deploying virtual private networks with microsoft windows server 2003 phần 7 ppsx

Demand-Dial Interface for the Connection to the ISP To connect the Dallas office router to the Internet by using a local ISP, a dial interface is created using the Demand-Dial Interface

Domain Configuration

All access to the network for any resource is authenticated by Active Directory, which provides the consolidation, control, and reporting of all security for the cor-poration For each employee who is allowed VPN remote access:

• The remote access permission on the dial-in properties of the user account is set to Control Access Through Remote Access Policy

• The user account is added to the VPN_Users Active Directory group

Remote Access Policy Configuration

To define the authentication and encryption settings for remote access VPN clients, the following common remote access policy is created:

• Policy Name: Remote Access VPN Connections

• Policy Encryption Level: Strong Encryption and Strongest Encryption selected

PPTP-Based Remote Access Client Configuration

On the Windows XP remote access client computers, the New Connection Wizard

is used to create a VPN connection with the following settings:

• Network Connection Type: Connect To The Network At My Workplace

• Network Connection: Virtual Private Network Connection

• Connection Name: Contoso, LTD

• VPN Server Selection: vpn.contoso.example.com

• Connection Availability: Anyone’s Use (This option is available only on dows XP clients that are members of a domain.)

Win-L2TP/IPSec-Based Remote Access Client Configuration

The remote access computer logs on to the Contoso, LTD domain using a LAN connection to the Contoso, LTD intranet and receives a computer certificate through auto-enrollment This needs to happen prior to the user trying to connect from home because it needs to happen over the local LAN (If you want to enable

bootstrapping certificates for non-domain attached clients, use PPTP to connect

first, run a connect action to plumb the machine and user certificates, disconnect

from PPTP and reconnect with L2TP/IPSec.) Then the New Connection Wizard is

used to create the VPN connection with the following settings:

• Network Connection Type: Connect To The Network At My Workplace

• Network Connection: Virtual Private Network Connection

• Connection Name: Contoso, LTD

• VPN Server Selection: vpn.contoso.example.com

• Connection Availability: Anyone’s Use (This option is available only on

Win-dows XP clients that are members of a domain.)

In the Network Connections windows, right-click Contoso, LTD click Properties,

and then click the Networking tab On the Networking tab, Type Of VPN must be

set to L2TPIPSec VPN When Type Of VPN is set to Automatic, PPTP is tried first,

and then L2TP/IPSec In this case, the network administrator for Contoso, LTD

does not want remote access clients that are capable of establishing an L2TP/IPSec

connection to use PPTP

On-Demand Branch Office

Now that we have the remote access setups done on the VPN server and the

remote access clients, let’s take a look at the site-to-site connections we need to

create for the remote offices The Portland and Dallas branch offices of Contoso,

LTD are connected to the corporate office by using on-demand site-to-site VPN

connections Both the Portland and Dallas offices contain a few dozen employees

who need only occasional connectivity with the corporate office (For anything

fewer than 10 users at a site, the users should be left on remote access This will

allow the corporation to not have to support server-based services remotely at the

branch office For any more than 10 users, site-to-site connections with a dedicated

server is the preferred model.) The Window Server 2003 routers in the Portland and

Dallas offices are equipped with an Integrated Services Digital Network (ISDN)

adapter that dials a local ISP to gain access to the Internet When access is gained,

a site-to-site VPN connection is made across the Internet When the VPN

connec-tion is idle for five minutes, the routers at the branch offices terminate the VPN

con-nection

The Dallas branch office uses the IP network ID of 192.168.28.0 with a subnet mask

of 255.255.255.0 (192.168.28.0/24) The Portland branch office uses the IP network

ID of 192.168.4.0 with a subnet mask of 255.255.255.0 (192.168.4.0/24)

To simplify the configuration, the VPN connection is a one-way initiated connection

that is always initiated by the branch office router This is preferable to two-way

ini-tiated connection because the branch office does not have to use an always-on

Inter-net connection and thus saves on costs (In many cases these days, a branch office can use ADSL or cable modem for its connection and therefore maintain an always-

on state, so see what options are available for your scenario and branch office nections We will be setting up some two-way connections later on in this chapter.) For more background information, see Chapter 8

con-Figure 10-3 shows the Contoso, LTD VPN server that provides on-demand branch office connections

Portland branch office

Figure 10-3 The Contoso, LTD VPN server that provides on-demand branch office connections

