Secure imaging over the network

Shifting work patterns mean that organizations need to provision new machines remotely without undermining security protocols.

Overview

Customers that have highly secure internal networks may enforce enhanced security protocols like 802.1x or IPSec for machines on the corporate network.

However, this presents challenges when trying to boot a machine using PXE or iPXE for re-imaging.

If your organization is attempting to allow re-imaging throughout the enterprise (at every user’s desk) – not just in protected imaging labs – 2Pint Software can help you navigate the challenges.

Racked servers
Network switch

802.1x Background

The goal of 802.1x is to keep critical network resources on protected (or “Authorized”) networks, and unknown devices in isolated (or “Un-Authorized”) networks, even when the authorized and un-authorized computers are connected to the same switch. 802.1x allows for encrypted communications between authorized network devices.

Authorization happens when the machine first connects to the network, either by passing a certificate, or with user credentials.

It may be possible to identify when endpoint computers are in a non-compliant state, and to block authorization. For example, if the machine hasn’t been patched in a long time, has active anti-virus or anti-malware alerts, or any other reason, the 802.1x authorization server could deny a machine access to the protected internal corporate network.

For machines that have fallen behind in patching, or that are under security review the un-authorized network could be used to for patching, or incident response. Once secured, the device could have access to the authorized network restored.

Alert circle icon

The challenge

The challenge is that iPXE cannot be protected or encapsulated with other security protocols. The network must allow access to:

  • DHCP – for an IP address
  • BootP – to get the network boot protocol file (NBP)
  • HTTP(s) - to download the iPXE binary from the iPXE Server
  • ConfigMgr - (if applicable) a CM distribution point
  • WinPE – any additional servers the WinPE client will connect to
    • File server for downloading the Install.wim
    • File access to any server to initiate network level security
    • Optionally, access to the domain controller if a domain join is necessary