Remote Access, Part II—VPNs and BackOffice Server

Remote network access has changed dramatically over the past few years. Administrators and network managers used to have to dial in to their systems over long-distance connections with expensive connect charges. Medium-size and large businesses typically used a system of owned or leased lines (which were private and available to only the companies that owned the lines) to manage these remote connections.

After the big Internet access explosion, VPNs began to appear. A VPN is a private data network that uses the public network infrastructure while ensuring security. VPNs use standard resources available to the public, rather than costly private resources, to give an organization the same capabilities as owned or leased lines at a much lower cost. Today, companies look to VPNs for extranet and wide-area intranet services.

VPNs encrypt data before sending it through the public infrastructure, then decrypt the data at the receiving end of the network. For additional security, you can encrypt originating and destination network addresses. The VPN provides a point-to-point connection between the remote user's computer, the VPN client, and the organization's server. In a sense, the public network's logistics don't matter because the data looks as if you sent it across a dedicated private link. Although the pathway doesn't matter to the VPN user, that pathway's performance does.

VPNs bring with them two performance concerns. First, users want assurance that their VPN solutions will deliver reliable and predictable service. Several potential solutions are under discussion at the Internet Engineering Task Force (IETF), including Differentiated Services (DiffServ), which would let you prioritize IP traffic, and multi-protocol label switching, which allows special treatment over the switched networks that underlie most ISPs. Second, the overhead of the encyption/decryption process reduces IP performance speed. Several manufacturers are making revisions to allow dedicated VPN devices that support wire-speed encryption, thus bypassing Windows 2000 VPN servers. Data compression and hardware encryption on special server NICs also alleviate the bottleneck that security over a VPN connection creates.

To use BackOffice Server 2000 as a VPN server, you must have a full-time VPN connection. You can create a dedicated VPN link with an existing network adapter or install a new card specifically for VPN use. Whichever you choose, the card must have a connection to the public infrastructure. BackOffice Server 2000 includes wizards that can help you set up the VPN, depending on the following firewall conditions:

The following procedure configures RRAS to accept VPN connections without the ISA Server 2000 firewall. If you have a multi-homed machine (i.e., you have more than one network adapter), make sure each card connects to an active network segment. Otherwise, Win2K will configure the disconnected card to use a set of IP addresses that prevents Internet routing.

If you use the ISA Server 2000 software as a firewall and you want to set up VPN access, follow these steps: