on your network that is configured to forward connection requests to the local server running NPS for processing.

Connection request policies are conditions and settings that validate requests for network access and govern where this validation is performed. Use the following procedure to confirm that connection request policy on the local server running NPS is configured for NAP IPsec enforcement.

To verify connection request policies

1. In the NPS console tree, double-click Policies, and then click Connection Request Policies.

2. In the details pane, double-click the connection request policy that is used to authenticate incoming network access requests from IPsec-protected NAP clients. If this policy is not present, perform the following steps to create a connection request policy.

   1. Right-click Connection Request Policies, and then click New.
      
      
   2. Under Policy Name, type a name for the connection request policy (for example, NAP IPsec with HRA).
      
      
   3. Under Type of network access server, select Health Registration Authority, and then click Next.
      
      
   4. Connection request policy requires that at least one condition is specified. To add a condition that does not deny any incoming access requests, on the Specify Conditions page, click Add.
      
      
   5. In the Select condition window, click Day and Time Restrictions, and then click Add.
      
      
   6. In the Time of day constraints window, select Permitted. Verify that all days and times are permitted, click OK, and then click Next.
      
      
   7. If the local server running NPS is a NAP health policy server, verify that Authenticate requests on this server is selected, click Next three times, and then click Finish. If the local server running NPS will forward requests to another server for evaluation, see Verify NPS proxy configuration.
      
      

3. On the Overview tab, verify that the Policy enabled check box is selected.

4. On the Overview tab, verify that the Type of network access server is either Health Registration Authority or Unspecified. For more information about specifying an access server type, see “Additional considerations” later in this topic.

5. Click the Conditions tab, and verify that all configured conditions are matched by both compliant and noncompliant NAP clients. For example, Day and time restrictions can be configured to permit network access only on specified days at specified times.

6. Click the Settings tab. Under Required Authentication Methods, click Authentication Methods, and verify that the Override network policy authentication settings check box is cleared.

7. Under Forwarding Connection Request, click Authentication.

8. To enable the local server running NPS as a NAP health policy server, verify that Authenticate requests on this server is selected.

9. Click OK to close the properties window.

Network policies use conditions, settings, and constraints to determine who can connect to the network. To evaluate health status of NAP clients, there must be at least one network policy that will be applied to computers that are compliant with the health requirements, and at least one network policy that will be applied to computers that are noncompliant. Use the following procedure to verify that these policies have been created and configured for NAP IPsec enforcement.

To verify network policies

1. In the NPS console tree, double-click Policies, and then click Network Policies.

2. In the details pane, verify that you have at least one policy for compliant computers and one policy for noncompliant computers, and that these policies have a Status of Enabled. To enable a policy, right-click the policy name, and then click Enable. If these policies are not present, perform the following steps to create a network policy.

   1. Right-click Network Policies, and then click New.
      
      
   2. Under Policy Name, type a name for the network policy (for example, NAP IPsec with HRA Compliant or NAP IPsec with HRA Noncompliant).
      
      
   3. Under Type of network access server, select Health Registration Authority, and then click Next.
      
      
   4. On the Specify Conditions page, click Add.
      
      
   5. In Select condition, click Health Policies, and then click Add.
      
      
   6. If this network policy will apply to compliant client computers, under Health Policies, choose a health policy that has been configured to match a compliant client health state, and then click OK.
      
      
   7. If this network policy will apply to noncompliant client computers, under Health Policies, choose a health policy that has been configured to match a noncompliant client health state, and then click OK.
      
      
   8. Click Next, select Access granted, and then click Next.
      
      
   9. On the Configure Authentication Methods page, select the Perform machine health check only check box, and then click Next twice.
      
      
   10. On the Configure Settings page, click NAP Enforcement.
       
       
   11. Choose an enforcement mode for this policy. For more information, see NAP enforcement modes later in this topic.
       
       
   12. To enable auto-remediation of noncompliant clients, select the Enable auto-remediation of client computers check box. If you do not wish to enable auto-remediation, clear this check box.
       
       
   13. Click Next, and then click Finish.
       
       
   14. Resume the current procedure to validate configuration of the new network policy.
       
       

3. In the details pane, verify that the Processing Order of policies is configured correctly for your deployment. More specific policies are processed before more general policies. To change the order of policies, right-click the policy name, and then click Move Up or Move Down.

4. In the details pane, verify that both your compliant and noncompliant NAP policies are configured with an Access Type of Grant Access. To configure access permissions, right-click the policy name, click Properties, click the Overview tab, and then select Grant Access.

5. In the details pane, verify that the Source of your policies used to process IPsec-protected NAP clients is either Health Registration Authority or Unspecified. For more information about specifying an access server type, see “Additional considerations” later in this topic.

6. In the details pane, double-click the name of a network policy used to match compliant clients, and then click the Conditions tab.

7. Verify that at least one of the conditions specified is Health Policy, and the Value corresponds to a health policy that you have configured to match a compliant client health state. If this condition is not present, perform the following steps.

   1. Click Add, click Health Policies, and then click Add.
      
      
   2. Under Health Policies, choose a policy that corresponds to a compliant client health state, and then click OK. If no health policies are available, then verify health policies and repeat this procedure.
      
