Hands-On Microsoft Windows Server 2003 Administration Chapter 11 Administering Remote Access Services.

Slides:



Advertisements
Similar presentations
1 Chapter 2: Networking Protocol Design Designs That Include TCP/IP Essential TCP/IP Design Concepts TCP/IP Data Protection TCP/IP Optimization.
Advertisements

Setting Up a Virtual Private Network Chapter 9. Learning Objectives Understand the components and essential operations of virtual private networks (VPNs)
1.1 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 1: Introducing Windows Server.
Module 6: Configuring Windows XP Professional to Operate in a Microsoft Network.
4.1 Configuring Network Access Components of a Network Access Services Infrastructure What is the Network Policy and Access Services Role? What is Routing.
11 TROUBLESHOOTING Chapter 12. Chapter 12: TROUBLESHOOTING2 OVERVIEW  Determine whether a network communications problem is related to TCP/IP.  Understand.
1 Routing and Remote Access Service (Week 15, Friday 4/21/2006) © Abdou Illia, Spring 2006.
Module 5: Configuring Access for Remote Clients and Networks.
1 Objectives Configure Network Access Services in Windows Server 2008 RADIUS 1.
1 Configuring Virtual Private Networks for Remote Clients and Networks.
70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 11: Planning Network Access.
Module 10: Configuring Virtual Private Network Access for Remote Clients and Networks.
MCDST : Supporting Users and Troubleshooting a Microsoft Windows XP Operating System Chapter 13: Troubleshoot TCP/IP.
CN1260 Client Operating System Kemtis Kunanuraksapong MSIS with Distinction MCT, MCITP, MCTS, MCDST, MCP, A+
MCDST : Supporting Users and Troubleshooting a Microsoft Windows XP Operating System Chapter 14: Troubleshooting Remote Connections.
70-270, MCSE/MCSA Guide to Installing and Managing Microsoft Windows XP Professional and Windows Server 2003 Chapter Twelve Implementing Terminal.
Chapter 13 Chapter 13: Managing Internet and Network Interoperability.
Chapter 8: Configuring Network Connectivity. Installing Network Adapters Network adapter cards connect a computer to a network. Installation –Plug and.
MCITP Guide to Microsoft Windows Server 2008 Server Administration (Exam #70-646) Chapter 10 Configuring Remote Access.
Remote Networking Architectures
Virtual Private Network (VPN) © N. Ganesan, Ph.D..
Overview of Routing and Remote Access Service (RRAS) When RRAS was implemented in Microsoft Windows NT 4.0, it added support for a number of features.
1 Chapter Overview Using Remote Access Using Virtual Private Networks Using NAT and ICS Using Terminal Services.
Module 11: Supporting Remote Users. Overview Establishing Remote Access Connections Connecting to Virtual Private Networks Configuring Authentication.
Chapter 11: Dial-Up Connectivity in Remote Access Designs
70-291: MCSE Guide to Managing a Microsoft Windows Server 2003 Network Chapter 10: Remote Access.
1 Microsoft Windows NT 4.0 Authentication Protocols Password Authentication Protocol (PAP) Challenge Handshake Authentication Protocol (CHAP) Microsoft.
MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration Chapter 9 Network Policy and Access Services in Windows Server 2008.
Virtual Private Networks (Tunnels). When Are VPN Tunnels Used? VPN with PPTP tunnel Used if: All routers support VPN tunnels You are using MS-CHAP or.
Week #10 Objectives: Remote Access and Mobile Computing Configure Mobile Computer and Device Settings Configure Remote Desktop and Remote Assistance for.
Network Services Lesson 6. Objectives Skills/ConceptsObjective Domain Description Objective Domain Number Setting up common networking services Understanding.
Windows Server 2008 Chapter 9 Last Update
11 NETWORK PROTOCOLS AND SERVICES Chapter 10. Chapter 10: Network Protocols and Services2 NETWORK PROTOCOLS AND SERVICES  Identify how computers on TCP/IP.
Guide to Operating System Security Chapter 9 Web, Remote Access, and VPN Security.
Configuring Routing and Remote Access(RRAS) and Wireless Networking
Chapter 20: Getting from the Office to the Road: VPNs BAI617.
Chapter 12 Chapter 12: Remote Access and Virtual Private Networks.
Module 8: Configuring Virtual Private Network Access for Remote Clients and Networks.
Module 9: Planning Network Access. Overview Introducing Network Access Selecting Network Access Connection Methods Selecting a Remote Access Policy Strategy.
12-Sep-15 Virtual Private Network. Why the need To transmit files securely without disclosing sensitive information to others in the Internet.
Module 6: Configuring and Troubleshooting Routing and Remote Access
Objectives Configure routing in Windows Server 2008 Configure Network Address Translation 1.
Remote Access Chapter 4. Learning Objectives Understand implications of IEEE 802.1x and how it is used Understand VPN technology and its uses for securing.
11.59 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 11: Introducing WINS, DNS,
70-411: Administering Windows Server 2012
Objectives Configure routing in Windows Server 2008 Configure Routing and Remote Access Services in Windows Server 2008 Network Address Translation 1.
Module 8 Configuring Mobile Computing and Remote Access in Windows® 7.
1 Chapter Overview Installing the TCP/IP Protocols Configuring TCP/IP.
1 Chapter Overview Using the New Connection Wizard to configure network and Internet connections Using the New Connection Wizard to configure outbound.
1 Week 6 – NPS and RADIUS Install and Configure a Network Policy Server Configure RADIUS Clients and Servers NPS Authentication Methods Monitor and Troubleshoot.
Module 8: Designing Network Access Solutions. Module Overview Securing and Controlling Network Access Designing Remote Access Services Designing RADIUS.
1 Chapter 12: VPN Connectivity in Remote Access Designs Designs That Include VPN Remote Access Essential VPN Remote Access Design Concepts Data Protection.
Module 11: Remote Access Fundamentals
VIRTUAL PRIVATE NETWORK By: Tammy Be Khoa Kieu Stephen Tran Michael Tse.
11.59 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 11: Introducing WINS, DNS,
Hands-On Microsoft Windows Server Introduction to Remote Access Routing and Remote Access Services (RRAS) –Enable routing and remote access through.
5.1 © 2004 Pearson Education, Inc. Exam Designing a Microsoft ® Windows ® Server 2003 Active Directory and Network Infrastructure Lesson 5: Planning.
Page 1 TCP/IP Networking and Remote Access Lecture 9 Hassan Shuja 11/23/2004.
1 Week #5 Routing and NAT Network Overview Configuring Routing Configuring Network Address Translation Troubleshooting Routing and Remote Access.
Network Infrastructure Microsoft Windows 2003 Network Infrastructure MCSE Study Guide for Exam
Routing with Windows Server 2003 Chapter 9. Objectives for this Chapter Manage Routing And Remote Access routing interfaces Manage packet filters Manage.
NetTech Solutions Common Connectivity Problems Lesson Eight.
Using Routing and Remote Access Chapter Five. Exam Objectives in this Chapter:  Plan a routing strategy Identify routing protocols to use in a specified.
70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 4: Planning and Configuring Routing and Switching.
Configure and Security Remote Acess. Chapter 8 Advance Computer Network Lecture Sorn Pisey
Windows Vista Configuration MCTS : Advanced Networking.
KAPLAN SCHOOL OF INFORMATION SYSTEMS AND TECHNOLOGY IT375 Window Enterprise Administration Course Name – IT Introduction to Network Security Instructor.
Module 9: Configuring Network Access
Configuring and Troubleshooting Routing and Remote Access
Presentation transcript:

