IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
The RAS client software is generally not installed on one of the user’s
computers, but instead the RAS functionality is made available through
dedicated hardware in the form of a router. When data packets need to be
transmitted from one LAN to the other, the RAS client contained in the
router automatically establishes a connection with the destination LAN
when it dials in to the RAS server on that LAN. In this configuration
generally a symmetric architecture is chosen for both LANs, so that the
RAS server into which the RAS client dials is also contained in a router
and a point-to-point connection is established. Alternatively, several
remote LANs can be connected over one access server (a RAS server
which permits several simultaneous connections).
The advantage of this is that thanks to the functional separation of RAS
client and the remote user's computer it is possible for several remote IT
systems to be connected to the destination LAN over a single connection.
The router which contains the RAS client makes the established connection
available to all the computers connected to the remote LAN
simultaneously. But the downside is that the connection capacity is divided
among the remote IT systems accessing the destination LAN and cannot be
used exclusively.
Another obvious disadvantage is that the clients are no longer mobile.
3. Connection of a computer or a LAN through a service provider
A more elaborate version of the two above scenarios is for a computer or
LAN to also be connected through a special access phone number of a
service provider. In this case the RAS client contacts a special telephone
number which is frequently a local phone number or a number that is tollfree.
Calls to these special numbers are forwarded by the service provider
to the RAS server of the destination LAN within the communications
network. This variant is a useful way of allowing staff on business trips to
establish a connection without incurring high telephone charges.
4. Connection of a computer or a LAN over the Internet
This case differs from the scenarios described above in that initially the
client connects to an Internet Service Provider (ISP). Only then is the client
connected to the destination LAN, over the existing Internet connection.
This approach requires that the remote user’s access rights permit him to
access the ISP concerned and that the destination LAN has an Internet
connection. In this case, communication with the destination LAN is
effected using Internet protocols. It is not necessary for the destination
LAN to have its own RAS server (for direct connections over a
telecommunications network).
This variant is generally used in order to keep down the telephone charges
incurred by the remote user (e.g. so that local call charges apply) but it can
prove quite complicated to configure. As the Internet access of a LAN is
generally protected via a firewall, the possibility of Internet-based access
by remote users must be considered when the firewall architecture is being
planned (see also module 7.3 Firewalls).
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000