VPN Quarantine - IAS needed?

[segil]

Hi,

just a quick question. We're thinking about using the VPN quarantine abilities of Windows 2003 server SP1. Currently we have 2 VPN servers with Windows 2003 server without Radius.

I was wondering if it's a requirement to use Radius in order to be able to VPN Quarantine? Or does the Quarantine also work without Radius??

Our internet access is controlled by a Linux firewall, so we don't use IAS. If necessary, can IAS be installed on one of the VPN servers?

Thanks!

 

[segil]

Does anybody have experience with this topic?
I've searched on the internet and in these forums, but can't find an article that says ISA is / isn't needed for VPN Quarantine.

Besides that, VPN Quarantine sounds very promising, hopefully it can make our VPN connections even more secure.

 

[porkchopexpress]

This might help. I did have a pcpro article all about it, if i find it i will post it.

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/vpnroamingquarantine.mspx

 

[porkchopexpress]

From the looks of the Quarantine.doc file in this link ISA is not required, take a look at appendix B page 32.

http://www.microsoft.com/windowsserver2003/techinfo/overview/quarantine.mspx

 

[segil]

Okay, I see it... thanks... it seems that you only need to use ISA when you want to be able to use the time-out option and the IP filters, to allow access to certain servers.

Just to be curious, will it be easy to install ISA on the same computer as the RRAS service and use it ONLY for these two options? Or does ISA require a computer with 2 nics and some sort of firewall policies configured?

 

[porkchopexpress]

ISA requires 2 cards to use the firewall features, otherwise it will just function as a cacheing proxy.

 

[segil]

Okay great, I will experience with that... our two RRAS servers (Windows 2003 servers) have one nic installed, so the firewall can't be used... hopefully the Radius option for VPN quarantine can be used.

 

[porkchopexpress]

Looking at the document it looks like it should work but i haven't set it up myself so i can't say for sure.

Good luck.