IDM with NAP, "unknow" status problem

[Karol Karkowski]

Hi

I'am making deployment of HP Procurve Manager with IDM and NAP for one of my client.
I am using 802.1x authorization mechanisms and NAP based on Windows Server 2008 wich acts as Radius Server in this case.
I have made standard configuration steps (according to Microsoft NAP - Step by step and Hp documents):
- created realm
- sync AD groups & users form Domain Controler
- installed IDM agent on Win Server 2008 and connected with IDM
- created policy 802.1x with NAP on Windows Serv 2008 with appropriate wizard
- created Access Profiles for Access Profiles Groups in IDM
- deployed access profiles to the realm
- created policy group on Dimain Controler's AD for client station for automatic NAP configuration
- configured switch with IDM Secure Access Wizard

I have problem with NAP status for some hosts in the LAN:
IDM gets Endpoint Security status as UNKNOW although :
- NAP agent service on the station is activated
- NAP enforcement client for EAP is started
- NAP status is ok (complaint)

I have checked a lot of things but I haven't found any reason.

Please help

best regards

[Holger Hasenaug]

An unknown IDM Endpoint Integrity status occur if the following MS RADIUS attributes which are passed by the NPS to the IDM agent have the following values:
- MS-Quarantine-State=0x1=Quarantined
AND
- Not-Quarantine-Capable=0x1=Endpoint does not send SoH

This may be caused by one of the following:

- Client does not support NAP
- NAP Agent is not started on client
- The â Enable Quarantine checksâ check-box is not marked under LAN properties/Protected EAP Properties

---

An "any" IDM Endpoint Integrity status occur if the check-box called â RADIUS client is NAP capableâ is not marked on the NPS server on the RADIUS clients settings.

[Karol Karkowski]

Hi Holger

Thanks a lot, really,
I have lost a lot of time finding solutions.
You really helped me.

The problem was with Enable Quarantine checks in LAN Connection settings under EAP. I have overlooked this setting and it wasn't mentioned in the Microsoft and HP documentation.

Do you know is it possible to set this settings in Active Directory to automate turning it on by creating Group Policy or something like this?

Thanks once more

best regards

[Holger Hasenaug]

Hi Karol,

For configuring 802.1X including the NAP settings through GPO for the wired LAN interface the Windows Domain must either be a native Windows 2008 domain or you need to do an AD schema extention on your 2003 domain.

Below is a good blog from Microsoft which as pretty valuable information on this topic, especially the last entry.

Have fun.

[Holger Hasenaug]

Ups I forgot the URL. Here it is:

http://social.technet.microsoft.com/Forums/en/winserverNAP/thread/8df1735b-1022-4455-b3f2-2c7545ff47e1