When designing and implementing remote access services, you want to make sure that the network users will have transparent access to the network from wherever they are, just like when they are connected to the actual network. The users must reach the resources they are authorized to use just as they would from the enterprise campus.
In order to provide these services, the connection requirements must be carefully analyzed to make sure that they are fulfilled. Typical requirements include:
- VoIP support
- VPN support
- High volume traffic or low volume traffic
- Permanent connection (whether needed or not)
- Type of flows
Because remote access and VPN networks often use the public Internet or the PSTN as their carrier, you should be aware of possible spoofing (or masquerading) techniques that will allow an attacker to impersonate a legitimate client and gain remote access or VPN access through the enterprise network. The network becomes vulnerable to spoofing when the attacker is able to steal some credentials or to guess some authentication key. Another issue is compromising data confidentiality and integrity that can happen from both the central remote access module and the branch/remote offices, so the other side of the connection should be properly secured as well.
To secure remote access, you should carefully implement VPN technologies using dedicated equipment or software solutions that include advanced security mechanisms. Some of the most commonly used remote access protocols are:
- RAS
- PPP
- PPPoE
- RDP
- ICA
- SSH
Remote Access Service (RAS) is a legacy technology that was used by remote users to communicate to a central location using dial-up over PSTN lines. This was implemented either in hardware or software that could function as an RAS server. RAS was a term created by Microsoft but became generic over time.
Another protocol commonly used in remote access solutions is Point-to-Point Protocol (PPP), which is a Layer 2 protocol so you can use it in conjunction with many Layer 2 protocols. It provides the following functionalities:
- Authentication
- Data compression
- Error detection
- Multilink
PPP is a very versatile protocol and it is used in many different environments, including:
- Serial connections
- Telephone lines
- Mobile connections
One common way to implement PPP in modern networks is over Ethernet using the PPP over Ethernet (PPPoE) protocol. PPP functions by encapsulating PPPoE and is often used in association with DSL lines. Service providers that offer such services can set up a connection with PPP, authenticate it, and build a circuit that can be used mostly by residential users.
PPPoE is simple to implement because it is similar to dial-up architecture, it is natively supported in many operating systems, and you don’t need to use a router for this because of the Layer 2 protocol. This means that PPPoE does not involve a lot of costs so it is an affordable remote access solution.
Remote Desktop Protocol (RDP) can also be considered a remote access technology because it allows a remote user to access an internal enterprise system and control it. RDP allows screen (desktop) or application sharing over TCP port 3389. RDP functionality is built into most of the Windows platforms and it can be used with a pair of valid credentials, without additional overhead. Even though it is a Windows-specific protocol, other operating systems offer RDP clients so you can use this over any type of OS:
- Windows
- Mac OS
- Linux
- Unix
- Mobile OS systems
Independent Computing Architecture (ICA) is a proprietary protocol from Citrix Systems that allows user access to a particular server or service. Even though it is Citrix-proprietary, ICA is used in many systems and allows users to run applications remotely using dedicated clients (for multiple OSs, including Mac OS, Linux, and Unix). With this technology you can have many clients connected to a single server and all of them running independent sessions. This brings a series of advantages:
- Increased administration flexibility
- Centralized management
- Reduced client footprint
Secure Shell (SSH) offers communication services to remote devices over a terminal session, and this is one of the most basic ways of remotely managing network devices. SSH offers increased security, as it encrypts the communication between the two endpoints. It also provides a command line view of the remote device. SSH does not require a lot of bandwidth and it functions by having an SSH server on the managed device and an SSH client on the client side. The most commonly used SSH client is PuTTY (an open source application).