Creating a Remote Access PPTP VPN Server - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

Creating a Remote Access PPTP VPN Server

A remote access VPN server accepts VPN calls from VPN client machines. A remote access VPN server allows single client machines and users access to corporate network resources after the VPN connection is established. In contrast, a VPN gateway connects entire networks to each other and allows multiple hosts on each network to connect to other networks through a VPN site-to-site link.

You can use any VPN client software that supports PPTP or L2TP/IPSec to connect to a VPN server. The ideal VPN client software is the Microsoft VPN client, which is included with all versions of Windows. However, if you wish to use L2TP/IPSec with pre-shared keys and NAT traversal support, you should download and install the updated L2TP/IPSec client from the Microsoft download site. We'll go over the details on how to obtain this software later in the chapter.

In this section, we'll go over the procedures required to create a PPTP remote access VPN server on the ISA firewall. The specific steps we'll perform include:

Enabling the ISA Firewall's VPN Server component

Creating an Access Rule allowing VPN Clients access to the Internal network

Enabling Dial-in Access for VPN User Accounts

Testing a PPTP VPN Connection

Enable the VPN Server

You need to turn on the VPN server component, as it is disabled by default. The first step is to enable the VPN server feature and configure the VPN server components. You do this in the Microsoft Internet Security and Acceleration Server 2004 management console and not in the RRAS console.

Most of the problems we've seen with the ISA firewall VPN configuration are related to fledgling ISA firewall administrators using the RRAS console to configure the VPN components. While there will be times when we want to use the RRAS console, the vast majority of the configuration for the ISA firewall's VPN server and VPN gateway is done in the Microsoft Internet Security and Acceleration Server 2004 management console.

Perform the following steps to enable and configure the ISA 2004 VPN Server:

Open the Microsoft Internet Security and Acceleration Server 2004 management console and expand the server name. Click on the Virtual Private Networks (VPN) node.

Click on the Tasks tab in the Task pane. Click the Enable VPN Client Access link (Figure 9.1).

Figure 9.1: The Enable VPN Client Access link

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

Click the Configure VPN Client Access link on the Tasks tab.

On the General tab in the VPN Clients Properties dialog box, change the value for the Maximum number of VPN clients allowed from 5 to 10. The Standard Edition of the ISA firewall supports up to 1000 concurrent VPN connections. This is a hard-coded limit and it is locked-in regardless of the number of VPN connections supported by the Windows operating system on which the ISA firewall is installed. The exact number is unclear, but we do know that when the ISA firewall is installed on the Enterprise version of Windows Server 2003, you can create over 16,000 PPTP connections and over 30,000 L2TP/IPSec VPN connections to the ISA firewall. The General tab is shown in Figure 9.2.

Figure 9.2: The General Tab

Make sure that you will have at least the number of IP addresses available to VPN clients as the number you list in the Maximum number of VPN clients allowed text box. Determine the number of VPN clients you want to connect to the ISA firewall, and then add one more for the ISA firewall itself. That's the number you want to enter into this text box.

Click on the Groups tab (Figure 9.3). On the Groups tab, click Add.

Figure 9.3: The Groups Tab

In the Select Groups dialog box, click the Locations button. In the Locations dialog box, click msfirewall.org, and click OK.

In the Select Group dialog box, enter Domain Users in the Enter the object names to select text box. Click Check Names. The group name will be underlined when it is found in the Active Directory. Click OK.

You can enter local groups that are configured on the ISA firewall machine itself, or you can use domain groups. The ISA firewall will use only domain Global Groups, it will not use Domain Local Groups. You configure domain Global Groups on the Groups tab only when the ISA firewall is a member of the domain. If the ISA firewall is not a member of the domain, then you can use RADIUS authentication to allow domain Global Groups access to the ISA firewall's VPN server. We will cover the details of configuring RADIUS authentication for VPN remote-access connections later in this chapter.

Another thing to keep in mind is that when you control access to the VPN server via a domain (or local) group, the users must have remote access permission. We'll discuss that issue later in this chapter.

Click the Protocols tab. On the Protocols tab, put a checkmark in the Enable PPTP check box only, as shown in Figure 9.4.

Figure 9.4: The Protocols Tab

Click the User Mapping tab. Put a checkmark in the Enable User Mapping check box. Put a checkmark in the When username does not contain a domain, use this domain check box. Enter msfirewall.org in the Domain Name text box. Note that these settings will only apply when using RADIUS/EAP authentication. These settings are ignored when using Windows authentication (such as when the ISA 2004 firewall machine belongs to the domain and the user explicitly enters domain credentials). Click Apply and OK. You may see a Microsoft Internet Security and Acceleration Server 2004 dialog box informing you that you need to restart the computer for the settings to take effect. If so, click OK in the dialog box. The User Mapping tab is shown in Figure 9.5.

Figure 9.5: The User Mapping tab

The User Mapping function is a bit obscure, and there isn't any good documentation on how the User Mapping functions with RADIUS (at this time). In fact, you can prevent all VPN connections to your ISA firewall if you enable user mapping and do not make the ISA firewall a member of the domain. From what we can tell, user mapping can be used when the ISA firewall is a member of your domain, and you use RADIUS authentication to support authentication for users that belong to multiple domains. In this case, you can enable user mapping to support creating user/group-based access control over users who log on via RADIUS and map those user accounts to accounts in the domain the ISA firewall belongs to, and then create Access Rules using those accounts by creating User Sets on the ISA firewall.

We have some information about User Mapping and how it works and doesn't work in an article, Using RADIUS Authentication with the ISA Firewall's VPN Server, at http://isaserver.org/articles/2004vpnradiusl. We will discuss this subject in more detail later in this chapter and also discuss how to use apply user/group-based access control over VPN clients that log on via RADIUS.

One area where User Mapping is well understood, and we have confirmed that it works correctly, is when you use EAP user certificate authentication. We will go over the details of how User Mapping works with EAP user certificate authentication later in the chapter.

On the Tasks tab, click Select Access Networks.

In the Virtual Private Networks (VPN) Properties dialog box, click Access Networks. Note that the External checkbox is selected. This indicates that the external interface is listening for incoming VPN client connections. If you want internal users to connect to the ISA firewall, select Internal. You also have the options to allow VPN connections from All Networks (and Local Host) Network and All Protected Networks. The Virtual Private Networks Properties dialog box is shown in Figure 9.6, Select and Configure Access Networks Options.

Figure 9.6: Select and Configure Access Networks Options

The ability to select VPN connections from multiple networks can be useful when you have unsecure networks located behind the ISA firewall. For example, suppose you have a trihomed ISA firewall that has an external interface, an Internal interface, and a WLAN interface. You use the WLAN for users who bring in laptops that are not managed by your organization. You also require users who have managed computers to use the WLAN segment as well when they bring laptops that are moved between the corporate network and untrusted networks.

You configure Access Rules on the ISA firewall to prevent connections from the WLAN segment. However, you configure Access Rules that allow VPN connections on the WLAN interface to connect to resources on the corporate Internal network. In this way, no users connected to the WLAN segment are able to access resources on the corporate Internal network segment except those corporate users who can VPN into the WLAN interface on the ISA firewall and present the proper credentials to complete a VPN link.

Another scenario where you might want to allow a VPN connection into the ISA firewall is when the ISA firewall is acting as a front-end firewall. In that case, you probably do not want to allow direct RDP or remote MMC connections to the ISA firewall. What you can do is allow RDP connections only from VPN Clients and then allow VPN clients RDP access to the Local Host Network. In this way, a user must establish a secure VPN connection to the front-end ISA firewall before an RDP connection can be established. Hosts connecting via any other means are denied access to the RDP protocols. Nice!

Click the Address Assignment tab (Figure 9.7). Select Internal from the Use the following network to obtain DHCP, DNS and WINS services drop down list box. This is a critical setting as it defines the network on which access to the DHCP is made.

Figure 9.7: The Address Assignment Tab

Note that this isn't your only option. You can select any of the adapters on the ISA firewall from Use the following network to obtain DHCP, DNS and WINS services. The key issue is that you select the adapter that has the correct name server information on it, and the most likely candidate is the Internal interface of the ISA firewall.

You also have the option to use a Static address pool to assign addresses to the VPN clients. The problem with using a static address pool is, if you assign on subnet addresses (addresses in the same network ID as one of the interfaces on the ISA firewall), you will need to remove those addresses from the definition of the Network to which the ISA firewall is connected.

For example, suppose the ISA firewall has two network interfaces: an external and an internal interface. The internal interface is connected to your default Internal Network and the Internal Network ID is 192.168.1.0/24. If you want to assign VPN clients addresses in the Internal Network address range using a static address pool, such as 192.168.1.200/211 (total of 10 addresses), you will need to manually remove those addresses from the definition of the Internal Network before you can create a static address pool with these addresses. If you try to create a static address pool with these on subnet addresses, you'll see the following error (Figure 9.8).

Figure 9.8: A Network Warning Dialog Box.

You can assign name server addresses to VPN clients that are independent of the name server configuration on any of the interfaces on the ISA firewall. Click the Advanced button, and you'll see the Name Resolution dialog box. The default settings are Obtain DNS server addresses using DHCP configuration and Obtain WINS server addresses using DHCP configuration. Of course, you cannot obtain DHCP options for VPN clients unless you install and configure a DHCP Relay Agent on the ISA firewall. The ISA firewall's RRAS service will only obtain blocks of IP addresses for the VPN clients, not DHCP options. We will discuss this issue in more detail later in this chapter.

If you want to avoid installing the DHCP Relay Agent, you can still deliver custom DNS and WINS server addresses to VPN clients by selecting Use the following DNS server addresses and Use the following WINS server addresses. See Figure 9.9.

Figure 9.9: The Name Resolution Dialog Box

Click on the Authentication tab. Note that the default setting enables only Microsoft encrypted authentication version 2 (MS-CHAPv2). Note the Allow custom IPSec policy for L2TP connection checkbox. If you do not want to create a public key infrastructure (PKI), or, you are in the process of creating one but have not yet finished, you can enable this checkbox and enter a pre-shared key. You should also enable a custom IPSec policy pre-shared key if you want to create a site-to-site VPN connection with pre-shared keys. We'll discuss this issue in detail later in this chapter. For the highest level of authentication security, enable the Extensible authentication protocol (EAP) with smart card or other certificate option. We will discuss later in this chapter how to configure the ISA firewall and VPN clients to use User Certificates to authenticate to the ISA firewall. Figure 9.10 shows the Authentication tab options.

Figure 9.10: The Authentication Tab

Click the RADIUS tab. Here you can configure the ISA 2004 firewall VPN server to use RADIUS to authenticate the VPN users. The advantage of RADIUS authentication is that you can leverage the Active Directory's (and other directories) user database to authenticate users without requiring the ISA firewall to be a member of a domain. See Figure 9.11. We'll go over the details of how to configure RADIUS support for VPN user authentication later in this chapter.

Figure 9.11: Virtual Private Networks Properties

Click Apply in the Virtual Private Networks (VPN) Properties dialog box and then click OK.

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

Restart the ISA firewall machine.

The ISA firewall will obtain a block of IP addresses from the DHCP Server on the Internal network when it restarts. Note that on a production network where the DHCP server is located on a network segment remote from the ISA 2004 firewall, all interposed routers will need to have BOOTP or DHCP relay enabled so that DHCP requests from the firewall can reach the remote DHCP servers.

Create an Access Rule Allowing VPN Clients Access to Allowed Resources

The ISA firewall will be able to accept incoming VPN connections after the restart. However, VPN clients cannot access any resources because there are no Access Rules allowing the VPN clients to get to anything. You must create Access Rules allowing members of the VPN Clients network access to the resources you want them to access. This is a stark contrast to other combined firewall/VPN server solutions in that the ISA firewall VPN server applies stateful filtering and stateful application-layer inspection on all VPN client connections.

In the following example, you will create an Access Rule allowing all traffic to pass from the VPN Clients network to the Internal network. In a production environment, you would create more restrictive access rules so that users on the VPN Clients network have access only to resources they require. Later in this chapter, we will demonstrate how you can configure a more restrictive Access Policy using user/group-based access control on VPN clients.

Perform the following steps to create an unrestricted-access VPN clients Access Rule:

In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and click the Firewall Policy node. Right-click the Firewall Policy node, point to New and click Access Rule.

In the Welcome to the New Access Rule Wizard page, enter a name for the rule in the Access Rule name text box. In this example, enter VPN Client to Internal. Click Next.

On the Rule Action page, select Allow and click Next.

On the Protocols page, select All outbound protocols in the This rule applies to list. Click Next.

On the Access Rule Sources page, click Add. In the Add Network Entities dialog box (Figure 9.12), click the Networks folder and double-click on VPN Clients. Click Close.

Figure 9.12: The Add Network Entities Dialog Box

Click Next on the Access Rule Sources page.

On the Access Rule Destinations page, click Add. In the Add Network Entities dialog box, click the Networks folder, and double-click Internal. Click Close.

On the User Sets page, accept the default setting, All Users, and click Next.

Click Finish on the Completing the New Access Rule Wizard page.

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box. The VPN client policy is now the top-listed Access Rule in the Access Policy list as shown in Figure 9.13.

Figure 9.13: VPN Client Policy

At this point VPN clients that successfully authenticate and have Dial-in permission will be able to access all resources, using any protocol, on the Internal network.

Enable Dial-in Access

In non-native mode Active Directory domains, all user accounts have dial-in access disabled by default. You must enable dial-in access on a per account basis for these non-native mode Active Directory domains. In contrast, native-mode Active Directory domains have dial-in access controlled by Remote Access Policy by default. Windows NT 4.0 domains always have dial-in access controlled on a per user account basis.

