Deploying SSTP VPN Remote Access.docx
- 文档编号:29868434
- 上传时间:2023-08-03
- 格式:DOCX
- 页数:39
- 大小:446.05KB
Deploying SSTP VPN Remote Access.docx
《Deploying SSTP VPN Remote Access.docx》由会员分享,可在线阅读,更多相关《Deploying SSTP VPN Remote Access.docx(39页珍藏版)》请在冰豆网上搜索。
DeployingSSTPVPNRemoteAccess
Step-by-StepGuide:
DeployingSSTPRemoteAccess
MicrosoftCorporation
Published:
December2007
Abstract
SecureSocketTunnelingProtocol(SSTP)isanewformofVPNtunnelwithfeaturesthatallowtraffictopassthroughfirewallsthatblockPPTPandL2TP/IPsectraffic.SSTPprovidesamechanismtoencapsulatePPPtrafficovertheSSLchanneloftheHTTPSprotocol.TheuseofPPPallowssupportforstrongauthenticationmethodssuchasEAP-TLS.TheuseofHTTPSmeanstrafficwillflowthroughTCPport443,aportcommonlyusedforWebaccess.SecureSocketsLayer(SSL)providestransport-levelsecuritywithenhancedkeynegotiation,encryption,andintegritychecking.vpn
Thispaperprovidesdetailedinformationabouthowyoucanusethreecomputerstocreateatestlabwithwhichtoconfigureandtestvirtualprivatenetwork(VPN)remoteaccesswithWindows Server® 2008andWindows Vista®withServicePack 1(SP1).TheseinstructionsaredesignedtotakeyoustepbystepthroughtheconfigurationrequiredforaSecureSocketTunnelingProtocol(SSTP)connection.
CopyrightInformation
Thisdocumentsupportsapreliminaryreleaseofasoftwareproductthatmaybechangedsubstantiallypriortofinalcommercialrelease,andistheconfidentialandproprietaryinformationofMicrosoftCorporation.Itisdisclosedpursuanttoanon-disclosureagreementbetweentherecipientandMicrosoft.ThisdocumentisprovidedforinformationalpurposesonlyandMicrosoftmakesnowarranties,eitherexpressorimplied,inthisdocument.Informationinthisdocument,includingURLandotherInternetWebsitereferences,issubjecttochangewithoutnotice.Theentireriskoftheuseortheresultsfromtheuseofthisdocumentremainswiththeuser.Unlessotherwisenoted,theexamplecompanies,organizations,products,domainnames,visit,thene-mailaddresses,logos,people,places,andeventsdepictedhereinarefictitious,andnoassociationwithanyrealcompany,organization,product,domainname,e-mailaddress,logo,person,place,oreventisintendedorshouldbeinferred.Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.Withoutlimitingtherightsundercopyright,nopartofthisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recording,orotherwise),orforanypurpose,withouttheexpresswrittenpermissionofMicrosoftCorporation.
Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubjectmatterinthisdocument.ExceptasexpresslyprovidedinanywrittenlicenseagreementfromMicrosoft,thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty.
©2007MicrosoftCorporation.Allrightsreserved.
Microsoft,MS-DOS,Windows,Windows NT,andWindows ServerareeitherregisteredtrademarksortrademarksofMicrosoft CorporationintheUnited Statesand/orothercountries.
Allothertrademarksarepropertyoftheirrespectiveowners.
Contents
Step-by-StepGuide:
DeployingSSTPRemoteAccess
Thisguideprovidesdetailedinformationabouthowyoucanusethreecomputerstocreateatestlabwithwhichtoconfigureandtestvirtualprivatenetwork(VPN)remoteaccesswithWindows Server® 2008andWindows Vista®withServicePack 1(SP1).TheseinstructionsaredesignedtotakeyoustepbystepthroughtheconfigurationrequiredforaSecureSocketTunnelingProtocol(SSTP)connection.
Note
Thefollowinginstructionsareforconfiguringatestlabbyusingaminimumnumberofcomputersandproceduresteps.Tominimizesetuptimeandcomplexity,serviceswerecombinedonthenetworkserversratherthanusingindividualcomputerstoseparatetheservicesinamoresecuremanner.Thisconfigurationisdesignedtoreflectneitherbestpracticesnoradesiredorrecommendedconfigurationforaproductionnetwork.Theconfiguration,includingIPaddressesandallotherconfigurationparameters,isdesignedtoworkonlyonaseparatetestlabnetwork.
ConsiderusingVirtualPCorVirtualServer
MicrosoftVirtualPCorVirtualServerallowsyoutocreatethecomputerlabusedinthisdocumentbyusingonlyoneortwophysicalcomputers.Afterthevirtuallabisconfigured,youcanswitchbetweenthethreevirtualcomputersneededforthislabwiththeclickofabutton.Formoreinformation,seethefollowingresources:
∙VirtualPC2007ProductInformation(
∙VirtualServerProductInformation(
∙DoMoreWithLess:
ExploringVirtualServer2005(
∙TechNetwebcast:
VirtualServer2005-SettingUpaVirtualTestandDevelopmentEnvironment—Level200(
SecureSocketTunnelingProtocol
SecureSocketTunnelingProtocol(SSTP)isanewformofVPNtunnelwithfeaturesthatallowtraffictopassthroughfirewallsthatblockPPTPandL2TP/IPsectraffic.SSTPprovidesamechanismtoencapsulatePPPtrafficovertheSSLchanneloftheHTTPSprotocol.TheuseofPPPallowssupportforstrongauthenticationmethodssuchasEAP-TLS.TheuseofHTTPSmeanstrafficwillflowthroughTCPport443,aportcommonlyusedforWebaccess.SecureSocketsLayer(SSL)providestransport-levelsecuritywithenhancedkeynegotiation,encryption,andintegritychecking.
