Creating a Site to Site VPN using ISA 2006 Firewalls at the Main and Branch Office
[LEFT][CODE]http://www.isaserver.org/tutorials/Creating-VPN-ISA-Server-2006-Firewalls-Main-Branch-Office-Part1html.html[/CODE]
[SIZE=3][B]PART-1[/B][/SIZE]
In this, part 1 of a two part series on creating site to site VPNs using the new ISA firewall, we will go over the basic network configuration and then start the configuration for the site to site VPN at the main office ISA firewall.
[LEFT]A site-to-site VPN connection connects two or more networks using a VPN link over the Internet. The VPN site-to-site configuration works just like a LAN router; packets destined for IP addresses at a remote site are routed through the ISA Server 2006 firewall. The ISA firewall acts as a VPN gateway joining two networks over the Internet.[/LEFT]
Each site-to-site link can use one of the following VPN protocols:
[LIST][*][B]PPTP[/B][*][B]L2TP/IPSec[/B][*][B]IPSec Tunnel Mode[/B][/LIST]
PPTP is the Point-to-Point Tunneling Protocol and can provide a good level of security, depending on the complexity of the password used to authenticate the PPTP connection. You can enhance the level of security applied to a PPTP link by using EAP/TLS-based authentication methods. For information on how to use EAP/TLS authentication for site to site VPN links, check out [B][URL="http://www.isaserver.org/articles/2004s2seapauth.html"]this link[/URL].[/B]
The L2TP/IPSec VPN protocol provides a higher level of security because it uses the IPSec encryption protocol to secure the connection and enforces machine authentication as well as user authentication. You can use computer and user certificates to provide an even higher level of security to the L2TP/IPSec connection. If you are not ready to deploy a certificate infrastructure, you can use a pre-shared key to create the site-to-site L2TP/IPSec VPN connection.
ISA 2006 firewall support IPSec tunnel mode for site-to-site VPN connections. Only use IPSec tunnel mode when you need to create a site-to-site link with third-party VPN gateways. There are three primary reasons for avoiding IPSec tunnel mode:
[LIST][*]IPSec tunnel mode is less secure[*]IPSec tunnel mode has limited routing abilities on Windows Server 2003 machines[*]IPSec tunnel mode can reduce effective throughput through the VPN tunnel by as much as 50%. You can confirm this by reading the [URL="http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/bestpractices.mspx"][B]ISA 2004 performance white paper[/B][/URL].[/LIST]
The figure below depicts how such a site-to-site VPN works:
[INDENT] [IMG]http://www.isaserver.org/img/upl/image0031154957362267.gif[/IMG]
[B]Figure 1[/B][/INDENT]In this two part article series we will go through procedures required to create an L2TP/IPSec site-to-site link between two ISA Server 2006 firewall machines. The ISALOCAL machine will simulate the Main Office firewall, and the ISA2005BRANCH will simulate the Branch Office firewall. We will use the L2TP/IPSec VPN protocol to create the site-to-site link and both computer certificates and pre-shared keys to support the IPSec encryption protocol.
You will complete the following procedures to create the site-to-site VPN connection:
[LIST][*]Create the Remote Network at the Main Office[*]Create the VPN Gateway Dial-in Account at the Main Office[*]Create the Remote Network at the Branch Office[*]Create the Network Rule at the Branch Office[*]Create the Access Rules at the Branch Office[*]Create the VPN Gateway Dial-in Account at the Branch Office[*]Activate the Site-to-Site Links[/LIST]
The lab network includes two ISA firewalls, one at the main office and one at the branch office, a domain controller that is also running Exchange 2003, and a client machine located behind the branch office ISA firewall, which in this case is Windows Server 2003 SP1. The figure below depicts the machines in this article and their IP addresses.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image005a1154957362267.JPG[/IMG]
[B]Figure 2[/B]
[/INDENT][INDENT] [B]Note: [/B]
It is important to note that both the [B]EXCHANGE2003BE[/B] machine and the [B]REMOTEHOST [/B]machine are DHCP servers. This is required to provide Routing and Remote Access Service IP addresses to assign the calling VPN gateways. If your network does not have a DHCP server, you can use static address pools configured on each of the ISA Server 2006 firewall/VPN gateways. I prefer to use DHCP because it will make it easier to assign on-subnet addresses to the VPN gateways virtual interfaces.[/INDENT]In this article I will not go through the process of deploying certificates and will use a pre-shared key for our L2TP/IPSec site to site VPN connection. I should note here that this is not a best practice and that you should use certificates for machine authentication for your site to site VPNs. There are a number of methods you can use to obtain and install machine certificates and I have gone through this procedure many times on the ISAserver.org Web site.