In the lab environment used in this book, Active Directory is in Windows Server 2003 mixed mode, so we will need to manually change the dial-in settings on each domain user account that requires access to the VPN server.

Perform the following steps on the domain controller to enable Dial-in access for the Administrator account:

Click Start and point to Administrative Tools. Click Active Directory Users and Computers.

In the Active Directory Users and Computers console, click on the Users node in the left pane. Double-click on the Administrator account in the right pane of the console.

Click on the Dial-in tab. In the Remote Access Permission (Dial-in or VPN) frame, select Allow access as shown in Figure 9.14. Click Apply and OK.

Figure 9.14: The account dial-in tab

Close the Active Directory Users and Computers console.

Another option is to create groups on the ISA firewall itself. You can create local users on the ISA firewall and then place those users into groups. This method allows you to use the default setting on the user accounts created on the ISA firewall, where the default dial-in setting is control access via Remote Access Policy.

While this option doesn't scale very well, it's a viable option for those organizations that have a limited number of VPN users and who don't want to use RADIUS or don't have a RADIUS server to use.

Perform the following steps to create a user group that has access to the ISA firewall's VPN server:

On the ISA firewall, right-click My Computer on the desktop and click Manage.

In the Computer Management console, expand System Tools, and expand the Local Users and Groups node. Right-click the Groups node, and click New Group.

In the New Group dialog box, enter a name for the group in the Group Name text box. In this example, we'll name the group VPN Users. Click Add.

In the Select Users dialog box, click Advanced.

In the Select Users dialog box, select the users or groups you want to make part of the VPN Users group. In this example, we'll select Authenticated Users. Click OK.

Click OK in the Select Users dialog box.

Click Create, and then Close.

Now let's configure the ISA firewall's VPN server component to allow access to members of the VPN Users group:

In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and then click Virtual Private Networking (VPN). Click Configure VPN Client Access on the Tasks tab in the Task pane.

In the VPN Clients Properties dialog box, click Add.

In the Select Groups dialog box, enter VPN Users in the Enter the object name to select text box, and click Check Names. The group name will be underlined when it's found. Click OK.

We enter the local VPN Users group in the Groups tab in this example because VPN access can be controlled via the Control access through Remote Access Policy setting on the user accounts of users in the local SAM of the ISA firewall. You can also enter domain users and groups (when the ISA firewall is a member of the user domain) when the domain supports Dial-in access via Remote Access Policy. We will talk more about domain users and groups and Remote Access Policy later in this chapter. See Figure 9.15 for controlling permission via Remote Access Policy.

Figure 9.15: Controlling permission via Remote Access Policy

Click Apply, and then click OK in the VPN Client Properties dialog box (Figure 9.16).

Figure 9.16: The Groups Tab

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

Test the PPTP VPN Connection

The ISA 2004 VPN server is now ready to accept VPN client connections. Set up the VPN connectoid on your VPN client, and then establish the VPN connection to the ISA firewall. In this book's test lab, we use a Windows XP client running Service Pack 1.

Perform the following steps to test the VPN Server:

On the Windows XP external client machine, right-click My Network Places on the desktop, and click Properties.

Double-click New Connection Wizard in the Network Connections window.

Click Next on the Welcome to the New Connection Wizard page.

On the Network Connection Type page, select Connect to a private network at my workplace, and click Next.

On the Network Connection page, select the Virtual Private Network connection page, and click Next.

On the Connection Name page, enter VPN in the Company Name text box, and click Next.

On the VPN Server Selection page, enter the IP address on the external interface of the ISA firewall (in this example, the external IP address is 192.168.1.70) in the Host name or IP address text box. Click Next.

Click Finish on the Completing the New Connection Wizard page.

In the Connect VPN dialog box, enter the user name Administrator and the password for the administrator user account. (NOTE: If the ISA firewall is a member of a domain, enter the machine name or the domain name before the user name in the format NAME\username). Click Connect.

The VPN client establishes a connection with the ISA 2004 VPN server. Click OK in the Connection Complete dialog box informing that the connection is established.

Double-click the connection icon in the system tray, and click Details. You can see that MPPE 128 encryption is used to protect the data and the IP address assigned to the VPN client (Figure 9.17). Click Close.

Figure 9.17: Details of PPTP connection

If you're using the lab setup for this book, click Start and Run. In the Run dialog box, enter \\EXCHANGE2003BE in the Open textbox, and click OK. The shares on the domain controller computer appear. Close the windows displaying the domain controller's contents. Note that we were able to use a single label name to connect to the domain controller because the ISA firewall assigned the VPN client a WINS server address. A single label name would also work via a DNS query if the VPN client machine were configured to fully qualify single label names with the correct domain name.

Right-click the connection icon in the system tray, and click Disconnect.