WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Internet Connection Sharing Scenario: Connecting Your Branch Office's Intranet to the Internet

This scenario describes how to connect a branch office of a corporation to the Internet. It also explains the differences between setting up an analog modem or ISDN connection, and setting up a cable modem or DSL connection. It also discusses how to configure a computer on the branch office's intranet to connect to the corporate network using a virtual private networking (VPN) connection.

Overview

This section describes the basics of this scenario: the branch office's current configuration, and the proposed solution using Windows 2000 Internet Connection Sharing (ICS). Figure 21.14 shows the current configuration for a branch office.

Figure 21.14 Current Configuration of a Branch Office

Using Internet Connection Sharing

The Internet Connection Sharing (ICS) feature in Windows 2000 provides a simple solution to allow all of the computers on a local intranet to share the same external connection to the Internet.

Using ICS, you designate one branch office computer as the ICS computer. Typically, this is the computer with the fastest external connection, such as a DSL or cable modem. You use the ICS computer to establish the connection to the Internet. All of the other computers on your branch's intranet—referred to from this point as "clients" to distinguish them from the ICS computer —use the shared connection on the ICS computer to access the Internet. In general, this is a three step process:

Configure the ICS computer for Internet access. How you set up the ICS computer depends on whether it uses an analog modem or ISDN connection, or a DSL or cable modem connection to the outside world.

Enable Internet Connection Sharing on the ICS computer to provide Internet access to everyone on the branch intranet.

Configure your client computers for automatic IP addressing.

NOTE

---

Never turn off the ICS computer while any of the clients are running, as the ICS computer provides IP address configuration, name resolution services, and a gateway to the Internet. If you do lose power to the ICS computer, the other branch office clients cannot access the Internet because the shared connection on the ICS computer is not available.

Configuring the ICS Computer

How you configure the ICS computer depends on whether it connects to the Internet using an analog modem or ISDN connection, or a high-speed device such as a DSL or cable modem.

NOTE

---

The ICS computer automatically assigns IP addresses, forwards DNS names to the Internet for resolution, and assigns itself as the default gateway for connecting to the Internet. If any of the clients on the branch office's intranet are providing these functions, Internet Connection Sharing might not work.

Configuring an ICS Computer with an Analog Modem or ISDN Connection

In this configuration, the ICS computer connects to the Internet using an analog modem or ISDN connection. The ICS computer and all of the other computers in the Seattle branch office, are connected to the branch office's intranet using network adapters. Figure 21.15 shows how an Internet connection is shared using an analog modem or an ISDN connection.

Figure 21.15 Internet Connection Sharing Using an Analog Modem or ISDN Connection

Install the analog modem (or make sure you have a modem installed) on the ICS computer you want to use to access the Internet. If you are installing an analog modem in the ICS computer for the first time, Windows 2000 Plug and Play automatically detects and configures it.

Open the Network and Dial-Up Connections folder, and then double-click Make New Connection. This starts the Windows 2000 Network Connection Wizard to set up the connection to your Internet service provider (ISP). Configure the connection by using the settings provided by your ISP.

After the wizard has created the new connection to your ISP, Windows 2000 adds a new icon for the connection in the Network and Dial-Up Connections folder. Test the new Internet connection by connecting to your ISP and verifying that you can browse the World Wide Web.

Next, open the Properties of the new connection, click the Sharing tab, and then select the Enable Internet Connection Sharing for this connection check box.

Next, check the configuration of the clients, as described in "Configuring the Branch Office Client Computers" later in this section. Finally, verify the shared ICS connection by browsing the World Wide Web from one of the clients on the branch office intranet.

Configuring an ICS Computer with a DSL or Cable Modem Connection

In this configuration, the ICS computer connects to the Internet using a second network adapter connected to a high-speed DSL or cable modem. The ICS computer connects to the other computers in the Seattle branch office's intranet using the first network adapter. The rest of the computers in the branch office connect to the local intranet using other network adapters. Figure 21.16 shows how an Internet connection is shared by using a DSL or cable modem connection.

Figure 21.16 Internet Connection Sharing Using a DSL or Cable Modem Connection

Rename the local area connection for the branch intranet ("Office Intranet," for example) on the ICS computer that you want to use to access the Internet, and then install the second network adapter (or make sure you have a second network adapter installed) to connect to the DSL or cable modem connection. If you are installing the second network adapter for the first time, Windows 2000 Plug and Play automatically detects and configures it.

Next, open the Properties of the new connection, and configure the connection by using the settings provided by your ISP. Next, click the Sharing tab, and then select the Enable Internet Connection Sharing for this connection check box.

NOTE

---

Rename the new external connection to the Internet to differentiate it from the branch office's intranet.

