Planning Routing and Remote Access in Software

Drawing PDF 417 in Software Planning Routing and Remote Access

Remote access policies provide an additional layer of security beyond the standard authentication and authorization system to give you more control over who connects to your network and what they can do once they have connected Settings include restricting access to certain times and allowing calls only from certain phone numbers, as well as specific settings applying to the connection such as security settings, authentication protocols, and IP address settings The policies are split into three sections:

Permissions A toggle between granting and denying access, based on the conditions Profile Sets connection-level preferences, including security and authentication, for the connection

When a user connects, they are granted access only if their profile within Active Directory allows them remote access and only if they are accepted by the different policies within the RRAS system Policies are numbered and processed in a top-down fashion Each condition within a policy needs to be matched only once, however, even though a policy can contain multiple conditions You can see an example of the main policy window in Figure 57

Note that policies are only processed if the user has been granted permission to dial in in the first place If the user s dial-in permission is set to Deny Access, the user is disconnected before the various policies are processed

Authentication-Type Called-Station-ID Calling-Station-ID Client-Friendly-Name Client-IP-Address Client-Vendor

The authentication scheme used to verify the user The phone number dialed by the user The phone number from where the call originated The friendly name for the RADIUS client (Internet Authentication Service [IAS] only) The IP address of the RADIUS client (IAS only) The manufacturer of the RADIUS proxy or Network Access Server s (NAS) manufacturer (IAS only) The time periods and days during which a user is allowed to connect

Conditions for a Remote Access Policy (continued)

Framed-Protocol NAS-Identifier NAS-IP-Address NAS-Port-Type Service-Type Tunnel-Type Windows-Groups

The communication protocol used by the client The string that identifies the NAS that originated the request (IAS only) The IP address of the NAS where the request originated (IAS only) The type of physical port used by the NAS originating the request (IAS only) The type of service requested by the user The tunneling protocols used The groups to which a user belongs

Once you ve set the conditions, you must specify whether this grants access, which is the role of the remote access permissions We ll cover how to do that next

When remote access processes the individual conditions, you can then apply a grant or deny access action according to whether the permissions were matched For example, you can create a policy that has a condition to restrict access to a period between 9 AM and 6 PM each day If you then set the permission to grant access during this period if the condition is matched, users will only be able to connect during this time If you set the condition so that access is denied if the condition is matched, access will be restricted to after 6 PM but before 9 AM each day

The last stage of the puzzle is the remote access profile This sets preferences and settings for the connection according to whether the condition was matched Because profiles are attached to policies, you can use them to set specific options depending on how a user connects For example, you can create a profile that enables encrypted communication if a user has connected using their mobile phone (as identified by the policy) and another profile that uses nonsecure communication when the user connects from their ISDN line Profile settings are configured through the window shown in Figure 58 The window is split into six tabs, Dial-in Constraints, IP, Multilink, Authentication, Encryption, and Advanced We ll cover authentication and encryption in just a moment; the others we ll cover now