For a comprehensive review of how to obtain and install machine certificates for ISA firewalls in a site to site VPN scenario, I highly recommend that you check out the ISA Server 2000 VPN deployment kit. While the ISA firewall configuration is quite different, the certificate deployment issues remain unchanged. Check out the [URL="http://www.isaserver.org/articles/isa2000vpndeploymentkit.html"][B]ISA Server 2000 VPN Deployment Kit[/B][/URL].
[B]Create the Remote Site at the Main Office ISA Firewall[/B]
We will begin by configuring the ISA firewall at the Main Office. The first step is to configure the Remote Site Network in the [B]Microsoft Internet Security and Acceleration Server 2006[/B] management console.
Perform the following steps to create the Remote Site Network at the Main Office ISA firewall:
[LIST=1][*]Open the [B]Microsoft Internet Security and Acceleration Server 2006[/B] management console and expand the server name. Click on [B]Virtual Private Networks (VPN) [/B]node.[*]Click on the [B]Remote Sites[/B] tab in the Details pane. Click on the [B]Tasks [/B]tab in the Task pane. Click [B]Add Remote Site Network[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image0071154957362282.jpg[/IMG]
[B]Figure 3[/B][/INDENT]
[LIST=1][*]On the [B]Welcome to the Create VPN Site to Site Connection Wizard [/B]page, enter a name for the remote network in the [B]Site to site network name [/B]text box. In this example, enter [B]Branch[/B]. Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image009a1154958089954.JPG[/IMG]
[B]Figure 4[/B][/INDENT]
[LIST=1][*]On the [B]VPN Protocol[/B] page, you have the choice of using
[B]IP Security protocol (IPSec Tunnel Mode[/B],
[B]Layer Two Tunneling Protocol (L2TP) over IPSec[/B] or
[B]Point-to-Point Tunneling Protocol.
[/B]If you do not have certificates installed on the Main and Branch Office machines and do not plan to deploy them in the future, choose the PPTP option. If you have certificates installed on the Main and Branch Office firewalls, or if you plan to install them in the future, choose the L2TP/IPSec option (you can use the pre-shared key prior to installing the certificates).
Do [I]not[/I] use the IPSec option unless you are connecting to a third-party VPN server (because of the low security conferred by IPSec Tunnel Mode site-to-site links and much lower throughput).
In this example, we will use pre-shared keys for our site to site VPN connection in preparation for deploying certificates after the L2TP/IPSec tunnels are established. Select [B]Layer Two Tunneling Protocol (L2TP) over IPSec[/B]. Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image011a1154958089970.JPG[/IMG]
[B]Figure 5[/B][/INDENT]
[LIST=1][*]A dialog box appears informing you that you need to create a user account on the main office ISA firewall. This user account will be used by the branch office ISA firewall to authenticate to the main office ISA firewall when the branch office ISA firewall attempts to create its site to site VPN connection to the main office ISA firewall.
The user account must have the same name as the Remote Site Network we’re creating, and that’s defined by the name we included in the first page in the wizard. In this example, we named the site to site Network connection [B]Branch[/B], so the user account we create on the main office ISA firewall must also have the name [B]Branch[/B], and we will need to enable dial-up access for that account. We’ll go through the details of creating that account later in this article. Click [B]OK[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image013a1154958089970.JPG[/IMG]
[B]Figure 6[/B][/INDENT]
[LIST=1][*]On the [B]Connection Owner[/B] page you select which machine in the array should be the connection own for this site to site VPN connection. This option is only seen in ISA Enterprise Edition and not in Standard Edition. If you have NLB enabled on the array, then you don’t need to manually assign the connection owner, as the integrated NLB process will automatically assign a connection owner when NLB is enabled on the array.
