The Barnes & Noble Review
Can you believe Microsoft certification has been around for more than a decade? Alan Carter can, because that's how long he's been teaching it. Now, he's brought together coverage of all four core Windows 2000 exams -- plus the NT4 migration exam -- in a single study system. Follow it from start to finish, and you won't merely pass your exam. You'll actually learn how to run Windows 2000 enterprise networks -- bugs, pitfalls, and all.
What makes this book different, aside from its sheer 1,500-page size? Carter organizes his course around key concepts, not simply exam objectives. This makes it far easier to grasp what Windows 2000's all about. Second, there are dozens of thorough step-by-step walkthroughs, covering complex tasks such as configuring DNS. But most of all, once you're certified, this book won't turn into an expensive paperweight: it'll keep solving problems as long as your Win2K systems keep chugging.
Bill Camarda is a consultant and writer with nearly 20 years' experience in helping technology companies deploy and market advanced software, computing, and networking products and services. His 15 books include Special Edition Using Word 2000 and Upgrading & Fixing Networks For Dummies®, Second Edition.
Read an Excerpt
Chapter: 17 Managing Remote Access
This chapter is all about remote access in a Windows 2000 environment. Remote access is a critical networking function for today's highly mobile workforce. With remote access, users can connect to their company's network from home, from a hotel room, or from any computer connected to the Internet. The same service that provides routing functionality in Windows 2000 also provides remote access capability - the Routing and Remote Access service.
I'll begin by providing an overview of remote access, including a discussion of the remote access connection types, and the connection and transport protocols supported by the Routing and Remote Access Service. Then I'll show you how to enable remote access and how to configure the remote access server. I'll also explain how to add and configure inbound connection ports. Next, I'll show you how to control access to a remote access server by creating and using remote access policies.
Finally, I'll cover the tools you can use to monitor remote access and provide some tips for troubleshooting common remote access problems.
1. What is a virtual private network (VPN) connection?
2. How do PPTP and L2TP differ from each other?
3. Which transport protocols are supported by the Routing and Remote Access service?
4. What is a multilink connection?
5. What kinds of ports are supported by the Routing and Remote Access service?
6. What is a remote access policy?
Overview of Remote Access
Remote access is a feature that enables client computers to use dial-up and VPN connections to connect to a remote access server. (A remote access server is a Windows 2000 Server computer that runs the Routing and Remote Access service and is configured to provide remote access.) Once a connection with the remote access server is established, the client computer has access to the network the remote access server is connected to. Remote access enables users of remote computers to use the network as though they were directly connected to it. There is no difference in network functionality for the remote access client, except that the speed of the link is often much slower than a direct connection to the LAN.
Remote access is an important networking function in light of today's highly mobile workforce. With remote access, users can connect to their company's network from home, from a hotel room, from a client's remote office, or from any computer connected to the Internet.
The Routing and Remote Access service is a Windows 2000 Server service that enables a Windows 2000 Server computer to function both as a router and as a remote access server. I introduced you to this service in Chapter 16, where you learned all about the routing features of this service. In this chapter I'll tackle the other half of this service - remote access.
The Routing and Remote Access service is only available on Windows 2000 Server computers - in other words, it's not available on Windows 2000 Professional computers.
Remote access is a complex topic. Even administrators who manage remote access servers on a daily basis are well advised to study the details and nuances presented in this chapter before taking the Server or Network exam.
Client computers that run MS-DOS, Windows for Workgroups, Windows 95, Windows 98, Windows NT 4.0, and Windows 2000 can be configured as remote access clients of a Windows 2000 remote access server. In addition, any computer that supports the Point-to-Point Protocol (PPP) can connect to a Windows 2000 remote access server.
As implemented in Windows 2000, remote access supports multiple connection types, connection protocols, and transport protocols, as the following sections explain.
Remote Access Connection Types
Remote access client computers can connect to a Windows 2000 remote access server by using a variety of connection types, including:
* A standard telephone line (also called a Public Switched Telephone Network or PSTN) and modem
* A digital link
* Virtual private network (VPN), including PPTP and L2TP
Probably the most common connection type is a standard analog telephone line and modem. This service is inexpensive and widely available.
A digital link is a new connection type in which the remote access server uses a digital connection to the public telephone system, and remote access clients connect to the remote access server by using V.90 modems. This connection type enables remote access clients to communicate at speeds of up to 33.6 Kbps, and enables the remote access server to communicate with its clients at speeds of up to 56 Kbps.
Integrated Services Digital Network (ISDN) is a digital, dial-up telephone service that supports faster data transmission rates than a standard analog telephone line. The standard ISDN connection is called an ISDN Basic Rate Interface (BRI) line. An ISDN BRI line consists of three separate data channels. Two of these channels (called B channels) support telephone or data communications at a rate of up to 64 Kbps. The third channel is called a D channel, and is used to establish and maintain the connection. If both B channels are used together, data transmission rates of up to 128 Kbps can be supported.
X.25 is a packet-switching protocol that is used on dial-up or leased lines. X.25 is available in most countries. An X.25 connection requires a fair amount of hardware, including an X.25 adapter card, with either a built-in or external Packet Assembler/Disassembler (PAD) in both the remote access server and the remote access client. In addition, access to an X.25 packet-switched network is required at both the remote access server and remote access client locations.
A virtual private network (VPN) is not a physical connection type. Rather, it's a virtual connection that is tunneled inside of an existing TCP/IP network connection. VPNs can be established by using either PPTP or L2TP. Both of these protocols support encryption of the data sent over the VPN connection. Because a VPN uses an existing TCP/IP network connection, no additional hardware is required. VPN connections are commonly used between two computers that communicate over the Internet.
Connection Protocols Supported by Remote Access
Remote access in Windows 2000 can be carried out over several connection protocols. These protocols provide the data-link connectivity for remote access connections in much the same way as Ethernet or Token Ring provide the data-link connectivity on a local area network. Each of these protocols has different features and capabilities. The connection protocols Windows 2000 supports for remote access include: Point-to-Point Protocol (PPP), Point-to-Point Multilink Protocol, Point-to-Point Tunneling Protocol, Layer Two Tunneling Protocol (L2TP), Serial Line Internet Protocol (SLIP), and the Microsoft RAS protocol (also called AsyBEUI).
The Point-to-Point Protocol (PPP) is currently the industry standard remote connection protocol. PPP connections support multiple transport protocols, including TCP/IP, NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, AppleTalk, and NetBEUI.
The Point-to-Point Multilink Protocol is an extension of PPP. Point-to-Point Multilink Protocol combines the bandwidth from multiple physical connections into a single logical connection. This means that multiple modem, ISDN, digital link, or X.25 connections can be bundled together to form a single logical connection with a much higher bandwidth than a single connection can support.
The Point-to-Point Tunneling Protocol (PPTP) permits a virtual private network (VPN) connection between two computers over an existing TCP/IP network connection. The existing TCP/IP network connection can be over the Internet, a local area network, or a remote access TCP/IP connection. All standard transport protocols are supported within the PPTP connection.
The Layer Two Tunneling Protocol (L2TP), like PPTP, permits a VPN connection between two computers over an existing TCP/IP network connection. The major difference between PPTP and L2TP is that PPTP uses Microsoft Point-to-Point Encryption (MPPE) while L2TP uses IPSec for encryption. In addition, L2TP is rapidly becoming the industry standard tunneling protocol. Currently, only Windows 2000 remote access clients and remote access servers support L2TP....