Configuring Routing and Remote Access(RRAS) and Wireless Networking Chapter 5 Configuring Routing and Remote Access(RRAS) and Wireless Networking

Configuring Routing Routing –transferring data across our network one LAN to another. Routers are used to making routing decisions Routers are the default gateways for our PCs Routers get us outside of our network Types of Routes Static Dynamic – RIP is the only one available in W2K08 Windows Server 2008 is considered a software-based router when running the RRAS service

Configuring Routing Install the RRAS service and Choose Custom Configuration Most Setups require 2 NICS to be installed Select which type of routing you are going to use 2 choices Static Routes RIP

Reading the IP routing Table Can view the routing table through the RRAS console or by using the route print command 4 types of routes that will be found Directly attached networks Remote network Routes Host routes – subnetmask will be 255.255.255.255 Default Route – 0.0.0.0

Configuring Demand Dial Routing With Demand Dial Routing the connection is only active when it needs to be. When a router receives a packet for a remote network this will initiate a connection to the remote site. 1st step is to configure a demand-dial interface The next step is to configure a static route to that destination.

Configuring Remote Access Windows Server 2008 provides several options to allow hosts to connect remotely to your network and network resources Dial-Up Networking (DUN) VPN NAT

Configuring Dial-Up Remote Access Enables remote computers that have modems to connect to the network. Typically used in laptops. Allows the computer to act as if it were locally connected. To enable multiple PCs to connect at the same time a modem bank is needed.

Configuring VPNs Creates a tunnel through a public network such as the internet into the private network. No dedicated lines are needed Performance is not comparable to a dedicated line Use a dedicated line when traffic speed is important or traffic is synchronous, as in voice and video A tunneling-Protocol must be chosen when creating the VPN PPTP – Point to Point Tunneling Protocol L2TP – Layer Two Tunneling Protocol

NAT Network Address Translation Allows clients to connect to the internet with only 1 IP address available. Similar to how home wireless routers work.

Authorizing Remote Connections Users must submit credentials (username and password) to be authenticated on the network. Authentication proves that the user is who he or she claims to be. Once the user is authenticated they must be authorized to connect remotely Authorizing controls what users can and can’t access Can they have access remotely or not? A two step process is used to authorize

Authorizing Remote Connections Step #1 The Dial-In properties of the user account must be evaluated Done in Active Directory for a domain environment In the local users and groups for stand-alone servers Step #2 The authorizing process must meet all criteria specified in the NPS network Policy Example: must be between 8:00 – 5:00 and use L2TP to connect

Configuring an NPS Policy An NPS policy is basically a rule for evaluating remote connections. Consists of 3 parts Conditions – must meet a condition: Ex: certain users, or IP’s Constraints – if the condition is met it must also meet all of the constraints Settings – Once conditions and constraints are met the certain settings can be applied to that remote connection NPS policies are processed in order Once a policy is matched it will not move on to the next Page 117 gives a good example on how this works.

Choosing an Authentication Protocol When submitting credentials a common authentication protocol must be used. In order from most secure to least: EAP-TLS MS-CHAP v2 MS-CHAP v1 EAP-MD5 CHAP CHAP SPAP PAP Unauthenticated Access

Configuring Wireless Access IEEE 802.1X – standard for network access control Port based – can allow or deny access based on physical port or logical port 802.1X provides port-based security using 3 components. Supplicant – devices seeking access Authenticator –component that requests authentication credentials from supplicant. Usually port or wireless AP. The Authenticator forwards the credentials to the AS. Authentication Server (AS) – server that verifies the supplicants credentials. It tells the authenticator whether to allow or deny access.

Configuring Wireless Access To configure Server 08 to allow wireless access you will need to do the following. Install and configure radius clients Switches or Wireless AP’s that are 802.1X capable Select an authentication protocol Add radius clients to NPS server Configure a NPS network Policy Configuring accounting – logs what a user attempts to access

You Learned By using the Routing and Remote Access service, Windows Server 2008 can be configured as a router and remote access server. The Routing And Remote Access console is the principal tool used for configuring and managing this service. Lesson 5

You Learned (cont.) Lesson 5 Routing and Remote Access can be automatically configured for several options: Remote Access (Dial-Up Or VPN), Network Address Translation (NAT), Virtual Private Network (VPN) Access And NAT, and Secure Connection Between Two Private Networks. If none of the standard options match your requirements, you can also manually configure Routing and Remote Access. Lesson 5

You Learned (cont.) Lesson 5 Without dynamic routing protocols, such as RIPv2, network administrators must add static routes to connect to non-neighboring subnets when those subnets do not lie in the same direction as the default route. Lesson 5

You Learned (cont.) Lesson 5 Routers read the destination addresses of received packets and route those packets according to directions that are provided by routing tables. In Windows Server 2008, you can view the IP routing table through the Routing And Remote Access console or through the Route Print command. Lesson 5

You Learned (cont.) Lesson 5 Windows Server 2008 provides extensive support for demand-dial routing, which is the routing of packets over physical point-to-point links, such as analog phone lines and ISDN, and over virtual point-to-point links, such as PPTP and L2TP. Demand-dial routing allows you to connect to the Internet, connect branch offices, or implement router-to-router VPN connections. Lesson 5

You Learned (cont.) Lesson 5 The remote access connection must be authorized after it is authenticated. Remote access authorization begins with the user account’s dial-in properties; the first matching remote access policy is then applied to the connection. Lesson 5

You Learned (cont.) Lesson 5 Microsoft implementation of a RADIUS server is the Network Policy Server. Use a RADIUS server to centralize remote access authentication, authoriza- tion, and logging. When you implement RADIUS, multiple Windows Server 2008 computers running the Routing and Remote Access service forward access requests to the RADIUS server. The RADIUS server then queries the domain controller for authentication and applies remote access policies to the connection requests. Lesson 5

You Learned (cont.) Lesson 5 The 802.1X IEEE standard allows for port-level network access control of both wired and wireless connections. A Windows Server 2008 server running the NPS role can also secure 802.1X connectivity for 802.1X-capable network switched and wireless access ports. Lesson 5