Planning a Remote Access Strategy

Remote Access Overview

Dial-up networking allows a remote access client to establish a dial-up connection to a port on a remote access server. The configuration of the DUN server determines what resources the remote user can access. Users that connect through a DUN server, connect to the network much like a standard LAN user accessing resources.

Virtual Private Networks (VPNs) provide secure and advanced connections through a non-secure network by providing data privacy. Private data is secure in a public environment. Remote access VPNs provides a common environment where many different sources such as intermediaries, clients and off-site employees can access information via web browsers or email. Many companies supply their own VPN connections through the Internet. Through their ISPs, remote users running VPN client software are assured private access in a publicly shared environment. Tunneling is the concept used to describe a method of using an internetwork infrastructure to transfer a payload. IPSec tunnel mode enables IP payloads to be encrypted and encapsulated in an IP header so that it can be sent over the corporate IP internetwork or Internet.

Routing is the process that transfers data over the internetwork from one local area network (LAN) to another. Routers are devices operating at the network layer of the OSI model that use the IP routing tables to forward traffic which it receives from a host or from another router. The different types of TCP/IP traffic become important when discussing routing and the routing protocols:

There are a number of technologies that enable remote network connections, including:

The Routing and Remote Access Service (RRAS) provides multiprotocol routing services for Microsoft Windows 2000 Server and Windows Server 2003 computers. RRAS includes a wide variety of features that support unicast and multicast IP routing, IPX routing, AppleTalk routing, and remote access.

Determining Organizational and User Requirements

Determining the remote access requirements of the organization and users should be one of the initial stages when you plan your remote access strategy. All organizations and all users do not have common remote access requirements.

From an organization perspective, a few issues that need to be initially addressed are:

From a users perspective, a few issues that need to be initially addressed are:

Determining the Types of Remote Access to Allow

When deciding on the specific type(s) of remote access that you are going to allow, you have to include the needs of the organization and the users which you have identified. The focal point here is whether the remote access type meets these needs and requirements. Another important factor that should be included when you determine the remote access type you are going to allow is the cost and administrative skills needed to both implement and maintain the remote access type.

The different types of remote access are summarized below:

Understanding Network Access Client Types:

Based on the different types of remote access, there are three network access client types:

Dial-In Access Design Considerations

The common dial-up networking connection methods are:

A few factors to consider before implementing dial-in remote access are:

The main factors or issues that you need to clarify when planning a dial-up networking strategy are:

VPN Access Design Considerations

Before looking at the design considerations for implementing a VPN remote access strategy, lets first look at the components that are needed for VPN connections to occur:

The main factors or issues that you need to clarify when planning a VPN remote access strategy are summarized below:

  • The hardware requirements of the VPN server are:
  • The VPN protocols that you will be using: You can support the use of one or both of the VPN tunneling protocols: Point-to-Point Tunneling Protocol (PPTP) or Layer Two Transport Protocol (L2TP). The factors to consider when deciding on which VPN protocol to use are:

    • Wireless Remote Access Design Considerations

    The main requirements for enabling wireless remote access are:

    Determining Authentication Methods for Remote Access

    When planning your remote access strategy, you need to determine the authentication method that will be used to authenticate clients connecting to the remote access server. Once authentication occurs, authorization would determine the level of access that the user has to access network resources. The different authentication protocols are listed below:

    Determining domain functional Levels

    The domain functional level specified for the domain would determine whether additional security features are supported, and therefore also affects which remote access security features can be used. The Windows Server 2003 domain functional level is the highest level that can be specified for a domain. All Active Directory domain features are available in Windows Server 2003 domain functional level, including the following:

    How to check which domain function level is set for the domain

    1. Open the Active Directory Domains And Trusts console
    2. Right-click the particular domain whose functional level you want verify, and select Raise Domain Functional Level from the shortcut menu.
    3. The Raise Domain Functional Level dialog box opens
    4. You can view the existing domain functional level for the domain in Current domain functional level.