In this example we are not using NLB on the main office array (I’ll do another article on how to do that in the future), and there is only one member of our main office ISA firewall Enterprise Edition array. So we’ll use the default entry, which is the name of the ISA firewall at the main office and click [B]Next[/B]. (note, the name of the server in the graphic suggests that this machine is Standard Edition, but it is in fact Enterprise Edition).[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image015a1155028436126.JPG[/IMG]
[B]Figure 7[/B][/INDENT]
[LIST=1][*]On the [B]Remote Site Gateway[/B] page, enter the IP address or FQDN representing the external interface of the remote ISA Server 2006 firewall machine. Note that this is a new feature in the 2006 ISA firewall, in that before you could not use a FQDN. This is helpful as many branch offices must use dynamic addresses and so the only way to reliably connect to the branch office was via a DDNS service.
In this example, we’ll use the FQDN [B]branch.msfirewall.org[/B], so enter this value into the text box. Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image017a1155028436142.JPG[/IMG]
[B]Figure 8[/B][/INDENT]
[LIST=1][*]On the [B]Remote Authentication[/B] page, put a checkmark in the [B]Local site can initiate connections to remote site using these credentials[/B] check box. Enter the name of the account that you will create on the branch office ISA Server 2006 firewall to allow the Main Office ISA firewall access. In this example, the user account will be named [B]Main[/B] (the user account much match the name of the demand-dial interface created on the remote site). When we get to configuring the branch office ISA firewall, we will create a Remote Site Network with the name [B]Main[/B] and then create a user account with the name [B]Main[/B] on the branch office ISA firewall. The main office ISA firewall will use this account to authenticate to the branch office ISA firewall to create the site to site VPN connection.
The [B]Domain[/B] name is the name of the branch office ISA Server 2006 firewall, which in this example is [B]ISA2006BRANCH [/B](if the remote ISA Server 2006 firewall were a domain controller, you would use the domain name instead of the computer name). Enter a password for the account and confirm the password. Write down the password so you will remember it when you create an account later on the branch office ISA 2006 firewall. Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image019a1155028436142.JPG[/IMG]
[B]Figure 9[/B][/INDENT]
[LIST=1][*] On the [B]L2TP/IPSec Outgoing Authentication[/B] page you select the method you want authenticate your machine against the branch office ISA firewall. In this example we’ll use the [B]Pre-shared key authentication[/B] option and then enter a pre-shared key in the [B]Pre-shared key[/B] text box. Make sure you write this down, as we’ll need this information when configuring the machine authentication settings at the branch office. Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image021a1155029138954.JPG[/IMG]
[B]Figure 10[/B][/INDENT]
[LIST=1][*]Click [B]Add[/B][B] Range[/B] on the [B]Network Addresses[/B] page. In the [B]IP Address Range Properties[/B] dialog box, enter [B]10.0.1.0[/B] in the [B]Starting address[/B] text box. Enter [B]10.0.1.255[/B] in the [B]Ending address[/B] text box. Click [B]OK[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image023a1155029138954.JPG[/IMG]
[B]Figure 11[/B][/INDENT]
[LIST=1][*]Click [B]Next[/B] on the [B]Network Addresses[/B] page.[*]On the [B]Remote NLB[/B] page you tell the ISA firewall if NLB is being used on the branch office ISA firewall. If NLB is being used, then you would put a checkmark in the [B]The remote site is enabled for Network Load Balancing[/B] checkbox. Then you would add the dedicated IP addresses on the branch office NLB array by clicking the [B]Add[/B][B] Range[/B] button.
We’re not running NLB at the branch office, so we’ll remove the checkmark from the [B]The remote site is enabled for Network Load Balancing[/B]. In a future article I’ll show you how to create site to site VPNs with the NLB feature enabled. Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image025a1155029138954.JPG[/IMG]
[B]Figure 12[/B][/INDENT]
[LIST=1][*]On the [B]Site to Site Network Rule [/B]page you can configure a Network Rule that connects the main and branch office ISA firewall Networks. Remember, the ISA firewall requires that you always have a Network Rule to connect ISA firewall Networks to each other. Even if you create the Networks and create Access Rules, the connections will not work until you create a Network Rule.
The new ISA firewall fixes a problem that people had when creating site to site VPNs with ISA 2004, in that most people forget or didn’t know that they needed a Network Rule in order for it work. The 2006 ISA firewall will ask you if you want to create the Network Rule while still in the wizard, which is a nice convenience and great usability improvement. It’s clear that the ISA firewall’s development team are a lot more mindful of ease of use than the Exchange 2007 beta team!
Select the [B]Create a Network Rule specifying a route relationship[/B] option and accept the default name. Note that you also have the [B]I’ll create a Network Rule later[/B] option if you want to create the Network Rule manually. Notice that the default option is to set a route relationship between the main and branch office ISA firewall Networks. This is a excellent choice because you have a much wider range of protocol access when using route relationships.
Click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image027a1155029466407.JPG[/IMG]
[B]Figure 13[/B][/INDENT]
[LIST=1][*]Another new feature in the 2006 ISA firewall is the [B]Site to Site Network Access Rule [/B]page. Here you can configure an Access Rule allowing connections from the main office to the branch office. With the ISA 2004 firewall, you had to do this manually after the wizard was completed, another kudo for the VPN developers on the ISA team!
You also have the option to not create an Access Rules at this time by selecting the [B]I’ll change the Access Policy later[/B] option.
When you select the [B]Create an allow Access Rule. This rule will allow traffic cetween the Internal Network and the new site to site Network for all users[/B] option, you’ll be given three choices from the [B]Apply the rule to these protocols[/B] drop down list. This include:
[B]All outbound traffic:[/B] Use this option if you want to allow all traffic from the main office to the branch office.
[B]Selected protocols: [/B]Use this option if you want to control which traffic can move from the main office to the branch office. If you want to limit the connections to a selected list of protocols, select this option and click the [B]Add[/B] button to all the protocols. Note that at this point you can’t lock down the protocol usage on a per user/group basis. You’ll have to wait until the wizard is complete and then go into the Firewall policy to make that change.
[B]All outbound traffic except selected: [/B]Select this option if you want to allow all traffic except for a few protocols. Again, you use the [B]Add [/B]button to set which protocols you want to block.
In this example, we’ll being by allowing all protocols. Later, I’ll show you how you can use user/group based authentication to control which users at the main office are allowed to connect to the branch office. This is important, as typically you don’t want average users to access to the branch office, you just want the administrators to get there. We’ll also see how you can use user/group based access controls at the branch office to prevent branch office users from getting adventurous.
Select the [B]All outbound traffic [/B]option and click [B]Next[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image029a1155029466407.JPG[/IMG]
[B]Figure 14[/B][/INDENT]
[LIST=1][*]Click [B]Finish[/B] on the [B]Completing the New Site to Site Network Wizard [/B]page.[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image031a1155029466423.JPG[/IMG]
[B]Figure 15[/B][/INDENT]
[LIST=1][*]In the [B]Remaining VPN Site to Site Tasks[/B] dialog box, it informs you that that you need to create a user account with the name [B]Branch[/B]. We’ll do that in the next section. Click [B]OK[/B].[/LIST]
You can see the new ISA firewall Remote Site Network in the ISA firewall console, as seen in the figure below.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image033a1155029948079.JPG[/IMG]
[B]Figure 16[/B][/INDENT]Select the Remote Site Network and click the [B]Edit Selected Network[/B] link in the [B]Task Pane[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/image0351155029948079.jpg[/IMG]
[B]Figure 17[/B][/INDENT]In the [B]Branch Properties[/B] dialog box, the [B]General[/B] tab provides information about the Remote Site Network. You can also enable or disable the site to site VPN connection from this tab.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image037a1155030295329.JPG[/IMG]
[B]Figure 18[/B][/INDENT][CENTER]
[URL="http://www.amazon.com/exec/obidos/ASIN/1931836191/isaserver1-20/"]
[/URL][/CENTER]
On the [B]Server[/B] tab, you can change the connection owner for the site to site VPN. You only have to assign a connection owner when NLB isn’t enabled on the external interface of the ISA firewall. If NLB is enabled on the external interface of the ISA firewall, then NLB will automatically assign the connection own for you. Keep in mind that you can create ISA firewall arrays of VPN gateways [I]without[/I] NLB enabled on the external interface. However, in most cases you will want to use NLB. We’re not using NLB on the external interface in this article because there is a single ISA Enterprise Edition firewall in our current configuration.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image039a1155031183923.JPG[/IMG]
[B]Figure 19[/B][/INDENT]On the [B]Addresses[/B] tab, you can change or add addresses to the definition of the Remote Site Network.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image041a1155031183923.JPG[/IMG]
[B]Figure 20[/B][/INDENT]On the [B]Remote NLB[/B] tab, you specify the dedicated IP addresses on the remote site VPN gateway. You only need to configure these addresses if the Remote Site Network’s VPN gateway is using NLB. We won’t be adding addresses in our example because NLB won’t be enabled at the branch office ISA firewall.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image043a1155031183923.JPG[/IMG]
[B]Figure 21[/B][/INDENT]On the [B]Authentication[/B] tab you choose the authentication protocol you want the main office ISA firewall to use when authenticating with the branch office VPN gateway. The default is [B]Microsoft CHAP Version 2[/B]. The most secure option is EAP, but that requires that you assign user certificates to the accounts used to authenticate with each gateway. Maybe in the future I’ll show you how to do it with 2006 ISA firewall’s, but the procedure is very similar to how you do it in ISA 2004, as shown in [URL="http://www.isaserver.org/articles/2004s2seapauth.html"][B]http://www.isaserver.org/articles/2004s2seapauth.html[/B][/URL].
[INDENT] [IMG]http://www.isaserver.org/img/upl/image045a1155031631938.JPG[/IMG]
[B]Figure 22[/B][/INDENT]On the [B]Protocol[/B] tab you configure what VPN protocol you want to use to create the site to site VPN tunnel. You can also change the pre-shared key here.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image049a1155031631938.JPG[/IMG]
[B]Figure 23[/B][/INDENT]On the [B]Connection[/B] tab you can change the credentials used to authenticated to the Remote Site Network’s VPN gateway. You can also configure how long you want the site to site VPN to stay up during idle periods. The default is [B]Never[/B] drop the connection.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image049b1155031631970.JPG[/IMG]
[B]Figure 24[/B][/INDENT]Close the [B]Branch Properties[/B] dialog box.
Right click the Remote Site Network and click the [B]Site to Site Summary[/B] command. In the [B]Site to Site Summary[/B] dialog box you’ll see summary information about the local site to site settings and the [B]Required site to site settings for the other end of this tunnel[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/image051a1155032156392.JPG[/IMG]
[B]Figure 25[/B][/INDENT]You can right click in the lower frame and Select All and then Copy to get the information on how to configure the Remote Site VPN gateway.
[INDENT] General VPN Settings Authentication Protocols (one or more of the following):
MS-CHAP v2
VPN Network Authentication Protocols (one or more of the following):
MS-CHAP v2
Outgoing Authentication Method: Pre-shared secret (the pre-shared key will appear here)
Incoming Authentication Method: Certificate and pre-shared secret (the pre-shared key will appear here)
Remote Gateway Address:
An IP address or a DNS resolvable name.
If NLB is enabled, the VIP of the remote array should be used.
Local User: ISA2006BRANCH\main
Remote Site User: Branch
Site-to-Site Network IP Addresses: 10.0.0.0-10.0.0.255, 10.255.255.255
Routable Local IP Addresses: 10.0.1.0-10.0.1.255[/INDENT]Complete the configuration by clicking [B]Apply[/B] to save the changes and then click [B]OK[/B] in the [B]Apply New Configuration[/B] dialog box.
[B]DHCP Configuration[/B]
One last thing you need to confirm is your addressing information for the site to site VPN gateway. You have two options to assign IP addresses:
[LIST][*] DHCP[*] Static address pool[/LIST]
I prefer to use DHCP because it allows you to assign VPN clients and gateways on-subnet addresses without having to manually remove those addresses from the definition of the default Internet Network, to which the internal interface of the ISA firewall belongs.
For example, suppose the ISA firewall’s internal interface has the IP address [B]192.168.1.1[/B]. The definition of the default Internal Network is [B]192.168.1.0-192.168.1.255[/B]. If we wanted to use a static address pool to assign on-subnet addresses, such as [B]192.168.1.10-192.168.1.20[/B], we would have to change the definition of the default Internal Network because these addresses we want to assign VPN clients overlap with the definition of the default Internal Network. In this case the definition of the default Internal Network would change to:
[INDENT] [B]192.168.1.0-192.168.1.9[/B]
[B]192.168.1.21-192.168.1.255[/B][/INDENT]On the other hand, if we used DHCP to assign the VPN clients on-subnet addresses, the ISA firewall will automatically remove any address assigned to a VPN client or VPN gateway from the definition of the default Internal Network and dynamically assign them to the definition of the VPN clients Network. This prevents overlap between the VPN Clients Network and the default Internal Network.
You can check on the IP address assignment method by clicking on the [B]Virtual Private Networks (VPN)[/B] node in the left pane of the console and then clicking the [B]Defiane Address Assignments[/B] link in on the [B]Tasks[/B] tab in the Task Pane. You’ll see what appears in the figure below.
[INDENT] [IMG]http://www.isaserver.org/img/upl/image053a1155032156407.JPG[/IMG]
[B]Figure 26[/B][/INDENT]Note that the [B]Dynamic Host Configuration Protocol (DHCP)[/B] option is only available on ISA Standard Edition or single-member ISA Enterprise Edition arrays. If you choose not to use DHCP, then you must click the [B]Add[/B] button to manually add your IP addresses assignment to VPN clients and VPN gateways.
If you use a static address pool, you might want to consider using off-subnet IP addresses. There is no problem with this, but you must make your routing infrastructure aware that in order to reach the network ID used for the VPN clients network that they must forward those connections to the ISA firewall interface from which the connection was received.
In a simple dual NIC configuration, this would be the Internal interface. In a 3+ NIC configuration, you would configure the routers to forward requests to the VPN clients network ID to the ISA firewall interface closest to the routers.
[B]Configure the Main Office Firewall’s Demand-dial Interface to not Register in DNS[/B]
A common problem encountered with multihomed computers is that they register multiple interfaces in the DNS. This is especially problematic when machines create site-to-site connections and register their demand-dial interface IP address. This can cause difficult to troubleshoot problems, such as Web Proxy and Firewall clients being unable to connect to the Internet. The reason why the Web Proxy and Firewall clients cannot connect to the Internet in this scenario is that the ISA Server 2004 firewall’s Demand-dial interface registered itself in the DNS, and the Web Proxy and Firewall clients attempt to connect to the ISA Server 2004 firewall via that address.
Perform the following steps to disable dynamic DNS registration for the ISA Server 2004 firewall’s Demand-dial interface:
[LIST=1][*]At the Main Office ISA Server 2004 firewall, click [B]Start[/B], and point to [B]Administrative Tools[/B]. Click [B]Routing and Remote Access[/B].[*]In the [B]Routing and Remote Access [/B]console, expand the server name in the left pane of the console. Click the [B]Network Interfaces[/B] node.[*]In the right pane of the [B]Network Interfaces[/B] node, right click on [B]Branch[/B], and click [B]Properties[/B].[*]On the [B]Branch Properties[/B] dialog box, click the [B]Networking[/B] tab.[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image055a1155032156407.JPG[/IMG]
[B]Figure 27[/B][/INDENT]
[LIST=1][*]On the [B]Networking[/B] tab, click [B]Internet Protocol (TCP/IP)[/B] in the [B]This connection uses the following items[/B] list, and click [B]Properties[/B].[*]On the [B]Internet Protocol (TCP/IP) Properties[/B] dialog box, click [B]Advanced[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image057a1155032202423.JPG[/IMG]
[B]Figure 28[/B][/INDENT]
[LIST=1][*]On the [B]Advanced TCP/IP Settings[/B] dialog box, click the [B]DNS[/B] tab. On the [B]DNS[/B] tab, remove the checkmark from the [B]Register this connection’s addresses in DNS[/B] check box, and click [B]OK[/B].[/LIST]
[INDENT] [IMG]http://www.isaserver.org/img/upl/image059a1155032202423.JPG[/IMG]
[B]Figure 29[/B][/INDENT]
[LIST=1][*]Click [B]OK[/B] in the [B]Internet Protocol (TCP/IP) Properties[/B] dialog box.[*]Click [B]OK[/B] in the [B]Branch[/B] [B]Properties[/B] dialog box.[*]Close the [B]Routing and Remote Access[/B] console.[/LIST]
[B]Create the VPN Gateway Dial-in Account at the Main Office[/B]
A user account must be created on the Main Office ISA firewall that the Branch Office firewall can use to authenticate when it creates the site-to-site connection. This user account must have the same name as the demand-dial interface on the Main Office computer. You will later configure the Branch Office ISA firewall to use this account when it dials the VPN site-to-site link.
Perform the following steps to create the account the remote ISA Server 2006 firewall will use to connect to the Main Office VPN gateway:
[LIST=1][*]Right click [B]My Computer[/B] on the desktop, and click [B]Manage[/B].[*]In the [B]Computer Management[/B] console, expand the [B]Local Users and Groups[/B] node. Right click the [B]Users[/B] node, and click [B]New User[/B].[*]In the [B]New User[/B] dialog box, enter the name of the Main Office demand-dial interface. In our current example, the demand-dial interface is named [B]Branch[/B]. Enter [B]Branch[/B] into the text box. Enter a [B]Password[/B] and confirm the [B]Password[/B]. Write down this password because you’ll need to use it when you configure the remote ISA Server 2006 VPN gateway machine. Remove the checkmark from the [B]User must change password at next logon[/B] check box. Place checkmarks in the [B]User cannot change password[/B] and [B]Password never expires[/B] check boxes. Click [B]Create[/B].[*]Click [B]Close[/B] in the [B]New User[/B] dialog box.[*]Double click the [B]Branch[/B] user in the right pane of the console.[*]In the [B]Branch Properties[/B] dialog box, click the [B]Dial-in[/B] tab. Select [B]Allow access[/B]. Click [B]Apply[/B], and then click [B]OK[/B].[/LIST]
[IMG]http://www.isaserver.org/img/upl/image061a1155032202423.JPG[/IMG]
[B]Figure 30[/B]
[B]Summary[/B]
In this, part 1 of a two part series on creating site to site VPNs using the new ISA firewall, we went over the basic network configuration and then started the configuration for the site to site VPN at the main office ISA firewall. We created the Remote Site Network at the main office ISA firewall and created the user account that the branch office ISA firewall will use when calling the main office ISA firewall.
In the second and last part of the site to site VPN series, we’ll move our attention to the branch office ISA firewall and configure it to connect to the main office ISA firewall. We’ll also create a user account that the main office firewall will be able to use when calling the branch office ISA firewall. Then we’ll test the solution by activating the site to site VPN link and checking the log files and sessions information to see what things look like in the ISA firewall console when the site to site VPN is successfully established.
[/LEFT]
