Summary of Exam Objectives

Planning a remote access strategy involves analyzing the needs of the organization, the needs of individual users, and other factors. You should also consider which of the remote access types you need to support:

• Dial-in remote access

• VPN (virtual private network)

• Wireless access

Dial-in access using modems is the traditional type of remote access and is still useful. If you will enable dial-in access, there are a number of factors to plan for. These include whether the RRAS server will assign IP addresses using a static address pool, using DHCP, or using automatic private addressing. You will also need to consider number of incoming ports you will need and whether to manage access by user or using remote access policies.

VPN access uses a client’s Internet connection and the server’s Internet connection to create a virtual connection, or tunnel, and provide for remote access. A VPN uses one or more VPN protocols to create the tunnels and manage encryption. The VPN tunneling protocols are as follows:

• PPTP (point-to-point tunneling protocol): A protocol based on PPP. Uses MPPE for encryption.

• L2TP (Layer 2 tunneling protocol): A newer protocol that provides for tunneling and takes advantage of IPSec (IP Security) for encryption. L2TP supports data integrity and sender authentication, unlike PPTP, but requires a public key infrastructure and computer certificates for clients and servers.

Wireless remote access uses the 802.11 standard. A WAP provides access to a number of clients and connects to the LAN. WAPs can use IAS (RADIUS) to provide enhanced security and centralized authentication.

Your plan for the security of a remote access solution should consider the functional levels of domains and the features they support, the authentication methods and encryption levels you will enable, and whether you will support advanced features such as callback security, managed connections, and smart cards.

Remote access policies can be used to grant or deny remote access based on a number of criteria. Each remote access policy includes a profile, which can control what the connection allows after it is established. A profile also includes settings, such as maximum session time and idle timeout, to control the length of remote sessions.