لطفا منتظر باشید ...
previous section to allow the branch office ISA firewall access to the Web enrollment site of the enterprise CA located on the main office network.
We will perform the following procedures to enable the L2TP/IPSec site-to-site VPN link:
Enable the System Policy Rule on the Main office firewall to access the enterprise CA We will enable a system policy rule that allows the ISA firewall to connect from the Local Host Network to all Networks. While, ostensibly, this rule is to allow for CRL checking, we can use it to allow the ISA firewall at the main office access to the Web enrollment site on the Internal network.
Request and install a Web site certificate for the Main office firewall Once we connect to the Web enrollment site, we will request an Administrator certificate that we will install into the main office's local machine certificate store. We will also install the enterprise CA's certificate into the main office ISA firewall's Trusted Root Certification Authorities machine certificate store.
Configure the main office ISA firewall to use L2TP/IPSec for the site-to-site link The Remote Site Network configuration that defines the branch office Network is set to use PPTP for the site-to-site link. We need to change this so that L2TP/IPSec is used instead of PPTP.
Enable the System Policy Rule on the Branch office firewall to access the enterprise CA For the same reason we did so on the main office ISA firewall, we need to enable a System Policy rule that will allow the branch office's Local Host Network access to the Web enrollment site on the main office network.
Request and install a Web site certificate for the Branch office firewall When the PPTP site-to-site link is established, the branch office ISA firewall will be able to connect to the Web enrollment site over that connection. We will install an Administrator certificate on the branch office firewall in its machine certificate store, and install the CA certificate for the main office enterprise CA in the branch office ISA firewall's Trusted Root Certification Authorities machine certificate store.
Configure the branch office ISA firewall to use L2TP/IPSec for the site-to-site link The Remote Site Network representing the main office network must be configured to use L2TP/IPSec instead of PPTP for the site-to-site link.
Establish the IPSec Site-to-Site Connection After we install the certificates and make the changes to the ISA firewall configurations, we'll trigger the site-to-site link and see the L2TP/IPSec connection in the ISA firewall's Monitoring node.
Configuring Pre-shared keys for Site-to-Site L2TP/IPSec VPN Links This is an optional procedure. While we prefer that everyone use certificates for machine authentication, we realize that this is not always possible. We discuss the procedures you can use to support pre-shared key authentication for your L2TP/IPSec site-to-site VPN links.
Enable the System Policy Rule on the Main Office Firewall to Access the Enterprise CA
The ISA 2004 firewall is locked down by default and only a very limited set of protocols and sites are allowed outbound from the ISA firewall immediately after installation. As for any other communications moving through the ISA firewall, Access Rules are required to allow the firewall access to any network or network host. We will need to configure the ISA firewall at the main office with an Access Rule allowing it HTTP access to the Web enrollment site. We could create an Access Rule, or we could enable a System Policy rule. Creating an Access Rule allowing access from the Local Host Network to the enterprise CA using only the HTTP protocol would be more secure, but it's easier to enable the System Policy rule. In this example, we will enable a System Policy Rule that allows the firewall access to the Web enrollment site.
Perform the following steps to enable the System Policy rule on the Main Office firewall:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and click the Firewall Policy node.
Right-click Firewall Policy; point to View, and click Show System Policy Rules.
In the System Policy Rule list, double-click Allow HTTP from ISA Server to all networks (for CRL downloads). This is System Policy Rule #26.
In the System Policy Editor dialog box, check the Enable checkbox on the General tab as shown in Figure 9.37. Click OK.
Figure 9.37: Configuring System Policy
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
Click Show/Hide System Policy Rules (on the far right of the button bar in the MMC console) to hide System Policy.
Request and install a Web Site Certificate for the Main Office Firewall
The next step is to request a certificate from the enterprise CA's Web enrollment site. After obtaining the certificate, we will copy the CA certificate into the ISA firewall's Trusted Root Certification Authorities certificate store.
Perform the following steps on the main office ISA firewall to request and install the certificates:
Open Internet Explorer. In the Address bar, enter http://10.0.0.2/certsrv (where 10.0.0.2 is the IP address of the enterprise CA), and click OK.
In the Enter Network Password dialog box, enter Administrator in the User Name text box, and enter the Administrator's password in the Password text box. Click OK.
In the Internet Explorer security dialog box, click Add. In the Trusted Sites dialog box, click Add and Close.
Click Request a Certificate on the Welcome page.
On the Request a Certificate page, click advanced certificate request.
Figure 9.38: The Show/Hide System Policy Rules Button
On the Advanced Certificate Request page, click Create and submit a request to this CA.
On the Advanced Certificate Request page, select the Administrator certificate from the Certificate Template list as shown in Figure 9.39. Remove the checkmark from the Mark keys as exportable checkbox. Place a checkmark in the Store certificate in the local computer certificate store checkbox as shown in Figure 9.40. Click Submit.
Figure 9.39: The Advanced Certificate Request Page
Figure 9.40: The Store Certificate in the Local Computer Certificate Store Option
Click Yes in the Potential Scripting Violation dialog box.
On the Certificate Issued page, click Install this certificate.
Click Yes on the Potential Scripting Violation page.
Close the browser after viewing the Certificate Installed page.
Click Start, and then click Run. Enter mmc in the Open text box, and click OK.
In Console1, click the File menu, and then click Add/Remove Snap-in.
Click Add in the Add/Remove Snap-in dialog box.
Select the Certificates entry in the Available Standalone Snap-ins list in the Add Standalone Snap-in dialog box. Click Add.
Select Computer account on the Certificates snap-in page.
Select Local computer on the Select Computer page.
Click Close in the Add Standalone Snap-in dialog box.
Click OK in the Add/Remove Snap-in dialog box.
In the left pane of the console, expand Certificates (Local Computer), and then expand Personal. Click on \Personal\Certificates. Double-click on the Administrator certificate in the right pane of the console.
In the Certificate dialog box, click the Certification Path tab. The root CA certificate is at the top of the certificate hierarchy seen in the Certification path frame. Click the EXCHANGE2003BE certificate (which is the CA that issued the Administrator certificate) at the top of the list. Click View Certificate (Figure 9.41).
Figure 9.41: The Certificate Path Tab
In the CA certificate's Certificate dialog box, click the Details tab. Click Copy to File.
Click Next in the Welcome to the Certificate Export Wizard page.
On the Export File Format page, select Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B), and click Next.
On the File to Export page, enter c:\cacert in the File name text box. Click Next.
Click Finish on the Completing the Certificate Export Wizard page.
Click OK in the Certificate Export Wizard dialog box.
Click OK in the Certificate dialog box. Click OK again in the Certificate dialog box.
In the left pane of the console, expand Trusted Root Certification Authorities and click the Certificates node. Right-click \Trusted Root Certification Authorities\Certificates; point to All Tasks, and click Import.
Click Next on the Welcome to the Certificate Import Wizard page.
On the File to Import page, use Browse to locate the CA certificate you saved to the local hard disk, and click Next.
On the Certificate Store page, accept the default settings, and click Next.
Click Finish on the Completing the Certificate Import Wizard page.
Click OK in the Certificate Import Wizard dialog box informing you that the import was successful.
Configure the Main Office ISA Firewall to Use L2TP/IPSec for the Site-to-Site Link
The Remote Site Network on the main office ISA firewall representing the branch office network is configured to use PPTP for the site-to-site connection. We need to change this to L2TP/IPSec. Perform the following steps to make the change:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and then click the Virtual Private Networks (VPN) node in the left pane of the console.
On the Virtual Private Networks (VPN) node, click the Remote Sites tab in the Details pane. Double-click the Branch Remote Site Network entry.
In the Branch Properties dialog box, select the L2TP/IPSec (provides a highly secure connection method) option. Click Apply and then click OK.
Do not apply the new configuration to the Firewall Policy yet. This will break our PPTP site-to-site link, and we need this PPTP site-to-site link to stay up until we have installed a certificate on the branch office ISA firewall. After the branch office ISA firewall has been configured, then you can apply the changes to the Firewall Policy at the main office.
Enable the System Policy Rule on the Branch Office Firewall to Access the Enterprise CA
Now we'll switch our attention to the branch office ISA firewall. We need to enable the System Policy Rule allowing the branch office firewall to connect to the enterprise CA on the main office network.
Perform the following steps to enable the System Policy rule on the branch office firewall:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and click the Firewall Policy node.
Right-click Firewall Policy; point to View, and click Show System Policy Rules.
In the System Policy Rule list, double-click Allow HTTP from ISA Server to all networks (for CRL downloads). This is System Policy Rule #26.
In the System Policy Editor dialog box (Figure 9.42), put a checkmark in the Enable checkbox on the General tab. Click OK.
Figure 9.42: Configuring System Policy
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box
Request and Install a Web Site Certificate for the Branch Office Firewall
Now we'll request a certificate for the branch office firewall. After we obtain the certificate, we will copy the CA certificate into the machine's Trusted Root Certification Authorities certificate store.
Perform the following steps on the branch office ISA firewall to request and install the certificates:
Open Internet Explorer. In the Address bar, enter http://10.0.0.2/certsrv, and click OK.
In the Enter Network Password dialog box, enter Administrator in the User Name text box, and enter the Administrator's password in the Password text box. Click OK.
In the Internet Explorer security dialog box, click Add. In the Trusted Sites dialog box, click Add and Close.
Click Request a Certificate on the Welcome page.
On the Request a Certificate page, click advanced certificate request.
On the Advanced Certificate Request page, click Create and submit a request to this CA.
On the Advanced Certificate Request page, select the Administrator certificate from the Certificate Template list. Remove the checkmark from the Mark keys as exportable checkbox. Place a checkmark in the Store certificate in the local computer certificate store checkbox. Click Submit.
