Profile Packet Filtering For Remote Access Policies

By Author: Shirley Green
Total Articles: 129
Comment this article

A remote access policy can specify IP packet filters that will restrict IP traffic on a Windows XP Professional. This is important for two reasons:
Packet filters can be used to restrict traffic type and destination on the internal network; for example, restricting external VPN access for specific groups
of clients to specific Web servers.
Packet filters can also be used to prevent other computers from using the VPN client as a router. A normal VPN connection creates a default route for the VPN
client. All traffic that matches this route traverses the VPN connection. A computer might attempt to forward traffic to the remote access VPN client and thus use this connection to penetrate the network. In addition, if the client computer is configured to route traffic from other computers on a home or small
office LAN, this traffic might be routed through the VPN tunnel.

RADIUS accounting messages can provide MCSA Certification a record of VPN connections whether or not the RADIUS server is used to provide authentication.

Network ...
... Address Translation (NAT) assigns an Internet-routable address to a client when the client's traffic is routed through a NAT server. By default, the NAT server will forward traffic from the external network to the internal network only if the traffic-comes in response to a client request. However, most NAT servers have the capability of forwarding external requests for specific services, such as access to Web servers that are located on the internal network Two issues for VPNs are:
Protocol compatibility PPTP VPN clients can be placed behind a NAT server and will have no difficulty. To use NAT servers and L2TP/IPSec VPNs, VPN clients
and VPN servers must be configured to use NAT-T.
Locating VPN and NAT services on the same server You can configure a Windows Server 2003 computer to be both a VPN server and a NAT server. Be
careful about configuring static packet filters on the external interface of the computer. The NAT service might not be able to receive traffic from the CCNA certification to facilitate client requests.