Presentation is loading. Please wait.

Presentation is loading. Please wait.

Chapter 12: Remote Access and Virtual Private Networks

Similar presentations


Presentation on theme: "Chapter 12: Remote Access and Virtual Private Networks"— Presentation transcript:

1 Chapter 12: Remote Access and Virtual Private Networks

2 Key Terms access server – A device that connects several different types of communication devices and telecommunication lines to a network, providing network routing for these types of communications. aggregate link – Linking two or more communications channels, such as ISDN channels so that they appear as one channel, but with the combined speed of all channels in the aggregate. Bandwidth Allocation Control Protocol (BACP) – Similar to BAP, but is able to select a preferred client when two or more clients vie for the same bandwidth. Bandwidth Allocation Protocol (BAP) – A protocol that works with Multilink in Windows 2000 Server that enables the bandwidth or speed of a remote connection to be allocated on the basis of the needs of an application, with the maximum allocation equal to the maximum speed of all channels aggregated via Multilink. bits per second (bps) – Number of binary bits (0s or 1s) sent in one second, a measure used to gauge network, modem, and telecommunications speeds. callback security – Used for remote communications verification, the remote server calls back the accessing workstation to verify the access is from an authorized telephone number. Challenge Handshake Authentication Protocol (CHAP) – An encrypted handshake protocol designed for standard IP- or PPP-based exchange of passwords. It provides a reasonably secure, standard, cross-platform method for sender and receiver to negotiate a connection.

3 Key Terms CHAP with Microsoft extensions (MS-CHAP) – A Microsoft-enhanced version of CHAP that can negotiate encryption levels and that uses the highly secure RSA RC4 encryption algorithm to encrypt communications between client and host. CHAP with Microsoft extensions version 2 (MS-CHAP v2) – An enhancement of MS-CHAP that provides better authentication and data encryption and that is especially well suited for VPNs. data communications equipment (DCE) – A device that converts data from a DTE, such as a computer, to be transmitted over a telecommunications line. data terminal equipment (DTE) – A computer or computing device that prepares data to be transmitted over a telecommunications line to which it attaches by using a DCE, such as a modem. DHCP Relay Agent – A server or computer that broadcasts IP configuration information between the DHCP server on a network and the client acquiring an address, such for remote connections and when they are on different networks and thus transmissions must go through one or more routers. digital subscriber line (DSL) – A technology that uses advanced modulation technologies on regular telephone lines for high-speed networking at speeds of up to 60 Mbps between subscribers and a telecommunications company.

4 Key Terms Extensible Authentication Protocol (EAP) – An authentication protocol employed by network clients that use special security devices such as smart cards, token cards, and others that use certificate authentication. frame relay – A WAN communications technology that relies on packet switching and virtual connection techniques to transit at from 56 Kbps to 45 Mbps. Integrated Services Digital Network (ISDN) – A telecommunications standard for delivering data services over digital telephone lines with a current practical limit of Mbps and a theoretical limit of 622 Mbps. Internet Authentication Service (IAS) – Used to establish and maintain security for RAS, Internet, and VPN dial-in access and can be employed with RADIUS. IAS can use certificates to authenticate client access. Layer Two Tunneling Protocol (L2TP) – A protocol that transports PPP over a VPN, intranet, or Internet. L2TP works similarly to PPTP, but unlike PPTP, L2TP uses an additional network communications standard, called Layer Two Forwarding, that enables forwarding on the basis of MAC addressing. line device – A DCE such as a modem or ISDN adapter that connects to a telecommunications line.

5 Key Terms Microsoft Point-to-Point Encryption (MPPE) – A starting to ending point encryption technique that uses special encryption keys varying in length from 40 to 128 bits. modem – A modulator/demodulator that converts a transmitted digital signal to an analog signal for a telephone line. It also converts a received analog signal to a digital signal for use by a computer. Multilink or Multilink PPP – A capability of RAS to aggregate multiple data streams into one logical network connection for the purpose of using more than one modem, ISDN channel, or other communication line in a single logical connection. Password Authentication Protocol (PAP) – A non-encrypted plain-text password authentication protocol. This represents the lowest level of security for exchanging passwords via PPP or TCP/IP. Silva’s PAP (SPAP) is a version that is used for authenticating remote access devices and network equipment manufactured by Silva (now Intel Network Systems, Inc.). Point-to-Point Protocol (PPP) – A widely used remote communication protocol that supports IPX/SPX, NetBEUI, and TCP/IP for point-to-point communication (such as between a remote PC and a Windows 2000 server on a network). Point-to-Point Tunneling Protocol (PPTP) – A remote communication protocol that enables connectivity to a network through the Internet and connectivity through intranets and VPNs. Remote Access Services (RAS) – Microsoft software services that enable off-site workstations to access a Windows 2000 server through telecommunications lines, the Internet, or intranets.

