Routing information administration

To forward packets by the best possible route, NetWare routers maintain a routing information table that holds information about all the segments on the network. Table 4-4 gives an example of a routing information table (only the fields pertinent to this discussion have been included).

Table 4-4 Portion of routing information table

---------------------------------------------------------------------------------- Network Hops to Ticks to Immediate address Net Aging number LAN segment LAN segment NIC of forwarding router status timer ---------------------------------------------------------------------------------- 00000001 1 2 A 0 00000002 1 2 B 0 FEED0038 1 20 C R 0 FEED0035 2 3 B 00001B029927 1 000000FF 2 3 A 00001B0349B2 2 FEED0036 3 4 A 00001B0349B2 2

Network number

Contains the network numbers of the segments of which the router is aware. The router simply matches the destination network number in the packet's IPX header with an entry in this field to get its forwarding instructions for the packet.

Hops to LAN segment

Indicates the number of routers that must be traversed to reach the network segment.

Ticks to LAN segment

Contains an estimate of the time necessary to reach the destination segment. It is used by the router in its periodic broadcasts to indicate the time necessary to deliver a packet to a node on that segment.

NIC

Indicates through which network interface card in the router the network segment can be reached

Immediate address

Contains the node number of the router that can forward packets to each segment. If the segment is directly connected to the router, this field will remain empty.

Net status

Indicates whether the segment is directly connected to the router and whether the segment is considered reliable

Aging timer

Is used to make sure that information about the segment is current

The method that drivers use for estimating the time delay on a segment depends on the segment type. For local segments with more than 1 megabyte per second (Token-Ring, Ethernet, Arcnet, and so on), the driver makes the assumption that delivery time is one tick. For remote segments (Tl, 64 KBps, X.25, and asynchronous), the driver will periodically poll to determine the current time delay. For example, the delay for a T1 link normally ranges from six to seven ticks. If this delay changes, the driver will inform its router. As information about the segment is passed throughout the network (by way of periodic broadcasts), routers will add any additional delay that they impose to the initial time estimate for the segment.

For NetWare versions prior to 2.16c, the routing information table keeps a list of all alternate routes for each network number in case the primary shortest route to a network number goes down. In other words, if the router can reach the segment through more than one of its NICs, it will make a record of all routes. The fastest route, the one that requires the least number of ticks, will always be used as the primary route. NetWare versions 2.16c and later maintain alternate routes only if these alternate routes require the same number of ticks to reach the segment as the primary route. This procedure reduces the size of the routing information table.

Network Access Protection Design Guide

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

Network Access Protection (NAP) is one of the most anticipated features of the Windows Server� 2008 operating system. NAP is a new platform that allows network administrators to define specific levels of network access based on a client�s identity, the groups to which the client belongs, and the degree to which the client complies with corporate governance policy. If a client is not compliant, NAP provides a mechanism for automatically bringing the client into compliance (a process known as remediation) and then dynamically increasing its level of network access. NAP is supported by Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista�, and Windows� XP with Service Pack 3 (SP3). NAP includes an application programming interface that developers and vendors can use to integrate their products and leverage this health state validation, access enforcement, and ongoing compliance evaluation. For more information about the NAP API, see Network Access Protection (http://go.microsoft.com/fwlink/?LinkId=128423).

The following are key NAP concepts:

NAP Agent. A service included with Windows Server 2008, Windows Vista, and Windows XP with SP3 that collects and manages health information for NAP client computers.
NAP client computer. A computer that has the NAP Agent service installed and running, and is providing its health status to NAP server computers.
NAP-capable computer. A computer that has the NAP Agent service installed and running and is capable of providing its health status to NAP server computers. NAP-capable computers include computers running Windows Server 2008, Windows Vista, and Windows XP with SP3.
Non-NAP-capable computer. A computer that cannot provide its health status to NAP server components. A computer that has NAP agent installed but not running is also considered non-NAP-capable.
Compliant computer. A computer that meets the NAP health requirements that you have defined for your network. Only NAP client computers can be compliant.
Noncompliant computer. A computer that does not meet the NAP health requirements that you have defined for your network. Only NAP client computers can be noncompliant.
Health status. Information about a NAP client computer that NAP uses to allow or restrict access to a network. Health is defined by a client computer's configuration state. Some common measurements of health include the operational status of Windows Firewall, the update status of antivirus signatures, and the installation status of security updates. A NAP client computer provides health status by sending a message called a statement of health (SoH).
NAP health policy server. A NAP health policy server is a computer running Windows Server 2008 with the Network Policy Server (NPS) role service installed and configured for NAP. The NAP health policy server uses NPS policies and settings to evaluate the health of NAP client computers when they request access to the network, or when their health state changes. Based on the results of this evaluation, the NAP health policy server instructs whether NAP client computers will be granted full or restricted access to the network.