Appendix D: Setting Up Remote Access VPN Connections in a Test Lab | Deploying Virtual Private Networks with Microsoft Windows Server 2003 (Technical Reference)

This appendix provides detailed information about how you can use five computers to create a test lab with which to configure and test virtual private network (VPN) remote access with Microsoft Windows XP and the Windows Server 2003 family. These instructions are designed to take you step by step through the configuration required for Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol with Internet Protocol Security (L2TP/IPSec) connections, and finally they will take you through setting up a VPN connection that uses certificate- based Extensible Authentication Protocol-Transport Level Security (EAP-TLS) authentication.

Note

The following instructions are for configuring a test lab using a minimum number of computers. Individual computers are needed to separate the services provided on the network and to clearly show the desired functionality. This configuration is not designed to reflect best practices, nor is it designed to reflect an optimal or recommended configuration for a production network. The configuration, including IP addresses and all other configuration parameters, is designed to work only on a separate test lab network.

PPTP-Based Remote Access VPN Connections

The infrastructure for the VPN test lab network consists of five computers performing the following services:

A computer running Windows Server 2003, Enterprise Edition, named DC1 that is acting as a domain controller; a Domain Name System (DNS) server; a Dynamic Host Configuration Protocol (DHCP) server; and a certification authority (CA).
A computer running Windows Server 2003, Standard Edition, named VPN1 that is acting as a VPN server. VPN1 has two network adapters installed.
A computer running Windows Server 2003, Standard Edition, named IAS1 that is acting as a Remote Authentication Dial-In User Service (RADIUS) server.
A computer running Windows Server 2003, Standard Edition, named IIS1 that is acting as a Web and file server.
A computer running Windows XP Professional named CLIENT1 that is acting as a VPN client.

Figure D-1 shows the configuration of the VPN test lab.

click to expand
Figure D-1: Configuration of the VPN test lab.

There is a network segment representing a corporate intranet and a network segment representing the Internet. All computers on the corporate intranet are connected to a common hub or Layer 2 switch. All computers on the Internet are connected to a separate common hub or Layer 2 switch. Private addresses are used throughout the test lab configuration. The private network of 172.16.0.0/24 is used for the intranet. The private network of 10.0.0.0/24 is used for the simulated Internet.

IIS1 obtains its IP address configuration using DHCP. CLIENT1 uses DHCP for its IP address configuration; however, it is also configured with an alternate IP configuration so that it can be placed on either the intranet network segment or the simulated Internet. All other computers have a manual IP address configuration. There are no Windows Internet Name Service (WINS) servers present.

The following sections describe the configuration required for each computer in the test lab to set up the basic infrastructure and to do a PPTP-based remote access connection. PPTP is typically used when there is no public key infrastructure (PKI) to issue computer certificates that are required for L2TP/IPSec connections.

To reconstruct this test lab, configure the computers in the order presented. Later sections of this appendix describe L2TP/IPSec and EAP-TLS-based remote access connections.

DC1

DC1 is a computer running Windows Server 2003, Enterprise Edition, that is providing the following services:

•A domain controller for the example.com Active Directory directory service domain
A DNS server for the example.com DNS domain
A DHCP server for the intranet network segment

The enterprise root certification authority (CA) for the example.com domain

Note

Windows Server 2003, Enterprise Edition, is used so that auto-enrollment of user certificates for EAP-TLS authentication can be configured. This is described in the “EAP-TLS-Based Remote Access VPN Connections” section of this appendix.

To configure DC1 for these services, perform the following steps.

Install Windows Server 2003, Enterprise Edition, as a standalone server.
Configure the TCP/IP protocol with the IP address of 172.16.0.1 and the subnet mask of 255.255.255.0.
Run the Active Directory Installation Wizard (dcpromo.exe) for a new domain named example.com in a new forest. Install the DNS service when prompted.
Using the Active Directory Users And Computers snap-in, right-click the example.com domain and then click Raise Domain Functional Level.
Select Windows Server 2003, and then click Raise.
Install Dynamic Host Configuration Protocol (DHCP) as a Networking Services component by using Control Panel>Add Or Remove Programs>Add/ Remove Windows Components.
Open the DHCP snap-in from the Administrative Tools folder.
Select the DHCP server, click Action, and then click Authorize to authorize the DHCP service.
In the console tree, right-click dc1.example.com and then click New Scope.
On the Welcome page of the New Scope Wizard, click Next.
On the Scope Name page, type CorpNet in the Name text box.
Click Next. On the IP Address Range page, type 172.16.0.10 in Start IP Address, 172.16.0.100 in End IP Address, and 24 in Length. This is shown in the following figure.
Click Next. On the Add Exclusions page, click Next.
On the Lease Duration page, click Next.
On the Configure DHCP Options page, click Yes, I Want To Configure These Options Now.
Click Next. On the Router (Default Gateway) page, click Next.
On the Domain Name And DNS Servers page, type example.com in the Parent Domain text box. Type 172.16.0.1 in IP Address, and then click Add. This is shown in the following figure.
Click Next. On the WINS Servers page, click Next.
On the Activate Scope page, click Yes, I Want To Activate This Scope Now.
Click Next. On the Completing The New Scope Wizard page, click Finish.
Install the Certificate Services component as an enterprise root CA with the name Example CA by using Control Panel>Add Or Remove Programs>Add/ Remove Windows Components.
Open the Active Directory Users And Computers snap-in.
In the console tree, open example.com.
Right-click Users, click NEW, and then click Computer.
In the New Object – Computer dialog box, type IAS1 in the Computer Name text box.
Click Next. In the Managed dialog box, click Next. In the New Object – Computer dialog box, click Finish.
Use steps 24 through 26 to create additional computer accounts with the following names: IIS1, VPN1, and CLIENT1.
In the console tree, right-click Users, click New, and then click User.
In the New Object – User dialog box, type VPNUser1 in the First Name text box and type VPNUser1 in the User Logon Name text box.
Click Next.
In the New Object – User dialog box, type a password of your choice in the Password and Confirm Password text boxes. Clear the User Must Change Password At Next Logon check box, and select the Password Never Expires check box. This is shown in the following figure.
In the New Object – User dialog box, click Next, and then click Finish.
In the console tree, right-click Users, click Next, and then click Group.
In the New Object – Group dialog box, type VPNUsers in the Group Name text box and then click OK. This is shown in the following figure.
In the details pane, double-click VPNUsers.
Click the Members tab, and then click Add.
In the Select Users, Contacts, Users, Or Groups dialog box, type vpnuser1 in the Enter The Object Names To Select text box.
Click OK. The VPNUser1 user account is added to the VPNUsers group.
Click OK to save changes to the VPNUsers group.

IAS1

IAS1 is a computer running Windows Server 2003, Standard Edition, that is providing RADIUS authentication, authorization, and accounting for VPN1. To configure IAS1 as a RADIUS server, perform the following steps:

Install Windows Server 2003, Standard Edition, as a member server named IAS1 in the example.com domain.
For the intranet local area connection, configure the TCP/IP protocol with the IP address of 172.16.0.2, the subnet mask of 255.255.255.0, and the DNS server IP address of 172.16.0.1.
Install Internet Authentication Service (IAS) as a Networking Services component in Control Panel>Add Or Remove Programs>Add/Remove Windows Components.
Open the Internet Authentication Service snap-in from the Administrative Tools folder.
Right-click Internet Authentication Service, and then click Register Server In Active Directory. When the Register Internet Authentication Server In Active Directory dialog box appears, click OK.
In the console tree, right-click RADIUS Clients and then click New RADIUS Client.
On the Name And Address page of the New RADIUS Client wizard, for Friendly Name, type VPN1. In the Client Address (IP Or DNS) text box, type 172.16.0.3. This is shown in the following figure.
Click Next. On the Additional Information page of the New RADIUS Client Wizard, for Shared Secret, type a shared secret for VPN1 and then type it again in the Confirm Shared Secret text box. This is shown in the following figure.
Click Finish.
In the console tree, right-click Remote Access Policies and then click New Remote Access Policy.
On the Welcome To The New Remote Access Policy Wizard page, click Next.
On the Policy Configuration Method page, type VPN remote access to intranet in the Policy Name text box.
Click Next. On the Access Method page, select VPN.
Click Next. On the User Or Group Access page, select Group.
Click Add. In the Select Groups dialog box, type vpnusers in the Enter The Object Names To Select text box.
Click OK. The VPNUsers group in the example.com domain is added to the list of groups on the User Or Group Access page. This is shown in the following figure.
Click Next. On the Authentication Methods page, the MS-CHAP v2 authentication protocol is selected by default.
Click Next. On the Policy Encryption Level page, clear the Basic Encryption and Strong Encryption check boxes. This is shown in the following figure.
Click Next. On the Completing The New Remote Access Policy Wizard page, click Finish.

IIS1

IIS1 is a computer running Windows Server 2003, Standard Edition, and Internet Information Services (IIS). It is providing Web and file server services for intranet clients. To configure IIS1 as a Web and file server, perform the following steps:

Install Windows Server 2003, Standard Edition, as a member server named IIS1 in the example.com domain.
Install Internet Information Services (IIS) as a subcomponent of the Application Server component in the Windows Components Wizard of Control Panel>Add Or Remove Programs.
On IIS1, use Windows Explorer to create a new share for the root folder of the C: drive using the share name ROOT with the default permissions.
To determine whether the Web server is working correctly, run Microsoft Internet Explorer on IAS1. If the Internet Connection Wizard prompts you, configure Internet connectivity for a LAN connection. In Internet Explorer, in the Address text box, type http://IIS1.example.com/iisstart.htm. You should see a Web page titled “Under Construction.”
To determine whether file sharing is working correctly, on IAS, click Start, Run, type \\IIS1\ROOT, and then click OK. You should see the contents of the root folder of the C: drive on IIS1.