Test the new Internet connection by connecting to your ISP and verifying that you can browse the World Wide Web.

Finally, check the configuration of the clients (as described in the following section) and then verify the shared ICS connection by browsing the World Wide Web from one of the clients.

Configuring the Branch Office Client Computers

To verify that the network settings on each client in the branch office are configured properly to use the new ICS computer to connect to the Internet, do the following:

Verify that the local area connection to the branch office intranet uses the Client for Microsoft Networks, File and Printer Sharing, and Internet Protocol (TCP/IP) components. (These are the default settings in Windows 2000.)

Verify that the TCP/IP properties for the connection are configured to obtain an IP address and a DNS server address automatically. (These are the default settings in Windows 2000.)

After the ICS computer has been initially configured and tested, restart all of the clients. Do not restart the ICS computer.

TIP

---

If you have trouble accessing the Internet from a client, verify that the client's Internet browser is configured to connect using the LAN. If this is not the problem, ping the ICS computer by typing ping 192.168.0.1 at a command prompt. If this also fails, verify the client's physical connection to the office intranet. Finally, you can use IPConfig, a diagnostic tool included with Windows 2000 Professional, to view details of the client's IP configuration. Open a command window, and then type ipconfig. If you want help with using the tool, type ipconfig /?.

The only necessary modification for client applications is to configure Internet Explorer to use the branch office LAN connection to the Internet.

To configure Internet Explorer to use a shared ICS connection

On the Tools menu, click Internet Options, and then click the Connections tab.

In Dial-Up Settings, click Never dial a connection, and then click LAN Settings.

In Automatic Configuration, check the Automatically detect settings check box and clear the Use automatic configuration script check box.

In Proxy Server, clear the Use a proxy server check box.

ICS is designed to enable a computer to be a translating gateway to the Internet. In some configurations involving cable modems or DSL, the equipment provided and the setup is contrary to this purpose. To properly use ICS, do not connect a cable or DSL modem, the ICS computer, and all of the other clients on the branch office intranet directly into a network hub, as shown in Figure 21.17.

Figure 21.17 Do Not Connect a Cable or DSL Modem Directly into a Network Hub

NOTE

---

You can use this type of configuration when your ISP has assigned a static IP address to each client on your intranet. In this scenario, ICS is not needed for Internet access. However, in this configuration, you must disable File and Printer Sharing on all computers to prevent access to your computers from Internet users. Most branch offices avoid this configuration because it disables file and printer sharing between the clients on the branch's intranet.

Some cable or DSL modems provide a built-in network hub. In this scenario, do not connect the network adapters of all the computers on your intranet directly into the cable modem, as shown in Figure 21.18.

Figure 21.18 Do Not Connect Multiple Computers Directly into a Cable Modem

Creating a VPN Connection to the Corporate Network

As network administrator of the branch office, you want to configure a few individual clients for access to the corporate network to send and receive e-mail, install software updates, transfer files, and otherwise access network servers and company-wide resources.

You can create a virtual private network (VPN) connection from one of the branch office's clients that tunnels through the Internet (using PPTP) to the corporate network by using a VPN connection. It is a safe, secure way of connecting directly to the corporate network from a computer on the branch office network. Figure 21.19 shows how one client on the office intranet is connected to a corporate network by means of a PPTP tunnel.

Figure 21.19 Connect a Branch Office Client to the Corporate Network Using a VPN Connection

NOTE

---

Do not create a VPN connection to the corporate network from the ICS computer. If you do, then by default all traffic from the ICS computer including traffic from intranet clients will forwarded over the VPN connection to the corporate network. This means that Internet resources will no longer be reachable and all the branch office computers will be sending data over a logical connection created with the credentials of the ICS computer user, a questionable security practice.

The first time you launch a new VPN connection, it takes a few moments to connect using L2TP and IPSec, and then tries to connect using PPTP. Subsequent connections do not take as long because the VPN connection memorizes which VPN protocol was successful for the initial connection.

After the VPN connection is made, the client on the branch office's intranet has access to the shared resources (such as file servers and printers) on the corporate network.

NOTE

---

While the client computer is connected to the corporate network using VPN, the client is logically disconnected from the Internet unless the corporate network provides its own Web access. To access the Web through the corporate network, a branch office client must be configured to use the rules established for Web access from the corporate network. For example, many corporations use a proxy server. In this scenario, you need to configure the client's browser to use the corporate proxy server to access the Web. You can configure Internet Explorer to use specific proxy settings with specific Internet connections. After doing so, the client computer can easily shift between accessing the Internet by using the shared connection on the ICS computer, or accessing the Internet through a VPN connection to the corporate network.