• For the dial-in properties on the VPN_Dallas account, the remote access mission is set to Control Access Through Remote Access Policy and the static route 192.168.28.0 with a subnet mask of 255.255.255.0 is added

per-• The VPN_Dallas account is added to the VPN_Routers group

For the VPN connection to the Portland office, the user account VPN_Portland is

created with the following settings:

• Password of P*4s=wq!Gx1

• For the account properties of the VPN_Portland account, the User Must

Change Password At Next Logon option is cleared and the Password Never

Expires option is selected

• For the dial-in properties on the VPN_Portland account, the remote access

permission is set to Control Access Through Remote Access Policy and the

static route 192.168.4.0 with a subnet mask of 255.255.255.0 is added

• The VPN_Portland account is added to the VPN_Routers group

Remote Access Policy Configuration

To define the authentication and encryption settings for the VPN routers, the

fol-lowing remote access policy is created:

• Policy Name: VPN Routers

• Access Method: VPN

• User Or Group Access: Group, with the EXAMPLE\VPN_Routers group

selected

• Authentication Methods: Extensible Authentication Protocol (EAP), with the

Smart Card Or Other Certificate type, and Microsoft Encrypted

Authentica-tion version 2 (MS-CHAP v2) selected

• Policy Encryption Level: Strong Encryption and Strongest Encryption

selected

The following sections describe a PPTP-based on-demand branch office connection

for the Dallas office and an L2TP/IPSec-based on-demand branch office connection

for the Portland office By describing this scenario, we can cover all bases for your

own deployments For the best security, L2TP/IPSec with certificates is the

recom-mended solution for site-to-site connections Many vendors suggest IPSec tunnel

mode for this operation, but Microsoft does not support it because it has been

rejected for security reasons by the Internet Engineering Task Force (IETF) See the

sidebar in Chapter 8 for more details

PPTP-Based On-Demand Branch Office

The Dallas branch office is a PPTP-based branch office that uses a Windows Server

2003 router to create an on-demand, site-to-site VPN connection with the VPN

server in New York as needed When the connection is made and is idle for five

minutes, the connection is terminated

To deploy a PPTP, one-way initiated, on-demand, site-to-site VPN connection to the corporate office based on the settings configured in the “Common Configuration for the VPN Server” and “On-Demand Branch Office” sections of this chapter, the fol-lowing settings are configured on the Dallas router

Demand-Dial Interface for the Connection to the ISP

To connect the Dallas office router to the Internet by using a local ISP, a dial interface is created using the Demand-Dial Interface Wizard with the following settings:

demand-• Interface Name: ISP

• Connection Type: Connect Using A Modem, ISDN Adapter, Or Other cal Device

Physi-• Select a Device: The appropriate ISDN device is specified

• Phone Number: Phone number of the ISP for the Dallas office

• Protocols And Security: The Route IP Packets On This Interface check box is selected

• Static Routes For Remote Networks

To create the connection to the Dallas ISP when the site-to-site VPN tion needs to be made, the following static route is created:

connec-• Destination: 207.209.68.1

• Network mask: 255.255.255.255

• Metric: 1

• Dial Out Credentials

User name: Dallas office ISP account name

Password: Dallas office ISP account password

Confirm password: Dallas office ISP account password

To run the Demand-Dial Interface Wizard, right-click Network Interfaces in the Routing And Remote Access snap-in’s control tree, and then click New Demand-Dial Interface

Demand-Dial Interface for Site-to-Site VPN Connection

To connect the Dallas office router to the VPN server by using a site-to-site VPN connection over the Internet, the New York office’s network administrator created a demand-dial interface using the Demand-Dial Interface Wizard with the following settings:

• Interface Name: CorpHQ

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Point-to-Point Tunneling Protocol (PPTP)

• Destination Address: 207.209.68.1

• Protocols And Security: The Route IP Packets On This Interface check box is

selected

• Static Routes For Remote Networks

To make all locations on the corporate intranet reachable, the following

static route is created:

• Destination: 172.16.0.0

• Network mask: 255.240.0.0

• Metric: 1

To make all locations on Contoso, LTD branch offices reachable, the

follow-ing static route is created:

Confirm Password: nY7W{q8~=z3

L2TP/IPSec-Based On-Demand Branch Office

The Portland branch office is an L2TP/IPSec-based branch office that uses a

Win-dows Server 2003 router to create an on-demand, site-to-site VPN connection with

the VPN server in New York as needed When the connection is made and is idle

for five minutes, the connection is terminated

To deploy an L2TP/IPSec, one-way initiated, on-demand, site-to-site VPN

connec-tion to the corporate office based on the settings configured in the “Common

Con-figuration for the VPN Server” and “On-Demand Branch Office” sections of this

chapter, the following settings are configured on the Portland router

Certificate Configuration

The Portland router was configured by the Contoso, LTD network administrator

while it was physically connected to the Contoso, LTD intranet It was then

shipped to the Portland site While the Portland router was connected to the

Con-toso, LTD intranet, a computer certificate was installed through auto-enrollment

and the user name was created in Active Directory on the headquarters intranet This point is important to remember, especially if you are going to do two-way ini-tiated connections with separate Active Directory instances on each side of the link Configure the remote router while it is still connected to the central intranet, syn-chronize the two Active Directory user entries on either one’s Active Directory domain controller, and then ship the VPN server to the remote site

Demand-Dial Interface for the Connection to the ISP

To connect the Portland office router to the Internet by using a local ISP, the work administrator created a demand-dial interface using the Demand-Dial Inter-face Wizard with the following settings:

net-• Interface Name: ISP

• Connection Type: Connect Using A Modem, ISDN Adapter, Or Other cal Device

Physi-• Select a Device: The appropriate ISDN device is specified

• Phone Number: Phone number of the ISP for the Portland office

• Protocols And Security: The Route IP Packets On This Interface check box is selected

• Static Routes For Remote Networks

To create the connection to the Portland ISP when the site-to-site VPN nection needs to be made, the following static route is created:

con-• Destination: 207.209.68.1

• Network Mask: 255.255.255.255

• Metric: 1

• Dial-Out Credentials

User Name: Portland office ISP account name

Password: Portland office ISP account password

Confirm Password: Portland office ISP account password

Demand-Dial Interface for Site-to-Site VPN Connection

To connect the Portland office router to the VPN server by using a site-to-site VPN connection over the Internet, the network administrator created a demand-dial interface using the Demand-Dial Interface Wizard with the following settings:

• Interface Name: CorpHQ

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Layer 2 Tunneling Protocol (L2TP)

• Destination Address: 207.209.68.1

• Protocols And Security: The Route IP Packets On This Interface check box is

selected

• Static Routes For Remote Networks

To make all locations on the corporate intranet reachable, the following

static route is created:

• Destination: 172.16.0.0

• Network Mask: 255.240.0.0

• Metric: 1

To make all locations on Contoso, LTD branch offices reachable, the

follow-ing static route is created:

Persistent Branch Office

The Chicago and Phoenix branch offices of Contoso, LTD are connected to the

corporate office by using persistent site-to-site VPN connections that stay connected

24 hours a day The Windows Server 2003 routers in the Chicago and Phoenix

offices are equipped with T1 WAN adapters that have a permanent connection to a

local ISP to gain access to the Internet In today’s communications market, many

companies would use ADSL or cable modem for these purposes for two reasons:

the cost is much cheaper on a recurring monthly basis because the cost of the

Inter-net connection for ADSL or cable modem is less than $100 U.S per month as

opposed to greater than $1,000 U.S per month for a T1 leased line, and they

pro-vide a decent amount of bandwidth—at a minimum, equivalent in bandwidth to a

dual channel ISDN 128-kilobits per seconds (Kbps) link

The Chicago branch office uses the IP network ID of 192.168.9.0 with a subnet

mask of 255.255.255.0 (192.168.9.0/24) The Chicago branch office router uses the

public IP address of 131.107.0.1 for its Internet interface The Phoenix branch office

uses the IP network ID of 192.168.14.0 with a subnet mask of 255.255.255.0 (192.168.14.0/24) The Phoenix branch office router uses the public IP address of 157.60.0.1 for its Internet interface

The VPN connection is a two-way initiated connection The connection is initiated from either the branch office router or the VPN server Two-way initiated connec-tions require the creation of demand-dial interfaces, remote access policies, and static IP address pools on the routers on both sides of the connection

Figure 10-4 shows the Contoso, LTD VPN server that provides persistent branch office connections

Chicago branch office

Figure 10-4 The Contoso, LTD VPN server that provides persistent branch office connections

• For the dial-in properties on the VPN_Chicago account, the remote access permission is set to Control Access Through Remote Access Policy

