IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.185 Selection of a suitable RAS system
architecture
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: IT Security Management, Administrators
Depending on the planned operational scenarios, different RAS system
architectures can be used to implement remote access to a LAN. The various
system architectures inevitably have different characteristics and therefore
differ as to which particular operational purposes they are suitable for.
Theoretically every combination is possible, but the wrong choice could entail
additional expense (e.g. the need to purchase additional hardware or more
time spent on administrative tasks).
The RAS scenarios described below and to which in each case one typical
system architecture can be assigned are commonly encountered in practice.
1. Connection of individual computers to a LAN
In this case an architecture known as "direct dial-in" is necessary. The RAS
software is installed on the remote user’s computer. The computer has a
connection to a telecommunications network. For example, the connection
can be over an analogue modem, an ISDN card or even over a mobile
phone. To establish a connection, the RAS client software dials the
telephone number through which the RAS server software can be accessed.
The RAS server is also connected with the telecommunications network
via a modem or an ISDN card. Depending on the RAS server product (also
known as the access server), one server can establish several
communications links (e.g. via "modem pools") so that several RAS clients
can dial in simultaneously.
The advantage here is that through this method a given computer can be
connected to the LAN from any location. This is especially useful for users
who do not work from a fixed location. Although direct dial-in to the RAS
server of the destination LAN only switches the connection over the
telecommunications network of the telecommunications providers used,
nevertheless, it is recommended that mechanisms are used to protect
communications here as well, e.g. encryption, digital signatures,
authentication.
One drawback with this approach is that the telephone charges incurred,
which generally have to be paid by the remote user (unless special
provisions are taken), will vary according to the distance to the destination
LAN. This variant is not suitable where several users who are all located in
the same remote location need to access the LAN, as a dedicated
connection between client and server needs to be established in every case.
Every client must therefore be equipped with its own modem and it is not
possible for several client computers to share a common connection
simultaneously.
2. Connection of several computers to one LAN
In this case an architecture known as "direct LAN-to-LAN dial-in" is often
used. Here, the computers of the remote users constitute a separate LAN.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000