Configuring Windows Server 2008 as a Remote Access SSL VPN Server

[LEFT][CODE]http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Remote-Access-SSL-VPN-Server-Part1.html[/CODE]
[B][SIZE=3]
PART-1[/SIZE][/B]

Remote Access is one of today’s “big things”. As an increasing number of people need access to information stored on work and home computers, the ability to access that information from anywhere is critical. Gone are the days when you could say “I’ll get that information to you when I get to my computer”. You need that information now if you want to be competitive in today’s business environment.
In the stone age of computing, the way to remotely access information on your computer was to use a dial-up connection. RAS dial-up connections worked over regular POTS (Plain Old Telephone Service) lines and had speeds that ranged up to around 56kbps. Speed was a major problem with dial-up RAS connections, but an even bigger problem was the cost of the connections when a long distance number was required for access.
With the introduction and growth of the Internet, dial-up RAS connections became less relevant. The reason for this was the introduction of virtual private network (VPN) connections. VPN connections provided the same point to point connectivity that the dial-up RAS connections provided, but did so faster and cheaper, as the speed of the VPN connection could be as fast as the Internet link and the cost of the connection is independent of the destination. The only cost is that of the Internet link.
[B]Virtual Private Networking[/B]

A VPN connection allows a computer to establish a [I]virtual[/I] and [I]private[/I] connection to a network over the Internet. The connection is [I]virtual[/I] because when the computer establishes a VPN connection over the Internet, the computer making the VPN connection acts like a node that’s directly connected to the network, as if it had an Ethernet cable connected to that network. The user can access all the same resources he could connect to as if he were directly connected to the network. However, in the case of the VPN client connection to a VPN server, the connection is a [I]virtual[/I] one because there is no actual Ethernet connection to the destination network. The connection is [I]private[/I] because the contents of the datastream moving inside the VPN connection are [I]encrypted[/I] so that no one over the Internet is able to intercept and read the contents of the communications moving over the VPN link.
Windows Servers and clients have supported VPN connections since the days of Windows NT and Windows 95. While Windows clients and servers have supported VPN connections for over a decade, the type of VPN support has evolved over time. Windows Vista Service Pack 1 and Windows Server 2008 now support three types of VPN connections. These are:

[LIST][*]PPTP[*]L2TP/IPSec[*]SSTP[/LIST]
PPTP is the Point to Point tunneling protocol. PPTP is the simplest method you can use to establish a VPN connection, but unfortunately it is also the least secure. The reason why PPTP is the least secure option is that user credentials are not exchanged over a secure link. That is to say, encryption of the VPN connection takes place [I]after[/I] credentials are exchanged. Even though actual credential information is not transmitted between VPN client and server, the hash values exchanged can be leveraged by sophisticated hackers to gain access to VPN servers and connect to corporate networks.
A more secure VPN protocol is L2TP/IPSec. L2TP/IPSec was a joint development between Microsoft and Cisco. L2TP/IPSec is more secure than PPTP because a secure IPSec session is established before credentials are sent over the wire. Hackers are not able to access the user credentials and thus cannot steal them to use them later. More importantly, IPSec provides for mutual machine authentication, so that untrusted machines are not able to connect to the L2TP/IPSec VPN gateway. IPSec provides for mutual machine authentication, data integrity, confidentiality, and non-repudiation. L2TP supports PPP and EAP user authentication mechanisms, which allows for a high level of log on security because both user and machine authentication is required.
Windows Vista SP1 and Windows Server 2008 now support a new VPN protocol – Secure Socket Tunneling Protocol or SSTP. SSTP uses SSL encrypted HTTP connections to establish a VPN connection to the VPN gateway. SSTP is secure because user credentials are not sent until after a secure SSL tunnel is established with the VPN gateway. SSTP is also known as PPP over SSL, so this means that you can use PPP and EAP authentication mechanisms to make your SSTP connection more secure.
[B]Privacy is Not Security[/B]

I should note here that VPN connections are more about privacy than security. While I do recognize that privacy is a major component of secure communications, privacy in and of itself does not provide security. VPN technologies provide for privacy of communications over the Internet, which prevents intruders from reading the contents of your communications. VPN technologies also allow you to make sure that only authorized users can connect to the network through the VPN gateway. However, privacy, authentication and authorization do not provide a comprehensive security solution.
For example, suppose you have an employee who you have granted VPN access. Since your Windows Server 2008 VPN protocols support EAP user authentication, you decided to deploy smart cards for your users and use the L2TP/IPSec VPN protocol. The combination of smart cards and L2TP/IPSec help insure that strong machine and user authentication is required. Your smart card and L2TP/IPSec solution works well and everyone is happy.
Everyone is happy until one day one of your users connects to your SQL server to access payroll information and starts to share that information with other employees. What happened? Wasn’t the VPN connection secure? Yes, the VPN connection was secure to the extent that it provided privacy, authentication and authorization – but one thing it did not provide was access control, and access control is the most pivotal aspects of computer security. In fact, it can be argued that without access control, all other security measure are of relatively little value.
For a VPN solution to be truly secure, you need to make sure your VPN gateway is able to perform user/group based access controls so that you can implement least privilege access to VPN users. Advanced VPN gateways and firewalls like the ISA Firewall can perform this type of strong user/group based access control on VPN connections. In addition, advanced firewalls like the ISA Firewall can perform stateful packet and application layer inspection on VPN client connections.
Even though the Windows Server 2008 VPN server does not provide for user/group access controls, there are other ways you can implement strong access controls on the data servers themselves if you do not want to pay for an advanced firewall and VPN gateway. In this article we are focusing only the VPN server component. If you would like to learn more about the ISA firewall and its advanced VPN server capabilities, check out [URL="http://www.isaserver.org/"]www.isaserver.org[/URL]
[B]Why Introduce a New VPN Protocol?[/B]

