Guidelines For Using Connection Manager Profiles And Phone Books

By Author: joan
Total Articles: 286
Comment this article

Follow these guidelines:
If Connection Manager phone books are used and File Transfer Protocol (FTP) is used to update the MCP certification phone book files on the phone book server, be sure that the
FTP services are stopped or disabled after the phone book is transferred and that they are started only when new changes must be transferred.
Do not allow anonymous FTP access to the Phone Book Server (PBS).
Protect administrative connections to the PBS server using IPSec.
Protect Connection Manager profiles and the distribution process. This is important because:
Profiles contain scripts and access data that might provide an attacker with valuable information. Although connections are password protected, providing an attacker with all the server configuration information and access numbers reduces the amount of work the attacker has to do to successfully attack your network.
If an unauthorized individual is allowed to access and modify profiles, that person can mount a denial of service attack (by providing incorrect information in profiles that ...
... later get distributed to users and that don't work), weaken VPN communications (by configuring less secure options, such as weaker encryption strength), and access a lot of information that might provide Free Security+ practice exams ideas and data for other types of attacks.
Client configuration Considerations include:
Authentication selection for the client must match at least one of the approved authentication configurations on the server.
Encryption strength selection on the client must match at least one of the approved encryption strength settings on the server.
VPN protocol selection on the client must match at least one VPN protocol selected on the server.
If certificates are required, a valid certificate of the right type must be installed on the client computer or smart card.
A VPN client can be prevented from creating a new default route (one in which the client will be able to directly access the Internet and your intranet) in the Advanced TCP/IP Properties dialog box for the VPN connection. Figure 10-4 is a screen shot of this page with the Determining Routing For VPN Remote Access Clients check box deselected. If this setting is disabled, a route is created—it just does not become the default route. User selection of this element can be prevented MCSE 2003 certification by configuring Group Policy.