Remote access through a standard dial-up network has the potential to increase productivity. However, it must be made secure against unauthorised access
Providing remote access to branch offices or telecommuters requires balancing the cost and flexibility of the solution with the needs of users. With recent improvements in its technology, dial-up remote access is emerging as one of the most cost effective and flexible solutions available today. Dial-up remote access requires only plain old telephone service (POTS) or ISDN lines, and allows users to make connections to many resources, from corporate headquarters, to bulletin board services, to the Internet/Intranet. Dial-up remote access also allows travelling or telecommuting remote users to connect to their network as if they were located on-site.
When considering a remote access network, the network manager has several choices that offer trade-offs in cost, flexibility and data throughput. Dial-up remote access is a good option when flexibility and low cost are more important than speed. One alternative to dial-up remote access is using leased line services for LAN-to-LAN connections. Leased line services cost more and are less flexible but typically offer very fast speeds.
A big contributor to the cost of both of these remote access methods is the hardware necessary to do remote access networking. Branch office routers for use with T1/E1 or other leased line services can cost upwards of £3,000, while a remote access server, which also offers routing, can cost less than £600. Additionally, leased line circuits can be several multiples of the cost of a regular telephone line. These leased services are characterised by flat rate, point-to-point pricing with 24-hour-a-day availability.
While POTS is still the predominate method of remote access today, ISDN is growing in popularity due to its efficiency and high rates of data throughput. ISDN basic rate service offers two 64Kbit/s channels, called B channels, for data throughput. These channels can be combined for a total of 128Kbit/s of total throughput, or can be divided and shared among different users or applications. ISDN, in some ways, offers the best of both dial-up and leased line remote access; in a similar way to dial-up, you pay only when you use the service, but like leased line services you get high throughput.
Today, ISDN is ideal for the small office or power user home office environment where the incremental cost of an ISDN line can be justified against the increased speed of the connection. While ISDN is attractive, it still doesn't offer the flexibility of POTS dial-up access. Specifically, today there are few public locations where the commuter or business traveler can find an ISDN hookup ( though this is expected to change very quickly during the next couple of years.
The technology that has allowed dial-up remote access to compete in functionality with other remote access schemes has been the ability to route data over dial-up POTS lines. With the adoption of industry standards like the Point-to-Point Protocol (PPP) and Serial Line Internet Protocol (SLIP), users can now choose products that best fit their business needs. Data throughput also has been dramatically boosted with improved modem speeds and gains in data compression algorithms. There are several remote access applications that are well-suited for dial-up remote access products: LAN-to-LAN connectivity, Internet/intranet access, remote user access and modem pooling.
A dial-up connection between two networks is termed as an LAN-to-LAN connection. In most cases, remote office locations will connect to a main corporate network at a central location. In other cases, one small office may connect to another small office or to a site where services such as Internet access or information services are provided.
When a connection is made to another network, routing is the key to this type of functionality ( when a user on the network requests connection to a resource available only on another network, the remote access device recognises the need to dial another network and then automatically dials up the appropriate remote site according to a stored profile. Once the connection has been established, the remote access device will monitor the connection according to the parameters established by the network manager.
An important consideration in purchasing a remote access product is the flexibility the network manager has to select these control parameters. Basic functions that should be available include control over the length of time the connection is inactive before automatically disconnecting, and the time of day that connections are allowed to particular locations.
More advanced functions include an automatic time-out for connections if the packets being transmitted are not data (i.e., they are keep alive signals generated by the NOS), policy-based filtering of packets from particular nodes or particular protocol types and bandwidth on demand in which the remote access server brings up an additional connection to a remote network to increase available bandwidth to that site. With bandwidth-on-demand, the network manager specifies the desired throughput threshold for the extra line to be added or to be taken down and this feature is enabled when the threshold is reached and a second line is available.
In LAN-to-LAN application, the two primary ingredients for a good remote access product are the ability to make automatic connections when necessary (routing capability) and the ability to allow the network manager to control the network connections via parameter selection (link management). For the busy network manager, operation of these dial-up connections will require little or no involvement other than the initial configuration; for the user, they will gain what appears to be a transparent connection to the required remote resources.
A secondary consideration, but still an important one, is the connectivity requirement of the remote site. If the remote site needs only occasional or limited connection time to the corporate site, then a low-cost single-port remote access router can be a cost-effective solution. On the other hand, if simultaneous LAN-to-LAN and remote node activity is a requirement, then a multi-port device may be required. Although PPP-based solutions are generally interoperable, it makes sense to choose a vendor that offers different product configurations for remote access to make for easy management (shared configuration files, less need for training).
With the increased demand for connection to the World Wide Web, Internet Service Providers (ISPs) have sprung up to offer previously unconnected users access to the "Information Superhighway". The Internet access application is similar to the LAN-to-LAN application with all of the same issues and need for features such as time-of-day controls and inactivity time-outs. These features are particularly important to maintain cost controls when the telephone bills are based on connect time.
A remote access server that can function as a router can be useful as an intermediate point between a network and an ISP to act as a firewall, particularly if that device can support multiple filtering options. By applying various filters to packets arriving on a dial-up line, a network manager can ensure that no unsolicited or unregulated packet traffic can enter the network via those lines.
In addition to accessing information from other companies or sites on the Web, a growing number of companies are starting to use the Internet as an extension of their private networks, thereby creating what has been called an intranet. By leveraging this technology in this manner, companies are able to provide solutions to their users with easy to use web browser applications (e.g., Netscape Navigator, MS Explorer and others) over a well established and cost effective conduit. Thus, the users only have to call a local number (i.e. nearest ISP access number), thereby saving money on toll charges and the main corporate site does not have to purchase and support large central site remote access server devices.
Remote node network access allows remote users to connect to a network using a modem. Remote node users are typically mobile or telecommuter users who run a remote client software package on their PC or workstation giving them network access through a dial-up server. Remote node access to the network has become easier because of the TCP/IP or IPX support that's been built into Windows95 and other operating systems. Most of the current demand for such services involves either IP (Unix) or IPX (Novell NetWare) protocols.
Remote node works best in applications where the remote device either runs brief queries from a host or processes data uploaded from the main network. Examples of this include reading email or uploading text files or spreadsheet information.
Using a remote access server to support remote node connections to a network frees up PCs and other host systems that may have been dedicated to the support of remote users in the past. Additionally, a good remote access server supporting remote node will be standards-based (PPP, SLIP or CSLIP), which allows it to service users running any software package supporting those standards.
A related application to remote node is remote control. Remote control is achieved when the remote user dials into the network and takes control of a PC residing on the network. The remote user's keyboard then becomes the equivalent of the slave PC's keyboard, allowing the remote user to act as if they were physically working on the slave PC.
Remote control is useful when a user needs a lot of processing power or number crunching capability, because only the serial information sent to the keyboard, mouse and display need pass over the dial-up link. The drawback of this approach is that the user can only view the information and cannot transfer files or obtain data to be processed on their remote system. Remote control is more frequently used with the IPX (NetWare) protocol; IP users can use terminal servers to achieve the same result when a multi-user host is available.
While most of the applications described above are almost completely transparent to the user, there are some applications where the user requires some control over the proceedings. Using a modem to dial out to an electronic bulletin board or on-line service is still a necesary function for many users.
For the network manager, modem pooling provides the added conveniences of easy maintenance because all modems are in one location, and easy management as remote access servers typically have more robust network management than modems. Protocols such as IP and IPX support the sharing of modem resources through software tools available under a host or network operating system ( the remote access device that supports these applications provides ever greater value. INT14 support under IPX and redirection of serial port output to a communications port using IP and IPX protocols are essential features that this type of software should support.
No matter what remote access strategy you plan to implement, one key attribute that requires the greatest attention, is that of providing controlled access to your important/proprietary data. When a strategy for networking involves dial-up technology, issues of network security become very important. Each modem is a potential gateway for uninvited users, either by chance or malicious intent, to gain access to the attached network.
Although the requirements of each network will be different from a security standpoint, it is necessary that remote access products offer as many capabilities as possible to allow for customisation. Protection should be flexible and it should be capable of being "layered" so that areas of vital concern can be very secure and other areas of lesser importance can be suitably protected. One site may require CHAP passwords, protocol filters, Radius authentication and Novell Bindery passwords. Another site may only demand a dial back authentication string.
The ability of a server to support many different schemes makes these choices possible. Passwords are one means of security that is almost universally supported on remote access servers. Passwords are routinely found at the level of the server itself (login passwords) and at the level of the host/protocal being used (IP-Unix/TFTP or IPX-NetWare Bindery). Additionally, PPP itself specifies two forms of password protection called Password Authentication Protocal (PAP) and Challenge Handshake Authentication Protocol (CHAP).
With PAP, a password is specified for both devices on a remote connection and both must be confirmed before a remote session can begin. With CHAP, that password can be repeated throughout the remote session if desired.
There are also a number of other external password and encryption schemes, including Security Dynamics SecurID, Kerberos and Radius that provide a more sophisticated method of protection. These authentication schemes use encrypted passwords to avoid having them detected via a network analyser or they change the actual passwords themselves on a random basis. Authentication schemes such as these require a dedicated host running a software package supporting the security scheme, but the cost of these packages is small compared to the extra security they can provide to the network. It is imperative that the network manager verify compatibility of a remote access server with the scheme they intend to run. Lack of compatibility will render the authentication investment worthless if support for the scheme cannot be accommodated.
Another important security feature for regular users is dial back. With this feature, the dial-up router receiving a call will check the user's identification and then dial that user back at a pre-set telephone number to ensure that an intruder isn't using an existing user's address to log into the system. Dial back is one method that can be inexpensively used to enhance security when it is supported by a remote access product.
Routers allow the network manager to filter packets. This capability can be used to ensure that particular types of packets are not allowed from remote access server ports to the main network. These firewalls can be used to increase the security of a network by not allowing traffic other than that between known users on the dial-up lines to reach the network.
Devices that support the downloading of standardised configuration files also assist the network manager by allowing for easy modification of tested templates. For many networks, dial-up remote access provides a high-performance, flexible way to meet remote connectivity needs.
Compiled by Ajith Ram
( Lantronix 1997
W.RMA.WP4-T1.210799.DOC I.S. Department 19/08/99 12:13