لطفا منتظر باشید ...
last section, we discussed the procedures required to enable and configure the ISA firewall's VPN server component to allow remote access VPN client PPTP connections. In the following section, we'll build on the configuration we created in the last section and configure the ISA firewall to support a L2TP/IPSec remote access VPN client connection.
We'll perform the following procedures to allow L2TP/IPSec remote access VPN client connections to the ISA firewall:
Issue certificates to the ISA 2004 firewall and VPN clients
Test a L2TP/IPSec VPN connection
Monitor VPN Client Connections
Issue Certificates to the ISA Firewall and VPN Clients
You can significantly improve the level of security on your VPN connections by using the L2TP/IPSec VPN protocol. The IPSec encryption protocol provides a number of security advantages over the Microsoft Point-to-Point Encryption (MPPE) protocol used to secure PPTP connections. While the ISA firewall supports using a pre-shared key to support the IPSec encryption process, this should be considered a low-security option and should be avoided if possible.
| Warning | While PPTP and MPPE are secure VPN protocols that can be used by organizations that do not want to use PKI and L2TP/IPSec, the level of security provided by PPTP/MPPE is directly related to the complexity of the user credentials and the PPP user authentication protocol. You should use only complex user passwords with MS-CHAPv2 or EAP user certificate authentication. |
However, if you just aren't in the position to roll out a PKI, then a pre-shared key for L2TP/IPSec is still a viable option. Just be aware that it lowers the level of security for your L2TP/IPSec connections compared to those created using machine certificates. The secure IPSec solution is to use computer certificates on the VPN server and VPN clients. We'll discuss using pre-shared keys after going through the procedures for using certificate authentication for the L2TP/IPSec connection.
The first step is to issue a computer certificate to the ISA firewall. There are a number of methods you can use to request a computer certificate. In the following example, we will use the Certificates stand-alone MMC snap-in. Note that you can only use the Certificate MMC snap-in when the ISA firewall is a member of the same domain where an enterprise CA is installed. If the ISA firewall is not a member of a domain where there is an enterprise CA, then you can use the Web enrollment site to obtain a machine certificate.
In order for the stand-alone MMC snap-in to communicate with the certificate authority, we will need to enable an 'all open' rule that allows all traffic from the Local Host network to the Internet network. We will disable this rule after the certificate request is complete.
Perform the following steps on the ISA 2004 firewall to request a certificate from the enterprise CA on the Internal network:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name in the left pane, and then click the Firewall Policy node. Click the Tasks tab in the Task pane, and then click Create New Access Rule.
On the Welcome to the New Access Rule Wizard page, enter a name for the rule in the Access Rule name text box. In this example, we will enter All Open from Local Host to Internal. Click Next.
On the Rule Action page, select Allow, and click Next.
On the Protocols page, accept the default selection, All outbound traffic, and click Next.
On the Access Rule Sources page, click Add. In the Add Network Entities dialog box, click the Networks folder. Double-click Local Host, and click Close.
On the Access Rule Destinations page, click Add. In the Add Network Entities dialog box, click the Networks folder. Double-click Internal, and click Close.
On the User Sets page, accept the default setting, All Users, and click Next.
Click Finish on the Completing the New Access Rule Wizard page.
Right-click the All Open from Local Host to Internal Access Rule, and click the Configure RPC Protocol command.
In the Configure RPC protocol policy dialog box, remove the checkmark from the Enforce strict RPC compliance checkbox. Click Apply, and then click OK.
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the Configuration node, and click on the Add-ins node. Right-click on the RPC Filter entry in the Details pane, and click Disable.
In the ISA Server Warning dialog box, select Save the changes and restart the services. Click OK.
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
Click Start and the Run command. Enter mmc in the Open text box, and click OK.
In Console1, click the File menu and the Add/Remove Snap-in command.
In the Add/Remove Snap-in dialog box, click Add.
In the Add Standalone Snap-in dialog box, select the Certificates entry from the Available Standalone Snap-ins list. Click Add.
On the Certificates snap-in page, select Computer account.
On the Select Computer page, select Local computer.
Click Close in the Add Standalone Snap-in dialog box.
Click OK in the Add/Remove Snap-in dialog box.
In the left pane of the console, expand Certificates (Local Computer) and click on Personal. Right-click on the Personal node. Point to All Tasks, and click Request New Certificate.
Click Next on the Welcome to the Certificate Request Wizard page.
On the Certificate Types page, select the Computer entry in the Certificate types lists, and click Next.
On the Certificate Friendly Name and Description page, enter a name in the Friendly name text box. In this example, enter Firewall Computer Certificate,. Click Next.
Click Finish on the Completing the Certificate Request Wizard page.
Click OK in the dialog box informing you that the certificate request was successful.
Return to the Microsoft Internet Security and Acceleration Server 2004 management console, and expand the computer name in the left pane. Click on the Firewall Policy node. Right-click on the All Open from Local Host to Internal Access Rule, and click Disable.
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the Configuration node, and click on the Add-ins node. Right-click on the RPC Filter entry in the Details pane, and click Enable.
Click Apply to save the changes and update the firewall policy
In the ISA Server Warning dialog box, select Save the changes and restart the services. Click OK.
Click OK in the Apply New Configuration dialog box.
| Tip | If you do not disable the RPC filter before attempting to request a certificate from the Certificates MMC, the certificate request will fail. If you then disable the RPC filter after requesting the certificate, the request will fail again. You will need to restart the ISA firewall in order to request the certificate. The moral of this story? Do not request the certificates from the Certificates MMC before you disable the RPC filter. |
Note that you will not need to manually copy the enterprise CA certificate into the ISA firewall's Trusted Root Certification Authorities certificate store because CA certificate is automatically installed on domain members. If the firewall were not a member of the domain where an enterprise CA is installed, then you would need to manually place the CA certificate into the Trusted Root Certification Authorities certificate store.
The next step is to issue a computer certificate to the VPN client computer. In this example, the VPN client machine is not a member of the domain. You need to request a computer certificate using the enterprise CA's Web enrollment site and manually place the enterprise CA certificate into the client's Trusted Root Certification Authorities machine certificate store. The easiest way to accomplish this is to have the VPN client machine request the certificate when connected via a PPTP link.
| Note | In a production environment, untrusted client machines must not be issued computer certificates. Only managed computers should be allowed to install computer certificates. Domain members are managed clients and, therefore, under the organization's administrative control. We strongly encourage you to not allow users to install their own certificates on unmanaged machines. The computer certificate is a security principle and is not meant to provide free access to all users who wish to have one. |
Perform the following steps to request and install the CA certificate:
Establish a PPTP VPN connection to the ISA firewall.
Open Internet Explorer. In the Address bar, enter http://10.0.0.2/certsrv (where 10.0.0.2 is the IP address of the CA on the Internal Network), and click OK.
In the Enter Network Password dialog box, enter Administrator in the User Name text box and enter the Administrator's password in the Password text box. Click OK.
Click Request a Certificate on the Welcome page.
On the Request a Certificate page, click advanced certificate request.
On the Advanced Certificate Request page, click Create and submit a request to this CA.
On the Advanced Certificate Request page, select the Administrator certificate from the Certificate Template list. Place a checkmark in the Store certificate in the local computer certificate store checkbox. Click Submit.
Click Yes in the Potential Scripting Violation dialog box.
On the Certificate Issued page, click Install this certificate.
Click Yes on the Potential Scripting Violation page.
Close the browser after viewing the Certificate Installed page.
Click Start, and then click Run. Enter mmc in the Open text box, and click OK.
In Console1, click the File menu, and click the Add/Remove Snap-in command.
Click Add in the Add/Remove Snap-in dialog box.
In the Add Standalone Snap-in dialog box, select the Certificates entry from the Available Standalone Snap-ins list. Click Add.
Select Computer account on the Certificates snap-in page.
Select Local computer on the Select Computer page.
Click Close in the Add Standalone Snap-in dialog box.
Click OK in the Add/Remove Snap-in dialog box.
In the left pane of the console, expand Certificates (Local Computer) Personal. Click on \Personal\Certificates. Double-click on Administrator certificate in the right pane of the console.
In the Certificate dialog box, click Certification Path. At the top of the certificate hierarchy seen in the Certification path frame is the root CA certificate. Click the EXCHANGE2003BE certificate at the top of the list. Click View Certificate.
In the CA certificate's Certificate dialog box, click the Details tab. Click Copy to File.
Click Next on the Welcome to the Certificate Export Wizard page.
On the Export File Format page, select Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B), and click Next.
On the File to Export page, enter c:\cacert in the File name text box. Click Next.
Click Finish on the Completing the Certificate Export Wizard page.
Click OK in the Certificate Export Wizard dialog box.
Click OK in the Certificate dialog box. Click OK again in the Certificate dialog box.
In the left pane of the console, expand the Trusted Root Certification Authorities node, and click Certificates. Right-click \Trusted Root Certification Authorities\Certificates. Point to All Tasks, and click Import.
Click Next on the Welcome to the Certificate Import Wizard page.
On the File to Import page. Use the Browse button to locate the CA certificate you saved to the local hard disk, and click Next.
On the Certificate Store page, accept the default settings, and click Next.
On the Completing the Certificate Import Wizard page, click Finish.