6 Key Terms Remote Authentication Dial-In User Service (RADIUS) – A protocol and service set up on one RAS or VPN server, such as in a domain when there are multiple RAS or VPN servers to coordinate authentication and to keep track of remote dial-in statistics for all RAS and VPN servers. Serial Line Internet Protocol (SLIP) – An older remote communications protocol that is used by UNIX computers. The modern compressed SLIP (CSLIP) version uses header compression to reduce communications overhead. Shiva’s Password Authentication Protocol (SPAP) – See Password Authentication Protocol. T-carrier – A dedicated leased telephone line that can be used for data communications over multiple channels for speeds of up to Mbps. Telephone Application Programming Interface (TAPI) – An interface for communication line devices (such as modems) that provides line device functions, such as call holding, call receiving, call hang-up, and call forwarding. terminal adapter (TA) – Popularly called a digital modem, links a computer or a fax to an ISDN line. Universal Modem Driver – A modem driver standard used on recently developed modems. virtual private network (VPN) – A private network that is like a tunnel through a larger network – such as the Internet, an enterprise network, or both – that is restricted only to designated member clients. X.25 – An older packet-switching protocol for connecting remote networks at speeds up to Mbps.

7 Learning Objectives Explain how remote access and virtual private network (VPN) services work Explain how to implement remote access communications devices and protocols Configure remote access services, security, dial-up connectivity, and client access

8 Learning Objectives (continued)
Configure VPN services, security, dial-up connectivity, and client access Troubleshoot remote access, VPN services, and client connectivity

9 Early Remote Access Methods
An early method for accessing a network, which is still used, is to connect to a workstation through remote access software such as Carbon Copy

10 Accessing a Workstation Remotely
Figure Remotely accessing a workstations on a network

11 Microsoft Remote Access
A modern way to access a network remotely is by using Microsoft Remote Access Services (RAS) in Windows 2000 Server

12 Using RAS Figure 12-2 Remotely accessing a network through
Microsoft RAS

13 Virtual Private Network
Virtual private network: A private network that is like a tunnel through a larger network – such as the Internet, an enterprise network, or both – that is restricted only to designated member clients

14 Planning Tip Use a VPN to save money on modems and telephone lines for remote access to a network

15 VPN Architecture Figure 12-3 VPN network architecture

16 Operating Systems Than Can Connect to RAS
MS-DOS Windows 3.1 and 3.11 Windows NT (all versions) Windows 95 Windows 98 Windows 2000 Server and Professional

17 Connection Types Supported by RAS
Asynchronous modems Synchronous modems through an access server Null modem connections Regular dial-up telephone lines Leased telecommunications lines, such as T-carrier

18 Connection Types Supported by RAS (continued)
ISDN lines (and digital modems) X.25 lines DSL lines Frame relay lines

19 T-Carrier T-carrier: A dedicated leased telephone line that can be used for data communications over multiple channels for speeds of up to Mbps and beyond Two common varieties of T-carrier are: T-1 at Mbps T-3 at Mbps

20 Frame Relay Frame relay: A WAN communications technology that relies on packet switching and virtual connection techniques to transmit at from 56 Kbps to 45 Mbps

21 ISDN Integrated Services Digital Network (ISDN): A telecommunications standard for delivering data services over digital telephone lines with a current practical limit of Mbps and a theoretical limit of 622 Mbps

22 X.25 An older packet-switching protocol for connecting remote networks at speeds up to Mbps

23 DSL Digital subscriber line (DSL): A technology that uses advanced modulation technologies on regular telephone lines for high-speed networking at speeds of up to 60 Mbps between subscribers and a telecommunications company

24 Telephony Interfaces RAS supports telephony interfaces that include:
Universal Modem Driver: A modem driver standard used on recently developed modems Telephone Application Programming Interface: An interface for communication line devices (such as modems) that provides line device functions, such as call holding, call receiving, call hang-up, and call forwarding

25 Transport and Remote Communication Protocols
RAS supports protocols such as: TCP/IP NWLink NetBEUI PPP PPTP L2TP

26 Using Modems One of the most common ways to connect through RAS is by using modems either at the RAS server end, the client end, or both Cable TV modems are another possibility, but verify that the end-to-end connections can be made secure

27 ISDN Connectivity Digital “modems” can be used to connect a RAS server to ISDN, but these are really terminal adapters (TAs) and not modems, because ISDN is digital and does not use modulation/demodulation A design advantage of ISDN is that you can aggregate multiple lines to appear as one super fast connection

28 Access Server An effective way to connect different telecommunications and WAN media to RAS is through an access server For example, an access server can provide the following types of connectivity: Modems ISDN X.25 T-carrier

29 Access Server Architecture
Figure 12-4 Using an access server

30 Remote Access Protocols
Serial Line Internet Protocol (SLIP): An older remote communications protocol that is used by UNIX computers. The modern compressed SLIP (CSLIP) version uses header compression to reduce communications overhead. Point-to-Point Protocol (PPP): A widely used remote communication protocol that supports IPX/SPX, NetBEUI, and TCP/IP for point-to-point communication.

31 Table 12-1 SLIP and PPP Compared

32 Remote Access Protocols (continued)
Point-to-Point Tunneling Protocol (PPTP): A remote communication protocol that enables connectivity to a network through the Internet and connectivity through intranets and VPNs

33 Remote Access Protocols (continued)
Layer Two Tunneling Protocol (L2TP): A protocol that transports PPP over a VPN, intranet, or Internet. L2TP works similarly to PPTP, but unlike PPTP, L2TP uses an additional network communications standard, called Layer Two Forwarding, that enables forwarding on the basis of MAC addressing

34 General RAS Configuration Steps
Configure a Windows 2000 server with RAS, including the appropriate protocols Configure a DHCP Relay Agent (if IP addresses are assigned via DHCP) Configure RAS security Configure a dial-up and remote connection Configure RAS on client workstations

35 Configuring RAS Use the Routing and Remote Access tool to install RAS

36 Figure 12-5 Configuring routing and RAS
Installing RAS Figure Configuring routing and RAS

37 Installing RAS (continued)
Figure Selecting the option to install RAS

38 Routing and Remote Access Options

39 Installing RAS (continued)
Figure IP address assignment options

40 RAS Installation Tip If you configure RAS for AppleTalk, then users access RAS through the Guest account, which cannot have a password

41 RAS Properties You can configure RAS properties after RAS is installed by right-clicking the RAS server in the tree of the Routing and Remote Access tool and then clicking Properties

42 Viewing a RAS Server’s Properties
Figure RAS server properties

43 DHCP Relay Agent If you configure RAS to use DHCP to assign IP addresses, then you must configure a DHCP Relay Agent: Double-click the RAS server in the tree of the Routing and Remote Access tool Click IP Routing in the tree Right-click DHCP Relay Agent and click Properties Enter the IP address of the RAS server, click Add, and then click OK

44 Multilink If you plan to use an aggregated connection, such as for ISDN or multiple modems, configure Multilink and Bandwidth Allocation Protocol in the RAS Properties PPP tab

45 Multilink and BAP Multilink: A capability of RAS to aggregate multiple data streams into one logical network connection for the purpose of using more than one modem, ISDN channel, or other communication line in a single logical connection Bandwidth Allocation Protocol (BAP): A protocol that works with Multilink in Windows 2000 Server that enables the bandwidth or speed of a remote connection to be allocated on the basis of the needs of an application, with the maximum allocation equal to the maximum speed of all channels aggregated via Multilink

46 BACP Bandwidth Allocation Control Protocol: Similar to BAP, but BACP is able to select a preferred client when two or more clients vie for the same bandwidth

47 Configuring Multilink and BAP/BACP
Figure Configuring Multilink and BAP

48 Security Set at the Client
Set up security on the client’s account properties via the Dial-in tab, including whether to use a remote access policy for security and callback security

49 Callback Options No Callback: access is allowed on the first dial-up attempt Set By Caller: the server calls back a number provided by the remote computer Always Callback to: the server calls back a number that has already been entered in the Dial-in tab

50 Configuring Dial-in Security
Figure Configuring dial-in security for a user account

51 Remote Access Policies
Configure remote access policies and a profile to secure the RAS server and to manage access including: Dial-in constraints IP address assignment rules Authentication Encryption Allowing Multilink connections

52 Configuring Remote Access Policies
Figure Granting remote access as a RAS policy

53 Authentication Options
There are several authentication options that can be set in a remote access policies profile: Extensible Authentication Protocol (EAP): An authentication protocol employed by network clients that use special security devices such as smart cards, token cards, and others that use certificate authentication

