Overview of Routing and Remote Access Service (RRAS)

1. Overview of Routing and Remote Access Service (RRAS) • When RRAS was implemented in Microsoft Windows NT 4.0, it added support for a number of features. • Microsoft Windows 2000 builds on RRAS in Windows NT 4.0 and adds a number of new features. • RRAS is fully integrated with Windows 2000 Server. • RRAS is extensible with application programming interfaces (APIs) that third-party developers can use to create custom networking solutions and that vendors can use to participate in internetworking. • The combined features of Windows 2000 RRAS allow a Windows 2000 Server computer to function as a multiprotocol router, a demand-dial router, and a remote access server.

2. Combining Routing and Remote Access Service • Routing services and remote access services have been combined because of Point-to-Point Protocol (PPP), which is the protocol suite that is commonly used to negotiate point-to-point connections. • Demand-dial routing connections also use PPP to provide the same kinds of services as remote access connections. • The PPP infrastructure of Windows 2000 Server supports several types of access.

3. Installation and Configuration

4. Disabling Routing and Remote Access Service • You can use the Routing and Remote Access snap-in to disable RRAS. • You can refresh the RRAS configuration by first disabling the service and then enabling it.

5. Authentication and Authorization

6. IPX Support • The Windows 2000 Server router is a fully functional IPX router. • Routing and Remote Access Service includes a number of features to support IPX routing.

7. AppleTalk • Windows 2000 RRAS can operate as an AppleTalk router by forwarding AppleTalk packets and supporting the use of RTMP. • Most large AppleTalk networks are AppleTalk internets that are connected by routers. • A Windows 2000–based server can provide routing and seed routing support.

8. Demand-Dial Routing • Windows 2000 provides support for demand-dial routing. • IP and IPX can be forwarded over demand-dial interfaces over persistent or on-demand wide area network (WAN) links.

9. Remote Access • RRAS enables a computer to be a remote access server. • RRAS accepts remote access connections from remote access clients that use traditional dial-up technologies.

10. VPN Server • RRAS enables a computer to be a virtual private network (VPN) server. • RRAS supports Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) over IP Security (IPSec).

11. RADIUS Client-Server • Internet Authentication Service (IAS) is the Microsoft implementation of a Remote Authentication Dial-In User Service (RADIUS) server. • RADIUS is a client-server protocol that enables RADIUS clients to submit authentication and accounting requests. • The RADIUS server has access to user account information and can check remote access authentication credentials. • RADIUS supports remote access user authentication and authorization and allows accounting data to be maintained in a central location.

12. API Support for Third-Party Components • RRAS has fully published API sets for unicast and multicast routing protocol and administration utility support. • Developers can write additional routing protocols and interfaces directly into RRAS architecture.

13. Overview of Remote Access • Remote access clients are either connected to only the remote access server’s resources, or they are connected to the RAS server’s resources and beyond. • A Windows 2000 remote access server provides two remote access connection methods.

14. Dial-Up Remote Access Connections

15. Remote Access Client • A number of remote access clients can connect to Windows 2000 remote access server. • Almost any third-party PPP remote access clients can connect to a Windows 2000 remote access server. • The Microsoft remote access client can dial into a Serial Line Interface Protocol (SLIP) server.

16. Remote Access Service Server • The remote access server accepts dial-up connections. • The remote access server forwards packets between remote access clients and the network to which the remote access server is attached.

17. Dial-Up Equipment and WAN Infrastructure • Public Switched Telephone Network (PSTN) • Digital links and V.90 • Integrated Services Digital Network (ISDN) • X.25 • ATM over ADSL

18. Public Switched Telephone Network (PSTN)

19. Digital Links and V.90

20. Asynchronous Transfer Mode (ATM) over Asymmetric Digital Subscriber Line (ADSL)

21. Remote Access Protocols • Remote access protocols control the establishment of connections and the transmission of data over WAN links. • Windows 2000 remote access supports three types of remote access protocols: PPP, SLIP, and AsyBEUI.

22. LAN Protocols • LAN protocols are the protocols used by remote access clients to access resources on the network connected to the RAS server. • Windows 2000 remote access supports TCP/IP, IPX, AppleTalk, and NetBEUI.

23. Secure User Authentication • Secure user authentication is obtained through the encrypted exchange of user credentials. • Secure authentication is possible through the use of PPP and one of the supported authentication protocols.

24. Mutual Authentication • Mutual authentication is obtained by authenticating both ends of the connection through the encrypted exchange of user credentials. • It is possible for a RAS server not to request authentication from the remote access client.

25. Data Encryption • Data encryption encrypts the data sent between the remote access client and the RAS server. • Data encryption on a remote access connection is based on a secret encryption key known to the RAS server and remote access client. • Data encryption is possible over dial-up remote access links when using PPP along with EAP-TLS or MS‑CHAP. • Microsoft Windows 2000, Windows NT 4.0, Windows 98, and Windows 95 remote access clients and remote access servers support Microsoft Point-to-Point Encryption (MPPE).

