Network Access Protection: With Network Access Protection, system administrators of an organization’s computer network can define policies for system health requirements. Examples of system health requirements are whether the computer has the most recent operating system updates installed, whether the computer has the latest version of the anti-virus software signature, or whether the computer has a host-based firewall installed and enabled.

When it takes more than five seconds to generate a Network Access Protection (NAP) statement of health (SoH) message on a Windows Vista-based computer or on a Windows XP Service Pack 3-based computer, client connections do not authenticate successfully with a Cisco switch.

When the Network Access Protection Agent service is disabled on a Windows Vista-based computer, the Transport Layer Security (TLS) session cookie is not updated. Also, the cookie will be reused when the Network Access Protection Agent service is enabled. This lets successful authentications occur even though the authentications do not participate in Network Access Protection (NAP).

On a network, you deploy a Network Access Protection (NAP) architecture. When you connect to this network from a Windows Vista-based client computer, you can access the network resource correctly. However, after you run the gpupdate /force command to reapply the Group Policy settings, the client computer may lose network connectivity.

This issue occurs when the following conditions are true:

• Both IPsec policy and connection security rules are configured for NAP architecture.
• The value of the IKEFlags registry entry is set to 1C in hexadecimal.
  Note: This registry entry is located under the following registry subkey:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley\