Configuring Windows Server 2003-based ISA Server Firewall/VPN Server to Accept inbound NAT-T L2TP/IP

[LEFT][CODE]http://www.isaserver.org/tutorials/natt2003.html[/CODE]


Road warriors depend on VPN access to the corporate network. Just one file, one presentation, can make the difference between happy holidays for everyone and standing in line at a soup kitchen. Windows Server 2003 supports PPTP, L2TP/IPSec, and the new RFC IPSec NAT Traversal VPN protocol. IPSec NAT-T allows your road warriors to use IPSec to connect from anywhere. Check this article to find out how.

There are a lot of reasons why you would want to run your ISA Server firewall on a Windows Server 2003 machine instead of Windows 2000. Just of few of these include:
Windows Server 2003 appears to be significantly more secure than Windows 2000, as least right out of the box
Windows Server 2003 supports VPN client quarantine
Windows Server 2003 supports conditional DNS forwarding
Windows Server 2003 supports NetBIOS proxy name resolution
Windows Server 2003 supports NAT-T L2TP/IPSec VPN clients
Support for NAT-T L2TP/IPSec VPN clients is provides one of the most compelling reasons to put your ISA Server firewall/VPN server on Windows Server 2003 instead of Windows Server 2003.
[CENTER][FONT=Verdana][B][URL="http://www.amazon.com/exec/obidos/ASIN/1928994296/ref=nosim/searchbyisbn/wwwshindernet-20"]
[/URL][/B][/FONT][/CENTER]
Why? Because you may want to allow external NAT-T L2TP/IPSec clients located behind a NAT device to connect to your Windows Server 2003-based ISA Server firewall/VPN server. Normally, any IPSec based protocol cannot be passed through a NAT device because NAT and IPSec are incompatible. Either the NAT device invalidates the packet, or the NAT device cannot read the packet headers required for address translation. The only other option you have is PPTP. While some NAT devices handle multiple outgoing PPTP connection intelligently, more often than not your outbound PPTP through a hotel conference center will get "bumped" after a certain number of other outbound PPTP connections are established
[INDENT] [I][B]Note:[/B]
For an excellent review of the issues involved with passing IPSec based protocols through a NAT device, please refer to Stefaan Pouseele's article [B][URL="http://isaserver.org/articles/IPSec_Passthrough.html"][COLOR=#800080]How to pass IPSec traffic through ISA Server[/COLOR][/URL][/B][/I][/INDENT]The figure below shows the typical remote access VPN scenario. A user is located at a hotel or home office and needs to create a secure L2TP/IPSec connection to the corporate network. This VPN user as two choices: PPTP or NAT-T L2TP/IPSec. While normal IPSec packets are stopped by NAT devices (such as NAT routers and "Internet gateways"), the NAT-T L2TP/IPSec packets are wrapped or "encapsulated" by UDP headers. These UDP headers protect the IPSec protected portion of the packet and allow the VPN connection to pass through the NAT device without harm. Note that in the figure below that the UDP 1701 header is encapsulated in the UDP 4500 header. The NAT device only needs to be able to pass UDP 500 and UDP 4500.
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1801.gif[/IMG][/URL][/FONT]
[FONT=Verdana]The advantage of using the Windows VPN client software to connect to the Windows Server 2003-based ISA Server firewall/VPN server is that both the client and server are RFC compliant. Unlike other major VPN server vendors that use non-RFC, proprietary and incompatible methods of NAT Traversal, the Microsoft NAT-T solution is compliant with IETF Internet draft standards.[/FONT]
[INDENT] [FONT=Verdana][I][B]Note:
[/B]For comprehensive information on how to install the Microsoft NAT-T L2TP/IPSec client, please refer the [B]ISA Server 2000 VPN Deployment Kit[/B] document that applies to your Windows client operating system at [B][URL="http://www.isaserver.org/img/upl/vpnkitbeta2/toc.htm"][COLOR=#800080]Complete List of ISA Server 2000 VPN Deployment Kit Documents[/COLOR][/URL][/B]. For more information on the details of the Windows NT/9x NAT-T L2TP/IPSec client, check out [B][URL="http://support.microsoft.com/default.aspx?scid=kb;en-us;324915"][COLOR=#800080]Description of the Microsoft L2TP/IPSec Virtual Private Networking Client for Earlier Clients[/COLOR][/URL][/B]. For more information on the details of the Windows 2000/Windows XP NAT-T L2TP/IPSec client, check out [B][URL="http://support.microsoft.com/default.aspx?scid=kb;en-us;818043"][COLOR=#800080]L2TP/IPSec NAT-T Update for Windows XP and Windows 2000[/COLOR][/URL][/B].[/I][/FONT]


[FONT=Verdana][I]
[/I][/FONT][/INDENT]

[B]Packet Filters Required to Allow Inbound NAT-T VPN Calls[/B]

[FONT=Verdana] [/FONT][FONT=Verdana]You need to do the following on the ISA Server firewall/VPN server to support inbound VPN calls from NAT-T RFC compliant L2TP/IPSec clients that are situated behind a NAT device:[/FONT]
[FONT=Verdana]Create a packet filter for inbound UDP 500 (receive/send)
Create a packet filter for inbound UDP 4500 (receive/send)
Create a packet filter for inbound UDP 1701 (receive/send)
[/FONT] [FONT=Verdana]The UDP 500 receive/send packet filter allows for Internet Key Exchange Protocol (IKE) packets to be received by the ISA Server firewall/VPN server. This packet filter is required for both NAT-T VPN clients and non-NAT-T VPN clients.[/FONT]
[FONT=Verdana]The UDP 4500 receive/send packet filter is specific for NAT-T VPN clients. The IPSec ESP header is encapsulated in the UDP port 4500 header. When the Windows Server 2003 ISA Server/VPN server receives the packet, it removes the UDP header and exposes the ESP header. This is how the server determines that the VPN client is a NAT-T client.[/FONT]
[FONT=Verdana]The UDP 1701 receive/send packet filter allows the L2TP control channel to be established and maintained. The are a number of different control messages that are sent through the L2TP control channel. The purpose of the control messages is to establish the VPN tunnel, maintain the VPN tunnel, and tear down (close) the tunnel in an orderly fashion when the connection is no longer needed. [/FONT]
[FONT=Verdana]The figure below shows the structure of an L2TP/IPSec packet. Notice that the IPSec ESP header is located in front of the L2TP UDP header. The IPSec ESP header does not require an open port. However, it does require that the firewall listen and accept incoming connections to IP Protocol 50. Only the tunnel IP header containing the tunnel endpoint information and the datalink layer header encapsulate the IPSec ESP header.[/FONT]
[FONT=Verdana][/FONT][INDENT] [FONT=Verdana][I][B]Note:
[/B]You do not need to create a packet filter to allow incoming IP Protocol 50. The reason for this is unknown.[/I][/FONT][/INDENT][FONT=Verdana] [/FONT][FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1802.gif[/IMG][/URL][/FONT]
[FONT=Verdana]Create the three packet filters at the ISA Server firewall/VPN server accepting the L2TP/IPSec connections from L2TP/IPSec clients located behind a NAT device. If you do not want to support NAT-T L2TP/IPSec clients, then you can use the ISA Server VPN Wizard and all the required packet filters are created for you.[/FONT]
[B]Creating the Packet Filter for UDP Port 500[/B]

[FONT=Verdana] [/FONT][FONT=Verdana]Perform the following steps to create the packet filter for UDP Port 500:[/FONT]

