Microsoft NAP, TNC to Go Hand in Hand?

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

The network access control (NAC) landscape is about to change on news today that Microsoft NAP and standards organization Trusted Computing Group’s Trusted Network Connect (TNC) are now interoperable.

The market for NAC is a competitive one, with the majority of solutions being compatible with one of three overriding frameworks: Cisco NAC, NAP or TNC. But now that NAP is considered an implementation of TNC, the NAC industry could be going from a three-horse race to a two-horse one between Cisco and TNC.

“The feedback we’re always getting is that NAC is too confusing and why are
there three architectures and not just one,” Steve Hanna co-chair of the TNC working group for TCG and a distinguished engineer with
Juniper Networks, told internetnews.com.

“Toward that end, this is
getting us moving in that direction with a really deep interoperability
that’s not some sort of half hearted thing.”

The interoperability involved TNC support for a Microsoft NAP approach
called Microsoft Statement of Health Protocol. The IF-TNCCS-SOH (TNC client server – statement of health) protocol will now become
the TNC standard. The IF-TNCCS-SOH acts as a transport to
help validate that an end point meets the security requirements.

Hanna explained that the TNC client/server protocol is transport-independent
and a common way that a network would see it is as 802.1x between the end
point and the switch. In terms of the security of the TNCCS-SOH transport,
there are significant measures in place to ensure that it isn’t tampered
with.

“Transport is not just encrypted; it’s also authenticated and integrity-protected,” Hanna said.

For Microsoft, by providing interoperability with TNC, they are hoping to
overcome one of the biggest barriers to adoption for access control.

“We talk with customers about the network access control market, and there
is a perceived adoption barrier to not knowing which solution to go with and
not knowing whether any particular solution would interoperate with another
solution in the long term,” Paul Mayfield, group program manager of Windows
Networking at Microsoft, told internetnews.com. “We felt it pretty
important to respond.”

TNC, which is supported by dozens of vendors, including Cisco rival Juniper Networks, won’t automatically now become
compliant with the hundreds of vendors that are compliant with Microsoft NAP.

And Mayfield noted that not all Microsoft NAP vendors will be immediately TNC-compliant, though some will be. Mayfield noted the devil is in the details.

TNC’s Hanna was a bit less optimistic.

“What we’re doing here is not waving a magic wand and all the products
that were previously shipped are now magically compatible. We can’t do
that,” Hanna said. “What needs to happen in order to make this compatibility
real is that vendors need to develop and ship products that ship this new
protocol.”

TNCCS-SOH support, already a part of Window Vista, will be part of
Microsoft Windows Server 2008 and will be part of Windows XP Service Pack 3.
On the TNC side, Juniper Networks has pledged support for TNCCS-SOH and will
be moving aggressively to provide interoperability.

So where does the new NAP/TNC interoperability leave Cisco NAC? It’s not
quite as isolated as you’d think. In 2004 Cisco and Microsoft formed a partnership to provide a degree of interoperability between NAC and NAP.

Microsoft’s Mayfield explained that the new TNC interoperability will not
impact Microsoft’s relationship with Cisco.

“Our policy server can interoperate with Cisco clients, but that is through
the agreement we had between our two companies as opposed to this standards
announcement with TNC,” Mayfield said. “We’ll continue to work with Cisco
and to work in standards efforts, but this announcement doesn’t change the
interoperability between Microsoft and Cisco.”

Cisco isn’t exactly chomping at the bit to join up with TNC, though.
Juniper’s Hanna said that the TCG has always welcomed Cisco to participate
within TNC, but so far the company has declined.

This article was first published on InternetNews.com. To read the full article, click here.