• The VPN_Chicago account is added to the VPN_Routers group

For the Phoenix office VPN connection that is initiated by the Phoenix router, the

user account VPN_Phoenix is created with the following settings:

• Password of z2F%s)bW$4f

• For the account properties of the VPN_Phoenix account, the User Must

Change Password At Next Logon option is cleared and the Password Never

Expires option is selected

• For the dial-in properties on the VPN_Phoenix account, the remote access

permission is set to Control Access Through Remote Access Policy

• The VPN_Phoenix account is added to the VPN_Routers group

For the Chicago office VPN connection and the Phoenix office VPN connection that

are initiated by the VPN server, the user account VPN_CorpHQ is created with the

following settings:

• Password of o3\Dn6@`-J4

• For the dial-in properties on the VPN_CorpHQ account, the remote access

permission is set to Control Access Through Remote Access Policy

• The VPN_CorpHQ account is added to the VPN_Routers group

Remote Access Policy Configuration

Because these are two-way connections, remote access policies must be configured

at the VPN server, the Chicago router, and the Phoenix router

Remote access policy configuration at the VPN server The r emote access

policy configuration for the VPN server is the same as described in the

“On-Demand Branch Office” section of this chapter

Remote access policy configuration at the Chicago router To d e f i n e t h e

authentication and encryption settings for the VPN connections, the following

remote access policy is created:

• Policy Name: VPN Routers

• Access Method: VPN

• User Or Group Access: Group, with the VPN_Routers group selected

• Authentication Methods: Extensible Authentication Protocol (EAP), with the

Smart Card Or Other Certificate type, and Microsoft Encrypted

Authentica-tion version 2 (MS-CHAP v2) selected

• Policy Encryption Level: Strong Encryption and Strongest Encryption

selected

Remote access policy configuration at the Phoenix router To d e f i n e t h e authentication and encryption settings for the VPN connections, the following remote access policy is created:

• Policy Name: VPN Routers

• Access Method: VPN

• User Or Group Access: Group, with the VPN_Routers group selected

• Authentication Methods: Extensible Authentication Protocol (EAP), with the Smart Card Or Other Certificate type, and Microsoft Encrypted Authentica-tion version 2 (MS-CHAP v2) selected

• Policy Encryption Level: Strong Encryption and Strongest Encryption selected

IP Address Pool Configuration

IP address pools must be configured at the VPN server, the Chicago router, and the Phoenix router as shown in the following sections

IP address pool configuration at the VPN server The IP address pool ration for the VPN server is the same as described in the “Common Configuration for the VPN Server” section of this chapter

configu-IP address pool configuration at the Chicago router A static IP address pool with an IP address of 192.168.9.248 and an ending IP address of 192.168.9.253 is configured This creates a static address pool for up to five VPN clients

IP address pool configuration at the Phoenix router A static IP address pool with a starting IP address of 192.168.14.248 and an ending IP address of 192.168.14.253 is configured This creates a static address pool for up to five VPN clients

The following sections describe a PPTP-based persistent branch office connection for the Chicago office and an L2TP/IPSec-based persistent branch office connec-tion for the Phoenix office

PPTP-Based Persistent Branch Office

The Chicago branch office is a PPTP-based branch office that uses a Windows Server 2003 VPN router to create a persistent, site-to-site VPN connection with the VPN server in New York The connection is never terminated, even when idle

To deploy a PPTP, two-way initiated, persistent, site-to-site VPN connection to the corporate office based on the settings configured in the “Common Configuration for the VPN Server” and “Persistent Branch Office” sections of this chapter, the follow-ing settings are configured on the VPN server and Chicago router

VPN Server Configuration

The VPN server is configured with a demand-dial interface, static routes, and PPTP packet filters

Demand-dial interface for site-to-site VPN connection To connect the VPN

server to the Chicago router by using a site-to-site VPN connection over the

Inter-net, the network administrator created a demand-dial interface using the

Demand-Dial Interface Wizard with the following settings:

• Interface Name: VPN_Chicago

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Point-to-Point Tunneling Protocol (PPTP)

• Destination Address: 131.107.0.1

• Protocols And Security: The Route IP Packets On This Interface check box is

selected

• Static Routes For Remote Networks

To make all locations on the Chicago network reachable, the following static

• Confirm Password: o3\Dn6@`-J4

Once the demand-dial interface is created, one change needs to be made For the

properties of the demand-dial interface, on the Options tab, under Connection

Type, Persistent Connection must be selected

Chicago Router Configuration

The Chicago router is configured with a demand-dial interface and static routes

Demand-dial interface for site-to-site VPN connection To connect the

Chi-cago office router to the VPN server by using a site-to-site VPN connection over the