54 Authentication Options (continued)
Challenge Handshake Authentication Protocol (CHAP): An encrypted handshake protocol designed for standard IP- or PPP-based exchange of passwords. It provides a reasonably secure, standard, cross-platform method for sender and receiver to negotiate a connection. CHAP with Microsoft extensions (MS-CHAP): A Microsoft-enhanced version of CHAP that can negotiate encryption levels and that uses the highly secure RSA RC4 encryption algorithm to encrypt communications between client and host

55 Authentication Options (continued)
CHAP with Microsoft extensions version 2 (MS-CHAP v2): An enhancement of MS-CHAP that provides better authentication and data encryption and that is especially well suited for VPNs Password Authentication Protocol (PAP): A non-encrypted plain-text password authentication protocol. This represents the lowest level of security for exchanging passwords via PPP or TCP/IP

56 Authentication Options (continued)
Silva’s Password Authentication Protocol (SPAP): A version of PAP that is used for authenticating remote access devices and network equipment manufactured by Silva (now Intel Network Systems, Inc.)

57 Configuring Authentication
Figure Configuring authentication

58 Encryption Options The RAS encryption options incorporate IPSec and Microsoft Point-to-Point Encryption (MPPE) MPPE: A starting to ending point encryption technique that uses special encryption keys varying in length from 40 to 128 bits

59 Encryption Selections
No Encryption: Clients do not employ data encryption Basic: Intended for clients using 40-bit encryption key MPPE or IPSec Strong: Intended for clients using 56-bit encryption key MPPE or IPSec

60 Encryption Note Originally the beta version of Windows 2000 Server included strongest encryption for 128-key MPPE or IPSec encryption, but this option is omitted in the first release of Windows 2000 Server. Expect strongest encryption to be included later in an update.

61 Dial-in and VPN Remote Access Tabs

62 Configuring a Dial-up Connection for a RAS Server
Use the Network and Dial-up Connections tool to configure a new dial-up connection for a RAS server

63 Creating a New Connection
Figure Creating a new connection

64 General Steps to Configure a VPN
Set up the network connectivity, such as through a WAN adapter, access server, or router Install the Routing and Remote Access Service, configuring it as a VPN server Establish the remote access policies and profile, including setting up EAP authentication Configure the number of PPTP and L2TP ports

65 Design Tip If you select to use a static pool of IP addresses when you install the VPN server, the upper limit of addresses that can be assigned is 253

66 Figure 12-14 Providing a range of addresses for a VPN server
Static Address Set Up Figure Providing a range of addresses for a VPN server

67 Configuring VPN Server Remote Access Policies
Configure VPN remote access policies and a profile using the same steps as for configuring a RAS server

68 Configuring Ports Configure the number of ports to equal those available through the WAN connection

69 Steps for Configuring Ports
To configure the number of ports: Right-click Ports in the tree under the server in the Routing and Remote Access tool Click Properties Double-click WAN Miniport (PPTP) and set the number of ports Double-click WAN Miniport (L2TP) and set the number of ports

70 Steps for Configuring Ports (continued)
Figure Configuring the number of ports

71 Hardware Troubleshooting Tips for RAS and VPN Servers
Use the Add/Remove Hardware tool or the Device Manager to test modems and WAN adapters Use the Network and Dial-up Connections tool to check dial-up and WAN connections Make sure access servers are working Make sure modem lines are properly connected and working

72 Software Troubleshooting Tips for RAS and VPN Servers
Make sure that the Remote Access Auto Connection Manager and Remote Access Connection Manager services are started Make sure the RAS or VPN server is enabled Use the Ports option to check the status of ports Make sure all IP parameters are properly configured

73 RAS and VPN Client Troubleshooting Tips
Check the dial-up networking and RAS setup on the client Make sure that clients are using the right protocols Check the dial-in security on the client’s user account Check the client’s modem to make sure it is working and set for compatible communications with the server

74 Chapter Summary RAS and VPN servers enable clients to remotely access Windows 2000 Server, such as those who telecommute Remote access can be configured through many types of WAN connectivity, such as dial-up telephone lines, high-speed lines, Internet connections, and routers

75 Chapter Summary RAS and VPN servers are compatible with remote access protocols such as PPP, PPTP, and L2TP Manage RAS and VPN servers using remote access policies and profiles


Download ppt "Chapter 12: Remote Access and Virtual Private Networks"

Similar presentations


Ads by Google