Microsoft already had two viable VPN protocols that allowed users to connect to the corporate network, so why introduce a third one? SSTP is a great advance for Windows VPN users because SSTP does not have the problems with firewalls and NAT devices that PPTP and L2TP/IPSec have. In order for PPTP to work through a NAT device, the NAT device needs to support PPTP through a PPTP “NAT editor”. If there is no NAT editor for PPTP on the NAT device, the PPTP connections will fail.
L2TP/IPSec has problems with NAT devices and firewalls because the firewall needs to have the L2TP port UDP 1701 open outbound, the IPSec IKE port, UDP 500 open outbound, and the IPSec NAT traversal port, UDP 4500 open outbound (the L2TP port is not required when using NAT-T). Most firewalls in public places, such as hotels, conference centers, restaurants, and other locations only allow a small number of ports open outbound, such as HTTP, TCP port 80 and HTTPS (SSL), TCP port 443. If you need support for protocols other than HTTP and SSL when you leave the office, you are playing a game of dice. You may or may not get the required ports needed for PPTP or L2TP/IPSec.
In contrast, SSTP VPN connections are tunneled over SSL using TCP port 443. Since all firewalls and NAT devices have TCP port 443 open, you will be able to use SSTP from anywhere. This greatly simplifies the life of the road warrior who needs to use VPN connections to connect to the office, and also makes life a lot easier on the lives of the corporate admin who needs to support the road warrior, as well as the help desk people at the service providers who provide Internet access for hotels, conference centers, and other public locations.
[B]The SSTP Connection Process[/B]

The following shows how the SSTP connection process works:

[LIST=1][*]The SSTP VPN client establishes a TCP connection with the SSTP VPN gateway between a random TCP source port on the SSTP VPN client and TCP port 443 on the SSTP VPN gateway.[*]The SSTP VPN client sends an SSL [I]Client-Hello[/I] message, indicating that the SSTP VPN client wants to establish an SSL session with the SSTP VPN gateway.[*]The SSTP VPN gateway sends [I]its computer certificate[/I] to the SSTP VPN client.[*]The SSTP VPN client validates the computer certificate by checking its Trusted Root Certification Authorities certificates store to see if the CA certificate that signed the server certificate is located in that store. The SSTP VPN client then determines the encryption method for the SSL session, generates an SSL session key and encrypts it with the SSTP VPN gateway’s public key, and then sends the encrypted form of the SSL session key to the SSTP VPN gateway.[*]The SSTP VPN gateway decrypts the encrypted SSL session key with the private key of its computer certificate’s private key. All future communication between the SSTP VPN client and the SSTP VPN gateway is encrypted with the negotiated encryption method and SSL session key.[*]The SSTP VPN client sends an HTTP over SSL (HTTPS) request message to the SSTP VPN gateway.[*]The SSTP VPN client negotiates an SSTP tunnel with the SSTP VPN gateway.[*]The SSTP VPN client negotiates a PPP connection with the SSTP server. This negotiation includes authenticating the user’s credentials using standard PPP authentication methods (or even EAP authentication) and configuring settings for Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6) traffic.[*]The SSTP client begins sending IPv4 or IPv6 traffic over the PPP link.[/LIST]
For those of you who are interested in the characteristics of the VPN protocol architecture, you can see that in the figure below. Notice that SSTP has an additional header compared to the other two VPN protocols. That because there is HTTPS encapsulation in addition to the SSTP header. L2TP and PPTP don’t have application layer headers encapsulating the communication.
[B][IMG]http://www.windowsecurity.com/img/upl/untitled1199791794046.JPG[/IMG]
Figure 1[/B]
We will use a simple three machine example network to show how SSTP works. The names and characteristics of the three machines are:
[B]Vista:
[/B]Vista Business Edition
Vista Service Pack 1
Non-domain member
[B]W2008RC0-VPNGW:
[/B]Windows Server 2008 Enterprise Edition
Two NICs – Internal and External
Domain member
[B]WIN2008RC-DC:
[/B]Windows Server 2008 Enterprise Edition
Domain Controller of MSFIREWALL.ORG domain
DHCP Server
DNS Server
Certificate Server (Enterprise CA)
Notice that you must use Vista Service Pack 1 as the VPN client. While there have been discussions in the past about Windows XP Service Pack 3 supporting SSTP, this may not end up being the case. I recently installed the release candidate for Windows XP Service Pack 3 on a test machine and found no evidence of SSTP support. This is a real shame, as there is a large installed based of Windows XP on laptop computers, and the common consensus at this time is that Vista is too slow for laptop use at this time. Perhaps the Vista performance problems will be rectified with Vista Service Pack 1.
The high level configuration of the example network is seen in the figure below.
[B][IMG]http://www.windowsecurity.com/img/upl/SSTP11199866863937.JPG[/IMG]
Figure 2[/B]
[B]Summary[/B]

In this article we went over a short history of remote access communications to computer networks. We then discussed the major VPN protocols supported by Windows servers and clients, and then went over some of the security issues with the traditional Windows VPN protocols. We then looked at how SSTP solves the security and accessibility issues presented with PPTP and L2TP/IPSec. Finally, we took a short look at the lab network we will be using in the next article, which will be all about putting together a simple SSTP VPN client and server solution using Windows Server 2008 and Windows Vista Service Pack 1. See you then! –Tom

