Related documentation

SCO OpenServer systems include comprehensive documentation. Depending on which SCO OpenServer system you have, the following books are available in online and/or printed form. Access online books by double-clicking on the Desktop Help icon. Additional printed versions of the books are also available. The Desktop and most SCO OpenServer programs and utilities are linked to extensive context-sensitive help, which in turn is linked to relevant sections in the online versions of the following books. See ``Getting help'' in the SCO OpenServer Handbook.

NOTE:

Release Notes

contain important late-breaking information about installation, hardware requirements, and known limitations. The Release Notes also highlight the new features added for this release.

SCO OpenServer Handbook

provides the information needed to get your SCO OpenServer system up and running, including installation and configuration instructions, and introductions to the Desktop, online documentation, system administration, and troubleshooting.

Graphical Environment Guide

describes how to customize and administer the Graphical Environment, including the X Window System™ server, the SCO® Panner™ window manager, the Desktop, and other X clients.

Graphical Environment help

provides online context-sensitive help for Calendar, Edit, the Desktop, Help, Mail, Paint, the SCO Panner window manager, and the UNIX® command-line window.

Graphical Environment Reference

contains the manual pages for the X server (section X), the Desktop, and X clients from SCO and MIT (section XC).

Guide to Gateways for LAN Servers

describes how to set up SCO® Gateway for NetWare® and LAN Manager Client software on an SCO OpenServer system to access printers, filesystems, and other services provided by servers running Novell® NetWare® and by servers running LAN Manager over DOS, OS/2®, or UNIX systems. This book contains the manual pages for LAN Manager Client commands (section LMC).

Mail and Messaging Guide

describes how to configure and administer your mail system. Topics include sendmail, MMDF, SCO Shell Mail, mailx, and the Post Office Protocol (POP) server.

Networking Reference

contains the command, file, protocol, and utility manual pages for the IPX/SPX (section PADM), NFS (sections NADM, NC, and NF), and TCP/IP (sections ADMN, ADMP, SFF, and TC) networking software.

Operating System Administrator's Reference

contains the manual pages for system administration commands and utilities (section ADM), system file formats (section F), hardware-specific information (section HW), miscellaneous commands (section M), and SCO Visual Tcl™ commands (section TCL).

Operating System Tutorial

provides a basic introduction to the SCO OpenServer operating system. This book can also be used as a refresher course or a quick-reference guide. Each chapter is a self-contained lesson designed to give hands-on experience using the SCO OpenServer operating system.

Operating System User's Guide

provides an introduction to SCO OpenServer command-line utilities, the SCO Shell utilities, working with files and directories, editing files with the vi editor, transferring files to disks and tape, using DOS disks and files in the SCO OpenServer environment, managing processes, shell programming, regular expressions, awk, and sed.

Operating System User's Reference

contains the manual pages for user-accessible operating system commands and utilities (section C).

PC-Interface Guide

describes how to set up PC-Interface™ software on an SCO OpenServer system to provide print, file, and terminal emulation services to computers running PC-Interface client software under DOS or Microsoft® Windows™.

Performance Guide

describes performance tuning for uniprocessor, multiprocessor, and networked systems, including those with TCP/IP, NFS, and X clients. This book discusses how the various subsystems function, possible performance constraints due to hardware limitations, and optimizing system configuration for various uses. Concepts and strategies are illustrated with case studies.

SCO Merge User's Guide

describes how to use and configure an SCO® Merge™ system. Topics include installing Windows, installing DOS and Windows applications, using DOS with the SCO OpenServer operating system, configuring hardware and software resources, and using SCO Merge in an international environment.

SCO Wabi User's Guide

describes how to use SCO® Wabi™ software to run Windows 3.1 applications on the SCO OpenServer operating system. Topics include installing the SCO Wabi software, setting up drives, configuring ports, managing printing operations, and installing and running applications.

System Administration Guide

describes configuration and maintenance of the base operating system, including account, filesystem, printer, backup, security, UUCP, and virtual disk management.

Many other useful publications about SCO systems by independent authors are available from technical bookstores. For networking, these include:

general

UNIX Networking. Stephen G. Kochran and Patrick H. Wood, Hayden Books, 1989. ISBN 0-672-48440-4.

TCP/IP

Internetworking with TCP/IP. Douglas Comer, Prentice Hall, 1991. ISBN 0-13-470154-2.

TCP/IP Network Administration. Craig Hunt, O'Reilly & Associates, Inc., 1992. ISBN 0-937175-82-X.

UUCP

Managing UUCP and Usenet. Tim O'Reilly & Grace Todino, O'Reilly & Associates, Inc., 1992. ISBN 0-937175-93-5.

Using UUCP and Usenet. Grace Todino and Dale Dougherty, O'Reilly & Associates, Inc., 1991. ISBN 0-937175-93-5.

NFS & automount

Managing NFS and NIS. Hal Stern, O'Reilly & Associates, Inc., 1991. ISBN 0-937175-75-7.

domain name service

DNS and BIND. Paul Albitz & Cricket Liu, O'Reilly & Associates, Inc., 1992. ISBN 1-56592-010-4.

Choose an Enforcement Method

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

To choose the right NAP enforcement method for your network, review the following sections of this guide to understand the details of how each enforcement method works and determine which method best meets your deployment goals:

You might also consider the following when choosing an enforcement method:

Infrastructure. How well does your current network support the enforcement method?
Cost. Which aspect of your NAP deployment is more important: cost or flexibility?
Complexity. Do you have the expertise to implement and maintain your deployment?
Security. How secure is the enforcement method?

Infrastructure

All NAP enforcement methods can be implemented using a minimum of one computer running Windows Server 2008 R2 or Windows Server 2008. All enforcement methods require that NPS is installed on this computer and configured to evaluate the health of NAP clients. Additional required services depend on the enforcement method. For example, IPsec, VPN, and DHCP enforcement methods require a NAP enforcement server running Windows Server 2008 R2 or Windows Server 2008. The 802.1X enforcement method requires network hardware that supports the 802.1X authentication method and is capable of controlling port characteristics using RADIUS tunnel attributes. For more information, see NAP Configuration Overview.

MCITP Boot camp USA : MCITP CCNA Boot camp UK, MCITP MCSE CCNA Boot camp Asia, MCITP CCNA MCSE Bootcamp, MCITP MCSE RHCE Training

Cost

Because support for it is built into the Windows operating system, the cost of deploying NAP is typically low, but depends on how well your existing network hardware and software support your design. If you have deployed Windows Server 2008 R2 or Windows Server 2008 on your network, then you already have some or all of the components required to deploy NAP. Some NAP enforcement methods might require an upgrade of the components of your network infrastructure. For example, deploying NAP with 802.1X enforcement can be costly if you do not already have hardware that supports 802.1X authentication. If you already have hardware that supports 802.1X, then it is likely that you can deploy NAP with 802.1X enforcement at minimal cost. If your hardware does not support NAP, in some cases adding support can be as simple as downloading and installing new firmware. To determine the costs associated with a NAP deployment, review hardware and software requirements for the enforcement methods you have chosen and determine whether server and network hardware upgrades are required. Additional costs that might also be associated with a NAP deployment include planning and design costs and the training of support personnel.

Complexity

NAP with IPsec enforcement is generally the most complex enforcement method to deploy because it requires a public key infrastructure (PKI) and IPsec policies to create logical networks. However, Windows Server 2008 R2 and Windows Server 2008 include tools for managing and monitoring IPsec that eliminates much of this complexity. The 802.1X enforcement method is next in terms of complexity, followed by VPN enforcement. DHCP enforcement is the least complex enforcement method to deploy.

Security

IPsec enforcement is a powerful method for protecting compliant computers from any others; it can be combined with server and domain isolation to ensure that after a computer has demonstrated it is compliant, it will still be restricted to communicating only with authorized hosts. IPsec provides other benefits, too. Network packets are authenticated, which reduces the risk of man-in-the-middle and replay attacks, and traffic can be encrypted with IPsec, providing a high degree of protection from eavesdropping attacks.

Like IPsec, 802.1X offers a high degree of protection. Several enhancements to 802.1X are also available that provide improved security. Until a client has demonstrated that it complies with the organization�s health requirements, its access to the network will be restricted by the network switches and wireless access points. These restrictions can be very difficult to bypass, even by a determined malicious user.

VPN enforcement is a good choice for protecting remote access to the corporate network. Clients that connect to a NAP-enabled VPN server can be granted restricted access to the network at the point of entry using IP packet filters. The health of remote client computers is evaluated when the client connects and it is monitored during the VPN session. If a client computer becomes noncompliant, then access is restricted until the computer is compliant.

DHCP enforcement restricts noncompliant computers by providing a limited IPv4 address configuration. It is the least secure NAP enforcement method. It is easily bypassed by an advanced user who has administrative privileges on the computer.

Combining NAP enforcement methods

It is possible to use more than one enforcement method simultaneously. An organization might invest additional resources into combining these enforcement technologies because they have complementary strengths and weaknesses. NAP with VPN enforcement can be used to enforce organizational compliance policies on remote clients, while NAP with IPsec enforcement can be used for local clients. 802.1X and IPsec offer a particularly robust combination because together they can restrict network connectivity at multiple layers of the network protocol stack. The following table shows which enforcement methods can be combined. Keep in mind that the complexity of your NAP deployment will increase when you combine enforcement methods.

	IPsec	802.1X	VPN	DHCP
IPsec
802.1X			X
VPN		X		X
DHCP

Microsoft Course 20413