Hands-On Microsoft Windows Server 2003 Administration Chapter 11 Administering Remote Access Services

2 Objectives Configure remote access and virtual private network (VPN) connections Implement and troubleshoot remote access policies Configure and troubleshoot network address translation (NAT) Configure and troubleshoot Internet connection sharing Configure and manage Terminal Services

3 Configuring Remote Access and Virtual Private Network Connections Remote access server –A computer running Windows Server 2003 and the Routing and Remote Access Service (RRAS) RRAS authenticates remote or mobile users Options for providing a connection to a network from a remote location –Dial-up connections –Virtual private network (VPN) connections

4 Configuring Remote Access and Virtual Private Network Connections (Continued) Dial-up connections –Communication established via communication networks such as a Public Switched Telephone Network (PSTN) –Point-to-Point Protocol (PPP) Enables remote access clients and servers to communicate over a dial-up connection from any operating system that supports the PPP standards

5 Configuring Remote Access and Virtual Private Network Connections (Continued) VPN –Uses a LAN protocol and PPP, which are both encapsulated within a VPN protocol, to send data over a public network –Common VPN protocols Point-to-Point Tunneling Protocol (PPTP) Layer 2 Tunneling Protocol (L2TP)

6 PPTP and L2TP are both used to establish a secure tunnel between two endpoints over an insecure network Configuring Remote Access and Virtual Private Network Connections (Continued)

7 Remote access is implemented on a Windows Server 2003 system by configuring RRAS Primary tasks for providing remote access: –Configure RRAS with the appropriate remote access configuration –Configure clients to connect to the RRAS server –Configure user rights, security, and conditions to successfully and securely connect to the RRAS server Configuring Remote Access and Virtual Private Network Connections (Continued)

8 Configuring Dial-Up Connections Advantages of dial-up connections –Wide availability Disadvantages of dial-up connections –Slow speed 56-Kbps is the maximum connection speed using a single phone line –Unreliability

9 Configuring Dial-Up Connections (Continued) To provide remote access to clients –Configure the physical modem on the server to which the clients connect –Configure Windows Server 2003 as a remote access server Once the dial-up server is installed, you may want to –Configure IP-addressing options –Configure protocol options –Configure remote access clients

10 Implementing Virtual Private Network Access A VPN –Can be created to Ensure that data communication over a public network, such as the Internet, is secure Connect two LANs, forming a type of WAN connection using the Internet as the backbone link between two locations –Can be created over any existing connection to the Internet, such as Dial-up Cable modem Digital subscriber line (DSL)

11 Virtual private network (VPN)

12 Implementing Virtual Private Network Access (Continued) To configure the client for VPN –The VPN connection is configured as a new network connection using the New Connection Wizard To configure the server for VPN –RRAS is used to configure the VPN server

13 Configuring Remote Access Authentication Windows Authentication –Used by default for client requests Remote authentication dial-in user service (RADIUS) authentication –Can be chosen in environments with a configured RADIUS server Authentication protocols enabled on a Windows Server 2003 RRAS system by default –EAP –MS-CHAP v2 –MS-CHAP

14 Configuring Remote Access Authentication (Continued) Authentication protocols supported by Windows.NET Server –MS-CHAP –MS-CHAP v2 –CHAP –SPAP –PAP –EAP EAP-MD5 EAP-TLS You also have the option of implementing unauthenticated remote access

15 Configuring Encryption Protocols Encryption protocols –Used to encrypt the data sent between a client and an RAS server When using MS-CHAP (v1 or v2) or EAP, two forms of encryption can be used –Microsoft Point-to-Point Encryption (MPPE) Uses encryption keys varying in length from 40 bits to 128 bits Used when IP security is not available –IP Security (IPSec) Consists of a suite of cryptography-based protection services and protocols that provide machine-level authentication and data encryption

16 Configuring Encryption Protocols (Continued) Encryption levels supported on an RRAS server –No Encryption –Basic –Strong –Strongest

17 Troubleshooting Remote Access Possible solutions to dial-up or VPN connection problems –Verify that all dial-up credentials such as user name and password are correct –Ensure that remote access is enabled on the RRAS server –Check to see that ports such as PPTP or L2TP are enabled for inbound remote access connections –If attempting to connect to a VPN server using L2TP, ensure that the client has a computer certificate properly installed

18 Troubleshooting Remote Access (Continued) Possible solutions to dial-up or VPN connection problems (Continued) –Ensure that the remote access server and remote access client are configured with at least one common authentication and encryption method between the two –Check the remote access policy to be sure that it is configured to allow access –Verify that there are enough addresses in the static IP address range

