QuickStudy: Network Access Quarantine Control

Computerworld -

DEFINITION: Network Access Quarantine Control, or NAQC, is a set of services and utilities available for Windows Server 2003 that lets you prevent remote users from connecting to your network with machines that aren't up to date and secure by quarantining them in a secured area.

Expert network administrators have long known that most nefarious software and malware infiltrate your production network not through holes in your firewall, or brute-force password attacks or anything else that might occur at your corporate headquarters or campus.

Instead, they gain access to your wires through your mobile users when they try to connect to the network while on the road. There's a big problem with remote users, and it hinges on the unpredictability of the machines from which they're connecting.

Most remote users are authenticated and allowed access to your network only on the basis of their identity. They can prove that they are who they say they are, and that's good enough for a lot of deployments. But problematically, no effort is made to verify that their hardware and software meet a certain baseline requirement. Remote users could, and do every day, fail any or all of the following common-sense guidelines for very basic computer security:

• The latest service pack and the latest security hot fixes are installed.   
• The corporation-standard antivirus software is installed and running and the latest signature files are being used.   
• Internet or network routing is disabled.   
• Windows XP's ICF, or any other approved firewall, is installed, enabled and actively protecting ports on the computer.

You would expect your business desktops to comply with policy, particularly because of the excellent tools that are now available for distributed management.

But mobile users have typically been either overlooked or grudgingly accepted as exceptions to the rule. Luckily, Windows Server 2003 includes a new feature in its Resource Kit, or with Service Pack 1, known as Network Access Quarantine Control (NAQC). In a nutshell, NAQC prevents unhindered access to a network for a remote user connecting to a secured endpoint until after the machine at the endpoint has verified the connecting computer's configuration meets certain requirements and standards.

Under NAQC, when a client establishes a connection to a remote network's endpoint (a machine running the Routing and Remote Access Service included in Windows Server 2003), the destination DHCP server gives the remote, connecting computer an IP address, but a server running Microsoft's Internet Authentication Service (also included in Windows Server 2003) establishes a "quarantine mode." In quarantine mode, the following restrictions are in effect:

• A set of packet filters is enabled that restricts the traffic sent to and received from a remote access client.
• A session timer is enabled that limits the duration of a remote client's connection in quarantine mode before being terminated.