Configuring and Managing Remote Access in Visual Studio .NET

Generator Code 128 Code Set C in Visual Studio .NET Configuring and Managing Remote Access

10

The following selection presents a summary of the remote access authorization pro cess. In each scenario, authorization settings at the remote access server differ when User1, a member of the Telecommuters group, attempts to connect through a dial-up line. Figure 10-20 shows the order of remote access policies defined at the server.

Figure 10-20

In each of the following scenarios, it is assumed that the domain functional level is not set to Windows 2000 mixed.

For each of User1 s connection attempts, up to three sets of permissions and settings are applied, in the following order: 1. The dial-in properties of the user account provided with the connection 2. The access permission defined in the first matching remote access policy 3. The profile settings accompanying the first matching remote access policy In scenario #1, shown in Figure 10-21, the remote access permission for User1 s account has been left at the default setting: Control Access Through Remote Access Policy. Consequently, the remote access permission specified in the first matching remote access policy is applied to the connection. The first matching remote access policy, named Telecommuters, is configured to allow remote access for the Telecom muters security group. Once the remote access permission of the Telecommuters policy is applied, the profile of the policy is verified. In this case, the Telecommuters policy profile permits access on all days except Sundays. The end result of these server settings is that User1 is per mitted access unless the day is Sunday.

Authorizing Remote Access Connections 10-35

Figure 10-21

Remote access authorization scenario #1

10-36

10

In scenario #2, shown in Figure 10-22, the remote access permission for User1 s account is again left at the default setting. As a result, the remote access policy again determines the remote access permission. In this case, however, the Telecommuters policy has been configured to deny access to the Telecommuters group. As a result, User1 s connection attempt is blocked, and the policy profile is not read.

Figure 10-22

Remote access authorization scenario #2

Authorizing Remote Access Connections 10-37

Scenario #3 is illustrated in Figure 10-23. In this scenario, the remote access permission for User1 s account has been modified from the default setting to Allow Access. In this case, the remote access permission setting is ignored in the Telecommuters remote access policy. However, the policy profile is still read and applied. As a result, User1 is permitted remote access unless the day is Sunday.

Figure 10-23

Remote access authorization scenario #3

10-38

10

In scenario #4, illustrated in Figure 10-24, the remote access permission for User1 s account has been modified from the default setting to Deny Access. As a result of this server setting, the remote access connection is blocked, and no remote access policy or accompanying profile is read.

Figure 10-24

Remote access authorization scenario #4

Authorizing Remote Access Connections 10-39

In the final remote access authorization scenario, the remote access policies are deleted at the server. As a result, no matching policy can be applied to the inbound remote access connection. The connection request is thus denied regardless of the remote access permission for User1 s account, which in this case is set to Allow Access. Sce nario #5 is illustrated in Figure 10-25.

(No Matching Remote Access Policy)

Figure 10-25

Remote access authorization scenario #5

Use the following checklist to troubleshoot dial-up remote access connections:

Verify that the Remote Access Server option is enabled on the server properties General tab in the Routing And Remote Access console. If you have configured a static address pool, verify that the pool is large enough to accommodate the number of simultaneous client connections needed. If you have configured the remote access server to assign addresses through a DHCP server, verify that the address scope defined at the DHCP server is large enough to accommodate blocks of 10 addresses requested by the remote access server. Verify that enough modem devices are configured in the Ports node to accommo date the number of simultaneous client connections needed.

10-40