19 Troubleshooting Remote Access (Continued) Possible solutions to dial-up or VPN connection problems (Continued) –Ensure that a DHCP Relay Agent has been configured –Ensure that packet filters are not being used that may restrict access –Check to be sure that the network adapter that is connected to the Internet is configured with a static IP address

20 Implementing and Troubleshooting Remote Access Policies To grant users the ability to dial into an RRAS server, Windows Server 2003 uses both –Dial-in properties of user accounts –Remote access policies By default, all user accounts in an Active Directory domain have the dial-in properties configured to the Control Access through Remote Access Policy setting

21 Elements of a Remote Access Policy A remote access policy consists of –Conditions Attributes that are compared to a connection attempt –Permissions A combination of user account permissions as well as those defined in the policy –Profile Consists of settings such as dial-in constraints, multilink properties, authentication protocols, and encryption properties Each element of a remote access policy must be evaluated before a user is allowed to dial in

22 Creating a Remote Access Policy When RRASs are installed, two default policies are created –Connections to Microsoft Routing and Remote Access server –Connections to other access servers Remote Access Policies container –Found within the Routing and Remote Access snap-in –Lists all the remote access policies –Can be used to Configure the order of policy processing Add, delete, or edit individual policies

23 Creating a Remote Access Policy (Continued) Additional settings can be configured with the default profile to further control which clients can access the RRAS server

24 Troubleshooting Remote Access Policies Possible solutions to problems with remote access policies –Verify that the connection attempt matches the conditions of at least one remote access policy –Check to be sure the user is not a member of any groups that have been denied access –Ensure that the user attempting to connect has been granted permission to dial in either through a user account property or through a remote access policy

25 Troubleshooting Remote Access Policies (Continued) Possible solutions to problems with remote access policies (Continued) –Verify dial-in settings configured for the user account are not conflicting with those of the remote access policy –Verify that the connection attempt matches all of the settings configured in the profile of the policy

26 Configuring and Troubleshooting Network Address Translation Network address translation (NAT) –Allows a group of computers to access the Internet using a single Internet connection and a single IP address Services provided by a computer running NAT –Address translation –IP addressing –Name resolution –Basic Firewall –Static Packet Filters

27 Installing NAT If RRAS is not already installed –NAT can be configured by installing and enabling RRAS If RRAS is already installed and configured –NAT can be added to the server manually Routing and Remote Access snap-in –Can be used to configure the NAT protocol

28 Configuring NAT

29 Troubleshooting NAT Possible problems and solutions –If clients are not receiving IP addresses from the NAT computer, verify that NAT addressing has been enabled There is no other DHCP server running on the network –If name resolution is not working for NAT clients, check That name resolution has been enabled using the Name Resolution tab in the NAT properties dialog box The configuration of the NAT computer using the ipconfig command to verify DNS settings

30 Troubleshooting NAT (Continued) Possible problems and solutions (Continued) –If packets are not being properly translated, verify That both the Internet and LAN interface have been added to the NAT protocol The range of IP addresses that has been configured on the NAT computer That IP packet filtering is not preventing certain Internet traffic from being sent and received

31 Configuring Internet Connection Sharing Internet connection sharing (ICS) –Provides all computers on a LAN with complete access to Internet resources using a single public IP address –Provides the following for computers on the internal network NAT services IP addressing Name resolution

32 Configuring Internet Connection Sharing (Continued) After installing ICS on the computer connected to the Internet –The IP address of the internal network adapter is automatically set to –A simplified version of DHCP is installed, which assigns internal clients an IP address (from the network ID of /24) –A DNS proxy service is installed to pass internal DNS requests to the DNS server that the computer running ICS is configured to use

33 Configuring Internet Connection Sharing (Continued) ICS and NAT are both used to connect a small or home office to the Internet

34 Enabling ICS –Relatively straightforward –Does not require any configuration unless you want to change the applications and services that outside Internet users are able to access on an internal private network

