RealTime IT News

Microsoft NAP, TNC to Go Hand in Hand?

The network access control (NAC) landscape is about to change on news today that Microsoft NAP and standards organization Trusted Computing Group's Trusted Network Connect (TNC) are now interoperable.

The market for NAC is a competitive one, with the majority of solutions being compatible with one of three overriding frameworks: Cisco NAC, NAP or TNC. But now that NAP is considered an implementation of TNC, the NAC industry could be going from a three-horse race to a two-horse one between Cisco and TNC.

"The feedback we're always getting is that NAC is too confusing and why are there three architectures and not just one," Steve Hanna co-chair of the TNC working group for TCG and a distinguished engineer with Juniper Networks, told internetnews.com.

"Toward that end, this is getting us moving in that direction with a really deep interoperability that's not some sort of half hearted thing."

The interoperability involved TNC support for a Microsoft NAP approach called Microsoft Statement of Health Protocol. The IF-TNCCS-SOH (TNC client server - statement of health) protocol will now become the TNC standard. The IF-TNCCS-SOH acts as a transport to help validate that an end point meets the security requirements.

Hanna explained that the TNC client/server protocol is transport-independent and a common way that a network would see it is as 802.1x between the end point and the switch. In terms of the security of the TNCCS-SOH transport, there are significant measures in place to ensure that it isn't tampered with.

"Transport is not just encrypted; it's also authenticated and integrity-protected," Hanna said.

For Microsoft, by providing interoperability with TNC, they are hoping to overcome one of the biggest barriers to adoption for access control.

"We talk with customers about the network access control market, and there is a perceived adoption barrier to not knowing which solution to go with and not knowing whether any particular solution would interoperate with another solution in the long term," Paul Mayfield, group program manager of Windows Networking at Microsoft, told internetnews.com. "We felt it pretty important to respond."

TNC, which is supported by dozens of vendors, including Cisco rival Juniper Networks, won't automatically now become compliant with the hundreds of vendors that are compliant with Microsoft NAP.

And Mayfield noted that not all Microsoft NAP vendors will be immediately TNC-compliant, though some will be. Mayfield noted the devil is in the details.

TNC's Hanna was a bit less optimistic.

"What we're doing here is not waving a magic wand and all the products that were previously shipped are now magically compatible. We can't do that," Hanna said. "What needs to happen in order to make this compatibility real is that vendors need to develop and ship products that ship this new protocol."

TNCCS-SOH support, already a part of Window Vista, will be part of Microsoft Windows Server 2008 and will be part of Windows XP Service Pack 3. On the TNC side, Juniper Networks has pledged support for TNCCS-SOH and will be moving aggressively to provide interoperability.

So where does the new NAP/TNC interoperability leave Cisco NAC? It's not quite as isolated as you'd think. In 2004 Cisco and Microsoft formed a partnership to provide a degree of interoperability between NAC and NAP.

Microsoft's Mayfield explained that the new TNC interoperability will not impact Microsoft's relationship with Cisco.

"Our policy server can interoperate with Cisco clients, but that is through the agreement we had between our two companies as opposed to this standards announcement with TNC," Mayfield said. "We'll continue to work with Cisco and to work in standards efforts, but this announcement doesn't change the interoperability between Microsoft and Cisco."

Cisco isn't exactly chomping at the bit to join up with TNC, though. Juniper's Hanna said that the TCG has always welcomed Cisco to participate within TNC, but so far the company has declined.

The interoperability efforts between Juniper and Cisco are confined to a a group within the Internet Engineering Task Force (IETF), which is in the very early stages of discussing access control. The interoperability between TNC and NAP may, however, have an impact on Cisco's larger standards effort.

"My perspective is it will just help to will help to further that effort," Hanna said. "What we're doing here is improving interoperability, and that is just going to make it easier and more likely for us to achieve agreement in IETF."