Guidelines For Designing Authentication Using Radius

By Author: iris
Total Articles: 286
Comment this article

RADIUS authentication can be used wherever remote access—either dial-up MCSA required exams or VPN access to Web sites—is required. Dial-up and VPN access might be required for administration and content management. It might be provided for users seeking access to mailboxes on a Microsoft Exchange server or other secured intranet sites. It might already be in place to secure wireless access to intranet Web sites.

While there is no direct configuration option for IIS users to be authenticated using RADIUS, you could write an ISAPI filter that redirected access requests to the Web server to a RADIUS server. In this model, all access—even anonymous access—is redirected to the RADIUS server. If Microsoft Internet Authentication Server is used, remote access policies can also be used to constrain user access.
Follow these guidelines when designing authentication to Web sites using RADIUS:
Select RADIUS authentication when designing VPNs to be used for access to Web sites.
Require the dial-up property of user accounts that will access free 70-291 test questions ...
... Web sites using
RADIUS to be via remote access policies.
Configure remote access policies that are based on Windows groups. Use groups that are designed to manage and control access to Web sites. For example, a group created for Web site administrators should be used to authenticate remote access for Web site administration.
Add RADIUS logs to the list of logs that must be reviewed.Encrypt communication between the RADIUS client and RADIUS server.
Network Access Quarantine Control A new feature of Windows Server 2003 that can prevent access to a private network until the configuration of a remote com?puter has been validated. Validation is performed by comparing the remote com?puter against a list of required attributes provided in a script. The script is created by network administrators in compliance with a security policy. For example, administrators might want to ensure that clients have the latest service packs and hotfixes or up-to-date antivirus software before they are connected to the corpo?rate network.
Network Address Translation (NAT) A process that assigns an Intemet-routable address to a client when the client's traffic is routed through a NAT server. By default, the NAT server will forward traffic from the external network to the internal network only if the traffic comes in response to a client request. Flowever, most NAT servers have the capability of forwarding external requests free CompTIA practice tests for specific services, such as access to Web servers that are located on the internal network.