35 Configuring Internet Connection Sharing for a dial-up connection

36 Troubleshooting ICS Techniques to troubleshoot common problems –After ICS is installed, use the ipconfig command to verify that the network adapter has been assigned the IP address of and the subnet mask is –If client computers are unable to connect to the Internet Use the ipconfig command to verify that –An IP address in the range of through has been assigned –The subnet mask is –The default gateway is set to Use the ping command to verify –TCP/IP connectivity with the computer running ICS

37 Troubleshooting ICS (Continued) Techniques to troubleshoot common problems (Continued) –Verify that there is no DHCP server already running on the network –If clients are unable to access the Internet using an FQDN, verify that the IP address of a DNS server is configured in the TCP/IP properties of the connection to the Internet –If clients can only connect to the Internet after you manually establish a connection, verify that demand dialing is enabled on the ICS computer

38 Configuring Terminal Services and Remote Desktop for Administration Terminal Services –The ability of users to connect to a server for the purpose of running applications –Not installed unless explicitly added to a server by an administrator Remote Desktop for Administration –The ability of an administrator to connect to a server for administration purposes –Installed as part of Windows Server 2003, but disabled by default

39 Enabling Remote Desktop for Administration To enable Remote Desktop for Administration –Only a single setting in the Control Panel System program needs to be changed Permissions regarding connecting to a server using Remote Desktop for Administration –By default, only members of the Administrators group are granted access –Additional users can be granted access via the System program

40 Enabling Remote Desktop for Administration

41 Enabling Remote Desktop for Administration (Continued) To connect to a server using Remote Desktop for Administration –Users must access the Remote Desktop Connection software from their client system

42 Installing Terminal Services To install Terminal Services –Use the Add/Remove Windows Components section from within the Add or Remove Programs applet found in Control Panel To set up an application server –One Windows Server 2003 server on the network must be configured as a Terminal Services licensing server

43 Managing Terminal Services Primary tools used for Terminal Services administration –Terminal Services Manager –Terminal Services Configuration –Terminal Services Licensing

44 Managing Terminal Services (Continued) Connection settings for a Terminal Server are configured from the properties of a Terminal Server connection object

45 Managing Terminal Services (Continued) Authentication –Can be set to use either no authentication or standard Windows authentication when the clients are Windows 95, 98, NT, or 2000 Encryption options include –Client Compatible All data sent from the client to the server is encrypted using a key based on the maximum strength supported on the client –High Data sent from the client to the server and from the server to the client is encrypted using the highest encryption level available at the server

46 Terminal Services Client Software %Systemroot%\system32\clients\tsclient\win32 folder on the Terminal Server –Contains the files necessary to install the Remote Desktop Connection software that is used by clients to connect to a Windows Server 2003 Terminal Server Installing applications –When you install Windows Server 2003 Terminal Server, applications need to be installed in a compatible mode for multiple users to access them simultaneously

47 Terminal Services Client Software (Continued) Configuring Terminal Services User Properties –Extra tabs added when Terminal Server is installed Terminal Services Profile Remote control Sessions Environment

48 Summary Remote access server –A computer running Windows Server 2003 with Routing and Remote Access Services installed and enabled –Authenticates remote and mobile users, providing a gateway to internal network resources Remote access solutions include dial-up,VPN, and NAT Each RAS server can be configured using the Routing and Remote Access console Windows.NET Server supports two VPN protocols: PPTP and L2TP

49 Summary (Continued) Authentication and encryption protocols can be used to secure communications between the RAS server and a dial-up client Authentication protocols supported by Windows.NET Server –MS-CHAP v1 and v2, CHAP, SPAP, PAP, and EAP Dial-in access can be controlled through user account properties and Remote Access policies Remote Access policies consist of conditions, permissions, and profiles

50 Summary (Continued) Network address translation (NAT) and Internet connection sharing (ICS) –Provide a way of connecting computers in a small or home office to the Internet using a single connection Terminal Server –Enables clients to access applications on a terminal server Remote Desktop for Administrators –Gives administrators the ability to remotely administer network servers