20411B-ENU-TrainerHandbook

Administering Windows Server® 2012	MCT
	7-9
In dial-up environments, DHCP clients negotiate and receive dynamic configuration using the following
modified behavior:

•A leased IP address from the Routing and Remote Access server cache of DHCP scope addresses. The Routing and Remote Access server obtains and renews its cached address pool with the DHCP server.USE

•If the DHCP server typically provides the additional parameters and other configuration information that currently is provided through assigned DHCP options in the address lease, this information is returned to the Remote Access client based on TCP/IP properties that are configured on the Remote Access server.

Note: DHCP servers that are running Windows Server 2012 provide a predefined user class—the Default Routing and Remote Access Class—for assigning options that are provided only to Routing and Remote Access clients. To assign these options, you must create a DHCP policy with a condition of the User Class Equals Default Routing and Remote Access Class. Then, configure the required options.

PROHIBITED USE STUDENT .ONLY

7-10 Configuring and Troubleshooting Remote Access

	Lesson 2	MCT
	Configuring VPN Access

	Lesson Objectives			USE
	After completing this lesson, you will be able to:			.ONLY
	• Describe what a VPN connection is, and how it is used to connect remote network clients.
	• Describe the tunneling protocols used for a VPN connection.
	•	Describe VPN Reconnect.
	• Describe configuration requirements for a VPN connection.
	•	Explain how to configure VPN access.
	• Describe additional tasks that you can be completed after configuring a VPN server.
	• Describe the features in and benefits of the Connection Manager Administration Kit.
	• Explain how to create a connection profile using the Connection Manager Administration Kit.			STUDENT
	What Is a VPN Connection?
	To emulate a point-to-point link, data is
	encapsulated (or wrapped) and prefixed with a
	header; this header provides routing information
	that enables the data to traverse the shared or
	public network to reach its endpoint.			USE
	To emulate a private link, data is encrypted
	to ensure confidentiality. Packets that are
	intercepted on the shared or public network are
	indecipherable without encryption keys. The link
	in which the private data is encapsulated and
	encrypted is known as a VPN connection.
	There are two types of VPN connections:			PROHIBITED
	•	Remote access

To properly implement and support a VPN environment within your organization, it is important that you understand how to select a suitable tunneling protocol, how to configure VPN authentication, and how to configure the Network Policy and Access Services server role to support your chosen configuration.

• Site-to-site

Remote Access VPN

Remote access VPN connections enable your users who are working offsite (for example, at home, at a customer site, or from a public wireless access point) to access a server on your organization’s private network using the infrastructure that a public network provides, such as the Internet. From the user’s perspective, the VPN is a point-to-point connection between the computer, the VPN client, and your organization’s server. The exact infrastructure of the shared or public network is irrelevant because it appears logically as if the data is sent over a dedicated private link.

Data encryption. To ensure the confidentiality of data as it traverses the shared or public transit network, the sender encrypts the data, and the receiver decrypts it. The encryption and decryption processes depend on the sender and the receiver both using a common encryption key.

Properties of VPN Connections

Administering Windows Server® 2012 7-11

Site-to-Site VPN

	Site-to-site VPN connections, which are also known as router-to-router VPN connections, enable your	MCT
	organization to have routed connections between separate offices (or with other organizations) over a
	public network while helping to maintain secure communications. A routed VPN connection across the
	Internet logically operates as a dedicated WAN link. When networks connect over the Internet, a router
	forwards packets to another router across a VPN connection. To the routers, the VPN connection operates
	as a data-link layer link.	USE

A site-to-site VPN connection connects two portions of a private network. The VPN server provides a routed connection to the network to which the VPN server is attached. The calling router (the VPN client)

authenticates itself to the answering router (the VPN server), and for mutual authentication, the answeringONLY router authenticates itself to the calling router. In a site-to site VPN connection, the packets sent from

either router across the VPN connection typically do not originate at the routers.

VPN connections that use the Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol with Internet Protocol Security (L2TP/IPsec), and Secure Socket Tunneling Protocol (SSTP), have the following. properties:

• Encapsulation. With VPN technology, private data is encapsulated with a header containing routing information that allows the data to traverse the transit network.

• Authentication. Authentication for VPN connections takes the following three different forms:

o User-level authentication by using Point-to-Point Protocol (PPP) authentication. To establish the VPN connection, the VPN server authenticates the VPN client that is attempting the connection by using a PPP user-level authentication method, and verifies that the VPN client has the appropriate authorization. If you use mutual authentication, the VPN client also authenticates the VPN server, which provides protection against computers that are masquerading as VPN servers.

o Computer-level authentication by using Internet Key Exchange (IKE). To establish an IPsec
security association, the VPN client and the VPN server use the IKE protocol to exchange either
	STUDENT
computer certificates or a pre-shared key. In either case, the VPN client and server authenticate

each other at the computer level. We recommend computer-certificate authentication becauseUSEit is a much stronger authentication method. Computer-level authentication is only performed for L2TP/IPsec connections.

o Data origin authentication and data integrity. To verify that the data sent on the VPN connection originated at the other end of the connection and was not modified in transit, the data contains a

•

cryptographic checksum based on an encryption key known only to the sender and the receiver. PROHIBITED

Data origin authentication and data integrity are only available for L2TP/IPsec connections.

Packets that are intercepted in the transit network are unintelligible to anyone who does not have the common encryption key. The encryption key’s length is an important security parameter. You can use computational techniques to determine the encryption key. However, such techniques require more computing power and computational time as the encryption keys get larger. Therefore, it is important to use the largest possible key size to ensure data confidentiality.

7-12

Configuring and Troubleshooting Remote Access

	Tunneling Protocols for VPN Connections		MCT
	PPTP, L2TP, and SSTP depend heavily on the
			USE
	features originally specified for PPP. PPP was
	designed to send data across dial-up or
	dedicated point-to-point connections. For IP,
	PPP encapsulates IP packets within PPP frames,
	and then transmits the encapsulated PPP packets
	across a point-to-point link. PPP was defined
	originally as the protocol to use between a dial-up
	client and a network access server.
	PPTP
	PPTP enables you to encrypt and encapsulate in
	an IP header multi-protocol traffic that then is
	sent across an IP network or a public IP network, such as the Internet. You can use PPTP for remote access
			.ONLY
	and site-to-site VPN connections. When using the Internet as the VPN public network, the PPTP server is a
	PPTP—enabled VPN server with one interface on the Internet, and a second interface on the intranet.		STUDENT
	• Encapsulation. PPTP encapsulates PPP frames in IP datagrams for network transmission. PPTP uses a
	Transmission Control Protocol (TCP) connection for tunnel management, and a modified version of
	Generic Route Encapsulation (GRE) to encapsulate PPP frames for tunneled data. Payloads of the
	encapsulated PPP frames can be encrypted, compressed, or both.
	• Encryption. The PPP frame is encrypted with Microsoft Point-to-Point Encryption (MPPE) by using
	encryption keys that are generated from the MS-CHAPv2 or EAP-TLS authentication process. VPN
	clients must use the MS-CHAPv2 or EAP-TLS authentication protocol so that the payloads of PPP
	frames are encrypted. PPTP uses the underlying PPP encryption and encapsulating a previously
	encrypted PPP frame.
	L2TP
	L2TP enables you to encrypt multi-protocol traffic to send over any medium that supports point-to-point		USE
	datagram delivery, such as IP or asynchronous transfer mode (ATM). L2TP is a combination of PPTP and
	Layer 2 Forwarding (L2F). L2TP represents the best features of PPTP and L2F.
	Unlike PPTP, the Microsoft implementation of L2TP does not use MPPE to encrypt PPP datagrams. L2TP
	relies on IPsec in Transport Mode for encryption services. The combination of L2TP and IPsec is known as
	L2TP/IPsec.
	To utilize L2TP/IPsec, both the VPN client and server must support L2TP and IPsec. Client support for L2TP
	is built in to the Windows XP, Windows Vista®, Windows 7, and Windows 8 remote access clients. VPN
	server support for L2TP is built in to members of the Windows Server 2012, Windows Server 2008, and
	Windows Server 2003 families.

