لطفا منتظر باشید ...
A Note on VPN Quarantine
As mentioned in the introduction to this chapter, the ISA firewall has the ability to 'pre-qualify' VPN clients before they are allowed to connect to the corporate network. This is the ISA firewall's VPN Quarantine feature. When properly implemented, the VPN quarantine feature can be used to place all VPN clients in a special VPN Quarantine Network and leave those VPN clients on the VPN Quarantine Network until the client passes a number of security tests. When the VPN client passes these security tests, the VPN client is automatically removed from the VPN Quarantine Network to the VPN Clients Network.
The problem with the ISA firewall's implementation of VPN Quarantine is that it's of absolutely no use to the typical ISA firewall administrator unless he has advanced scripting or programming skills. Out of the box, the ISA firewall's VPN Quarantine provides only a development platform for a VPN Quarantine solution. In fact, without a development staff to assist you with rolling out a VPN-Q solution, you could completely lock out all VPN clients from reaching resources for which you have created Access Rules allowing them to reach.
The problem is that the ISA firewall's user interface can give the impression that enabling VPN Quarantine is a matter of putting a checkmark in a checkbox. To see what we mean, open the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and then expand the Configuration node and click the Networks node.
While on the Networks node, right-click the Quarantined VPN Clients Network in the Networks tab in the details pane and click Properties.
In the Quarantined VPN Clients Properties dialog box, click on the Quarantine tab. Put a checkmark in the Enable Quarantine Control checkbox. You'll see the following dialog box (Figure 9.78).
Figure 9.78: Warning Regarding VPN Quarantine and VPN Client Access
This dialog box states Enabling Quarantine Control requires configuration on both the ISA Server and VPN client computers. Otherwise, connecting VPN clients will be quarantined indefinitely and denied access based on default policy rules. This means that unless you have carried out the configuration and development procedures required to make VPN Quarantine work correctly, all VPN clients will remain assigned to the Quarantined VPN Clients Network and be able to access only resources available to members of the Quarantine VPN Clients Network. Of course, you could create Access Rules enabling members of the Quarantined VPN Clients Network to access any resource you want them to on the corporate network, but that defeats the purpose of using VPN-Q in the first place.
Once VPN-Q is enabled, you see that you have the following options:
Quarantine according to RADIUS server policies This option is only available when the ISA firewall is installed on Windows Server 2003 machines. This allows you to implement RADIUS server VPN quarantine policy.
Quarantine according to ISA Server policies This option can be used on Windows 2000 machines to enable VPN-Q.
Disconnect quarantined users after (seconds) This option allows you to set the time-out on VPN clients placed in the Quarantined VPN Clients Network. If the VPN client can't perform the steps required to remove itself from quarantine in this period of time, then the VPN client is disconnected.
Exempt these users from Quarantine Control You can prevent users or groups from ever being placed on the Quarantined VPN Clients Network by including those users in this list. See options for the Quarantine tab in Figure 9.79.
Figure 9.79: The Quarantine Tab on the Quarantined VPN Client Properties Page
If you have development resources at your disposal, or if you have advanced scripting or programming skills, then check out Microsoft's documentation on VPN-Q at http://www.microsoft.com/isaserver/techinfo/guidance/2004/vpn.asp
However, there is some good news for those ISA firewall administrators who don't have access to advanced scripting or development resources. Frederic Esnouf, an ISA firewall MVP, has put together a full-featured, start-to-finish solution for VPN-Q called the Quarantine Security Suite (QSS). We highly recommend Frederic's solution, and you can find more information on it at http://fesnouf.online.fr/programs/QSS/QSS.
Avanade also stepped in with some assistance to the VPN-Q puzzle. They have prototype software that will assist you in creating a functional VPN-Q solution at http://www.avanade.com/solutions/section.aspx?id=8&parentID=2.
| Tip | If you consider yourself handy with Windows scripting, Microsoft has recently released some sample scripts that you can customize for your own environment. You can read about these scripts at the VPN Quarantine Sample Scripts for Verifying Client Health Configurations page ( |
