RAS遠程訪問和VPN服務器架構

配置遠程訪問概述：介紹遠程訪問的根底結構配置VPN連接配置撥號連接配置無線連接為DHCP集成配置路由和遠程訪問利用遠程訪問策略控制用戶的遠程訪問介紹遠程訪問的根底結構NetworkAccess

ServerIASServerDHCPServerDomainControllerDial-upClientWirelessAccessPointWirelessClientVPNClient建立遠程訪問連接〔1〕LANProtocolsRemoteAccessProtocolsLocalAreaNetworkLANProtocolsRemoteAccessProtocolsInternetRemoteAccessClientRemoteAccess

Server遠程訪問客戶端TypeofClientDescriptionVPNClientConnectstoanetworkacrossasharedorpublicnetworkEmulatesapoint-to-pointlinkonaprivatenetwork

Dial-upClientConnectstoanetworkbyusingacommunicationsnetwork

Createsaphysicalconnectiontoaportonaremoteaccessserveronaprivatenetwork

UsesamodemorISDNadaptertodialintotheremoteaccessserver

WirelessClientConnectstoanetworkbyinfraredlightandradiofrequencytechnologies

Includesmanydifferenttypesofdevices身份驗證

AuthenticationVerifiesaremoteuser'sidentificationtothenetworkservicethattheremoteuserisattemptingtoaccess(interactivelogon)NetworkAccessServerNetworkAccessClientDomainController121

AuthorizationVerifiesthattheconnectionattemptisallowed;authorizationoccursafterasuccessfullogonattempt2概述：介紹遠程訪問的根底結構配置VPN連接配置撥號連接配置無線連接為DHCP集成配置路由和遠程訪問利用遠程訪問策略控制用戶的遠程訪問4配置VPN鏈接標準架構模式Server版操作系統，兩塊網卡，客戶端另類架構模式單網卡架構VPN效勞器單網卡單公網IP單網卡雙IP〔公+私〕虛擬網卡架構VPN效勞器利用MSLOOPBACK虛擬網卡配置方法如同標準架構模式5VPN原理在公共網絡上通過建立起點到點鏈路從而在兩臺計算機之間發(fā)送加密數據。數據封裝的目的：建立點到點鏈路。數據加密的目的：建立私有的鏈路。5VPN原理VPN的優(yōu)點節(jié)約本錢；移動通信費用的節(jié)?。粚＞€費用得節(jié)?。辉O備投資的節(jié)??；支持費用的節(jié)省。增強平安性：隧道技術Tunneling，加解密技術Encryption&Decryption，密鑰管理技術KeyManagement，身份認證技術Authentication。網絡協議支持：IP，IPX，NetBEUI。Appletalk，DECNet，SNA等。容易擴展?？呻S意與合作伙伴聯網。更好控制主動權。平安的IP地址。支持新興應用：IP語音，IP傳輸，RSIP，IPv6，MPLS，SNMPv3，以及支持ADSL、CableModem、光纖以太網、WLAN等網絡鏈接技術。DomainControllerVPNClientVPNServerVPN連接AVPNextendsthecapabilitiesofaprivatenetworktoencompasslinksacrosssharedorpublicnetworks,suchastheInternet,inamannerthatemulatesapoint-to-pointlink3VPNserverauthenticatesandauthorizestheclient2VPNserveranswersthecall4VPNservertransfersdataVPNclientcallstheVPNserver1VPN連接結構VPNTunnelTunnelingProtocolsTunneledDataVPNClientVPNServerAddressandNameServerAllocationDHCPServerDomainControllerAuthenticationTransitNetworkRemoteUsertoCorpNetRemoteAccessServerBranchOfficetoBranchOfficeRemoteAccessServerVPN連接協議ExamplesofRemoteAccessServerUsingL2TP/IPSec

CategoryDescriptionPPTPEmploysuser-levelPoint-to-PointProtocol(PPP)authenticationmethodsandMicrosoftPoint-to-PointEncryption(MPPE)fordataencryptionL2TP/IPSecEmploysuser-levelPPPauthenticationmethodsoveraconnectionthatisencryptedwithIPSec

RecommendedauthenticationmethodforVPNnetworkaccessisL2TP/IPSecwithcertificates配置虛擬專用網端口路由和遠程訪問操作(A)查看(V)路由和遠程訪問服務器狀態(tài)SERVERX(本地)Ports遠程訪問客戶端(0)IP路由遠程訪問策略名稱設備注釋狀態(tài)端口WAN微型端口(PPTP)(VPN3-4)VPN不活動WAN微型端口(PPTP)(VPN3-3)VPN不活動WAN微型端口(PPTP)(VPN3-2)VPNInactiveWAN微型端口(PPTP)(VPN3-1)VPNInactiveWAN微型端口(PPTP)(VPN3-0)VPN不活動WAN微型端口(L2TP)(VPN2-4)VPN不活動WAN微型端口(L2TP)(VPN2-3)VPNInactiveWAN微型端口(L2TP)(VPN2-2)VPNInactiveWAN微型端口(L2TP)(VPN2-1)VPN不活動WAN微型端口(L2TP)(VPN2-0)VPN不活動DirectParallel(LPT1)PARALLELInactiveModem(COM3)MODEMInactivePPTP端口L2TP端口調制解調器和電纜端口7.2.2配置虛擬專用網端口配置用戶撥入設置權限呼叫方ID回撥IP路由7.2.4配置用戶撥入設置驗證ＶＰＮ效勞器概述：介紹遠程訪問的根底結構配置VPN連接配置撥號連接配置無線連接為DHCP集成配置路由和遠程訪問利用遠程訪問策略控制用戶的遠程訪問撥號連接DomainControllerDial-up

ClientDial-upnetworkingistheprocessofaremoteaccessclientmakingatemporarydial-upconnectiontoaphysicalportonaremoteaccessserverbyusingtheserviceofatelecommunicationsprovider3RAserverauthenticatesandauthorizestheclient2RAserveranswersthecall4RAservertransfersdataDial-upclientcallstheRAserver1RemoteAccess

Server配置撥號鏈接和無線鏈接StandardDescription802.11又稱為Wi-Fi。由IEEE的一個工作組為WLAN開發(fā)的一組規(guī)范。定義了OSI中物理層和數據鏈路層中的媒體訪問子層MAC部分內容。所有的802.11標準的MAC子層均相同，但它們的物理實現方式有所不同。802.11b兩種速率：5.5Mbps和11Mbps，比802.11有更高的數據傳輸率，支持較大的工作距離，但易收到無線電信號干擾。適合于家庭和小型企業(yè)使用。802.11a傳輸速率高達54Mbps，工作距離小。使用12個互不重疊的信道，所以適合在高流量的場合中使用。由于使用的無線電頻譜喻802.11、802.11b、802.11g不同，所以它們之間不能實現互操作。802.11g是802.11b的增強版本，二者兼容。只需升級一個固件即可。速度達到54Mbps，但工作距離比802.11b反而短，且更易收到無線電信號的干擾。802.1x是802.11的擴展。定義了在允許訪問網絡之前需要進行身份驗證的方式。同時，也可適用于有線網絡。可以使用EAP-TLS、EAP-MS-CHAPv2、PEAP的密碼驗證方式。PEAP可與TLS或MS-CHAPv2一起使用。PEAP-TLS是推薦驗證方式，提供在嚴格的驗證方式和確定密鑰方式撥號訪問連接結構Dial-upClientAddressandNameServerAllocationDHCPServerDomainControllerAuthenticationRemoteAccessServerWANOptions:Telephone,ISDN,X.25,orATMLANandRemoteAccessProtocolsNetworkAccess

ServerIASServerDHCPServerDomainControllerWirelessAccessPointWirelessClient無線網絡訪問Awirelessnetworkusestechnologythatenablesdevicestocommunicatebyusingstandardnetworkprotocolsandelectromagneticwaves—notnetworkcabling—tocarrysignalsoverpartorallofthenetworkinfrastructureStandardDescriptionInfrastructureWLANClientsconnecttowirelessaccesspointsPeer-to-peerWLANNetworkwirelessclientscommunicatedirectlywitheachotherwithouttheuseofcables無線連接的結構DHCPServerRemote

AccessServerDomainControllerWirelessClient(Station)WirelessAccessPointAddressandNameServerAllocationAuthenticationPorts配置身份驗證協議標準的身份驗證可擴展的身份驗證AvailableMethodsofAuthenticationRemoteandwirelessauthenticationmethodsinclude:CHAPPAPSPAPMS-CHAPMS-CHAPv2EAP-TLSPEAPMD-5ChallengeRecommendedmethodforuserauthenticationisbyusingsmartcardcertificates身份驗證協議PAP(密碼身份驗證協議)使用簡單文字組成的密碼,它是最簡單的身份驗證協議SPAP(shiva密碼身份驗證協議)一種簡單的加密密碼的身份驗證協議被shive遠程訪問效勞器支持CHAP(質詢握手身份驗證協議)被各種類型的遠程訪問效勞器和客戶端使用Microsoft路由和遠程訪問效勞支持CHAP身份驗證協議MS-CHAP(microsoft質詢握手身份驗證協議)被microsoftwindows95客戶端使用只支持microsoft客戶端MS-CHAPV2(Microsoft質詢握手身份驗證協議)執(zhí)行交互的身份驗證作為windows2000和更新版本操作系統的默認遠程訪問協議EAP-TLS(可擴展身份驗證協議-傳輸層平安)PEAP(受保護的可擴展身份驗證協議)標準的身份驗證

ProtocolSecurity密碼身分驗證協議LowShiva密碼身份驗證協議MediumHighUsewhen客戶機和效勞器不能利用更平安的驗證形式進行協商時。連接到ShivaLANRover時，或者當Shiva客戶機連接到基于Windows2000的遠程訪問效勞器時。某些客戶機運行的不是Microsoft操作系統時盤問溝通身份驗證協議HighMS-CHAPMS-CHAPv2High你的客戶機運行WindowsNTversion4.0andlateror,MicrosoftWindows95或以后的版本有些運行Windows2000的撥號客戶機,運行WindowsNT4.0或Windows98的VPN客戶機時可擴展的身份驗證允許客戶機和效勞器協商他們將使用的身份驗證方法支持所使用的身份驗證1、MD5-CHAP2、傳輸層平安性3、附加的第三方的身份驗證方法確保支持通過API進行身份驗證的方法概述：介紹遠程訪問的根底結構配置VPN連接配置撥號連接配置無線連接為DHCP集成配置路由和遠程訪問利用遠程訪問策略控制用戶的遠程訪問利用DHCP將IP地址分配給遠程訪問客戶機如果DHCP效勞器是有效的遠程效勞器在最初從DHCP效勞器獲取10個IP地址如果DHCP效勞器是無效的遠程效勞器使用“自動專用IP尋址”地址確保DHCP效勞器總是可用為使用DHCP而配置路由和遠程訪問GeneralSecurityIPPPPEventLoggingEnableIProutingAllowIP-basedremoteaccessanddemand-dialconnectionsIPaddressassignmentThisservercanassignIPaddressesbyusing:DynamicHostConfigurationProtocol(DHCP)StaticaddresspoolFromToNumberIPAdd…MaskAdd…Edit…RemoveUsethefollowingadaptertoobtainDHCP,DNS,andWINSaddressesfordial-upclients.Adapter:OKCancelApplyLONDON(local)PropertiesCorpnet:概述：介紹遠程訪問的根底結構配置VPN連接配置撥號連接配置無線連接為DHCP集成配置路由和遠程訪問利用遠程訪問策略控制用戶的遠程訪問WhatIsaRemoteAccessPolicy?Aremoteaccesspolicyisanamedrulethat

consistsofthefollowingelements:Conditions.遠程訪問策略的條件是一系列參數，例如一天中的時間，用戶組，主叫ID或者ip地址。這些參數與連接到效勞器的客戶機的參數項匹配。Remoteaccesspermission.對用戶帳號的撥入屬性和遠程訪問策略加以組合，在此根底上才允許遠程訪問連接。Profile.每個策略包括一個配置文件，里面有一些設置值〔例如身份驗證和加密協議〕，這個配置文件被應用于相應的連接。配子文件中的設置值立即應用于連接，并且可能會導致該連接拒絕。WhatIsaRemoteAccessPolicyProfile?Dial-inConstraintsIPPropertiesIPAddressAssignmentIPFiltersMultilinkAuthenticationEncryptionAdvancedSettingsRemote

AccessUser檢測遠程訪問策略ARemoteAccessPolicy:存儲在本地，而不在活動目錄策略組件條件權限配置文件檢測遠程訪問策略評估遵循策略評估的邏輯檢測默認策略和檢測多個策略遵循策略評估的邏輯ConnectionNoDenyAllowProfile

EvaluationConditionsPermissionsProfileAllowDenyUseRemoteAccessPolicyConnectionYesNoConnectionNoDenyAllowProfile

EvaluationConnectionConditionsPermissionsProfileYesAllowDenyUseRemoteAccessPolicyNoYes實驗7-1如何架設windows2003遠程訪問效勞器遠程訪問的集中身份驗證IAS概述介紹IAS(InternetAuthenticationService)安裝和配置IASIntroductiontoIASWindows2003網絡中的IASandRADIUSIAS的用途和用法RADIUS(RemoteAuthenticationDial-InUserService)HowCentralizedAuthenticationWorksRADIUSServerRADIUSClientClientDialsintoalocalRADIUSclienttogainnetworkconnectivity1ForwardsrequeststoaRADIUSserver2Authenticatesrequestsandstoresaccountinginformation3DomainControllerCommunicatestotheRADIUSclienttograntordenyaccess4Remote

AccessServer

InstallingandConfiguringIAS安裝IASServer配置IASServer為利用RADIUS的身份驗證功能配置遠程訪問效勞器為利用RADIUS的記帳功能配置遠程訪問效勞器為記帳信息配置日志InstallinganIASServerWindowsComponentsWizardWindowsComponentsYoucanaddorremovecomponentsofWindows2000.Toaddorremoveacomponent,clickthecheckbox.Ashadedboxmeansthatonlypartofthecomponentwillbeinstalled.Toseewhat'sincludedinacomponent,clickDetails.Components:ManagementandMonitoringToolsMessageQueuingServicesOtherNetworkFileandPrintServicesNetworkingServices3.5MB0.0MB5.0MB2.6MBDescription:Containsavarietyofspecialized,network-relatedservicesandprotocols.Totaldiskspacerequired:Spaceavailableondisk:0.8MB5962.6MBDetails…<BackNext>CancelNetworkingServicesToaddorremoveacomponent,clickthecheckbox.Ashadedboxmeansthatonlypartofthecomponentwillbeinstalled.Toseewhat'sincludedinacomponent,clickDetails.Totaldiskspacerequired:Spaceavailableondisk:0.8MB5962.6MBDetails…CancelOKDescription:Enablesauthentication,authorizationandaccountingofdial-upandPNusers.IASsupportstheRADIUSprotocolSubcomponentsofNetworkingServices:COMInternetServicesProxyDomainNameSystem(DNS)DynamicHostConfigurationProtocol(DHCP)InternetAuthenticationServiceQoSAdmissionControlServiceSimpleTCP/IPServices0.0MB1.1MB0.0MB0.0MB0.0MB0.0MBConfiguringanIASServerAddRADIUSClientClientInformationSpecifyinformationregardingtheclient.Clientaddress(IPorDNS):192.168.1.200Client-VendorMicrosoftClientmustalwayssendthesignatureattributeintherequestSharedsecret:Confirmsharedsecret:<BackFinishCancelVerify…Usean

IPaddress,ifpossibleSelectMicrosoftifusingRoutingandRemoteAccessConfiguringaRemoteAccess

ServertoUseRADIUSAuthentication

PHOENIX(local)PropertiesGeneralSecurityIPPPPEventLoggingTheauthenticationprovidervalidatecredentialsforremoteaccessclientsanddemand-dialrouters.Authenticationprovider:RADIUSAuthenticationAuthenticationMethods…Configure…Configure…WindowsAccountingAccountingprovider:Theaccountingprovidermaintainsalogofconnectionrequestsandsessions.OKCancelApplyChangetoRADIUSAut