NAP with DHCP with an external NPS server

Question

Hi ,
I have setup NAP with DHCP setup in my lab setup  and it is working . On my setup both the DHCP server and NPS are running on the same Longhorn server .
What  I would like to understand better is the communication between the DHCP server and the radius server ( i.e NPS ) .I would therefore  like to run these two components on two separate boxes and capture sniffer traces as the two are communicating.
My question is what do I need to configure to have the DHCP server and  NPS to talk to each other since I will run them on two separate machines. Is there a write up that explains the interaction between the two .
Thanks
 Mohammed Yassin

Answer 1

I have configured NPS2 to proxy Machine Identity "Machine health check" to NPS1.  NPS2 is generating RADIUS Access-Requests when a client is attempting to obtain a DHCP address (as configured in the step by step doc) The RADIUS Access-Reject message is being returned, here is the output.  There is no user account in the originating request from NPS2, nor is the user account info present in the DHCP request by the NAP enabled client so I'm not sure how this should work.
Log Name:      System
Source:        IAS
Date:          1/24/2007 9:25:47 AM
Event ID:      2
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      NPS1
Description:
User <not present>  was denied access.
 Fully-Qualified-User-Name = <undetermined>
 Machine-Name = Infoblox-Vista1
 OS-Version = <not present>
 NAS-IP-Address = 192.168.0.3
 NAS-IPv6-Address = <not present>
 NAS-Identifier = NPS2
 Called-Station-Identifier = 192.168.0.0
 Calling-Station-Identifier = 001641E14B12
 Client-Friendly-Name = NPS2
 Client-IP-Address = 192.168.0.3
 Client-IPv6-Address = <not present>
 NAS-Port-Type = Ethernet
 NAS-Port = <not present>
 Proxy-Policy-Name = Use Windows authentication for all users
 Policy-Name = Connections to other access servers
 Authentication-Provider = Windows
 Authentication-Server = NPS1.idblox.com
 Authentication-Type = Unauthenticated
 EAP-Type = <undetermined>
 Account-Session-Identifier=349348166
 Reason-Code = 65
 Reason = The connection attempt failed because remote access permission for the user account was denied. To allow remote access, enable remote access permission for the user account, or, if the user account specifies that access is controlled through the matching remote access policy, enable remote access permission for that remote access policy.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="IAS" />
    <EventID Qualifiers="32768">2</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2007-01-24T17:25:47.000Z" />
    <EventRecordID>38921</EventRecordID>
    <Channel>System</Channel>
    <Computer>NPS1</Computer>
    <Security />
  </System>
  <EventData>
    <Data>%%2147483686</Data>
    <Data>%%2147483685</Data>
    <Data>Infoblox-Vista1</Data>
    <Data>%%2147483686</Data>
    <Data>192.168.0.3</Data>
    <Data>%%2147483686</Data>
    <Data>NPS2</Data>
    <Data>192.168.0.0</Data>
    <Data>001641E14B12</Data>
    <Data>NPS2</Data>
    <Data>192.168.0.3</Data>
    <Data>%%2147483686</Data>
    <Data>Ethernet</Data>
    <Data>%%2147483686</Data>
    <Data>Use Windows authentication for all users</Data>
    <Data>Connections to other access servers</Data>
    <Data>%%2147483688</Data>
    <Data>NPS1.idblox.com</Data>
    <Data>Unauthenticated</Data>
    <Data>%%2147483685</Data>
    <Data>349348166</Data>
    <Data>65</Data>
    <Data>%%3221229633</Data>
    <Binary>00000000</Binary>
  </EventData>
</Event>