Quick Check Facts for Windows Server 2008, Active Directory Network Infrastructure

IPv6 
IPv6 Addressing

• IPv6 address space is 128 bits (16 bytes)
• Large address space. Divided along 16-bit boundaries, converted to 4 digit hexadecimal numbers, separated by colons - known as colon hexadecimal .
• Simpler host configuration. IPv6 supports dynamic client configuration by using DHCPv6 and IPv6 also enables routers to configure hosts dynamically.
• Improved routing efficiency. Reduces how many routes the Internet must process by supporting hierarchical routing.
• Built-in security. IPv6 ensures all hosts encrypt data while in transit by including native IPSec support.
• IPv6 address types
• Unicast. Packets delivered to a unicast address are delivered to a single interface, one-to-one communication
• Multicast. Packets are delivered to multiple interfaces, one-to-many. One-to-many communication between computers that are defined as using the same multicast address. Multicast addresses have the first 8 bits set to 1111 1111 or FF
• Anycast. Identifies multiple interfaces, but delivered to a single interface, the closest one.  Used for locating services or the nearest router.
• Global Unicast address
• Equivalent to IPv4 public addresses
• Identified by the FP (Format Prefix) of 001 (globally routable and reachable on the IPv6 Internet
• The scope of a global unicast address is the entire IPv6 Internet
• The address prefix of a currently assigned global address is 2000::/3
• The combination of the first 3 high-order fixed bits and the 45-bit Global Routing Prefix is a 48-bit prefix assigned to an individual site
• The next 16 bits are the Subnet ID 
• The Interface ID field is the next 64-bits 

Configuring IPSec

Even though you can encrypt your data stored on your hard drive, how do you protect the data while it is in transmission? IPSec can do this. 

IPSec (Internet Protocol Security) is a set of protocols that give you a level of encryption between two computers while it is being transferred over an unsecured network.  IPSec uses security services and digital certificates with public and private keys. As stated in Mark Russinovich's and David Solomon's Windows Internals Book:

Internet Protocol Security (IPSec), which is integrated with the Windows TCP/IP stack, helps to protect unicast (IPSec itself supports multicast, but the Windows implementation does not) IP data against attacks such as eavesdropping, sniffer attacks, data modification, IP address spoofing, and man-in-th-middle attacks (when the identity of the remote machine can be verified, like a VPN). You can use IPSec to provide defense-in-depth against network-based attacks from untrusted computers; certain attacks that can result in the denial-of-service of applications, services, or the network; data corruption, data theft, and user-credential theft; and the administrative control over servers, other computers, and the network. IPSec helps defend against network-based attacks through cryptography-based security services, security protocols, and dynamic key management.

IPSec was originally designed to secure traffic over public networks. However, IPSec is being used increasingly on private networks. Windows Server 2008 provides enhancements to the IPSec rules.

Windows Internals Book

Configuring Network Access Protection (NAP)

How do you protect yourself from computers that do not meet your health requirements on your network?

Network Access Protection (NAP) with Windows Server 2008:

• A feature of Windows server 2008 that enforces health-requirement policies on client computers running:
  • Windows XP (SP3)
  • Vista
  • Windows 7
  • Windows server 2008
  • Windows server 2008 R2
• Ensures client computers are compliant with policies such as anti-virus and security policies on a granular level, based on who the client is and the group to which the client belongs.
• Remediation servers can offer support for computers not meeting health requirements, and to automatically bring the client back into compliance and dynamically increase its level of network access.
• You are able to integrate NAP’s features with software from other vendors or with custom programs.
• You can customize your health enforcement solutions. NAP includes an application programming interface (API) for developers and vendors that allows them to create customized solutions for health-requirements, network-access, and ongoing compliance.

About Network Policy Server Role Service

Installing and Configuring a Network Policy Server

The Network Policy Server (NPS) role in Windows Server 2008 replaces the Internet Authentication Service (IAS). Windows Server 2008 R2 can authenticate clients using Network Policy Server (NPS). NPS provides an additional layer of security for your network.

• NPS provides support for the Remote Authentication Dial-in User Service protocol and can be configured as a RADIUS server or proxy. 
• NPS also provides functionality that is essential for implementation of Network Access Protection (NAP). 
• NPS is used for enforcement for:
•  IPsec traffic
•  802.1X wired and wireless
•  DHCP
•  VPN

About Routing and Remote Access in Server 2008

Components of a Network Access Services Infrastructure

In Windows Server 2008, Network Access Service includes the following:

• VPN Server
• Active Directory Domain services (AD DS)
• IEEE 802.1X Devices – provides port based authentication of users
• Dynamic Host Configuration Protocol (DHCP) Server – Responsible for leasing IP addresses
• NAP Health Policy Server – Provides authentication services for other network access components
• Health Registration Authority – Obtains health certificates for clients passing the health policy verification
• Remediation Servers – A new server for Windows Server 2008 on a limited network, designed to treat machines that do not have the latest antivirus or Windows updates, by pushing the updates down to the NAP client sitting in the restricted network before the client accesses the main network

Network Policy and Access Services