[LIST=1][FONT=Verdana][*]In the [B]ISA Management [/B]console, expand the [B]Server and Arrays [/B]node, then expand your server name. Expand the [B]Access Policy [/B]node. Right click the [B]Packet Filters[/B] node, point to [B]New[/B] and click [B]Filter[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1803.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Type a name for the packet filter in the [B]IP packet filter name[/B] text box on the W[B]elcome to the New IP Packet Filter Wizard[/B] page. I recommend you name it [B]UDP 500 (receive/send)[/B]. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1804.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]Allow packet transmission[/B] option on the [B]Filter Mode[/B] page. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1805.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]Custom[/B] option on the [B]Filter Type[/B] page. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1806.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Configure the details of the packet filter on the [B]Filter Settings[/B] page. Select the [B]UDP [/B]option from the [B]IP protocol[/B] drop down list box. Select the [B]Receive send[/B] option in the [B]Direction[/B] drop down list box. Select the [B]Fixed port[/B] option in the [B]Local Port[/B] drop down list box. Set the local [B]Port number [/B]to [B]500[/B]. Select the [B]All ports[/B] option in the [B]Remote port [/B]drop down list box. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1807.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]Default IP addresses for each external interface on the ISA Server computer[/B] option on the [B]Local Computer [/B]page. The default IP address is the primary IP address bound to the interface. The primary address is the IP address at the top of the list in the [B]Advanced TCP/IP Properties[/B] dialog box. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1808.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]All remote computers[/B] option on the [B]Remote Computers[/B] page. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1809.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Review the settings on the [B]Completing the New IP Packet Filter Wizard[/B] page, then click [B]Finish[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1810.gif[/IMG][/URL][/FONT]
[FONT=Arial][SIZE=2] [CENTER][FONT=Verdana][B][FONT=Verdana][SIZE=2][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][/URL][/SIZE][/FONT][/B][/FONT][/CENTER]
[/SIZE][/FONT] [B]Creating the Packet Filter for UDP 4500[/B]

[FONT=Verdana] [/FONT][FONT=Verdana]Perform the following steps to create the packet filter for UDP 4500:[/FONT]

[LIST=1][FONT=Verdana][*]In the [B]ISA Management [/B]console, expand the [B]Server and Arrays [/B]node, then expand your server name. Expand the [B]Access Policy [/B]node. Right click the [B]Packet Filters[/B] node, point to [B]New[/B] and click [B]Filter[/B].[*]Type a name for the packet filter in the [B]IP packet filter name[/B] text box on the W[B]elcome to the New IP Packet Filter Wizard[/B] page. I recommend you name it [B]UDP 4500 (receive/send)[/B]. Click [B]Next[/B].[*]Select the [B]Allow packet transmission [/B]option on the [B]Filter Mode[/B] page. Click [B]Next[/B].[*]Select [B]Custom[/B] on the [B]Filter Type[/B] page. Click [B]Next[/B].[*]Configure the details of the packet filter on the [B]Filter Settings[/B] page. Select the [B]UDP [/B]option from the [B]IP protocol[/B] drop down list box. Select the [B]Receive send[/B] option in the [B]Direction[/B] drop down list box. Select the [B]Fixed port[/B] option in the [B]Local Port[/B] drop down list box. Set the local [B]Port number [/B]to [B]4500[/B]. Select the [B]All ports[/B] option in the [B]Remote port [/B]drop down list box. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1811.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]Default IP addresses for each external interface on the ISA Server computer[/B] option on the [B]Local Computer [/B]page. The default IP address is the primary IP address bound to the interface. The primary address is the IP address at the top of the list in the [B]Advanced TCP/IP Properties[/B] dialog box. Click [B]Next[/B].[*]Select the [B]All remote computers[/B] option on the [B]Remote Computers[/B] page. Click [B]Next[/B].[*]Review the settings on the [B]Completing the New IP Packet Filter Wizard[/B] page, then click [B]Finish[/B].[/FONT][/LIST]
[FONT=Verdana]Neither the Windows 2000/Windows Server 2003 server, nor the ISA Server services, need to be restarted. The packet filters will start working automatically. If you have a very busy machine and you need the packet filters to start working immediately, you should restart the Firewall service.[/FONT]
[FONT=Verdana][I][B]Note:[/B]
You can restart the firewall service by navigating to the [B]Servers and Arrays/Server Name/Monitoring/Services[/B] node in the [B]ISA Management [/B]console. Then right click on the [B]Firewall [/B]service entry in the right pane. Click the [B]Stop [/B]command. After the service is stopped, right click the [B]Firewall[/B] service entry again and click the [B]Start[/B] command. You can also stop the Firewall service from the command prompt. Open a command prompt and type "[B]net stop Microsoft firewall[/B]" (without the quotes). After the Firewall service stops, restart the Firewall service by typing "[B]net start Microsoft firewall[/B]" (without the quotes).
[/I][/FONT][FONT=Verdana][B] [CENTER][FONT=Verdana][SIZE=2][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][/URL][/SIZE][/FONT][/CENTER]
[/B][/FONT] [B]Creating the Packet Filter for UDP 1701[/B]