• Encapsulation: Encapsulation for L2TP/IPsec packets consists of two layers, L2TP encapsulation, and PROHIBITED IPsec encapsulation. L2TP encapsulates and encrypts data in the following way:

o First layer. The first layer is the L2TP encapsulation. A PPP frame (an IP datagram) is wrapped with an L2TP header and a User Datagram Protocol (UDP) header.

o Second layer. The second layer is the IPsec encapsulation. The resulting L2TP message is wrapped with an IPsec encapsulating security payload (ESP) header and trailer, an IPsec Authentication trailer that provides message integrity and authentication, and a final IP header. The IP header contains the source and destination IP address that corresponds to the VPN client and server.

• Encryption: The L2TP message is encrypted with either Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES) by using encryption keys that the IKE negotiation process generates.

	Administering Windows Server® 2012 7-13
SSTP	MCT

SSTP is a tunneling protocol that uses the HTTP/Secure (HTTPS) protocol over TCP port 443 to pass traffic through firewalls and web proxies, which otherwise might block PPTP and L2TP/IPsec traffic. SSTP

provides a mechanism to encapsulate PPP traffic over the Secure Sockets Layer (SSL) channel of the HTTPS protocol. The use of PPP allows support for strong authentication methods, such as EAP-TLS. SSL provides

transport-level security with enhanced key negotiation, encryption, and integrity checking.	USE
When a client tries to establish a SSTP-based VPN connection, SSTP first establishes a bidirectional HTTPS
layer with the SSTP server. Over this HTTPS layer, the protocol packets flow as the data payload using the
following encapsulation and encryption methods:
• Encapsulation. SSTP encapsulates PPP frames in IP datagrams for transmission over the network. SSTP
uses a TCP connection (over port 443) for tunnel management and as PPP data frames.
• Encryption. The SSTP message is encrypted with the SSL channel of the HTTPS protocol.

IKEv2 ONLY

IKEv2 uses the IPsec Tunnel Mode protocol over UDP port 500. IKEv2 supports mobility making it a good. protocol choice for a mobile workforce. IKEv2-based VPNs enable users to move easily between wireless hotspots, or between wireless and wired connections.

The use of IKEv2 and IPsec enables support for strong authentication and encryption methods.		STUDENT
• Encapsulation. IKEv2 encapsulates datagrams by using IPsec ESP or Authentication Header (AH) for
transmission over the network.
• Encryption. The message is encrypted with one of the following protocols by using encryption keys
that are generated from the IKEv2 negotiation process: AES 256, AES 192, AES 128, and 3DES
encryption algorithms.
IKEv2 is supported only on computers that are running Windows 7, Windows 8, Windows Server 2008 R2,
and Windows Server 2012. IKEv2 is the default VPN tunneling protocol in Windows 7 and Windows 8.
What Is VPN Reconnect?			USE
In dynamic business scenarios, users must be able
to securely access data anytime, from anywhere,
and access it continuously, without interruption.
For example, users might want to securely access
data that is on the company’s server, from a
branch office or while on the road.
To meet this requirement, you can configure
the VPN Reconnect feature that is available in
Windows Server 2012, Windows Server 2008 R2,
Windows 8, and Windows 7. With this feature,
users can access the company’s data by using
a VPN connection, which will reconnect
automatically if connectivity is interrupted. VPN Reconnect also enables roaming between different
networks.

a laptop that is running Windows 8. When the user travels to work in a train, he or she connects to the Internet with a wireless mobile broadband card, and then establishes a VPN connection to the company’s network. When the train passes through a tunnel, the Internet connection is lost. After the train emerges

VPN Reconnect uses the IKEv2 technology to provide seamless and consistent VPN connectivity. Users PROHIBITED who connect via a wireless mobile broadband will benefit most from this capability. Consider a user with

7-14 Configuring and Troubleshooting Remote Access	MCT

from the tunnel, the wireless mobile broadband card reconnects automatically to the Internet. With older versions of Windows client and server operating systems, VPN did not reconnect automatically. Therefore,

	the user would have to repeat the multistep process of connecting to the VPN manually. This was time-	USE
	consuming and frustrating for mobile users with intermittent connectivity.
	With VPN Reconnect, Windows Server 2012 and Windows 8 re-establish active VPN connections

automatically when Internet connectivity is re-established. Even though the reconnection might take several seconds, users need not reinstate the connection manually, or authenticate again to access internal network resources.

