CONFIGURING ROUTING AND REMOTE ACCESS SERVICES IN WINDOWS SERVER 2008

Posted by Team Secugenius - Microsoft Blogs, askds, askpfe, asktech Troubleshooting and solution Articles at 1:19 PM
Routing and Remote Access Service
Updated: September 30, 2009
Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista
The Routing and Remote Access service (RRAS) in Windows Server® 2008 R2 and Windows Server® 2008 supports remote user or site-to-site connectivity by using virtual private network (VPN) or dial-up connections. RRAS consists of the following components:
  • Remote Access. By using RRAS, you can deploy VPN connections to provide end users with remote access to your organization's network. You can also create a site-to-site VPN connection between two servers at different locations.
  • Routing. RRAS is a software router and an open platform for routing and networking. It offers routing services to businesses in local area network (LAN) and wide area network (WAN) environments or over the Internet by using secure VPN connections. Routing is used for multiprotocol LAN-to-LAN, LAN-to-WAN, VPN, and network address translation (NAT) routing services.
Getting Started
  • Windows Server 2008 R2 and Windows Server 2008 each include new features designed to enhance security and manageability of RRAS. This topic describes the new features and other significant changes made to RRAS, including the addition of new VPN tunneling protocols, VPN enforcement for Network Access Protection, and Internet Protocol version 6 (IPv6) support. For more information, see What's New in Routing and Remote Access in Windows Server 2008.
Deployment
The RRAS Deployment documentation provides information about implementing a VPN remote access server. Topics include planning and configuring secure remote access; configuring routing on the VPN server and VPN clients; and connecting remote sites.
The following describe how to deploy RRAS:
The following topics are still relevant to Windows Server 2008 and Windows Server 2008 R2, although they were written for Windows Server 2003. The topics have not yet been updated to include new features that have been added in those newer versions of Windows.
Operations
The following describe how to configure RRAS:
The following topics are still relevant to Windows Server 2008 and Windows Server 2008 R2, although they were written for Windows Server 2003. The topics have not yet been updated to include new features that have been added in those newer versions of Windows.
Technical Reference
The following provide foundational information for RRAS:
The following topics are still relevant to Windows Server 2008 and Windows Server 2008 R2, although they were written for Windows Server 2003. The topics have not yet been updated to include new features that have been added in those newer versions of Windows.
Troubleshooting
This reference contains troubleshooting information for events logged by RRAS. You can use this information to diagnose and resolve specific error conditions and to verify that those error conditions are no longer present.
This content is available at:
·         Routing and Remote Access Events and Errors for Windows Server 2008 R2
·         Routing and Remote Access Events and Errors for Windows Server 2008
Routing and Remote Access Product Help
After you install RRAS, product Help is available when you open the RRAS Microsoft Management Console (MMC) snap-in and press F1. The product Help provides information about how to install and configure Routing and Remote Access as a Virtual Private Network (VPN) server and as a router.

What's New in Routing and Remote Access in Windows Server 2008
Windows Server 2008 includes several new features designed to enhance security and manageability of Routing and Remote Access. This section describes the new features and other significant changes made to Routing and Remote Access in Windows Server 2008.
Server Manager
SSTP tunneling protocol
VPN enforcement for Network Access Protection
IPv6 support
New cryptographic support
Removed technologies

Server Manager

Server Manager is a new feature designed to guide information technology (IT) administrators through the process of installing, configuring, and managing server roles and features that are part of Windows Server 2008. Server Manager is started automatically after the administrator completes the tasks listed in Initial Configuration Tasks. After that, it is started automatically when an administrator logs on to the server.
Use the following steps to install Routing and Remote Access using Server Manager:
To install Routing and Remote Access
  1. Install Windows Server 2008.
  2. Click Start, Administrative Tools, Server Manager.
  3. Under Roles Summary, click Add roles.
  4. Click Next. Select the Network Access Services role, and then click Next.
  5. Click Next. Select the Routing and Remote Access Services role service, and then click Next.
  6. Click Install. When the Installation Results dialog box appears, click Close.
Use the following steps to configure and enable the Routing and Remote Access service:
To configure and enable the Routing and Remote Access service
  1. Click Start, Administrative Tools, Routing and Remote Access.
  2. By default, the local computer is listed as a server. Right-click the server, and then click Configure and Enable Routing and Remote Access.
  3. Click Next. Click Custom configuration, and then click Next.
  4. Select all the services except NAT, click Next, and then click Finish.
  5. Click OK, click Start service, and then click Finish.

