Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It seems domain isolation can be used to accomplish, but I'd like a solution that doesn't require IPsec, or more accurately, doesn't require IPsec on the fileserver. IPsec if done in software has a large CPU overhead and our NAS boxes don't support any kind of offload.

The goal is to avoid authenticated users using non-managed machines to access network resources. Network Access Protection (NAP) and the various enforcement points looked promsiing but I couldn't find a bulletproof way to use them [which doesn't require IPsec on the fileserver].

I was thinking when a domain user accesses the NAS box it will first need a Kerberos ticket from AD, so if AD could somehow verify the computer that was requesting the ticket was in the domain I'd have a solution.

share|improve this question
    
Can I ask why this is something you want to do? If a user already has access to your LAN, and has a valid username/password, why shouldn't they be able to connect to a fileserver? What's the problem that you're trying to solve? –  mfinni Dec 20 '10 at 17:29
    
You're going to have to do this for each method of access though, if you don't use something like NAP. You're already allowing untrusted machines onto your LAN or VPN. What's to prevent an unknown machine from trying an exploit that doesn't require authenticated SMB access? What's going to keep them from hitting your internal web applications? –  mfinni Dec 21 '10 at 14:10
add comment

1 Answer 1

Yes. Use ipSec. Domains are designed in exatly that way.

Also the overhead is not that high if you dont use IpSec to ENCRYPT the traffic, only to validate endpoint identity.

share|improve this answer
    
On a NetApp FAS3050 (so 5yr old hw) the max CIFS throughput is 290MB/s. Enable IPsec integrity checking (AH with SHA1) and the throughput decreases to 30MB/s which is a big hit. The NetApp gives many other advantages so we don't want to change hence the question to have a solution that doesn't use IPsec. –  Chris Madden Dec 21 '10 at 12:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.