[/LEFT]

[LEFT][CODE]http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Remote-Access-SSL-VPN-Server-Part2.html[/CODE]

[B][SIZE=3]PART-2[/SIZE][/B]

In the first part of this article series on how to configure Windows Server 2008 as a SSL VPN server, I went over some of the history of Microsoft VPN servers and VPN protocols. We finished that article up with a description of the example network that we’ll use in this and subsequent articles on configuring the VPN gateway to support SSTP connections from Vista SP1 clients.
Before we begin, I need to say that I know that there is a step by step guide on how to configure SSTP connections to Windows Server 2008 on the [URL="http://www.microsoft.com/"]www.microsoft.com[/URL] Web site. The problem with that article is that I felt it did not reflect a real world environment that uses an enterprise CA for certificate assignment. Because of that, and some of the issues that were left out of the Microsoft step by step guide, I decided to do this article. I think you will learn a few new things along the way as you follow along with me.
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1597491993/isaserver1-20/"]
[/URL][/CENTER]
I’m not going to go through all the steps from the ground up. I will assume that you have installed a DC and enabled the DHCP, DNS and Certificate Services roles on that server. The certificate server type should be Enterprise, so that you are hosting an enterprise CA on your network. The VPN server should be joined to the domain before you begin the following steps. The Vista client needs to have SP1 installed before you get started.
We will need to perform the following procedures to get the solution working:

[LIST][*]Install IIS on the VPN server[*]Request a machine certificate for the VPN server using the IIS Certificate Request Wizard[*]Install the RRAS server role on the VPN server[*]Enable the RRAS Server and configure it to be a VPN and NAT server[*]Configure the NAT server to publish the CRL[*]Configure the User Account to allow dial-up connections[*]Configure IIS on the Certificate Server to allow HTTP connections for the CRL directory[*]Configure the HOSTS file on the VPN client[*]Use PPTP to connect to the VPN server[*]Obtain a CA Certificate from the Enterprise CA[*]Configure the Client to use SSTP and Connect to the VPN Server using SSTP[/LIST]
[B]Install IIS on the VPN Server[/B]

This might sound like a strange way to get things started, as I normally suggest that you never put a Web server on a network security device. The good news is that we do not need to keep the Web server on the VPN server, we just need to use it for a little while. The reason for this is that the Web enrollment site included with the Windows Server 2008 Certificate Server is no longer very useful for requesting computer certificates. In fact, it is no use at all. What is interesting about this is that you can still try to get a computer certificate using the Web enrollment site, and it will look like it was installed, but in fact, the certificate is not installed.
To solve this problem, we will take advantage of the fact that we are using an enterprise CA. When using an Enterprise CA, you can make a request to an online certificate server. The online request for a computer certificate is allowed when you use the IIS Certificate Request Wizard and request what they now call a “Domain Certificate”. This only works when the machine requesting the certificate belongs to the same domain as the Enterprise CA.
Perform the following steps on the VPN server to install the IIS Web server role:

[LIST=1][*]Open the Windows 2008 [B]Server Manager.[/B][*]In the left pane of the console, click the [B]Roles[/B] node.[/LIST]
[IMG]http://www.windowsecurity.com/img/upl/image0021201691487909.jpg[/IMG]
[B]Figure 1[/B]

[LIST=1][*]Click the [B]Add Roles[/B] link on the right side of the right pane.[*]Click [B]Next[/B] on the [B]Before You Begin[/B] page.[*]Put a checkmark in the [B]Web Server (IIS)[/B] checkbox on the [B]Select Server Roles[/B] page. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0041201691487940.jpg[/IMG]
Figure 2[/B]

[LIST=1][*]Read the information on the [B]Web Server (IIS)[/B] page if you like. This is good general information about using IIS 7 as a Web server, but since we are not going to use the IIS Web server on the VPN server, this information does not really apply to our scenario. Click [B]Next[/B].[*]On the [B]Select Role Services[/B] page, a number of options are already selected. However, if you use the default options, it does not seem that you will get the option of using the Certificate Request Wizard. This was the case when I tested it. There is no Role Service for the Certificate Request Wizard, so I tried putting a checkmark in each of the [B]Security [/B]options and that seemed to work. Do the same on yours and click [B]Next[/B].[/LIST]
[IMG]http://www.windowsecurity.com/img/upl/image0061201691487940.jpg[/IMG]
[B]Figure 3[/B]

[LIST=1][*]Review the information on the [B]Confirm Installation Selections[/B] page and click [B]Install[/B].[*]Click [B]Close[/B] on the [B]Installation Results[/B] page.[/LIST]
[IMG]http://www.windowsecurity.com/img/upl/image0081201691602222.jpg[/IMG]
[B]Figure 4[/B]
[B]Request a Machine Certificate for the VPN Server using the IIS Certificate Request Wizard[/B]

The next step is to request a machine certificate for the VPN server. The VPN server needs a machine certificate to create the SSL VPN connection with the SSL VPN client computer. The common name on the certificate must match the name that the VPN client will use to connect to the SSL VPN gateway computer. This means that you will need to create a public DNS entry for the name on the certificate so that resolves to the external IP address on the VPN server, or the IP address of a NAT device in front of the VPN server that will forward the connection to the SSL VPN server.
Perform the following steps to request and install the computer certificate on the SSL VPN server:

[LIST=1][*]In the [B]Server Manager[/B], expand the [B]Roles[/B] node in the left pane and then expand the [B]Web Server (IIS)[/B] node. Click on [B]Internet Information Services (IIS) Manager[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0101201691602222.jpg[/IMG]
Figure 5[/B]

[LIST=1][*]In the [B]Internet Information Services (IIS) Manager[/B] console that appears in the panes to the right of the left pane, click on the name of the server. In this example, the name of the server is [B]W2008RC0-VPNGW[/B]. Click on the [B]Server Certificates[/B] icon in the right pane of the IIS console.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0121201691602237.jpg[/IMG]
Figure 6[/B]

[LIST=1][*]In the right pane of the console, click the [B]Create Domain Certificate[/B] link.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0141201691626644.jpg[/IMG]
Figure 7[/B]

[LIST=1][*]Fill out the information on the [B]Distinguished Name Properties[/B] page. The most important entry on this page is the [B]Common Name[/B] entry. This name is the name that VPN clients will use to connect to the VPN server. You will need a public DNS entry for this name so that it resolves either to the external interface of the VPN server, or the public address of a NAT device in front of the VPN server. In this example we will use the common name [B]sstp.msfirewall.org[/B]. Later, we will create HOSTS file entries on the VPN client computer so that it can resolve this name. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0161201691626644.jpg[/IMG]
Figure 8[/B]

[LIST=1][*]On the [B]Online Certification Authority[/B] page, click the [B]Select [/B]button. In the [B]Select Certification Authority[/B] dialog box, click the name of the Enterprise CA and click [B]OK[/B]. Enter a friendly name for the certificate in the [B]Friendly name[/B] text box. In this example we’ll use the name [B]SSTP Cert[/B] so that we know it is being used for the SSTP VPN gateway.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0181201691626644.jpg[/IMG]
Figure 9[/B]

[LIST=1][*]Click [B]Finish[/B] on the [B]Online Certification Authority[/B] page.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0201201691650253.jpg[/IMG]
Figure 10[/B]

[LIST=1][*]The wizard will run and then disappear. After this point you will see the certificate appear in the IIS console. Double click on the certificate and you can see the common name in the [B]Issued to[/B] section and that we have a private key that corresponds to the certificate. Click [B]OK[/B] to close the [B]Certificate[/B] dialog box.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0221201691650253.jpg[/IMG]
Figure 11[/B]
Now that we have a certificate, we can install the RRAS Server Role. Note that it is critical that you [I]install the certificate first[/I], before you install the RRAS Server Role. If you do not, you will end up being in a world of hurt, because you will have to use a fairly complex command line routine to bind the certificate to the SSL VPN listener.
[B]Install the RRAS Server Role on the VPN Server[/B]

To install the RRAS Server Role, perform the following steps:

[LIST=1][*]In the [B]Server Manager[/B], click the [B]Roles[/B] node in the left pane of the console.[*]In the [B]Roles Summary[/B] section, click the [B]Add Roles[/B] link.[*]Click [B]Next[/B] on the [B]Before You Begin[/B] page.[*]On the [B]Select Server Roles[/B] page, put a checkmark in the [B]Network Policy and Access Services[/B] checkbox. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0241201691650269.jpg[/IMG]
Figure 12[/B]

[LIST=1][*]Read the information on the [B]Network Policy and Access Services[/B] page. Most of it is about the new Network Policy Server (which used to be called the Internet Authentication Server [IAS] which was a RADIUS server) and NAP, neither of which apply to our current scenario. Click [B]Next[/B].[*]On the [B]Select Role Services[/B] page, put a checkmark in the [B]Routing and Remote Access Services[/B] checkbox. This will put checkmarks in the [B]Remote Access Service[/B] and [B]Routing[/B] checkboxes. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0261201691688065.jpg[/IMG]
Figure 13[/B]

[LIST=1][*]Click [B]Install[/B] on the [B]Confirm Installation Selections[/B] page.[*]Click [B]Close[/B] on the [B]Installation Results[/B] page.[/LIST]
[B]Enable the RRAS Server and Configure it to be a VPN and NAT Server[/B]

Now that the RRAS server role is installed, we need to enable the RRAS service, just like how we did it in previous versions of Windows. We need to enable the VPN server feature and the NAT service. While it is clear why we need to enable the VPN server component, you might wonder why we need to enable the NAT server. The reason for enabling the NAT server is so that external clients can gain access to the Certificate Server to connect to the CRL. If the SSTP VPN client cannot download the CRL, the SSTP VPN connection will fail.
In order to allow access to the CRL, we will configure the VPN server as a NAT server and publish the CRL using reverse NAT. In a production environment you will be more likely to have a firewall, such as an ISA Firewall, in front of the Certificate Server, so that you would publish the CRL using the firewall. However, in this example the only firewall we will be using is the Windows Firewall on the VPN server, so we will need to configure the VPN server as a NAT server in this example.
Perform the following steps to enable the RRAS service:

[LIST=1][*]In the [B]Server Manager[/B], expand the [B]Roles[/B] node in the left pane of the console. Expand the [B]Network Policy and Access Services [/B]node and click on the [B]Routing and Remote Access[/B] node. Right click on the [B]Routing and Remote Access[/B] node and click [B]Configure and Enable Routing and Remote Access[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0281201691688081.jpg[/IMG]
Figure 14[/B]

[LIST=1][*]Click [B]Next[/B] on the [B]Welcome to the Routing and Remote Access Server Setup Wizard[/B] page.[*]On the [B]Configuration [/B]page, select the [B]Virtual private network (VPN) access and NAT[/B] option and click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0301201691688081.jpg[/IMG]
Figure 15[/B]