VPN1

VPN1 is a computer running Windows Server 2003, Standard Edition, that is providing VPN server services for Internet-based VPN clients. To configure VPN1 as a VPN server, perform the following steps:

Install Windows Server 2003, Standard Edition, as a member server named VPN1 in the example.com domain.
Open the Control Panel>Network Connections folder.
For the intranet local area connection, rename the connection to CorpNet. For the Internet local area connection, rename the connection to Internet.
Configure the TCP/IP protocol for the CorpNet connection with the IP address of 172.16.0.4, the subnet mask of 255.255.255.0, and the DNS server IP address of 172.16.0.1.
Configure the TCP/IP protocol for the Internet connection with the IP address of 10.0.0.2 and the subnet mask of 255.255.255.0.
Run the Routing And Remote Access snap-in from the Administrative Tools folder.
In the console tree, right-click VPN1 and click Configure And Enable Routing And Remote Access.
On the Welcome To The Routing And Remote Access Server Setup Wizard page, click Next.
On the Configuration page, Remote Access (Dial-Up Or VPN) is selected by default.
Click Next. On the Remote Access page, select VPN.
Click Next. On the VPN Connection page, click the interface named Internet in Network Interfaces list.
Click Next. On the IP Address Assignment page, Automatically is selected by default.
Click Next. On the Managing Multiple Remote Access Servers page, click Yes, Set Up This Server To Work With A RADIUS Server.
Click Next. On the RADIUS Server Selection page, type 172.16.0.2 in the Primary RADIUS Server text box and type the shared secret in the Shared Secret text box. This is shown in the following figure.
Click Next. On the Completing The Routing And Remote Access Server Setup Wizard page, click Finish.
You are prompted with a message describing the need to configure the DHCP Relay Agent.
Click OK.
In the console tree, open VPN1 (local), IP Routing, and then DHCP Relay Agent. Right-click DHCP Relay Agent, and then click Properties.
In the DHCP Relay Agent Properties dialog box, type 172.16.0.1 in the Server Address text box. This is shown in the following figure.
Click Add, and then click OK.

CLIENT1

CLIENT1 is a computer running Windows XP Professional that is acting as a VPN client and gaining remote access to intranet resources across the simulated Internet. To configure CLIENT1 as a VPN client for a PPTP connection, perform the following steps:

Connect CLIENT1 to the intranet network segment.
On CLIENT1, install Windows XP Professional as a member computer named CLIENT1 of the example.com domain.
Add the VPNUser1 account in the example.com domain to the local Administrators group.
Log off, and then log on using the VPNUser1 account in the example.com domain.
From Control Panel>Network Connections, obtain properties on the Local Area Connection, and then obtain properties on the Internet Protocol (TCP/ IP).
Click the Alternate Configuration tab, and then click User Configured.
In IP Address, type 10.0.0.1. In Subnet Mask, type 255.255.255.0. This is shown in the following figure.
Click OK to save changes to the Internet Protocol (TCP/IP) properties. Click OK to save changes to the Local Area Connection properties.
Shut down the CLIENT1 computer.
Disconnect the CLIENT1 computer from the intranet network segment, and connect it to the simulated Internet network segment.
Restart the CLIENT1 computer, and log on using the VPNUser1 account.
On CLIENT1, open the Network Connections folder from Control Panel.
In Network Tasks, click Create A New Connection.
On the Welcome To The New Connection Wizard page of the New Connection Wizard, click Next.
On the Network Connection Type page, click Connect To The Network At My Workplace.
Click Next. On the Network Connection page, click Virtual Private Network Connection.
Click Next. On the Connection Name page, type PPTPtoCorpnet in the Company Name text box.
Click Next. On the Public Network page, make sure that Do Not Dial The Initial Connection is the selected option.
Click Next. On the VPN Server Selection page, type 10.0.0.2 in the Host Name Or IP Address text box.
Click Next. On the Connection Availability page, click Next.
On the Completing The New Connection Wizard page, click Finish. The Connect PPTPtoCorpnet dialog box is displayed.
Click Properties, and then click the Networking tab.
On the Networking tab, in the Type Of VPN drop-down list, select PPTP VPN. This is shown in the following figure.
Click OK to save changes to the PPTPtoCorpnet connection. The Connect PPTPtoCorpnet dialog box is displayed.
In the User Name text box, type example/VPNUser1. In the Password text box, type the password you chose for the VPNUser1 account. This is shown in the following figure.
Click Connect.
When the connection is complete, run Internet Explorer.
If prompted by the Internet Connection Wizard, configure it for a LAN connection. In the Address text box, type http://IIS1.example.com/iisstart.htm. You should see a Web page titled “Under Construction.”
Click Start, click Run, type \\IIS1\ROOT, and then click OK. You should see the contents of the Local Drive (C:) on IIS1.
Right-click the PPTPtoCorpnet connection, and then click Disconnect.