[FONT=Verdana] [/FONT][FONT=Verdana]Perform the following steps to create the packet filter for UDP 1701:[/FONT]

[LIST=1][FONT=Verdana][*]In the [B]ISA Management [/B]console, expand the [B]Server and Arrays [/B]node, then expand your server name. Expand the [B]Access Policy [/B]node. Right click the [B]Packet Filters[/B] node, point to [B]New[/B] and click [B]Filter[/B].[*]Type a name for the packet filter in the [B]IP packet filter name[/B] text box on the W[B]elcome to the New IP Packet Filter Wizard[/B] page. I recommend you name it [B]UDP 1701 (receive/send)[/B]. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1812.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]Allow packet transmission [/B]option on the [B]Filter Mode[/B] page. Click [B]Next[/B].[*]Select the [B]Custom[/B] option on the [B]Filter Type[/B] page. Click [B]Next[/B].[*]Configure the details of the packet filter on the [B]Filter Settings[/B] page. Select the [B]UDP [/B]option from the [B]IP protocol[/B] drop down list box. Select the [B]Receive send[/B] option in the [B]Direction[/B] drop down list box. Select the [B]Fixed port[/B] option in the [B]Local Port[/B] drop down list box. Set the local [B]Port number [/B]to [B]1701[/B]. Select the [B]All ports[/B] option in the [B]Remote port [/B]drop down list box. Click [B]Next[/B].[/FONT][/LIST]
[FONT=Verdana][URL="http://www.amazon.com/exec/obidos/ASIN/1931836663/ref=nosim/searchbyisbn/wwwshindernet-20"][IMG]http://www.isaserver.org/img/upl/natt2003/Image1813.gif[/IMG][/URL][/FONT]

[LIST=1][FONT=Verdana][*]Select the [B]Default IP addresses for each external interface on the ISA Server computer[/B] option on the [B]Local Computer [/B]page. The default IP address is the primary IP address bound to the interface. The primary address is the IP address at the top of the list in the [B]Advanced TCP/IP Properties[/B] dialog box. Click [B]Next[/B].[*]On the [B]Remote Computers[/B] page, select the [B]All remote computers[/B] option and click [B]Next[/B].[*]Review the settings on the [B]Completing the New IP Packet Filter Wizard[/B] page and click [B]Finish[/B].[/FONT][/LIST]
[FONT=Verdana]The L2TP/IPSec NAT-T VPN clients are able to connect after you create all three packet filters. Note that while the ISA Server VPN Wizard creates L2TP/IPSec packet filters, you should recreate the packet filters as noted in this article. These NAT-T L2TP/IPSec filters differ slightly from those created by the Wizard.[/FONT]
[CENTER][FONT=Verdana][FONT=Verdana][B][URL="http://www.amazon.com/exec/obidos/ASIN/1928994296/ref=nosim/searchbyisbn/wwwshindernet-20"]
[/URL][/B][/FONT][/FONT][/CENTER]
[FONT=Verdana][B] Summary
[/B] [/FONT][FONT=Verdana]In this article we discussed the issue of passing IPSec based protocols through a NAT device. NAT-T (NAT Traversal) protocols allow VPN clients to pass IPSec protected packets through a NAT device. The Windows L2TP/IPSec NAT-T VPN clients software works together with the Windows Server 2003-based ISA Server firewall/VPN server to allow VPN clients located behind a NAT device to pass IPSec protected through the NAT. We also went through detailed step by step procedures required to create the packet filters on the ISA Server firewall/VPN server that allow it to accept the inbound ISA Server firewall/VPN server calls.[/FONT]
[FONT=Verdana][/FONT][FONT=Verdana][I]I hope you enjoyed this article and found something in it that you can apply to your own network. If you have any questions on anything I discussed in this article, head on over to [B][URL="http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=13;t=001725"][COLOR=#26397a]http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=13;t=001725[/COLOR][/URL][/B] and post a message. I’ll be informed of your post and will answer your questions ASAP. Thanks! –Tom[/I][/FONT]
[/LEFT]