routed description

The routed daemon implements version I of the Routing Information Protocol (RIP I) to exchange routing information. It uses the /etc/gateways file to initialize static routes to distant networks. The /etc/gateways file is described in the reference manual page routed(ADMN).

If you wish to run routed, ensure that the file /etc/gated.conf does not exist. If it does, you must remove it, move it to another directory, or rename it. Otherwise, the gated daemon will execute instead of routed the next time your host reboots.

When routed starts, it reads the /etc/gateways file (if it exists) and installs the routes defined there into its routing table. It then broadcasts on each local network to find other hosts running routed. If such hosts exist, the routing daemons cooperate in maintaining a globally consistent view of routing within an autonomous system (AS). This view can be extended to include remote networks also running routed by setting up suitable entries in /etc/gateways.

Another approach to routing to nonlocal networks using routed is to define a default or wildcard route to a smart gateway. This gateway would then ICMP routing-redirect information dynamically create a routing database. This is done by adding an entry to /etc/tcp that invokes the route(ADMN) command, as in the following example:

/etc/route add default smart-gateway

route

The host uses the default route to the smart gateway as a last resort in routing packets to their destinations. Assuming the smart gateway will generate ICMP routing-redirect messages, the host will update its routing table entries based on the redirect messages received from the smart gateway.

This approach has certain advantages over using the routed daemon, but it is unsuitable in an environment where there are only bridges (for example, bridges do not generate ICMP routing-redirect messages). Further, if the smart gateway goes down, there is no way to maintain service except to alter the routing table manually using the route command.

The host always listens to, and processes, ICMP routing-redirect messages, and so it is possible to combine both of the above facilities. For example, the routed daemon might be used to maintain up-to-date information about routes to local networks, while employing the default routing techniques for distant networks.

Network Access Protection Design Guide

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

Network Access Protection (NAP) is one of the most anticipated features of the Windows Server� 2008 operating system. NAP is a new platform that allows network administrators to define specific levels of network access based on a client�s identity, the groups to which the client belongs, and the degree to which the client complies with corporate governance policy. If a client is not compliant, NAP provides a mechanism for automatically bringing the client into compliance (a process known as remediation) and then dynamically increasing its level of network access. NAP is supported by Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista�, and Windows� XP with Service Pack 3 (SP3). NAP includes an application programming interface that developers and vendors can use to integrate their products and leverage this health state validation, access enforcement, and ongoing compliance evaluation. For more information about the NAP API, see Network Access Protection (http://go.microsoft.com/fwlink/?LinkId=128423).

The following are key NAP concepts:

NAP Agent. A service included with Windows Server 2008, Windows Vista, and Windows XP with SP3 that collects and manages health information for NAP client computers.
NAP client computer. A computer that has the NAP Agent service installed and running, and is providing its health status to NAP server computers.
NAP-capable computer. A computer that has the NAP Agent service installed and running and is capable of providing its health status to NAP server computers. NAP-capable computers include computers running Windows Server 2008, Windows Vista, and Windows XP with SP3.
Non-NAP-capable computer. A computer that cannot provide its health status to NAP server components. A computer that has NAP agent installed but not running is also considered non-NAP-capable.
Compliant computer. A computer that meets the NAP health requirements that you have defined for your network. Only NAP client computers can be compliant.
Noncompliant computer. A computer that does not meet the NAP health requirements that you have defined for your network. Only NAP client computers can be noncompliant.
Health status. Information about a NAP client computer that NAP uses to allow or restrict access to a network. Health is defined by a client computer's configuration state. Some common measurements of health include the operational status of Windows Firewall, the update status of antivirus signatures, and the installation status of security updates. A NAP client computer provides health status by sending a message called a statement of health (SoH).
NAP health policy server. A NAP health policy server is a computer running Windows Server 2008 with the Network Policy Server (NPS) role service installed and configured for NAP. The NAP health policy server uses NPS policies and settings to evaluate the health of NAP client computers when they request access to the network, or when their health state changes. Based on the results of this evaluation, the NAP health policy server instructs whether NAP client computers will be granted full or restricted access to the network.