SSTP tunneling protocol

Secure Socket Tunneling Protocol (SSTP) is a new form of virtual private networking (VPN) tunnel with features that allow traffic to pass through firewalls that block PPTP and L2TP/IPsec traffic. SSTP provides a mechanism to encapsulate PPP traffic over the SSL channel of the HTTPS protocol. The use of PPP allows support for strong authentication methods, such as EAP-TLS. The use of HTTPS means traffic will flow through TCP port 443, a port commonly used for Web access. Secure Sockets Layer (SSL) provides transport-level security with enhanced key negotiation, encryption, and integrity checking.
For information about deploying SSTP, see:

VPN enforcement for Network Access Protection

VPN enforcement provides strong limited network access for all computers accessing the network through a VPN connection. VPN enforcement with Network Access Protection (NAP) is similar in function to Network Access Quarantine Control, a feature in Windows Server 2003, but it is easier to deploy.
NAP is a client health policy creation, enforcement, and remediation technology that is included in Windows Vista® client operating system and in the Windows Server 2008 operating system. With NAP, system administrators can establish and automatically enforce health policies, which can include software requirements, security update requirements, required computer configurations, and other settings.
When making VPN connections, client computers that are not in compliance with health policy can be provided with restricted network access until their configuration is updated and brought into compliance with policy. Depending on how you choose to deploy NAP, noncompliant clients can be automatically updated so that users can quickly regain full network access without manually updating or reconfiguring their computers.

Remote access policy configuration

You must use Network Policy Server to create and configure remote access policies. Use the following steps to set the remote access policy to grant user access:
To configure the remote access policy
  1. Open Routing and Remote Access.
  2. Right-click Remote Access Logging & Policies, and then click Launch NPS.
  3. Click Network Policies.
  4. Double-click Connections to Microsoft Routing and Remote Access server.
  5. On the Overview tab, under Access Permission, click Grant access, and then click OK.

IPv6 support

Windows Server 2008 and Windows Vista support the following enhancements to Internet Protocol version 6 (IPv6):
  • Protocols
·         PPPv6. Native IPv6 traffic can now be sent over PPP-based connections. (RFC 2472). For example, PPPv6 support allows you to connect with an IPv6-based Internet service provider (ISP) through dial-up or PPP over Ethernet (PPPoE)-based connections that might be used for broadband Internet access.
·         PPPv6 over dial-up/Ethernet as well as VPN tunnels
·         L2TP over IPv6
·         DHCPv6 Relay Agent
  • Stateless filtering, based on the following parameters:
·         Source IPv6 address/prefix
·         Destination IPv6 address/prefix
·         Next hop type (IP protocol type)
·         Source Port number (TCP/UDP)
·         Destination Port number (TCP/UDP)
  • RADIUS over IPv6 transport

IPv6 configuration

By default, Routing and Remote Access is configured to accept only Internet Protocol version 4 (IPv4) connections. In Windows Server 2008, you can use the Routing and Remote Access Microsoft Management Console (MMC) to configure IPv6 routing and connections. Use the following steps to configure Routing and Remote Access to accept IPv6 and IPv4 connections.
To enable IPv6 connections
  1. In the Routing and Remote Access MMC, right-click the server, and then click Properties.
  2. Click the IPv6 tab.
  3. Enter an IPv6 prefix (for example: 3ffe::).
  4. Click the General tab.
  5. Click IPv6 Router, and then click IPv6 Remote access server.
  6. Click OK, and then click Yes to restart the Routing and Remote Access service.

New cryptographic support

In response to governmental security requirements and trends in the security industry to support stronger cryptography, Windows Server 2008 and Windows Vista support the following encryption algorithms for PPTP and L2TP VPN connections.

Removed technologies

Support for the following technologies has been removed from Windows Server 2008 and Windows Vista:
  • Bandwidth Allocation Protocol (BAP). Removed from Windows Vista. Disabled in Windows Server 2008.
  • X.25.
  • Serial Line Interface Protocol (SLIP). SLIP-based connections will automatically be updated to PPP-based connections.
  • Asynchronous Transfer Mode (ATM).
  • IP over IEEE 1394.
  • NWLink IPX/SPX/NetBIOS Compatible Transport Protocol.
  • Services for Macintosh.
  • Open Shortest Path First (OSPF) routing protocol component in Routing and Remote Access.
  • Basic Firewall in Routing and Remote Access (replaced with Windows Firewall).
  • Static IP filter application programming interfaces (APIs) for Routing and Remote Access (replaced with Windows Filtering Platform APIs).
  • The SPAP, EAP-MD5-CHAP, and MS-CHAP authentication protocols for PPP-based connections.


0 comments:

Subscribe to: Post Comments (Atom)