The system requirements for using the VPN Reconnect feature are as follows:

•	.ONLY
	Windows Server 2008 R2 or Windows Server 2012 as a VPN server.
• Windows 7, Windows 8, Windows Server 2008 R2, or Windows Server 2012 client.
•	Public Key Infrastructure PKI, because a computer certificate is required for a remote connection with
	VPN Reconnect. You can use certificates issued by either an internal or public CA.

•Your VPN server requires two network STUDENT interfaces. You must determine which

network interface will connect to the Internet, and which network interface will connect to your private network. During configuration, you will be asked to choose which network interface connects to the Internet. If you

specify the incorrect interface, your remote

access VPN server will not operate correctly. USE

•Determine whether remote clients receive IP addresses from a DHCP server on your private network or from the remote access VPN server that you are configuring. If you have a DHCP server on your private network, the remote access VPN server can lease 10 addresses at a time from the DHCP

server, and then assign those addresses to remote clients. If you do not have a DHCP server on your

private network, the remote access VPN server can automatically generate and assign IP addresses to PROHIBITED remote clients. If you want the remote access VPN server to assign IP addresses from a range that you

specify, you must determine what that range should be.

•Determine whether you want connection requests from VPN clients to be authenticated by a RADIUS server or by the remote access VPN server that you are configuring. Adding a RADIUS server is useful if you plan to install multiple remote access VPN servers, wireless access points, or other RADIUS clients to your private network.

		Administering Windows Server® 2012	MCT
			7-15
	•	Determine whether VPN clients can send DHCPINFORM messages to the DHCP server on your private
		network. If a DHCP server is on the same subnet as your remote access VPN server, DHCPINFORM
		messages from VPN clients will be able to reach the DHCP server after the VPN connection is
		established. If a DHCP server is on a different subnet from your remote access VPN server, make sure
		that the router between subnets can relay DHCP messages between clients and the server. If your	USE
		router is running Windows Server 2008 R2 or Windows Server 2012, you can configure the DHCP
		Relay Agent service on the router to forward DHCPINFORM messages between subnets.
	•	Ensure that the person who is responsible for the deployment of your VPN solution has the necessary
		administrative group memberships to install the server roles and configure the necessary services;	.ONLY
		membership of the local Administrators group is required to perform these tasks.
	Demonstration: How to Configure VPN Access
	This demonstration shows how to:
	•	Configure Remote Access as a VPN server.	STUDENT
	•	Configure a VPN client.
	Demonstration Steps
	Configure Remote Access as a VPN server
	1.	Sign in to LON-RTR as Adatum\Administrator with the password Pa$$w0rd.
	2.	On LON-RTR, open Server Manager, and add the Network Policy and Access Services role.
	3.	Close Server Manager.
	4.	Open the Network Policy Server console.
	5.	Register the server in AD DS.
	6.	Leave the Network Policy Server window open.	USE
	7.	Open Routing and Remote Access.
	8.	Disable the existing configuration.
	9.	Reconfigure LON-RTR as a VPN Server using the following settings:
		o Local Area Connection 2 is the public interface.
		o The VPN server allocates addresses from the pool: 172.16.0.100 - 172.16.0.111.
		o The server is configured with the option No, use Routing and Remote Access to authenticate
		connection requests.
	10. Start the VPN service.
	Configure a VPN Client		PROHIBITED
	1.	Switch to LON-CL2, and sign in as Adatum\Administrator with the password of Pa$$w0rd.
	2.	Create a new VPN connection with the following properties:

o Internet address to connect to: 10.10.0.1 o Destination name: Adatum VPN

o Allow other people to use this connection: true

7-16 Configuring and Troubleshooting Remote Access

3.Once you have created the VPN, modify its settings by viewing the properties of the connection, and then select the Security tab to reconfigure the VPN using the following settings:

o Type of VPN: Point to Point Protocol (PPTP)

o Authentication: Allow these protocols =Microsoft CHAP Version 2 (MS-CHAP v2)

4.Test the VPN connection using the following credentials: o User name: Adatum\administrator

o Password: Pa$$w0rd

5.Wait for the VPN connection to be made. Your connection is unsuccessful. You receive an error relating to authentication issues.