[LIST=1][*]On the [B]VPN Connection[/B] page, select the NIC in the [B]Network interfaces[/B] section that represents the external interface of the VPN server. Then click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0321201691705190.jpg[/IMG]
Figure 16[/B]

[LIST=1][*]On the [B]IP Address Assignment[/B] page, select the [B]Automatically[/B] option. We can select this option because we have a DHCP server installed on the domain controller behind the VPN server. If you did not have a DHCP server, then you would have to select the [B]From a specified range of addresses[/B] option and then provide a list of addresses that VPN clients could use when connecting to the network through the VPN gateway. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0341201691705190.jpg[/IMG]
Figure 17[/B]

[LIST=1][*]On the [B]Managing Multiple Remote Access Servers[/B] page, select the [B]No, use Routing and Remote Access to authenticate connection requests[/B]. This is the option we use when there is no NPS or RADIUS server available. Since the VPN server is a member of the domain, you can authenticate users using domain accounts. If the VPN server were not a member of the domain, then only local accounts on the VPN server could be used, unless you decide to use the NPS server. I’ll do an article on how to use an NPS server in the future. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0361201691705190.jpg[/IMG]
Figure 18[/B]

[LIST=1][*]Read the summary information on the [B]Completing the Routing and Remote Access Server Setup Wizard[/B] page and click [B]Finish[/B].[*]Click [B]OK[/B] in the [B]Routing and Remote Access [/B]dialog box informing you that relaying of DHCP messages requires a DHCP relay agent.[*]In the left pane of the console, expand the [B]Routing and Remote Access[/B] node and then click on the [B]Ports [/B]node. In the middle pane you will see that WAN Miniport connections for SSTP are now available.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0381201691725737.jpg[/IMG]
Figure 19[/B]
[B]Configure the NAT Server to Publish the CRL[/B]

As I mentioned earlier, the SSL VPN client needs to be able to download the CRL to confirm that the server certificate on the VPN server has not been revoked. In order to do this, you need to configure a device in front of the certificate server to forward HTTP requests for the CRL location to the Certificate Server.
How do you know what URL the SSL VPN client needs to connect to in order to download the CRL? That information is contained within certificate itself. If you go to the VPN server again and double click on the certificate in the IIS console, as you did earlier, you will be able to find this information.
Click the [B]Details[/B] tab of the certificate and scroll down to the [B]CRL Distribution Points[/B] entry and click on that entry. In the lower pane you will see the various distribution points based on the protocol used to access those points. In the certificate seen in the figure below, you can see that we need to allow the SSL VPN client access to the CRL via the URL:
[I][url]http://win2008rc0-dc.msfirewall.org/CertEnroll/WIN2008RC0-DC.msfirewall.org.crl[/url][/I]
[B][IMG]http://www.windowsecurity.com/img/upl/image0401201691725753.jpg[/IMG]
Figure 20[/B]
Because of this, you need to create a public DNS entry for this name so that external VPN clients can resolve this name to an IP address on a device that will perform reverse NAT or reverse proxy to allow access to the Certificate Server’s Web site. In this example, we need to have [B]win2008rc0-dc.msfirewall.org[/B] resolve to the IP address on the external interface of the VPN server. When the connection reaches the external interface of the VPN server, the VPN server will reverse NAT the connection to the Certificate Server.
If you are using an advanced firewall, such as an ISA Firewall, you could make publishing the CRL site more secure, by allowing access [I]only[/I] to the CRL, and not the entire site. However, in this article we will limit ourselves to the capabilities of a simple NAT device, such as what the RRAS NAT provides.
I should note here that using the default CRL site name might not be the more secure option, since it exposes a private computer name to the Internet. You can create a custom CDP (CRL Distribution Point) to prevent this if you consider exposing the private name of your CA in your public DNS a security issue. You can find some information on how to change these values at [URL="http://support.microsoft.com/kb/313234"]How to Change the Policy Settings for a Certification Authority (CA) in Windows 2000[/URL].
Perform the following steps to configure RRAS NAT to forward HTTP requests to Certificate Server:

[LIST=1][*]In the left pane of the [B]Server Manager[/B], expand the [B]Routing and Remote Access[/B] node and then expand the [B]IPv4[/B] node. Click on the [B]NAT[/B] node.[*]In the [B]NAT[/B] node, right click on the external interface in the middle pane of the console. In this example, the name of the external interface is [B]Local Area Connection[/B]. Click [B]Properties[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0421201691725753.jpg[/IMG]
Figure 21[/B]

[LIST=1][*]In the [B]Local Area Connection Properties [/B]dialog box, click on the [B]Web Server (HTTP)[/B] checkbox. That brings up the [B]Edit Service[/B] dialog box. In the [B]Private Address[/B] text box, enter the IP address of the Certificate Server on the internal network. Click [B]OK[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0441201691741815.jpg[/IMG]
Figure 22[/B]

[LIST=1][*]Click [B]OK[/B] in the [B]Local Area Connection Properties[/B] dialog box.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0461201691741831.jpg[/IMG]
Figure 23[/B]
Now that the NAT server is installed and configured, we can move our attention to configuring the CA server and the SSTP VPN client.
[B]Summary[/B]

In this article we continued our series on configuring a SSL VPN server using Windows Server 2008. We went over installing IIS on the VPN server, requesting and installing a server certificate, and installing and configuring the RRAS and NAT services on the VPN server. In the next article, we’ll finish up by configuring the CA server and the SSTP VPN client. See you then! –Tom