Internet, the network administrator created a demand-dial interface using the

Demand-Dial Interface Wizard with the following settings:

• Interface Name: VPN_CorpHQ

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Point-to-Point Tunneling Protocol (PPTP)

• Destination Address: 207.209.68.1

• Protocols And Security: The Route IP Packets On This Interface check box is selected

• Static Routes For Remote Networks

To make all locations on the corporate intranet reachable, the following static route is created:

• Confirm Password: U9!j5dP(%q1

Once the demand-dial interface is created, one change needs to be made For the properties of the demand-dial interface, on the Options tab, under Connection Type, Persistent Connection must be selected

Static route for the Contoso, LTD VPN server To make the Contoso, LTD VPN server on the Internet reachable, the following static route is created:

• Interface: The WAN adapter attached to the Internet

L2TP/IPSec-Based Persistent Branch Office

The Phoenix branch office is an L2TP/IPSec-based branch office that uses a

Win-dows Server 2003 router to create a persistent, site-to-site VPN connection with the

VPN server in New York The connection is never terminated, even when idle

To deploy an L2TP/IPSec, two-way initiated, persistent, site-to-site VPN connection

to the corporate office based on the settings configured in the “Common

Configura-tion for the VPN Server” and “Persistent Branch Office” secConfigura-tions of this chapter, the

following settings are configured on the VPN server and Phoenix router

VPN Server Configuration

The VPN server is configured with a demand-dial interface and a static route

Demand-dial interface for site-to-site VPN connection To connect the VPN

server to the Phoenix router by using a site-to-site VPN connection over the

Inter-net, the network administrator created a demand-dial interface using the

Demand-Dial Interface Wizard with the following settings:

• Interface Name: VPN_Phoenix

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Layer 2 Tunneling Protocol (L2TP)

• Destination Address: 157.60.0.1

• Protocols And Security: The Route IP Packets On This Interface check box is

selected

• Static Routes For Remote Networks

To make all locations on the Phoenix network reachable, the following static

• Confirm Password: o3\Dn6@`-J4

After the demand-dial interface is created, one change needs to be made For the

properties of the demand-dial interface, on the Options tab, under Connection

Type, Persistent Connection must be selected

Phoenix Router Configuration

The Phoenix router was configured by the Contoso, LTD network administrator while it was connected to the Contoso, LTD intranet It was then shipped to the Phoenix site While the Phoenix router was connected to the Contoso, LTD intranet,

a computer certificate was installed through auto-enrollment Additionally, the nix router computer was configured with a demand-dial interface and a static route

Phoe-Demand-dial interface for site-to-site VPN connection To connect the nix office router to the VPN server by using a site-to-site VPN connection over the Internet, the network administrator created a demand-dial interface using the Demand-Dial Interface Wizard with the following settings:

Phoe-• Interface Name: VPN_CorpHQ

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Layer 2 Tunneling Protocol (L2TP)

• Destination Address: 207.209.68.1

• Protocols And Security: The Route IP Packets On This Interface check box is selected

• Static Routes For Remote Networks

To make all locations on the corporate intranet reachable, the following static route is created:

Once the demand-dial interface is created, one change needs to be made For the

properties of the demand-dial interface, on the Options tab, under Connection

Type, Persistent Connection must be selected

Static route for the Contoso, LTD VPN server To make the Contoso, LTD

VPN server on the Internet reachable, the following static route is created:

• Interface: The WAN adapter attached to the Internet

• Destination: 207.209.68.1

• Network Mask: 255.255.255.255

• Gateway: 0.0.0.0

• Metric: 1

Note Because the WAN adapter creates a point-to-point connection to the

ISP, any address can be entered for the gateway The gateway address of

0.0.0.0 is an example (0.0.0.0 is known as the unspecified IP address.)

Extranet for Business Partners

Now that we have all the company’s users connected and working and the remote

offices are communicating, Contoso, LTD has to do business with the rest of the

world The network administrator for Contoso, LTD has created an extranet, a

por-tion of the Contoso, LTD private network that is available to business partners

through secured VPN connections The Contoso, LTD extranet is the network

attached to the Contoso, LTD VPN server and contains a file server and a Web

server, which contain all the information they need to directly access Access to

internal resources from these utilities can be accomplished via Web proxy and

ter-minal services, thus protecting the corporate resources from direct contact by

non-corporate clients IPSec policies can be used between the extranet resources and

the intranet resources to ensure resources are not compromised Parts distributors

Fabrikam, Inc., and Blue Yonder Airlines are Contoso, LTD business partners They

connect to the Contoso, LTD extranet by using on-demand, site-to-site VPN

con-nections An additional remote access policy is used to ensure that the business

partners can access only the extranet file server and Web server

The file server on the Contoso, LTD extranet is configured with an IP address of

172.31.0.10, and the Web server is configured with an IP address of 172.31.0.11

Fabrikam, Inc., uses the public network ID of 131.107.254.0 with a subnet mask of

255.255.255.0 (131.107.254.0/24) Blue Yonder Airlines uses the public network ID

of 131.107.250.0 with a subnet mask of 255.255.255.0 (131.107.250.0/24) To ensure

that the extranet Web server and file server can reach the business partners, static

routes are configured on the file server and Web server for each of the business

partner networks that use the gateway address of 172.31.0.1

To simplify configuration, the VPN connection is a one-way initiated connection The business partner’s router always initiates the connection

Figure 10-5 shows the Contoso, LTD VPN server that provides extranet connections for business partners

VPN server

172.31.0.1 207.209.68.1

T3 link

Contoso, LTD intranet

Parnell Aerospace business partner

172.31.0.2

172.31.0.10

File server Web server

connec-For the VPN connection to Fabrikam, Inc., the user account Fabrikam, Inc is ated with the following settings:

cre-• Password of Y8#-vR7?]fI

• For the account properties of the Fabrikam, Inc account, the User Must Change Password At Next Logon option is cleared and the Password Never Expires option is selected

• For the dial-in properties on the Fabrikam, Inc account, the remote access permission is set to Control Access Through Remote Access Policy and the static route 131.107.254.0 with a subnet mask 255.255.255.0 is added

• The Fabrikam, Inc account is added to the VPN_Partners group

For the VPN connection to Blue Yonder Airlines, the user account Blue Yonder

Air-lines is created with the following settings:

• Password of W@8c^4r-;2\

• For the account properties of the Blue Yonder Airlines account, the User

Must Change Password At Next Logon option is cleared and the Password

Never Expires option is selected

• For the dial-in properties on the Blue Yonder Airlines account, the remote

access permission is set to Control Access Through Remote Access Policy

and the static route 131.107.250.0 with a subnet mask 255.255.255.0 is

added

• The Blue Yonder Airlines account is added to the VPN_Partners group

Remote Access Policy Configuration

To define the authentication and encryption settings for business partner VPN

con-nections, the following remote access policy is created:

• Policy Name: VPN Partners

• Access Method: VPN

• User Or Group Access: Group, with the EXAMPLE\VPN_Partners group

selected

• Authentication Methods: Extensible Authentication Protocol (EAP), with the

Smart Card Or Other Certificate type, and Microsoft Encrypted

Authentica-tion version 2 (MS-CHAP v2) selected

• Policy Encryption Level: Strong Encryption and Strongest Encryption

• Filter 1: Source Network IP Address of 172.31.0.10 and Subnet Mask of 255.255.255.255

• Filter 2: Source Network IP Address of 172.31.0.11 and Subnet Mask of 255.255.255.255

• Filter Action: Permit Only The Packets Listed Below

The following sections describe a PPTP-based extranet for the business partner Fabrikam, Inc., and an L2TP/IPSec-based extranet for the business partner Blue Yonder Airlines

PPTP-Based Extranet for Business Partners

Fabrikam, Inc., is a business partner that uses a Windows Server 2003 router to ate an on-demand, PPTP-based, site-to-site VPN connection with the Contoso, LTD VPN server in New York as needed When the connection is created and is idle for five minutes, the connection is terminated The Fabrikam, Inc., router is connected

cre-to the Internet with a permanent WAN connection

To deploy a PPTP, one-way initiated, on-demand, site-to-site VPN connection to the corporate office based on the settings configured in the “Common Configuration for the VPN Server” and “Extranet for Business Partners” sections of this chapter, the following settings are configured on the Fabrikam, Inc., router

Demand-Dial Interface for Site-to-Site VPN Connection

To connect the Fabrikam, Inc., router to the Contoso, LTD VPN server by using a site-to-site VPN connection over the Internet, the network administrator created a demand-dial interface using the Demand-Dial Interface Wizard with the following settings:

• Interface Name: Contoso

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Point-to-Point Tunneling Protocol (PPTP)

• Destination Address: 207.209.68.1

• Protocols And Security: The Route IP Packets On This Interface check box is selected

• Static Routes For Remote Networks

To make all locations on the Contoso, LTD extranet reachable, the following static route is created:

• Destination: 172.31.0.0

• Confirm Password: Y8#-vR7?]fI

L2TP/IPSec-Based Extranet for Business Partners

Blue Yonder Airlines is a business partner that uses a Windows Server 2003 router

to create an on-demand, L2TP/IPSec-based, site-to-site VPN connection with the

Contoso, LTD VPN server in New York as needed When the connection is created

and is idle for five minutes, the connection is terminated The Blue Yonder Airlines

router is connected to the Internet by using a permanent WAN connection

To deploy an L2TP/IPSec, one-way initiated, on-demand, site-to-site VPN

connec-tion to the corporate office based on the settings configured in the “Common

Con-figuration for the VPN Server” and “Extranet for Business Partners” sections of this

chapter, the following settings are configured on the Blue Yonder Airlines router

Certificate Configuration

The Blue Yonder Airlines router was configured by the Contoso, LTD network

administrator while it was physically connected to the Contoso, LTD intranet It

was then shipped to the network administrator at Blue Yonder Airlines While the

Blue Yonder Airlines router was connected to the Contoso, LTD intranet, a

com-puter certificate was installed through auto-enrollment

Demand-Dial Interface for Site-to-Site VPN Connection

To connect the Blue Yonder Airlines router to the Contoso, LTD VPN server by

using a site-to-site VPN connection over the Internet, the network administrator

cre-ated a demand-dial interface using the Demand-Dial Interface Wizard with the

fol-lowing settings:

• Interface Name: Contoso

• Connection Type: Connect Using Virtual Private Networking (VPN)

• VPN Type: Layer 2 Tunneling Protocol (L2TP)

• Destination Address: 207.209.68.1

• Protocols And Security: The Route IP Packets On This Interface check box is selected

• Static Routes For Remote Networks

To make all locations on the Contoso, LTD extranet reachable, the following static route is created:

Dial-Up and VPNs with RADIUS Authentication

In our sample scenario, in addition to VPN-based remote access, the network istrator for Contoso, LTD wants to provide modem-based dial-up remote access for employees of the New York office All employees of the New York office belong to

admin-an Active Directory group named NY_Employees A separate remote access server running Windows Server 2003 provides dial-up remote access at the phone number 555-0111 Rather than administer the remote access policies of both the VPN server and the remote access server separately, the network administrator is using a com-puter running Windows Server 2003 with the Internet Authentication Service (IAS) as

a RADIUS server The IAS server has an IP address of 172.31.0.9 on the Contoso, LTD intranet and provides centralized remote access authentication, authorization, and accounting for both the remote access server and the VPN server

Figure 10-6 shows the Contoso, LTD RADIUS server that provides authentication and accounting for the VPN server and the remote access server

Internet

Remote access server 555-0111

Dial-up remote access client

172.31.0.9

RADIUS server Figure 10-6 The Contoso, LTD RADIUS server that provides authentication and accounting

for the VPN server and the remote access server

Domain Configuration

For each New York office employee who is allowed dial-up access, the remote

access permission for the dial-in properties of the user account is set to Control

Access Through Remote Access Policy

Remote Access Policy Configuration

Remote access policies must be modified in two ways:

1 The existing remote access policies that are configured on the VPN server

must be copied to the IAS server

2 A new remote access policy is added for dial-up remote access clients on the

IAS server

Copying the remote access policies Once the VPN server is configured to use

RADIUS authentication, the remote access policies stored on the VPN server are no

longer used Instead, the remote access policies stored on the IAS server are used

Therefore, the current set of remote access policies is copied to the IAS server

To copy the configuration of the VPN server to the IAS server, the following steps

need to be completed:

1 On the VPN server computer, type netsh aaaa show config > path\file.txt

at a command prompt This stores the configuration settings, including registry

settings, in a text file The path can be a relative, absolute, or network path

2 Copy the file created in step 1 to the IAS server