1. Configuring Routing and Remote Access(RRAS) and Wireless Networking
Chapter 5
Configuring Routing and Remote Access(RRAS) and Wireless Networking

2. Configuring Routing
Routing –transferring data across our network one LAN to another.
Routers are used to making routing decisions
Routers are the default gateways for our PCs
Routers get us outside of our network
Types of Routes
Static
Dynamic – RIP is the only one available in W2K08
Windows Server 2008 is considered a software-based router when running the RRAS service

3. Configuring Routing
Install the RRAS service and Choose Custom Configuration
Most Setups require 2 NICS to be installed
Select which type of routing you are going to use
2 choices
Static Routes
RIP

4. Reading the IP routing Table
Can view the routing table through the RRAS console or by using the route print command
4 types of routes that will be found
Directly attached networks
Remote network Routes
Host routes – subnetmask will be
Default Route –

5. Configuring Demand Dial Routing
With Demand Dial Routing the connection is only active when it needs to be.
When a router receives a packet for a remote network this will initiate a connection to the remote site.
1st step is to configure a demand-dial interface
The next step is to configure a static route to that destination.

6. Configuring Remote Access
Windows Server 2008 provides several options to allow hosts to connect remotely to your network and network resources
Dial-Up Networking (DUN)
VPN
NAT

7. Configuring Dial-Up Remote Access
Enables remote computers that have modems to connect to the network.
Typically used in laptops.
Allows the computer to act as if it were locally connected.
To enable multiple PCs to connect at the same time a modem bank is needed.

8. Configuring VPNs
Creates a tunnel through a public network such as the internet into the private network.
No dedicated lines are needed
Performance is not comparable to a dedicated line
Use a dedicated line when traffic speed is important or traffic is synchronous, as in voice and video
A tunneling-Protocol must be chosen when creating the VPN
PPTP – Point to Point Tunneling Protocol
L2TP – Layer Two Tunneling Protocol

9. NAT Network Address Translation
Allows clients to connect to the internet with only 1 IP address available.
Similar to how home
wireless routers work.

10. Authorizing Remote Connections
Users must submit credentials (username and password) to be authenticated on the network.
Authentication proves that the user is who he or she claims to be.
Once the user is authenticated they must be authorized to connect remotely
Authorizing controls what users can and can’t access
Can they have access remotely or not?
A two step process is used to authorize

11. Authorizing Remote Connections
Step #1
The Dial-In properties of the user account must be evaluated
Done in Active Directory for a domain environment
In the local users and groups for stand-alone servers
Step #2
The authorizing process must meet all criteria specified in the NPS network Policy
Example: must be between 8:00 – 5:00 and use L2TP to connect

12. Configuring an NPS Policy
An NPS policy is basically a rule for evaluating remote connections.
Consists of 3 parts
Conditions – must meet a condition: Ex: certain users, or IP’s
Constraints – if the condition is met it must also meet all of the constraints
Settings – Once conditions and constraints are met the certain settings can be applied to that remote connection
NPS policies are processed in order
Once a policy is matched it will not move on to the next
Page 117 gives a good example on how this works.

13. Choosing an Authentication Protocol
When submitting credentials a common authentication protocol must be used.
In order from most secure to least:
EAP-TLS
MS-CHAP v2
MS-CHAP v1
EAP-MD5 CHAP
CHAP
SPAP
PAP
Unauthenticated Access

14. Configuring Wireless Access
IEEE 802.1X – standard for network access control
Port based – can allow or deny access based on physical port or logical port
802.1X provides port-based security using 3 components.
Supplicant – devices seeking access
Authenticator –component that requests authentication credentials from supplicant. Usually port or wireless AP. The Authenticator forwards the credentials to the AS.
Authentication Server (AS) – server that verifies the supplicants credentials. It tells the authenticator whether to allow or deny access.

15. Configuring Wireless Access
To configure Server 08 to allow wireless access you will need to do the following.
Install and configure radius clients
Switches or Wireless AP’s that are 802.1X capable
Select an authentication protocol
Add radius clients to NPS server
Configure a NPS network Policy
Configuring accounting – logs what a user attempts to access

16. You Learned
By using the Routing and Remote Access service, Windows Server 2008 can be configured as a router and remote access server. The Routing And Remote Access console is the principal tool used for configuring and managing this service.
Lesson 5

17. You Learned (cont.) Lesson 5
Routing and Remote Access can be automatically configured for several options: Remote Access (Dial-Up Or VPN), Network Address Translation (NAT), Virtual Private Network (VPN) Access And NAT, and Secure Connection Between Two Private Networks. If none of the standard options match your requirements, you can also manually configure Routing and Remote Access.
Lesson 5

18. You Learned (cont.) Lesson 5
Without dynamic routing protocols, such as RIPv2, network administrators must add static routes to connect to non-neighboring subnets when those subnets do not lie in the same direction as the default route.
Lesson 5

19. You Learned (cont.) Lesson 5
Routers read the destination addresses of received packets and route those packets according to directions that are provided by routing tables. In Windows Server 2008, you can view the IP routing table through the Routing And Remote Access console or through the Route Print command.
Lesson 5

20. You Learned (cont.) Lesson 5
Windows Server 2008 provides extensive support for demand-dial routing, which is the routing of packets over physical point-to-point links, such as analog phone lines and ISDN, and over virtual point-to-point links, such as PPTP and L2TP. Demand-dial routing allows you to connect to the Internet, connect branch offices, or implement router-to-router VPN connections.
Lesson 5

21. You Learned (cont.) Lesson 5
The remote access connection must be authorized after it is authenticated. Remote access authorization begins with the user account’s dial-in properties; the first matching remote access policy is then applied to the connection.
Lesson 5

22. You Learned (cont.) Lesson 5
Microsoft implementation of a RADIUS server is the Network Policy Server. Use a RADIUS server to centralize remote access authentication, authoriza- tion, and logging. When you implement RADIUS, multiple Windows Server 2008 computers running the Routing and Remote Access service forward access requests to the RADIUS server. The RADIUS server then queries the domain controller for authentication and applies remote access policies to the connection requests.
Lesson 5

23. You Learned (cont.) Lesson 5
The 802.1X IEEE standard allows for port-level network access control of both wired and wireless connections.
A Windows Server 2008 server running the NPS role can also secure 802.1X connectivity for X-capable network switched and wireless access ports.
Lesson 5