VPN Quarantine with RQS.EXE
18.01.2007
The VPN quarantine service has a simple mission: place each VPN client on a restricted virtual network, check it for required security patches, antivirus definitions, and any other prerequisites set forth by your security policy, and then allow the client access to the network if it passes the administrator's checks. Administrators may choose to put one or more software update servers on the quarantine network (as defined by ISA) to allow clients that don't pass the checks to download the necessary patches and re-attempt to clear quarantine.
The VPN quarantine service consists of two components. The first component, RQS.exe, is a listener that runs on the ISA VPN server. It's the service that allows ISA to transparently move healthy clients out of quarantine and onto the network. During the installation of RQS.exe, an administrator specifies a text string that represents a healthy status. The second component, RQC.exe, is used by clients to alert the quarantine service that the health checks have passed. Clients automatically run RQC.exe after the client-side scans have completed successfully, passing the required text string to the RQS.exe listener on the server. When the RQS.exe service receives the appropriate text string, the client is released from quarantine.
Many network administrators are surprised to learn that none of the actual scanning for security patches and antivirus definitions is performed by the Microsoft quarantine client, RQC.exe. Instead, you choose how you'd like to scan your clients—batch files, Windows Scripting Host, .NET Framework-based applications, or whatever you like. This flexibility allows customers to design their health check based on their specific requirements and lets them leverage the development skill they're most comfortable with. There's only one requirement: your client-scanning routine must call the RQC.exe client-side executable at the completion of a successful scan, passing the appropriate text string. That's how RQS.exe knows it's allowed to remove the client from quarantine and allow it access to the network.
The last obstacle we need to tackle is how to get our scanning scripts and the RQC.exe client-side component of the quarantine service delivered to our VPN clients. For that, we'll use the Connection Manager Administrator Kit (CMAK), yet another feature built into Windows Server 2003.
Related information
