To Design Remote Access Policies

By Author: Jessee
Total Articles: 286
Comment this article

Design remote access policies based on user needs and on the organization's remote access policy MCP certification. Follow these steps to design remote access policies:
1.Divide remote access policy needs into three groups: users, computers that will authenticate to switches or use wireless connections, and RADIUS clients. RADIUS clients can be RRAS servers or other Network Access Servers (NAS).
2.Follow these steps for users:
a.Determine whether access should be allowed or denied based on user Dial-in properties or based on routing and remote access policies.
b.Design a remote access policy that sets conditions that meet security policy.If the authorization decision will be based on user Dial-in properties, configure the user account dial-in property page to either Allow or Deny connections. If the authorization decision is based on the remote access policy,
configure user accounts to Control Access Through Remote Access Policy.
Use the Windows group membership of the user and the remote access policy group membership condition to control Deny and ...
... Allow access settings.
c.Create a profile for each remote access policy to meet free exam papers policy constraints or set constraints on an authorized connection.
3.Follow these steps for computers:
a. Configure computer accounts by placing them in groups and setting each computer's account dial-in property to grant access based on the remote access policy. Ensure that switches are configured to use EAP and IAS as the RADIUS server.
b.Use the computer group as a condition in the policy.
c.Set the access method to Ethernet or wireless.
d.Configure authentication—for example, provide computers with certificates if EAP-TLS is the preferred authentication choice.
e.Delete the default policies on the RRAS or IAS server.
4. Follow these steps for RADIUS clients:
a.Preconditions: Ensure that RRAS or NAS is added as a RADIUS client and that RRAS or NAS is configured.
b.Set conditions. Ensure that client-vendor matches the client configured and that the NAS port defined is the one used by the vendor. (For example,choose asynchronous if a modem is used.)
c.Set profile settings. These might be vendor specific and are set on the Advanced security+ certification page of the profile.
d.Delete default policies.