Inside Windows Server 1002003 [Electronic resources] نسخه متنی

Chapter 20. Managing Remote Access and Internet Routing

E

VERY GENERATION HAS ITS FAVORITE TOYS FOR building complex and fanciful structures. Tinker Toys gave way to Erector Sets, which gave way to LEGOs, now yield ground to K'Nex. Personally, I'm convinced that the toys we play with as children have a profound impact on the engineered structures we design as adults. This is especially apparent in data communications topologies. First point-to-point, then hub-and-spoke, then full mesh, and now three-dimensional neural structures.

As system administrators, we live inside these data communications structures just as surely as if they were made of glass and concrete. If you work in a large organization with a sizeable IT budget, it's safe to say that the components making up this structure were purchased specifically for particular functions. If you need to route traffic, you buy a router. If you need to provide dial-in services, you buy a network access point. If you need to provide secure Internet communications, you buy firewalls and Virtual Private Networks (VPNs).

But medium and small organizations, or cash-starved elements within a large organization, often need infrastructure services without spending money on specialized equipment that may or may not be in their realm of expertise. This is where a general-purpose server can come into the picture.

The IP infrastructure services in Windows Server 2003 are more than capable of supporting a moderate number of users in a production environment. The exact number of users depends on what they are doing and their performance expectations. For instance, a group of 30 thin-client users in a call center boiler room can use a server running Windows Server 2003 as a router to the main office where the terminal server resides. If the WAN connection is fast enough, the performance will be acceptable. But if that same server supported the same number of users but was required to use a Layer 2 Tunneling Protocol (L2TP) VPN with IPSec encryption, it might start to falter. You have to experiment to find the line for your situation.

This chapter covers the design and deployment of routing and remote access services in Windows Server 2003. It starts with an operational overview of the wide area networking services available in the various server packages and in XP desktops. It includes specific details on authentication methods so you can design proper security into your system. Then it covers the steps you'll need to perform to provide the following services to your users:

keys and digital signatures.




• Authenticate users using smart cards.
  An extra measure of security can be included in any of the remote access configurations by the use of smart cards, which contain certified key pairs that can be used to validate a user's identity prior to permitting connection to the remote access server.




• Connect users to the Internet.
  Windows Server 2003 can act as a secure router between a local private network and the Internet. The server uses Network Address Translation (NAT) so that all users share the same public IP address. The server has an integrated firewall to prevent access to ports that would otherwise be exposed on the public interface.




• Connect users on segments with different network media.
  Ethernet networks often must connect to 802.11b wireless networks and HomePNA Phoneline networks. (PNA stands for Phoneline Networking Association.) Windows Server 2003 equipped with appropriate adapters can route or bridge between any or all of these network types.