Module 6: Configuring

and Troubleshooting
Routing and Remote
Access
Module Overview
• Configuring Network Access

• Configuring VPN Access

• Overview of Network Policies

• Overview of the Connection Manager Administration Kit

• Troubleshooting Routing and Remote Access

Lesson 1: Configuring Network Access
• Components of a Network Access Services Infrastructure

• What Is the Network Policy and Access Services Role?

• What Is Routing and Remote Access?

• Considerations for Configuring and Enabling Routing and

Remote Access
• Demonstration: How to Install Routing and Remote Access
Services
• Network Authentication and Authorization

• Types of Authentication Methods

• Integrating DHCP Servers with the Routing and Remote

Access service
 Components of a Network Access Services
Infrastructure
VPN Server
Active IEEE 802.1X
Directory Devices

Health
Registration
Authority
Internet
NAP Health
DHCP Server
Perimeter Intranet Policy Server
Network

Restricted
Network
Remediation
NAP Client with
Servers
limited access
What Is the Network Policy and Access Services Role?

Component Description
Network Policy Server The Microsoft implementation of RADIUS
Server and proxy

Routing and Remote Provides VPN and dial-up solutions for

Access users, deploys full-featured software
routers, and shares Internet connections
across the intranet
Health Registration Issues health certificates to clients when
Authority using IPsec NAP enforcement
Host Credential Integrates with Cisco network access
Authorization Protocol control server
What Is Routing and Remote Access?

• Used to provide remote users access to resources on a

private network over Dial-up or VPN services

• Can be used to provide NAT services

• Can provide LAN and WAN routing services to connect

network segments
Demonstration: How to Install Routing and
Remote Access Services
In this demonstration, you will see how to install the Routing
and Remote Access server role in Windows Server 2008
Network Authentication and Authorization

Authentication:

• Verifies the credentials of a connection attempt

• Uses an authentication protocol to send the credentials from

the remote access client to the remote access server in
either plain text or encrypted form

Authorization:

• Verifies that the connection attempt is allowed

• Occurs after successful authentication

 Types of Authentication Methods
Protocol Description Security Level

PAP Uses plaintext passwords. Typically The least secure authentication protocol.
used if the remote access client and Does not protect against replay attacks,
remote access server cannot negotiate remote client impersonation, or remote
a more secure form of validation. server impersonation.

CHAP A challenge-response authentication An improvement over PAP in that the

protocol that uses the industry- password is not sent over the PPP link.
standard MD5 hashing scheme to
encrypt the response. Requires a plaintext version of the
password to validate the challenge
response. Does not protect against
remote server impersonation.
MS-CHAPv2 An upgrade of MS-CHAP. Two-way Provides stronger security than CHAP.
authentication, also known as mutual
authentication, is provided. The
remote access client receives
verification that the remote access
server that it is dialing in to has
access to the user’s password.
EAP Allows for arbitrary authentication of a Offers the strongest security by
remote access connection through the providing the most flexibility in
use of authentication schemes, known authentication variations.
as EAP types.
Integrating DHCP Servers with the Routing and
Remote Access Service

You can provide remote clients with IP configurations by

using either:
• A static pool created on the Routing and Remote
Access server for use with remote clients

• The corporate DHCP server located on the

corporate LAN

DHCP servers running Windows Server 2008:

• Provide a predefined user class called the

Default Routing and Remote Access Class

• Are useful for assigning options that are provided to

Routing and Remote Access clients only
Lesson 2: Configuring VPN Access
• What Is a VPN Connection?

• Components of a VPN Connection

• Tunneling Protocols for a VPN Connection

• Configuration Requirements

• Demonstration: Configuring VPN Access

• Completing Additional Tasks

• Components of a Dial-up Connection

What Is a VPN Connection?

Corporate Headquarters
Large Branch Office

Small Branch Office

VPN Server
VPN Server
VPN Server
Medium Branch Office

VPN
Home Office with
VPN Client

VPN Server
Remote User with VPN Client
 Components of a VPN Connection

VPN Tunnel Client Operating System

Routing and
Remote Access

VPN Server VPN Client

Virtual Network
Authentication

IP Configuration

Domain Controller

DHCP Server
Tunneling Protocols for a VPN Connection
Encrypted

PPTP:

IP GRE PPP PPP payload

header header trailer (IPv4 packet)

PPP frame
L2TP:
PPP payload
IP UDP L2TP PPP
(IP diagram, IPX datagram,
header header header header
NetBEUI frame)

PPP frame

L2TP frame

UDP message
SSTP
:
• Encapsulates PPP frames in IP datagrams, and uses port 443 (TCP)
for tunnel management and PPP data frames
• Encryption is performed by the SSL channel of the HTTPS protocol
Configuration Requirements

VPN server configuration requirements include:

• Two network interfaces (public and private)

• IP Address allocation (static pool or DHCP)

• Authentication provider (NPS/Radius or the

VPN server)

• DHCP relay agent considerations

• Membership in the Local Administrators group

or equivalent
Demonstration: Configuring VPN Access
In this demonstration, you will see how to:
• Configure user dial-in settings

• Configure Routing and Remote Access as a VPN server

• Configure a VPN client

Completing Additional Tasks

 Configure static packet filters

 Configure services and ports

 Adjust logging levels for routing protocols

 Configure number of available VPN ports

 Create a Connection Manager profile for users

 Add Certificate Services

 Increase remote access security

 Increase VPN security

Components of a Dial-Up Connection

Remote Access LAN and Remote Access

Server Protocols

WAN Options:
Telephone, ISDN,
X.25, or ATM Dial-Up Client
Domain
Controller
Authentication

DHCP
Server Address and Name Server Allocation
Lesson 3: Overview of Network Policies
• What Is a Network Policy?