Click Yes in the Potential Scripting Violation dialog box.
On the Certificate Issued page, click Install this certificate.
Click Yes on the Potential Scripting Violation page.
Close the browser after viewing the Certificate Installed page.
Click Start and Run. Enter mmc in the Open text box, and click OK.
In Console1, click the File menu, and then click Add/Remove Snap-in.
Click Add in the Add/Remove Snap-in dialog box.
Select the Certificates entry from the Available Standalone Snap-ins list in the Add Standalone Snap-in dialog box. Click Add.
Select Computer account on the Certificates snap-in page.
Select Local computer on the Select Computer page.
Click Close in the Add Standalone Snap-in dialog box.
Click OK in the Add/Remove Snap-in dialog box.
In the left pane of the console, expand Certificates (Local Computer), then expand Personal. Click on \Personal\Certificates. Double-click on the Administrator certificate in the right pane of the console.
In the Certificate dialog box, click the Certification Path tab. The root CA certificate is at the top of the certificate hierarchy seen in the Certification path frame. Click the EXCHANGE2003BE certificate at the top of the list. Click View Certificate.
In the CA certificate's Certificate dialog box, click Details. Click Copy to File.
Click Next in the Welcome to the Certificate Export Wizard page.
On the Export File Format page, select Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B), and click Next.
On the File to Export page, enter c:\cacert in the File name text box. Click Next.
Click Finish on the Completing the Certificate Export Wizard page.
Click OK in the Certificate Export Wizard dialog box.
Click OK in the Certificate dialog box. Click OK again in the Certificate dialog box.
In the left pane of the console, expand the Trusted Root Certification Authorities node, and click Certificates. Right-click the \Trusted Root Certification Authorities\Certificates node; point to All Tasks and click Import.
Click Next on the Welcome to the Certificate Import Wizard page.
On the File to Import page, use Browse to locate the CA certificate you saved to the local hard disk, and click Next.
On the Certificate Store page, accept the default settings, and click Next.
Click Finish on the Completing the Certificate Import Wizard page.
Click OK on the Certificate Import Wizard dialog box informing you that the import was successful.
Configure the Main Office ISA Firewall to Use L2TP/IPSec for the Site-to-Site Link
The Remote Site Network at the branch office ISA firewall representing the main office network is configured to use PPTP for the site-to-site connection. We need to change this to L2TP/IPSec. Perform the following steps to make the change:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and then click the Virtual Private Networks (VPN) node in the left pane of the console.
On the Virtual Private Networks (VPN) node, click the Remote Sites tab in the Details pane. Double-click the Main Remote Site Network entry.
In the Branch Properties dialog box, select L2TP/IPSec (provides a highly secure connection method). Click Apply, and then click OK.
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
Now you can save the changes to the Firewall Policy at the main office.
Activate the L2TP/IPSec Site-to-Site VPN Connection
Let's see if our L2TP/IPSec site-to-site VPN connection works:
First, you need to restart the Routing and Remote Access Service on both ISA firewalls so that the Routing and Remote Access Service recognizes the certificate.
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and click the Monitoring node.
On the Monitoring node, click the Services tab. Right-click the Routing and Remote Access Service, and click Stop.
When the service is stopped, right-click it again, and click Start.
From a host on the branch office network, ping the domain controller on the main office network.
When you receive ping responses, go to the branch office ISA firewall and open the Microsoft Internet Security and Acceleration Server 2004 management console. Expand the server name, and then click the Monitoring node.
On the Monitoring node, click the Sessions tab. On the Sessions tab, right-click any of the column headers, and then click the Application Name entry (see Figure 9.43).
Figure 9.43: Adding the Application Name column
In the Application Name column you'll see that an L2TP/IPSec connection was established (see Figure 9.44).
Figure 9.44: Viewing the L2TP/IPSec
Configuring Pre-shared Keys for Site-to-Site L2TP/IPSec VPN Links
In the previous example, we demonstrated the procedures required to create the site-to-site L2TP/IPSec connection using certificates for computer authentication. If you don't have a PKI in place yet, or if you do not plan on implementing a certificate infrastructure, you can use pre-shared keys for the computer authentication component of L2TP/IPSec connection establishment. This provides a more secure connection than you would see with IPSec tunnel mode and pre-shared keys, because you still have the user authentication requirement for the L2TP/IPSec connection.
Perform the following steps on both the main and branch office ISA firewalls to enable pre-shared keys for the site-to-site VPN connection:
In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and then click the Virtual Private Networking (VPN) node in the left pane of the console.
On the Virtual Private Networking (VPN) node, click the VPN Clients tab in the Details pane.
Click the Tasks tab in the Task pane. Click the Select Authentication Methods link.
In the Virtual Private Networks (VPN) Properties dialog box, put a checkmark in the Allow custom IPSec policy for L2TP connection checkbox.
Click Apply and then click OK.
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