[/LEFT]

[LEFT][CODE]http://www.windowsecurity.com/articles/Configuring-Windows-Server-2008-Remote-Access-SSL-VPN-Server-Part3.html[/CODE]


[B][SIZE=3]PART-3[/SIZE][/B]


In the first two parts of this series on how to create an SSL VPN server on Windows Server 2008, we went over the basics of VPN networking and then dived into the configuration of the server. At this point we are ready to finish things up by performing some small configuration changes in the Active Directory and on the CA Web site. After making these changes, we will focus on the VPN client configuration and finish up by establishing the SSL VPN connection.
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1597491993/isaserver1-20/"]
[/URL][/CENTER]
[B]Configure the User Account to Allow Dial-up Connections[/B]

User accounts need permission for dial-up access before they can connect to a Windows VPN server that is a member of an Active Directory domain. The best way to do this is to use a Network Policy Server (NPS) and use the default user account permission which is to allow remote access based on NPS policy. However, we did not install an NPS server in this scenario, so we will have to manually configure the user’s dial-in permission.
I will write a future article on how you can use an NPS server and EAP User Certificate authentication to establish the SSL VPN server connection.
Perform the following steps to enable dial-in permission on the user account that you want to connect to the SSL VPN server. In this example we will enable dial-in access for the default domain administrator account:

[LIST=1][*]At the domain controller, open the [B]Active Directory Users and Computers[/B] console from the [B]Administrative Tools[/B] menu.[*]In the left pane of the console, expand the domain name and click on the [B]Users[/B] node. Double click on the [B]Administrator[/B]account.[*]Click on the [B]Dial-in[/B] tab. The default setting is [B]Control access through NPS Network Policy[/B]. Since we do not have an NPS server in this scenario, we will change the setting to [B]Allow access[/B], as seen in the figure below. Click [B]OK[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0011202989466314.png[/IMG]
Figure 1[/B]
[B]Configure IIS on the Certificate Server to Allow HTTP Connections for the CRL Directory[/B]

For some reason, when the installation wizard installs the Certificate Services Web site, it configures the CRL directory to require an SSL connection. While this seems like a good idea from a security point of view, the problem is that the URI on the certificate is not configured to use SSL. I suppose you could create a custom CDP entry for the certificate so that it uses SSL, but you can bet dollars to donuts that Microsoft has not documented this problem anywhere. Since we are using the default settings for the CDP in this article, we need to turn off the SSL requirement on the CA’s Web site for the CRL directory path.
Perform the following steps to disable the SSL requirement for the CRL directory:

[LIST=1][*]From the [B]Administrative Tools[/B] menu, open the [B]Internet Information Services (IIS) Manager[/B].[*]In the left pane of the IIS console, expand the server name and then expand the [B]Sites[/B] node. Expand the [B]Default Web Site[/B] node and click on the [B]CertEnroll [/B]node, as seen in the figure below.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0031202989466329.png[/IMG]
Figure 2[/B]

[LIST=1][*]If you look in the middle pane of the console, you will see that the [B]CRL [/B]is located in this virtual directory, as seen in the figure below. In order to see the content of this virtual directory, you will need to click on the [B]Content View[/B] button at the bottom of the middle pane.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0051202989466329.png[/IMG]
Figure 3[/B]

[LIST=1][*]Click on the [B]Features View[/B] button on the bottom of the middle pane. At the bottom of the middle pane, double click the [B]SSL Settings[/B] icon.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0081202989488251.jpg[/IMG]
Figure 4[/B]

[LIST=1][*]The [B]SSL Settings[/B] page appears in the middle pane. Remove the checkmark from the [B]Require SSL[/B] checkbox. Click the [B]Apply[/B] link in the right pane of the console.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0101202989488251.jpg[/IMG]
Figure 5[/B]

[LIST=1][*]Close the IIS console after you see the [B]The changes have been successfully saved[/B] Alert.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0111202989488251.png[/IMG]
Figure 6[/B]
[B]Configure the HOSTS File on the VPN Client[/B]

Now we can move our attention to the VPN client. The first thing we need to do on the client is configure the HOSTS file so that we can simulate a public DNS infrastructure. There are two names that we need to enter into the HOSTS file (and the same is true for the public DNS server that you would use in a production environment). The first name is the name of the VPN server, as defined by the common/subject name on the certificate that we have bound to the SSL VPN server. The second name we need to enter into the HOSTS file (and the public DNS server) is the CDP URL, which is found on the certificate. We saw the location of the CDP information in part 2 of this series.
The two names we will need to enter into the HOSTS file in this example are:
[I]192.168.1.73 sstp.msfirewall.org[/I]
[I]192.168.1.73 win2008rc0-dc.msfirewall.org[/I]
Perform the following steps on the Vista SP1 VPN client to configure the HOSTS file:

[LIST=1][*]Click the [B]Start[/B] button and enter [B]c:\windows\system32\drivers\etc\hosts[/B] in the search box and press ENTER.[*]In the [B]Open With[/B] dialog box, double click on [B]Notepad[/B].[*]Enter the HOSTS file entries using the format as seen in the figure below. Make sure that you press enter after the last line so that the cursor appears under the last line.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0141202989499517.jpg[/IMG]
Figure 7[/B]

[LIST=1][*]Close the file and choose the [B]save[/B] option when asked.[/LIST]
[B]Use PPTP to Connect to the VPN Server[/B]

