topic Integrating Microsoft NAP with Cisco ASA in Network Access Control

Integrating Microsoft NAP with Cisco ASA

Sleepw4lker — Mon, 11 Mar 2019 03:40:45 GMT

Hello everyone,

I'm quite new to the Cisco world. I wonder if and how it is possible to marry Cisco ASA with Microsoft NAP (in Terms of VPN Enforcement). Does anybody know some helpful documents? Is an ACS Server/Appliance necessary?

Thanks in advance and kind regards

Re:Integrating Microsoft NAP with Cisco ASA

Jatin Katyal — Mon, 22 Jul 2013 12:33:08 GMT

No, you don't need acs if you want to integrate asa with nps for vpn and adminiterative (telnet/ssh) access. With Microsoft nps you just can't configure Tacacs related features like command authorization and command accounting. I will try to post a document/link for your reference.

Sent from Cisco Technical Support Android App

Integrating Microsoft NAP with Cisco ASA

Sleepw4lker — Mon, 22 Jul 2013 13:48:11 GMT

Hello Jatin,

thanks so much for your fast reply.

What is with Microsoft NAP (Network Access Protection), does this also work (Here are some Client-Components involved like System Health Validators and so on)?

Kind regards

Integrating Microsoft NAP with Cisco ASA

Jatin Katyal — Mon, 22 Jul 2013 13:52:35 GMT

You just need NPS (Network Policy server) to act as a radius server.

http://technet.microsoft.com/library/cc732912.aspx

~BR
Jatin Katyal

**Do rate helpful posts**

Integrating Microsoft NAP with Cisco ASA

Jatin Katyal — Mon, 22 Jul 2013 18:51:38 GMT

Please post here if you have any further queries.

~BR
Jatin Katyal

**Do rate helpful posts**

Integrating Microsoft NAP with Cisco ASA

Sleepw4lker — Wed, 24 Jul 2013 10:41:22 GMT

Hello Jatin,

thanks for your reply.

Microsoft states that authentication via PEAP is necessary for NAP to work:

"One security feature of PEAP is the transmission of Statement of Health (SoH) messages."

(see http://blogs.msdn.com/b/openspecification/archive/2009/06/05/peap-phase-2-encapsulation-examples-for-a-client-authenticating-with-ms-chapv2.aspx?Redirected=true)

However, I found this topic which states that PEAP auth. is not possible with the ASA: https://supportforums.cisco.com/thread/2028742

Is that true?