26. Callback • The RAS server calls the remote access client after the user credentials have been verified. • Callback can be configured on the server to call the remote access client back at a number specified by the user of the remote access client. • Callback can be configured to always call back the remote access client at a specific number.

27. Caller ID • Caller ID can be used to verify that the incoming call is coming from a specified phone number. • Caller ID requires that the caller’s telephone line, phone system, RAS server’s telephone line, and the Windows 2000 driver for the dial-up equipment support caller ID.

28. Remote Access Account Lockout • The remote access account lockout feature is used to specify how many times a remote access authentication can fail against a valid user account before access is denied. • The feature does not distinguish malicious attempts from authentic users. • An administrator must decide on two remote access account lockout variables.

29. Managing Users • Set up a master account database in the Active Directory store or on a RADIUS server. • A master account database allows the RAS server to send the authentication credentials to a central authenticating device.

30. Managing Addresses • For PPP connections, IP, IPX, and AppleTalk, addressing information must be allocated to remote access clients during the establishment of the connection. • The RAS server must be configured to allocate IP addresses, IPX network and node addresses, or AppleTalk network and node addresses.

31. Overview of Access Management • Remote access connections are accepted based on the dial-in properties of a user account and the remote access policies. • Different remote access conditions can be applied to different remote access clients or to the same remote access client based on the parameters of the connection attempt. • Multiple remote access policies can be used to meet various conditions. • RRAS and IAS use remote access policies to determine whether to accept or reject connection attempts.

32. Access by User Account

33. Access by Policy

34. Accepting a Connection Attempt When a user attempts a connection, the connection attempt is accepted or rejected based on a specific logic.

35. Managing Account Lockout • Changing settings in the registry on the authenticating computer configures the account lockout feature. • If the RAS server is configured for Windows authentication, modify the registry on the RAS server computer. • If the RAS server is configured for RADIUS authentication and IAS is being used, modify the registry on the IAS server.

36. Managing Authentication • Windows authentication • RADIUS authentication • Windows and RADIUS accounting

37. Overview of Virtual Private Networks (VPNs) • VPNs allow remote users to connect securely to a remote corporate server by using the routing infrastructure provided by a public internetwork, such as the Internet. • VPN is a point-to-point connection between the user’s computer and a corporate server. • VPN allows a corporation to connect with its branch offices or with other companies over a public internetwork. • The secure connection across the internetwork appears to the user as a virtual network interface.

38. Connecting Networks over the Internet • Dedicated lines • Dial-up lines

39. Connecting Computers over an Intranet • VPNs allow a department’s LAN to be physically connected to the corporate internetwork but separated by a VPN server. • The VPN server is not acting as a router between the corporate internetwork and the department LAN.

40. Overview of Tunneling • Tunneling is a method of using an internetwork infrastructure to transfer a payload. • Instead of sending the frame as produced by the originating node, the frame is encapsulated with an additional header, which provides routing information. • The process of encapsulation and transmission of packets is known as tunneling. • The logical path through which the encapsulated packets travel the transit internetwork is called a tunnel.

41. Tunnel Maintenance and Data Transfer • Tunnel maintenance protocol • Tunnel data transfer protocol

42. Tunnel Types • Voluntary tunnels • Compulsory tunnels

43. PPTP

44. L2TP

45. PPTP vs. L2TP • PPTP requires that the transit internetwork be an IP internetwork. L2TP requires only that the tunnel media provide packet-oriented point-to-point connectivity. • When header compression is enabled, L2TP operates with 4 bytes of overhead, compared to 6 bytes for PPTP. • L2TP provides tunnel authentication, while PPTP does not. • PPTP uses PPP encryption and L2TP does not.

46. IPSec • Overview of IPSec • ESP tunnel mode vs. ESP transport mode • IPSec ESP tunnel mode packet structure

47. IP-IP • IP-IP is a simple OSI layer 3 tunneling technique. • A virtual network is created by encapsulating an IP packet with an additional IP header. • The primary use of IP-IP is for tunneling multicast traffic over sections of a network that does not support multicast routing. • The IP payload includes everything above IP.

48. Managing Users • A master account database is usually set up on a domain controller or on a RADIUS server. • The same user account is used for both dial-in remote access and VPN remote access.

49. Managing Addresses and Name Servers • The VPN server must have IP addresses available in order to assign them to the VPN server’s virtual interface and to VPN clients. • By default, the IP addresses assigned to VPN clients are obtained through DHCP.

50. Managing Access Configure the properties on the Dial-In tab of the users’ properties and modify remote access policy as necessary.