Creating a Remote Access Policy

This example provides a fictitious scenario and an example solution.
You are a new security designer. Your boss asks you to provide 70-297 access to the sales and marketing department employees from anywhere during normal business hours plus or minus two hours, but only from their homes at other times. The employees must use a VPN to connect, and they must use the strongest encryp?tion setting. Normal business hours are 9 a.m. to 5 p.m. Monday through Friday. All sales and marketing employees are members of the SAandMA Windows group.

Create two remote access policies: one based on normal business hours, and the other based on the other hours of the week. The user dial-in properties are set to provide access based on remote access policies, and a home phone number is entered in the Verify text box. An example user dial-in property page from a remote access policy is displayed in Figure 10-9.
This page enables authentication types that can be used. It also enables or denies whether users are allowed to change their passwords by using MS-CHAP. (This setting must match the settings for RRAS.)
This page defines the encryption choices Free Network+ study guides that can be negotiated between the client and the server. Choices are: No Encryption, Basic (dial-up and PPTP connections will use 40-bit key MPPE; L2TP/IPSec connections will use 56-bit DES), Strong (PPTP connections will use56-bit MPPE; L2TP/ IPSec connections will use 56-DES), and Strongest (PPTP connections will use 128-bit MPPE; L2TP/IPSec connections will use 3DES).
This page provides the ability to define RADIUS attributes that will be used
in the remote access policy profile. Attributes can be used to constrain an authorized connection between the RADIUS server and the RADIUS client.
If all conditions of a remote access policy are met, an Allow or Deny permission is processed, either by using the user account property or the remote access policy. If the permission is Allow, the profile of the remote access policy is evaluated. The profile can further restrict the connection. Its characteristics can also restrict an MCSE 2003 certification authorized connection.