Completing Additional Configuration Tasks

After you complete the steps to deploy and initially configure your Remote Access solution, your server is ready for use as a remote access VPN server. However, the following are the additional tasks that you can also perform on your remote access/VPN server:

•Configure static packet filters. Add static packet filters to better protect your network.

•Configure services and ports. Choose which services on the private network you want to make available for remote access users.

•Adjust logging levels. Configure the level of event details that you want to log. You can decide which information you want to track in log files.

•Configure the number of VPN ports. Add or remove VPN ports.

•Create a Connection Manager profile for users. Manage the client connection experience for users, and simplify configuration and troubleshooting of client connections.

•Add (AD CS. Configure and manage a CA on a server for use in a PKI.

•Increase remote access security. Protect remote users and the private network by enforcing use of secure authentication methods, requiring higher levels of data encryption, and more.

•Increase VPN security. Protect remote users and the private network by requiring use of secure tunneling protocols, configuring account lockout, and more.

•Consider implementing VPN Reconnect. Consider adding VPN Reconnect to re-establish VPN connections automatically for users who temporarily lose their Internet connections.

PROHIBITED USE STUDENT .ONLY USE MCT

Administering Windows Server® 2012

What Is the Connection Manager Administration Kit?

The Connection Manager Administration Kit (CMAK) allows you to customize users’ remote connection options by creating predefined connections to remote servers and networks. The CMAK wizard creates an executable file, which you can then distribute in many ways, or include during deployment activities as part of the operating system image.

Connection Manager is a client network connection tool that allows a user to connect to a remote network, such as an Internet Service Provider (ISP) or a corporate network protected by a VPN server.

CMAK is a tool that you can use to customize the remote connection experience for users on your

7-MCT17

ONLY USE .

•Include the connection profile as part of the image that is included with new computers. STUDENT You can install your connection profile as part of the client computer images that are installed on

your organization’s new computers.

•Deliver the connection profile on removable media for the user to install manually. USE

You can deliver the connection profile installation program on a CD/DVD, USB flash drive, or any other removable media that you permit your users to access. Some removable media support autorun capabilities, which allow you to start the installation automatically, when the user inserts the media into the client computer.

•Deliver the connection profile with automated software distribution tools. PROHIBITED Many organizations use a desktop management and software deployment tool such as

Microsoft System Center Configuration Manager (previously called Systems Management Server). Configuration Manager provides the ability to package and deploy software that is intended for your

client computers. The installation can be invisible to your users, and you can configure it to report back to the management console whether the installation was successful or not.connectionCMAKnetwork by creating predefined connections to remote servers and networks. You use the CMAK wizardcreate to

7-18 Configuring and Troubleshooting Remote Access

Demonstration: How to Create a Connection Profile

This demonstration shows how to:

•Install CMAK.

•Create a connection profile.

•Examine the profile.

Demonstration Steps

Install CMAK

1.If necessary, on LON-CL2, sign in as Adatum\administrator with the password Pa$$w0rd.

2.Open Control Panel, and turn on a new windows feature called RAS Connection Manager Administration Kit (CMAK) feature.

Create a connection profile

1.In Administrative Tools, open the Connection Manager Administration Kit.

2.Complete the Connection Manager Administration Kit Wizard to create the connection profile.

Examine the created profile

•Use Windows Explorer to examine the contents of the folder that you created with the Connection Manager Administration Kit Wizard to create the connection profile. Normally, you would now distribute this profile to your users.

PROHIBITED USE STUDENT .ONLY USE MCT