• Process for Creating and Configuring a Network Policy

• How Are Network Policies Processed?

What Is a Network Policy?

A network policy consists of the following

elements:

• Conditions
• Constraints
• Settings
Process for Creating and Configuring a
Network Policy

 Determine authorization by user or group

Determine appropriate settings for the user account’s

 network access permissions

Configure the New Network Policy Wizard:


• Configure Network Policy conditions
• Configure Network Policy constraints
• Configure Network Policy settings
How Are Network Policies Processed?

STAR
T
Yes No
Go to next
Are there Does connection policy
No policies to Yes attempt match
process? policy conditions?
Yes Is the remote access
permission for the user
account set to Deny Access?
No
Reject
No Yes connecti
on
Reject Is the remote attempt
access Is the remote access
connection Yes No permission on the
permission for
attempt the user policy set to Deny
account set to remote access
Yes
permission? Accept
Allow Access? connectio
n
No Does the connectionattempt
attempt match the
user object and
profile settings?
Lesson 4: Overview of the Connection Manager
Administration Kit
• What Is the Connection Manager Administration Kit?

• Demonstration: Installing CMAK

• Process for Configuring a Connection Profile

• Demonstration: Creating a Connection Profile

• Distributing the Connection Profile to Users

What Is the Connection Manager Administration Kit?

The Connection Manager Administration Kit:

• Allows you to customize users’ remote connection

experience by creating predefined connections on
remote servers and networks
• Creates an executable file that can be run on a client
computer to establish a network connection that you
have designed
• Reduces Help Desk requests related to the configuration
of RAS connections
• Assists in problem resolution because the configuration
is known
• Reduces the likelihood of user errors when they
configure their own connection objects
Demonstration: Installing CMAK

In this demonstration, you will see how to use the Server

Manager tool to install the Connection Manager
Administration Kit
Process for Configuring a Connection Profile

The CMAK Connection Profile Wizard assists in the process of

creating custom connection profiles for users

Use the CMAK Connection Profile Wizard to configure:

• The target operating system

• Support for VPN
• Support for Dial-up, including the custom phone book
• Proxy
• Custom Help file
• Custom support information
Demonstration: Creating a Connection Profile

In this demonstration, you will see how to use the

Connection Manager Administration Kit to create a
connection profile
Distributing the Connection Profile to Users

The connection profile can be distributed to users in the following

ways:

• As part of an image for new computers

• On removable media for the user to install manually
• With software distribution tools, such as
Systems Management Server or
System Center Configuration Manager 2007
Lesson 5: Troubleshooting Routing and Remote Access
• TCP/IP Troubleshooting Tools

• Authentication and Accounting Logging

• Configuring Remote Access Logging

• Configuring Remote Access Tracing

• Common Troubleshooting Solutions

TCP/IP Troubleshooting Tools

Command Description
Ipconfig Displays current TCP/IP network configuration
values, updates, or releases; DHCP allocated
leases; and used to display, register, or flush DNS
names
Ping Sends ICMP Echo Request messages to verify that
TCP/IP is configured correctly and that a TCP/IP
host is available
Pathping Displays a path of a TCP/IP host and packet losses
at each router along the way
Tracert Displays the path of a TCP/IP host
Authentication and Accounting Logging

There are three types of logging for Network Policy Server:

• Event logging for auditing and troubleshooting

connection attempts
• Logging authentication and accounting requests to a
local file
• Logging authentication and accounting requests to a
SQL server database
Configuring Remote Access Logging

You can configure remote access logging to:

• Log errors only

• Log errors and warnings
• Log all events
• Not log any events
• Log additional routing and remote access information
Configuring Remote Access Tracing

You can configure remote access tracing by using:

• The Netsh command:

• Netsh ras diagnostics set rastracing * enabled
(enables tracing on all components in RAS)
• The Registry:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing

Tracing consumes resources, so you should use it for troubleshooting

only, and then disable it
Common Troubleshooting Solutions

Common problems regarding remote access include:

• Error 800: VPN unreachable

• Error 721: Remote computer not responding
• Error 741/742: Encryption mismatch
• Unable to establish VPN connection
• L2TP/IPsec issues
• EAP-TLS issues
Lab: Configuring and Managing Network Access
• Exercise 1: Configuring Routing and Remote Access as a
VPN Remote Access Solution
• Exercise 2: Configuring a Custom Network Policy

• Exercise 3: Configuring Logging

• Exercise 4: Configuring a Connection Profile

Logon information
Virtual machine 6421A-NYC-DC1,
6421A-NYC-SVR1 and
6421A-NYC-CL1
User name Administrator
Password Pa$$w0rd

Estimated time: 60 minutes

Lab Review
• What feature in Windows Server 2008 can help to keep
support calls for connection object creation to a minimum?
• When using DHCP to allocate addresses to remote clients,
how many IP addresses does the Routing and Remote
Access Service server acquire from the Corporate DHCP
server at a time?
• You must create a remote access solution for a company
that requires that multiple VPN servers exist in different
offices throughout the country. What service in Windows
Server 2008 can help to simplify administration in
configuring multiple servers running the Routing and
Remote Access Service?
Module Review and Takeaways
• Review Questions

• Best Practices

• Tools
Notes Page Over-flow Slide. Do Not Print Slide.
See Notes pane.