In the Certificate Import Wizard dialog box informing you that the import was successful, click OK.
Disconnect from the VPN server. Right-click on the connection icon in the system tray, and click Disconnect.
Test the L2TP/IPSec VPN Connection
Now that both the ISA firewall and the VPN client machines have machine certificates, you can test a secure L2TP/IPSec remote-access client VPN connection to the firewall. The first step is to restart the Routing and Remote Access Service so that it registers the new certificate.
Perform the following steps to enable L2TP/IPSec support:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and click Virtual Private Networking (VPN). Click Configure VPN Client Access on the Tasks tab in the Task pane. Click Apply, and then click OK.
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
Restart the ISA firewall machine.
The next step is to start the VPN client connection:
From the VPN client computer, open the VPN client connectoid. Click Properties. In the VPN Properties dialog box, click Networking. On the Networking tab, change the Type of VPN to L2TP IPSec VPN. Click OK.
Initiate the VPN connection to the ISA firewall.
Click OK in the Connection Complete dialog box informing you that the connection is established.
Double-click on the connection icon in the system tray.
In the ISA VPN Status dialog box (Figure 9.18), click the Details tab. You will see an entry for IPSEC Encryption, indicating that the L2TP/IPSec connection was successful.
Figure 9.18: L2TP/IPSec Connection Details
Click Close in the ISA VPN Status dialog box.
Monitor VPN Clients
The ISA firewall allows you to monitor the VPN client connections. Perform the following steps to see how you can view connections from VPN clients:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and click the Virtual Private Networks (VPN) node. Click the Tasks tab in the Task pane, and click Monitor VPN Clients (Figure 9.19). Note that this option will change the nature of the Sessions filter. You might want to back up your current sessions filter so that you can get back to it after the VPN filter is created.
Figure 9.19: The Monitor VPN Clients Link
You are moved to the Sessions tab in the Monitoring node. Here you can see that the sessions have been filtered to show only the VPN Client connections.
Click on the Dashboard tab. Here you can see in the Sessions pane the VPN Remote Client connections (Figure 9.20).
Figure 9.20: The ISA Firewall Dashboard
You can also use the real-time logging feature to see VPN client connections. Click on the Logging tab, and then click the Tasks tab in the Task pane. Click Start Query. You can use the filter capabilities to focus on specific VPN clients or only the VPN Clients network. Figure 9.21 shows the log file entries.
Figure 9.21: Log File Entries for the VPN Client Connection
Using a Pre-shared Key for VPN Client Remote Access Connections
As mentioned earlier in this chapter, you can use pre-shared keys for IPSec authentication if you don't have a PKI setup. The ISA firewall can be configured to support both pre-shared keys and certificates for VPN remote access client connections. The VPN client must support pre-shared keys for IPSec authentication. You can download the updated Windows L2TP/IPSec VPN clients at http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/l2tpclient.asp. This VPN client allows you to use pre-shared keys for Windows 9X, Windows NT 4.0, and Windows 2000 client operating systems.
The ISA firewall must be configured to support pre-shared keys. Perform the following steps to configure the ISA firewall to support pre-shared keys for IPSec authentication:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and click the Virtual Private Networking (VPN) node.
Click the Select Authentication Methods link on the Tasks tab in the Task pane.
In the Virtual Private Networks (VPN) Properties dialog box, put a checkmark in the Allow customer IPSec policy for L2TP connection checkbox. Enter a pre-shared key in the Pre-shared key text box. Make sure that the key is complex and contains letters, numbers, and symbols (see Figure 9.22). Make the key at least 17 characters in length.
Figure 9.22: The Authentication Tab
Click Apply, then click OK in the ISA 2004 dialog box informing you that the Routing and Remote Access Service must be restarted. Click OK in the Virtual Private Networking (VPN) Properties dialog box.
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
You need to configure the VPN client to support a pre-shared key. The procedures will vary with the client you're using. The following describes how to configure the Windows XP VPN client to use a pre-shared key:
Open the VPN connectoid that you use to connect to the ISA firewall and click the Properties button.
In the connectoid's Properties dialog box, click the Security tab.
On the Security tab, click the IPSec Settings button.
In the IPSec Settings dialog box, put a checkmark in the Use a pre-shared key for authentication checkbox, and then enter the key in the Key text box as shown in Figure 9.23. Click OK.
Figure 9.23: Enter a pre-shared key on the L2TP/IPSec client
Click OK in the connectoid's Properties dialog box.
Connect to the ISA firewall. You can see that the pre-shared key is used for the IPSec connection by viewing the connection's characteristics in the IPSec Security Monitor MMC snap-in (Figure 9.24).
Figure 9.24: Viewing IPSec Information in the IPSec MMC
