Lab Exercise10: RRAS (Part 1)

Student Name: ______

Remote Access

Q.1.A Microsoft Windows 2000 remote access server accepts dial-up connections
by remote access clients and forwards packets between a RADIUS server and
the network to whichthe remote access server is attached.TF

Q.2.In Microsoft Windows 2000, remote access connections are accepted based on
the dial-up properties of a user account or based on the remote access policies.TF

Q.3.Which two remote access connection methods are not provided by a Microsoft Windows 2000 remote access server? (Circle all correct answers)

a.Demand-dial

b.Dial-up

c.RADIUS

d.VPN

Q.4.Which types of remote access clients can connect to a Microsoft Windows 2000 remote access server? (Choose all answers that are correct.)

a.Windows NT 3.1

b.Windows 98

c.Windows XP

d.MS-DOS

Q.5.What types of telecommunications equipmentsareused by a remote access client to communicate with a remote access server?

a.Public Switched Telephone Network (PSTN)

b.ISDN

c.Serial connection

d.ATM over ADSL

e. All of the above

Q.6.What types of remote access protocols are supported by Microsoft Windows 2000 remote access?

a.Point-to-Point Protocol (PPP)

b.Serial Line Internet Protocol (SLIP)

c.Asynchronous NetBEUI

d. All of the above

Q.7.In Microsoft Windows 2000, the combined features of Routing and Remote Access Service allow a computer running Microsoft Windows 2000 Server to fulfill several roles. Which roles the server cannot fulfill? (Choose all answers that are correct.)

a.Multiprotocol router

b.Demand-dial router

c.WINS proxy agent

d.Remote access server

Q.8.How do you install Routing and Remote Access Service on a computer running Microsoft Windows 2000 Server?

a.You do not install Routing and Remote Access Service. The service is automatically installed when you install Microsoft Windows 2000.

b.By using the Routing And Remote Access snap-in.

c.By using the Computer Management snap-in.

d.By using the Add/Remove Programs utility in Control Panel.

Q.9.What are the differences between authentication and authorization in Routing and Remote Access Service?

a)Authentication is the verification of the credentials of the connection attempt, whereas
Authorization is the verification that the connection attempt is allowed.

b)Authentication is the verification that the connection attempt is allowed, whereas
Authorization is verification of the credentials of the connection attempt.

c)There is no difference between Authorization and Authentication.

Q.10. What is demand-dial routing? (Circle all correct answers)

a)It refers to the routing of packets over point-to-point links such as analog
telephone lines and ISDN.

b)It allows you to connect to the Internet

c)It allows you to implement router-to-router VPN connections

d)None of the above

Virtual Private Networks

Q.11. Which two actions are part of the tunneling process?

a.Broadcast

b.Routing

c.Encapsulation

d.Transmission

Q.12. Which types of tunnels are supported in Microsoft Windows 2000 VPNs?

a.Dedicated

b.Voluntary

c.Compulsory

d.Dial-up

Q13.What are the primary protocols used by Microsoft Windows 2000 for VPN access?

a.Point-to-Point Tunneling Protocol (PPTP)

b.Layer 2 Tunneling Protocol (L2TP)

c.IP Security (IPSec)

d.None of the above

Q.14. A VPN allows data to be transferred between two computers across a
network, such as the Internet or a local area network.TF

Lab Exercise 10: RRAS (Part 2)

Student Name: ______

Exercise 1: Modifying a Remote Access Policy

In this exercise, you will modify the Srvdcxx Remote Access Policy created in the RRAS hands-on exercise in order to add the following policies:

1)Point-to-Point Protocol (PPP) frames and X.25 frames should be the only types of frame to be accepted by the RAS server.

2)Point-to-Point Tunneling Protocol and Layer Two Tunneling Protocol should be the only tunneling protocols to be used for connecting the RAS server.

3)With caller-id software installed, the RAS server must be able to check the phone number from which Remote Access Clients are calling, and then call back that number. Use phone number 555-6666 for the purpose of this exercise.

4)Since the DHCP server experiences some problems, you should modify the RRAS configuration so that the RAS server assigns static IP addresses to Remote Access Clients. You should use the following pool of addresses: 192.67.0.75 to 192.67.0.87.

Exercise 2: Modifying a user account to specify dial-in properties

In this exercise, you will modify on of the user accounts you created earlier during the semester in YourLastNameOU organizational unit in order:

1)to grant that user the permission to dial into the RAS server.

2)to specify that the user must use Callback. For security reason, after the user is authenticated, the RAS server should callback the user at the specific phone number provided by the user. Note: you can type in any phone number of your choice.

Note: Mention the following information about the user account you configured in this exercise:

First name: ______

Last name: ______

User name (login name): ______

Password: ______

RRAS Management Question 1:
Your company has a Routing and Remote Access server at its main office. One of the company’s branch offices also runs Routing and Remote Access on a server that has one modem. The server is configured to use demand-dial routing to connect to the main office. The server is part of company’s Active Directory domain.

Some employees at this branch office use the branch office server to access their files from home. The manager of the branch office reports that sometimes none of the users in the office can connect to the main office. When you examine the event log on the branch office server, you find that users have been connecting to the server during working hours.

The manager wants users to be able to dial in to the server only between 6:00 p.m and 8:00 a.m.

However, the manager still wants users to be able to log on at any time when connected directly to the LAN.

What should you do to limit only dial-in access to these times?

A. Set the remote access policy to deny connections between 8:00a.m and 6:00p.m.
B. Change the logon hours for users’ accounts to deny logons between 8:00a.m and 6:00 p.m.

C. Create one batch file to start Remote Access Connection Manager service, and create another batch
file to stop it. Then, schedule the stop batch file to run at 8:00a.m every day and start batch file to run

at 6:00p.m every day.

D. Create two user accounts, for each user.

Grant dial-in permissions to one account, and deny dial-in permissions to the second account.

Change the logon hours for the dial-in accounts to deny logon between 8:00a.m to 6:00p.m.

RRAS Management Question 2:

Your network has two domains with approximately 1,000 users in each domain. Both domains are Active Directory domains. Some of the users have portable computers and access the network by using remote access. The managers at your company are concerned that remote access might pose a security risk. They want to see a list that shows which users are allowed to use remote access. How should you configure the remote access?

A. Create a group named RAS_USERS.

Add users who are allowed to dial in to the network.

Set the remote access permission for this group to Allow Access.

To show who has access to the remote access server, display the members of the group.
B. Create a group named RAS_USERS.

Add users who are permitted to dial in to the network.

Create a remote access policy that allows only this group to use the remote access server.

To show who has access to the remote access server, display the members of the group.

C. Write a script for the Windows Scripting Host.

In the script, iterate through the members of the users container.

Display the name of any user who has the remote access permission set to Allow access.

D. Use the default remote access policy to view users and groups who have been granted remote access

permission.

1

CIS3700 Local Area Networks