c# qr code generator source Configuring Virtual Private Networks for Remote Clients and Networks in C#.NET

Maker QR Code in C#.NET Configuring Virtual Private Networks for Remote Clients and Networks

10

By default, ISA Server 2004 enables only MS-CHAP v2 authentication for VPN access. If a client computer does not support this level of authentication, then the user cannot connect. For a client to connect, the server and client must both be enabled for at least one common authentication protocol.

In addition to choosing the authentication method and protocol, you also need to decide whether you will use RADIUS or RSA SecurID for authentication. Just like ISA Server can be configured to use these services to enable authentication for Web publishing rules, it can also use them to authenticate VPN users. ISA Server can use IAS servers or any other RADIUS-compliant server. Windows 2000 Server and Windows Server 2003 both include Internet Authentication Service, which is a RADIUS-compliant server. When ISA Server is configured to use the IAS server for authentication, the VPN server component forwards the credentials presented to it by the VPN client to the IAS server on the internal network. The IAS server forwards these credentials to a domain controller that authenticates the user. The most important advantage for using RADIUS to authenticate VPN clients is so that you can use domain credentials for authentication when the server running ISA Server is not a member of the network domain. This adds a layer of security to the ISA Server firewall/VPN server solution because, if the firewall is compromised in any way, the machine s domain membership cannot be leveraged to attack the internal network. A second advantage for using RADIUS for authentication is that this configuration allows you to centralize Remote Access Policy administration. For example, you could have five servers running ISA Server configured as VPN remote-access servers configured in a network load-balancing (NLB) array. You could configure the settings manually on each server, or you could configure each of the servers to use an IAS server for authentication and then configure the Remote Access Policies once on the IAS server. By doing this, the same remote-access policies are automatically applied to each computer running ISA Server. You can also configure ISA Server to use RSA SecurID for authenticating VPN remoteaccess clients. To enable ISA Server to use RSA SecurID, you must install and configure an RSA ACE/Server. Then, configure the ISA Server computer as an RSA ACE/Agent and then configure the EAP authentication method to use RSA SecurID. Using RSA SecurID provides similar advantages to using RADIUS for authentication. In addition, because SecurID uses a remote-access token to generate new pass codes for each connection, it provides an additional layer of security that is not available with the other authentication methods, which use the same password for each connection from the same client.

10-11

In most cases, a VPN remote-access server can only validate the credentials of remoteaccess users and computers. If the remote-access users successfully authenticate, they can access all resources on the internal network. However, the remote-access client computer may not comply with corporate security policies. In this situation, you can use VPN quarantine control to prevent remote access to a private network until a client-side script validates the remote-access client configuration. VPN quarantine control allows you to scan the VPN client computer configuration before allowing them access to the organization s network. To enable VPN quarantine, you create a Connection Manager Administration Kit (CMAK) package that includes a VPN client profile and a VPN-quarantine client-side script. This script runs on the remote-access client when the client connects to the VPN server. The script checks the security configuration of the client and reports the results to the VPN server. If the client passes the security configuration check, the client is granted access to the organization s network. If you use ISA Server as the VPN server, and the script reports that the client meets the software requirements for connecting to the network, the VPN client is moved from the Quarantined VPN Clients network to the VPN Clients network. You can set different access policies for hosts on the Quarantined VPN Clients network compared to the VPN Clients network. In this way, you can limit network access until the clients have cleared quarantine, and then provide full access. Although quarantine control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. A timer setting is also available, which you can use to specify an interval at which the connection is dropped if the client fails to meet configuration requirements. The following clients can use VPN quarantine:

Windows Server 2003 Windows XP Home Edition and Windows XP Professional Windows 2000 Windows Me Windows 98 Second Edition

10-12