      

8. Click the Constraints tab, and then click Authentication Methods.

9. Verify that the Perform machine health check only check box is selected.

10. Click the Settings tab, and then click NAP Enforcement.

11. Verify that Allow full network access is selected for this compliant network policy, and then click OK. This completes verification of a compliant network policy.

12. In the details pane, double-click the name of a network policy used to match noncompliant clients, and then click the Conditions tab.

13. Verify that at least one of the conditions specified is Health Policy, and the Value corresponds to a health policy that you have configured to match a noncompliant client health state. If this condition is not present, perform the following steps.

    1. Click Add, click Health Policies, and then click Add.
       
       
    2. Under Health Policies, choose a policy that corresponds to a noncompliant client health state, and then click OK. If no health policies are available, then verify health policies and repeat this procedure.
       
       

14. Click the Constraints tab, and then click Authentication Methods.

15. Verify that the Perform machine health check only check box is selected.

16. Click the Settings tab, and then click NAP Enforcement.

    • Verify that Allow limited access is selected for this noncompliant network policy if you have deployed NAP in a full enforcement mode.
      
      
    • Verify that Allow full network access for a limited time is selected for this noncompliant network policy if you have deployed NAP in deferred enforcement mode.
      
      
    • Verify that Allow full network access is selected for this noncompliant network policy if you have deployed NAP in reporting mode.
      
      
    • Verify that the Enable auto-remediation of client computers check box is selected if you wish to enable automatic remediation of noncompliant NAP clients.
      
      

17. Click OK.

18. Repeat these steps as necessary to verify configuration of each of the network policies used to evaluate access requests from IPsec-protected NAP clients.

NAP enforcement modes

Health policies define which SHVs are evaluated, and how they are used in validating the configuration of computers that attempt to connect to your network. Based on the results of SHV checks, health policies classify client health status. You need at least one health policy that corresponds to a compliant client health state, and at least one health policy that corresponds to a noncompliant client health state. Use the following procedure to verify that compliant and noncompliant health policies have been configured on the NAP health policy server.

To verify health policies

1. In the NPS console, double-click Policies, and then click Health Policies.

2. In the details pane, under Policy Name, double-click the name of a compliant health policy. If this policy is not present, use the following steps to create a compliant health policy.

   1. Right-click Health Policies, and then click New.
      
      
   2. Under Policy name, type a name for your compliant health policy (for example, NAP IPsec with HRA Compliant).
      
      
   3. Under Client SHV checks, select Client passes all SHV checks to create a strict health policy, or select Client passes one or more SHV checks to create a more lenient health policy.
      
      
   4. Under SHVs used in this health policy, select the check box next to each SHV that will be used to evaluate client health. The Windows Security Health Validator is available by default. Other SHVs are available if they have been installed.
      
      
   5. Click OK.
      
      

3. Under Client SHV checks, verify that either Client passes all SHV checks or Client passes one or more SHV checks is selected. These conditions are used to create compliant policies that are more restrictive or less restrictive, respectively.

4. Under SHVs used in this health policy, verify that the check boxes next to installed SHVs that will be used to evaluate health on your IPsec-protected NAP client computers are selected, and then click OK.

5. In the details pane, under Policy Name, double-click the name of a noncompliant health policy. If this policy is not present, use the following steps to create a noncompliant health policy.

   1. Right-click Health Policies, and then click New.
      
      
   2. Under Policy name, type a name for your noncompliant health policy (for example, NAP IPsec with HRA Noncompliant).
      
      
   3. Under Client SHV checks, select Client fails one or more SHV checks to create a strict health policy, or select Client fails all SHV checks to create a more lenient health policy.
      
      
   4. Under SHVs used in this health policy, select the check box next to each SHV that will be used to evaluate client health. The Windows Security Health Validator is available by default. Other SHVs are available if they have been installed.
      
      
   5. Click OK.
      
      

6. Under Client SHV checks, verify that either Client fails one or more SHV checks or Client fails all SHV checks is selected. These conditions are used to create noncompliant policies that are more restrictive or less restrictive, respectively.

7. Under SHVs used in this health policy, verify that the check boxes next to installed SHVs that will be used to evaluate health on your IPsec-protected NAP client computers are selected, and then click OK.

8. Repeat these steps for all health policies used to evaluate your IPsec-protected NAP client computers.

SHVs define software and configuration requirements for computers that attempt to connect to your network. Use the following procedure to verify that SHVs are configured correctly for your deployment.

To verify SHVs

1. In the NPS console, double-click Network Access Protection, and then click System Health Validators.

2. In the details pane, under Name, double-click the name of an installed SHV.

3. Configuration of SHVs will vary based on implementation. If you are using the Windows Security Health Validator, click Configure.

   • To configure health requirements for computers running Windows Vista, click the Windows Vista tab.
     
     
   • To configure health requirements for computers running Windows XP with Service Pack 3, click the Windows XP tab.
     
     

4. Enable health requirements by selecting the check boxes next to health components. Clear these check boxes to disable requirements. The health requirements available when using the WSHV include: Firewall, Virus Protection, Spyware Protection, Automatic Updating, and Security Update Protection.

5. Click OK, and configure error code resolutions for your deployment. Error code resolutions determine how clients are evaluated under the listed error conditions. You can select to return a status of Compliant or Noncompliant for each condition.

6. Click OK, and close the NPS console.