Routing and Remote Access Service (RRAS)
Version: Routing and Remote Access Service (RRAS) Microsoft Windows Server 2008 and later.
The Routing and Remote Access Service (RRAS) is a Microsoft API and server software that makes it possible to create applications to administer the routing and remote access service capabilities of the operating system, to function as a network router.
Netsurion Open XDR monitors user logon behaviour, access point configuration changes, WLAN group management and service status and generates flex reports, flex dashboards and alerts for rogue access point detected and system state changed.
Netsurion Data Source Integration for Routing and Remote Access Service (RRAS) allows you to monitor the following components:-
- Security- Authentication types.
- Compliance- Access success and failures.
- Operation- Access requests and accounting requests.
Once Routing and Remote Access Service (RRAS) is configured to deliver events to Netsurion Open XDR; alerts, dashboards and reports can be configured into Netsurion Open XDR.
The following are the key Data Source Integration available in Netsurion Open XDR.
Alerts
| Type | Name | Description |
|---|---|---|
| Security | MS RRAS – DHCP relay forward packet relay failure | This alert is generated when DHCP relay forward packet relay failure event occurs. |
| Security | MS RRAS – DHCP relay packet relay failure | This alert is generated when DHCP relay packet relay failure event occurs. |
| Security | MS RRAS – DHCPV6 relay agent configuration failure | This alert is generated when DHCPV6 relay agent configuration failure event occurs. |
| Security | MS RRAS – DHCPV6 relay agent incoming msg receive failure | This alert is generated when DHCPV6 relay agent incoming msg receive failure event occurs. |
| Security | MS RRAS – DHCPV6 relay agent multicast enable failure | This alert is generated when DHCPV6 relay agent multicast enable failure event occurs. |
| Security | MS RRAS – DHCPv6 relay agent packet discarded | This alert is generated when DHCPv6 relay agent packet discarded. |
| Security | MS RRAS – DHCPV6 relay event registration failed | This alert is generated when DHCPV6 relay event registration failed. |
| Security | MS RRAS – DHCPV6R critical section initialize failure | This alert is generated when DHCPV6R critical section initialize failure event occurs. |
| Security | MS RRAS – DHCPV6R event creation failed | This alert is generated when DHCPV6R event creation failed. |
| Security | MS RRAS – DHCPV6R event notification failure | This alert is generated when DHCPV6R event notification failure event occurs. |
| Security | MS RRAS – DHCPV6R memory allocation failure | This alert is generated when DHCPV6R memory allocation failure event occurs. |
| Security | MS RRAS – DHCPV6R semaphore creation failed | This alert is generated when DHCPV6R semaphore creation failed. |
| Security | MS RRAS – DHCPV6R stopped | This alert is generated when DHCPV6R stopped. |
| Security | MS RRAS – DHCPV6R synchronization object creation failed | This alert is generated when DHCPV6R synchronization object creation failed. |
| Security | MS RRAS – DHCPV6R timer queue creation failed | This alert is generated when DHCPV6R timer queue creation failed. |
| Security | MS RRAS – DHCPV6R windows socket initialize failure | This alert is generated when DHCPV6R windows socket initialize failure event occurs. |
| Security | MS RRAS – DLL component load failed | This alert is generated when DLL component load failed. |
| Security | MS RRAS – Error detected | This alert is generated when error detected. |
| Security | MS RRAS – Event notification request failure | This alert is generated when event notification request failure event occurs. |
| Security | MS RRAS – IGMP event creation failure | This alert is generated when IGMP event creation failure event occurs. |
| Security | MS RRAS – IGMP memory allocation failure | This alert is generated when IGMP memory allocation failure event occurs. |
| Security | MS RRAS – IGMP proxy failed to register with MGM | This alert is generated when IGMP proxy failed to register with MGM. |
| Security | MS RRAS – IGMP router failed to register with MGM | This alert is generated when IGMP router failed to register with MGM. |
| Security | MS RRAS – IGMP socket operation failure | This alert is generated when IGMP socket operation failure event occurs. |
| Security | MS RRAS – IGMP task scheduling failure | This alert is generated when IGMP task scheduling failure event occurs. |
| Security | MS RRAS – IGMPv2 network event enumeration failure | This alert is generated when IGMPv2 network event enumeration failure event occurs. |
| Security | MS RRAS – Interface info hold table creation failed | This alert is generated when interface info hold table creation failed. |
| Security | MS RRAS – IP address obtain error | This alert is generated when IP address obtain error occurs. |
| Security | MS RRAS – IP address user disconnected | This alert is generated when IP address user disconnected. |
| Security | MS RRAS – IP security apply failure | This alert is generated when IP security apply failure event occurs. |
| Security | MS RRAS – IPBOOTP stopped | This alert is generated when IPBOOTP stopped. |
| Security | MS RRAS – IPMGM memory allocation failure | This alert is generated when IPMGM memory allocation failure event occurs. |
| Security | MS RRAS – IPMGM semaphore creation failed | This alert is generated when IPMGM semaphore creation failed. |
| Operations | MS RRAS – Client auto disconnected | This alert is generated when client auto disconnected event occurs. |
| Operations | MS RRAS – Client disconnected to RAS automatically | This alert is generated when client disconnected to RAS automatically. |
| Operations | MS RRAS – Client exceeded license limit | This alert is generated when client exceeded license limit. |
| Operations | MS RRAS – Connection attempt failed | This alert is generated when connection attempt failed event occurs. |
| Operations | MS RRAS – Critical section initialization failed | This alert is generated when critical section initialization failed. |
| Operations | MS RRAS – Demand:dial connection initiation failed | This alert is generated when demand:dial connection initiation failed. |
| Operations | MS RRAS – Line disconnected | This alert is generated when line disconnected. |
| Operations | MS RRAS – Link disconnected | This alert is generated when link disconnected. |
| Operations | MS RRAS – Media access control handle failed | This alert is generated when media access control handle failed. |
| Operations | MS RRAS – Memory allocation failure | This alert is generated when memory allocation failure event occurs. |
| Operations | MS RRAS – MGM interface ownership failed | This alert is generated when MGM interface ownership failed. |
| Operations | MS RRAS – NAP enforcement client registration failed | This alert is generated when NAP enforcement client registration failed. |
| Operations | MS RRAS – NapAgent request failure | This alert is generated when NapAgent request failure event occurs. |
| Operations | MS RRAS – Packet filter disabled | This alert is generated when packet filter disabled. |
| Operations | MS RRAS – Port opening failure | This alert is generated when port opening failure event occurs. |
| Operations | MS RRAS – RAS IP address changed | This alert is generated when RAS IP address changed. |
| Operations | MS RRAS – RAS unable to renew IP address | This alert is generated when RAS unable to renew IP address. |
| Operations | MS RRAS – RASMAN Service port enumeration failed | This alert is generated when RASMAN Service port enumeration failed. |
| Operations | MS RRAS – RRAS DHCP relay failure | This alert is generated when RRAS DHCP relay failure event occurs. |
| Operations | MS RRAS – Socket creation failed | This alert is generated when socket creation failed. |
| Operations | MS RRAS – User callback failed | This alert is generated when user callback failed. |
| Operations | MS RRAS – User connected and disconnected again | This alert is generated when user connected and disconnected again event occurs. |
| Operations | MS RRAS – User device disconnection occurred | This alert is generated when user device disconnection occurred. |
| Operations | MS RRAS – User disconnected | This alert is generated when user disconnected event occurs. |
| Compliance | MS RRAS – VPN logon success | This alert is generated when VPN logon connects successfully |
| Compliance | MS RRAS – User connection failure | This alert is generated when user connection failure event occurs. |
| Compliance | MS RRAS – RRAS DHCP relay failure | This alert is generated when RRAS DHCP relay failure event occurs. |
| Compliance | MS RRAS – RASMAN service start failed | This alert is generated when RASMAN service start failed. |
| Compliance | MS RRAS – IPBOOTP configuration failure | This alert is generated when IPBOOTP configuration failure event occurs. |
| Compliance | MS RRAS – Broadcast enabling failure | This alert is generated when broadcast enabling failure event occurs. |
| Compliance | MS RRAS – Certificate config failure | This alert is generated when certificate config failure event occurs. |
| Compliance | MS RRAS – Communication device failure | This alert is generated when communication device failure event occurs. |
| Compliance | MS RRAS – VPN server route configuration failure | This alert is generated when VPN server route configuration failure event occurs. |
Reports
| Type | Name | Description |
|---|---|---|
| Security | MS RRAS – Authentication type | This report provides the details about the Authentication scheme that is used in the RRAS server. |
| Operations | MS RRAS – Accounting Request | This report provides the details about the Accounting request that is requested from the RRAS server. |
| Operations | MS RRAS – Access Request | This report provides the details about the Access request that is requested from the RRAS server. |
| Compliance | MS RRAS – Access Failure | This report provides the details about the Access failures that is attempted in the RRAS server. |
| Compliance | MS RRAS – Access Success | This report provides the details about the Access success that is attempted in the RRAS server. |
Documentation
The configuration details are consistent with Netsurion Open XDR 8.x and later,Routing and Remote Access Service (RRAS) Microsoft Windows Server 2008 and later.
Download Integration Guide for configuration instructions and more information.