Interop Labs: Microsoft gets NAC act together

The world of network access control is being drawn, irresistibly, into Microsoft's orbit now that the Redmond giant's full repertoire of Network Access Protection client, server and policy components are out there in the real world.

Last year's Interop Labs showed mostly wares adhering to the Trusted Computing Group's Trusted Network Connect (TCG/TNC) standard all working together nicely. But it's a new game this year because Microsoft has completely rolled out its NAP piece parts with Vista, Service Pack 3 for Windows XP and Windows Server 2008; Cisco has had to regroup its entire NAC strategy, quietly abandoning its own framework while forging ahead with adapting its Cisco Clean Access server for NAP deployments; and, there has been a relatively slow adoption of NAC in the enterprise.

If one were to write a history of NAC, the release of Microsoft Vista, Windows Server 2008, and Service Pack 3 (at the 'release candidate' level during our testing) to Windows XP would be regarded as the turning point in how enterprises deploy NAC. In the Interop Labs, we found a widespread assumption among team members and participating vendors that enterprises will want to start with Microsoft's built-in -- not to mention free -- NAP clients in Vista and XP SP3 and build a full NAC solution on top of those.

While both Cisco and Juniper participated in the Interop Labs testing, both focused their effort on their NAC policy servers and network infrastructure rather than their own NAC clients. Cisco supported the Interop Labs with network enforcement points (including its own switches and wireless equipment) and its Access Control Server (ACS) policy server, but chose not to bring in its own NAC framework client.

Our testing followed that assumption, by demonstrating interoperability between the Microsoft NAP client and each of five NAC policy servers, including Avenda Systems' eTIPS policy server, Cisco's ACS, Juniper's Unified Access Controller (UAC), Microsoft's Network Policy Server (NPS) and Open Systems Consultant's Radiator.

Another change in the world of NAC is the slow merger of some of the TCG/TNC NAC standards with Microsoft's NAP technology. Microsoft and the TCG last year announced that Microsoft's Statement of Health (SoH) protocol would also be an official TCG/TNC protocol. The SoH protocol, whether in Microsoft's NAP or TCG's TNC, is used to communicate end-point security information from the client trying to connect to the network to a policy server.

While one communication protocol out of a whole access control framework doesn't mean that NAP and TNC are fully merged, it does mean that end-point security vendors such as McAfee, Symantec, and Trend Micro could kill two birds with one stone. If they can make a SoH call within a Microsoft NAP deployment with the newly minted Windows Server 2008 and its NAP policy server in place, they should also be able to make that same type of call within any TCG/TNC deployment.