    How to raise the domain functional level for a domain

    1. Open the Active Directory Domains And Trusts console
    2. Right-click the particular domain whose functional level you want to raise, and select Raise Domain Functional Level from the shortcut menu.
    3. The Raise Domain Functional Level dialog box opens.
    4. Use the Select An Available Domain Functional Level list to choose the domain functional level for the domain.
    5. Click Raise
    6. Click OK

    Determining the Level of Encryption for VPN Access

    For VPN access, you need to decide on the level of encryption that will be used. The options are:

    How to enable remote access for specific user

    1. Click Start, Administrative Tools, and then click Active Directory Users and Computers to open the Active Directory Users and Computers management console.
    2. In the console tree, expand the domain that contains the user account that you want to enable remote access for.
    3. Select the Users container.
    4. In the right pane, locate the user account that you want to configure.
    5. Right-click the specific user account and then select Properties from the shortcut menu.
    6. The Properties dialog box of the user opens.
    7. Click the Dial-in tab.
    8. In the Remote Access Permission area, click the Allow Access option.
    9. Click OK.

    How to enable remote access based on remote access policy

    1. Click Start, Administrative Tools, and then click Active Directory Users and Computers to open the Active Directory Users and Computers management console.
    2. In the console tree, expand the domain that contains the user account that you want to enable remote access for.
    3. Select the Users container.
    4. In the right pane, locate the user account that you want to configure.
    5. Right-click the specific user account and then select Properties from the shortcut menu.
    6. The Properties dialog box of the user opens.
    7. Click the Dial-in tab.
    8. In the Remote Access Permission area, click the Control Access Through Remote Access Policy option.
    9. Click OK.

    How to install computer certificates to support L2TP over IPSec for VPN connections

    1. Click Start, Run, and enter mmc in the Run dialog box. Click OK.
    2. From the File menu, select Add/Remove Snap-In.
    3. When the Add/Remove Snap-In dialog box opens, click Add.
    4. When the Add Standalone Snap-In dialog box opens, select Certificates from the available list and click Add.
    5. Click Close to close the Add Standalone Snap-In dialog box opens.
    6. Click OK in the Add/Remove Snap-In dialog box.
    7. In the Certificates console, in the console tree, expand Certificates.
    8. Select Personal.
    9. Click the Action menu, and select All Tasks, and then Request New Certificate.
    10. The Certificate Request Wizard launches.
      11. 1
    11. Click Next on the initial page of the wizard.
      12. 1
    12. For the type of certificate to request, click Computer and click Next.
      13. 1
    13. Specify a name and description for the computer certificate, and then click Next.
      14. 1
    14. Click Finish.

    How to create a remote access policy for wireless access

    1. Click Start, Administrative Tools, and then click Routing and Remote Access to open the Routing and Remote Access console.
    2. Click the Action menu, and then select New Remote Access Policy.
    3. The New Remote Access Policy Wizard launches.
    4. Click Next on the initial screen of the New Remote Access Policy wizard.
    5. On the Policy Configuration Method page, select the Use the wizard to set up a typical policy option.
    6. In the Policy Name field, provide a name for the policy. Click Next.
    7. On the Access Method page, select the Wireless option. Click Next.
    8. On the User or Group Access, select the Group option, and then click the Add button.
    9. Specify the group, and then click OK and Next.
    10. Select the Smart card or other certificate option and then click Next.
      11. 1
    11. Click Finish.

    How to disable password based authentication

    Because password based authentication is considered a weak authentication method for securing remote access, you should disable the usage of the following password based authentication methods/protocols:

    To do this,

    1. Click Start, Administrative Tools, and then click Routing and Remote Access to open the Routing and Remote Access console.
    2. In the console tree, select the server, and then click the Action menu to select the Properties command.
    3. Switch to the Security tab.
    4. Click the Authentication Methods button.
    5. The Authentication Methods dialog box opens.
    6. Disable the checkbox for Microsoft Encrypted Authentication (MS-CHAP).
    7. Disable the checkbox for Encrypted Authentication (CHAP).
    8. Disable the checkbox for Shiva Password Authentication Protocol (SPAP)
    9. Disable the checkbox for Unencrypted Password (PAP).
    10. Click OK.


    Top 5 Free Networking Tools

    Bookmark Planning a Remote Access Strategy

    Latest Blog Posts


    English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
    GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

    Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.