We are getting closer to creating an SSL VPN connection! The next step is to create a VPN connectoid on the Vista SP1 client that will allow us to make an initial VPN connection to the VPN server. We need to do this in our current scenario because the client computer is not a domain member. Since the machine is not a domain member, it will not have the CA certificate automatically installed in its Trusted Root Certificate Authorities machine certificate store. If the machine were a domain member, autoenrollment would have taken care of that problem for us, since we have installed an Enterprise CA.
The easiest way to do this is to create a PPTP connection from the Vista SP1 VPN client to the Windows Server 2008 VPN server. By default, the VPN server will support PPTP connections and the client will try PPTP first before trying L2TP/IPSec and SSTP. To do this, we need to create a VPN connectoid or connection object.
Perform the following steps on the VPN client to create the connectoid:

[LIST=1][*]On the VPN client, right click the network icon in the tray and click the [B]Network and Sharing Center[/B].[*]In the Network Sharing Center window, click the [B]Set up a connection or network[/B] link on the left side of the window.[*]On the [B]Choose a connection option[/B] page, click on the [B]Connect to a workplace[/B] entry and click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0161202989587001.jpg[/IMG]
Figure 8[/B]

[LIST=1][*]On the [B]How do you want to connect[/B] page, select the [B]Use my Internet connection (VPN)[/B] entry.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0181202989587001.jpg[/IMG]
Figure 9[/B]

[LIST=1][*]On the [B]Type the Internet address to connect to[/B] page, enter the name of the SSL VPN server. Make sure that this is the same name as the common name on the certificate used by the SSL VPN server. In this example, the name is [B]sstp.msfirewall.org[/B]. Enter a [B]Destination Name[/B]. In this example we will name the destination [B]SSL VPN[/B]. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0201202989587017.jpg[/IMG]
Figure 10[/B]

[LIST=1][*]On the [B]Type your user name and password[/B] page, enter the [B]User name[/B], [B]Password[/B] and [B]Domain[/B]. Click [B]Connect[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0221202990225236.jpg[/IMG]
Figure 11[/B]

[LIST=1][*]Click [B]Close[/B] on the [B]You are connected [/B]page.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0241202990225236.jpg[/IMG]
Figure 12[/B]

[LIST=1][*]On the [B]Select a location for the “SSL VPN” network[/B] page, select the [B]Work[/B] option.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0261202990225236.jpg[/IMG]
Figure 13[/B]

[LIST=1][*]Click [B]Continue[/B] on the UAC prompt.[*]Click [B]Close[/B] on the [B]Successfully set network settings[/B] page.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0281202990285907.jpg[/IMG]
Figure 14[/B]

[LIST=1][*]In the [B]Network and Sharing Center[/B], click on the [B]View status[/B] link in the [B]SSL VPN[/B] section, as seen in the figure below. You will see in the [B]SSL VPN Status[/B] dialog box that the VPN connection type is PPTP. Click [B]Close [/B]in the [B]SSL VPN Status[/B] dialog box.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0301202990285907.jpg[/IMG]
Figure 15[/B]

[LIST=1][*]Open a command prompt and ping the domain controller. In this example, the IP address of the domain controller is [B]10.0.0.2[/B]. If your VPN connection is successful, you will receive a ping reply from the domain controller.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0321202990285907.jpg[/IMG]
Figure 16[/B]
[B]Obtain a CA Certificate from the Enterprise CA[/B]

The SSL VPN client needs to trust the CA that issued the certificate used by the VPN server. In order to establish this trust, we need to install the CA certificate of the CA that issued the VPN server’s certificate. We can do this by connecting to the Web enrollment site on the CA on the internal network and installing the certificate in the VPN client’s Trusted Root Certification Authorities certificate store.
Perform the following steps to obtain the certificate from the Web enrollment site:

[LIST=1][*]On the VPN client that is connected to the VPN server over a PPTP link, enter [B][url]http://10.0.0.2/certsrv[/url][/B] in the address bar in Internet Explorer and press ENTER.[*]Enter a user name and password that is valid in the credentials dialog box. In this example we will use the default domain administrator account’s username and password.[*]On the [B]Welcome[/B] page of the Web enrollment site, click the [B]Download a CA certificate, certificate chain, or CRL[/B] link.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0341202990310954.jpg[/IMG]
Figure 17[/B]

[LIST=1][*]Click [B]Allow[/B] in the dialog box warning you that [B]A website wants to open web content using this program on your computer[/B]. Then click [B]Close[/B] on the [B]Did you notice the Information bar[/B] dialog box if it appears.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0361202990310954.jpg[/IMG]
Figure 18[/B]

[LIST=1][*]Note that the Information bar informs you that the Web site might not work correctly, since the ActiveX control is blocked. This should not be a problem, as we will be downloading the CA certificate and using the Certificates MMC to install the certificate. Click the [B]Download CA certificate[/B] link.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0381202990310954.jpg[/IMG]
Figure 19[/B]

[LIST=1][*]In the [B]File Download – Security Warning[/B] dialog box, click the [B]Save[/B] button. Save the certificate to the Desktop.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0401202990342345.jpg[/IMG]
Figure 20[/B]

[LIST=1][*]Click [B]Close[/B] in the [B]Download complete [/B]dialog box.[*]Close [B]Internet Explorer[/B].[/LIST]
Now we need to install the CA certificate into the VPN client machine’s Trusted Root Certification Authorities Certificate Store. Perform the following steps to install the certificate:

[LIST=1][*]Click [B]Start[/B] and then enter [B]mmc[/B] in the Search box. Press ENTER.[*]Click [B]Continue[/B] in the UAC dialog box.[*]In the [B]Console1[/B] window, click the [B]File[/B] menu and then click [B]Add/Remove Snap-in[/B].[*]In the [B]Add or Remove Snap-ins[/B] dialog box, click the [B]Certificates[/B] entry in the [B]Available snap-ins[/B] list and then click [B]Add[/B].[*]On the [B]Certificates snap-in[/B] page, select the [B]Computer account[/B] option and click [B]Finish[/B].[*]On the [B]Select Computer[/B] page, select the [B]Local computer[/B] option and click [B]Finish[/B].[*]Click [B]OK[/B] in the [B]Add or Remove Snap-ins[/B] dialog box.[*]In the left pane of the console, expand the [B]Certificates (Local Computer)[/B] node and then expand the [B]Trusted Root Certification Authorities[/B] node. Click on the [B]Certificates[/B] node. Right click on the [B]Certificates[/B] node, point to [B]All Tasks[/B] and click [B]Import[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0421202990342361.jpg[/IMG]
Figure 21[/B]

[LIST=1][*]Click [B]Next[/B] on the [B]Welcome to the Certificate Import Wizard[/B] page.[*]On the [B]File to Import[/B] page, use the [B]Browse[/B] button to find the certificate, then click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0441202990342361.jpg[/IMG]
Figure 22[/B]

[LIST=1][*]On the [B]Certificate Store[/B] page, confirm that the [B]Place all certificates in the following store[/B] option is selected and that the [B]Trusted Root Certification Authorities[/B] store is the one listed. Click [B]Next[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0461202990373939.jpg[/IMG]
Figure 23[/B]

[LIST=1][*]Click [B]Finish[/B] on the [B]Completing the Certificate Import[/B] page.[*]Click [B]OK[/B] in the dialog box informing you that the import was successful.[*]The certificate now appears in the console, as seen in the figure below.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0471202990373939.png[/IMG]
Figure 24[/B]

[LIST=1][*]Close the MMC console.[/LIST]
[B]Configure the Client to use SSTP and Connect to the VPN Server using SSTP[/B]

We are almost there! Now we need to disconnect the VPN connection and configure the VPN client to use SSTP for its VPN protocol. In a production environment, you should not have the users do this step, as you would be using the Connection Manager Administration Kit to create the VPN connectoid for the user, which will set the client to use SSTP, or you would configure only SSTP ports on the VPN server.
It depends on your environment, as you want to time things so that users can use PPTP for a while as you are deploying certificates. Of course, you can always deploy the CA certificates out of band, such as via a Web site download or e-mail, in which case you would not need to allow PPTP. But then, if you had some downlevel clients that do not support SSTP, you would need to allow PPTP or L2TP/IPSec, so you would not be able to disable all non-SSTP ports. In that case, you will have to depend on manual configuration or an updated CMAK package.
Another option is to bind the SSTP listener to a specific IP address in the RRAS server. In this case, you could create a custom CMAK package that points only to the IP address on the SSL VPN server that is listening for the incoming SSTP connections. Other addresses on the SSTP VPN server would listen for PPTP and/or L2TP/IPSec connections.
Perform the following steps to disconnect the PPTP session and configure the VPN client connectoid to use SSTP:

[LIST=1][*]At the VPN client computer, open the [B]Network and Sharing Center[/B] as you did earlier.[*]In the [B]Network and Sharing Center[/B] window, click the [B]Disconnect[/B] link, which lies just under the [B]View Status [/B]link we used earlier. The [B]SSL VPN[/B] section will disappear from the [B]Network and Sharing[/B] [B]Center[/B].[*]In the [B]Network and Sharing Center[/B], click the [B]Manage network connections[/B] link.[*]Right click the [B]SSL VPN[/B] link and click the [B]Properties[/B] command.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0491202990373954.png[/IMG]
Figure 25[/B]

[LIST=1][*]In the [B]SSL VPN Properties[/B] dialog box, click the [B]Networking[/B] tab. In the [B]Type of VPN[/B] drop down box, click the down arrow and select the [B]Secure Socket Tunneling Protocol (SSTP)[/B] option and click [B]OK[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0511202990392751.png[/IMG]
Figure 26[/B]

[LIST=1][*]Double click the [B]SSL VPN[/B] connectoid in the [B]Network Connections[/B] window.[*]In the [B]Connect SSL VPN [/B]dialog box, click the [B]Connect[/B] button.[*]When the connection is complete, right click the [B]SSL VPN[/B] connectoid in the [B]Network Connections[/B] window and click [B]Status[/B].[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0531202990392751.png[/IMG]
Figure 27[/B]

[LIST=1][*]In the [B]SSL VPN Status[/B] dialog box, you can see that an SSTP WAN Miniport connection was established.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0551202990412142.png[/IMG]
Figure 28[/B]

[LIST=1][*]If you go to the VPN server and open the [B]Routing and Remote Access Console[/B], you will confirm that an SSTP connection was established.[/LIST]
[B][IMG]http://www.windowsecurity.com/img/upl/image0581202990412142.jpg[/IMG]
Figure 29[/B]
[B]Summary[/B]

In this, the final part of our article series on how to put together an SSL VPN server using Windows Server 2008, we completed the configuration of the user account, the CRL Web site, and the SSL VPN client. We finished up by completing the SSTP connection and confirmed that it was successful. I hope you enjoyed this series and you’re always welcome to write to me with questions at [EMAIL="tshinder@isaserver.org"]tshinder@isaserver.org[/EMAIL]. Thanks! –Tom
[/LEFT]