SSTP-basedVPNconnectionprocess
ThedataflowforanSSTP-basedVPNconnectiontakesplaceasfollows:
WhenauseronacomputerrunningWindowsServer 2008orWindowsVistawithSP1initiatesanSSTP-basedVPNconnection,thefollowingoccurs:
1.TheSSTPclientestablishesaTCPconnectionwiththeSSTPserverbetweenadynamicallyallocatedTCPportontheSSTPclientandTCPport443ontheSSTPserver.
2.TheSSTPclientsendsanSSLClient-Hellomessage,indicatingthattheSSTPclientwantstocreateanSSLsessionwiththeSSTPserver.
3.TheSSTPserversendsitscomputercertificatetotheSSTPclient.
4.TheSSTPclientvalidatesthecomputercertificate,determinestheencryptionmethodfortheSSLsession,generatesanSSLsessionkeyandencryptsitwiththepublickeyoftheSSTPserver’scertificate,andthensendstheencryptedformoftheSSLsessionkeytotheSSTPserver.
5.TheSSTPserverdecryptstheencryptedSSLsessionkeywiththeprivatekeyofitscomputercertificate.AllfuturecommunicationbetweentheSSTPclientandtheSSTPserverisencryptedwiththenegotiatedencryptionmethodandSSLsessionkey.
6.TheSSTPclientsendsanHTTPoverSSLrequestmessagetotheSSTPserver.
7.TheSSTPclientnegotiatesanSSTPtunnelwiththeSSTPserver.
8.TheSSTPclientnegotiatesaPPPconnectionwiththeSSTPserver.Thisnegotiationincludesauthenticatingtheuser’scredentialswithaPPPauthenticationmethodandconfiguringsettingsforInternetProtocolversion4(IPv4)orInternetProtocolversion6(IPv6)traffic.
9.TheSSTPclientbeginssendingIPv4orIPv6trafficoverthePPPlink.
Figure1.ProtocollevelviewofSSTPsystemarchitecture.
SettingupthetestlabforSSTPremoteaccessVPNconnections
TheinfrastructurefortheVPNtestlabnetworkconsistsofthreecomputers,whichperformthefollowingservices:
∙AservercomputerrunningWindowsServer 2008namedDC1thatactsasadomaincontroller,aDomainNameSystem(DNS)server,andafileserveronaprivate(intranet)network.
∙AservercomputerrunningWindowsServer 2008namedVPN1thatisconfiguredwithRoutingandRemoteAccessandactsasaVPNserver.Inaddition,VPN1isconfiguredwithActiveDirectoryCertificateServicesandInternetInformationServices(IIS)toallowWebenrollmentofthecomputercertificaterequiredforanSSTP-basedVPNconnection.VPN1hastwonetworkadaptersinstalled.
∙AclientcomputerrunningWindowsVistawithSP1namedCLIENT1thatactsasaVPNclientonapublic(Internet)network.
ThefollowingdiagramshowstheconfigurationoftheVPNtestlab.
Figure2.ConfigurationoftheSSTPconnectiontestlab.
ConfiguringDC1
DC1isacomputerrunningWindowsServer 2008thatprovidesthefollowingservices:
∙AdomaincontrollerfortheCActiveDirectory®domain.
∙ADNSserverfortheCDNSdomain.
∙Afileserver.
TheconfigurationofDC1requiresthefollowingsteps:
∙Installtheoperatingsystem.
∙ConfigureTCP/IP.
∙InstallActiveDirectoryandDNS.
∙Createauseraccountwithremoteaccesspermission.
∙Createasharedfolderandfile.
Thefollowingsectionsexplainthesestepsindetail.
Installtheoperatingsystem
InstallWindowsServer 2008
1.OnDC1,startyourcomputerbyusingtheWindowsServer 2008productdisc.
2.Followtheinstructionsthatappearonyourscreen.Whenpromptedforapassword,typeP@ssword.
ConfigureTCP/IP
ConfigureTCP/IPpropertiessothatDC1hasastaticIPaddressof192.168.0.1withthesubnetmask255.255.255.0andadefaultgatewayof192.168.0.2.
ConfigureTCP/IPproperties
1.OnDC1,intheInitialConfigurationTaskswindow,underProvideComputerInformation,clickConfigurenetworking.
Note
IftheInitialConfigurationTaskswindowisnotalreadyopen,youcanopenitbyclickingStart,clickingRun,typingoobeinthetextbox,andthenclickingOK.
Figure3.InitialConfigurationTaskswindow.
2.IntheNetworkConnectionswindow,right-clickLocalAreaConnection,andthenclickProperties.
3.OntheNetworkingtab,clickInternetProtocolVersion4(TCP/IPv4),andthenclickProperties.
4.ClickUsethefollowingIPaddress.Type192.168.0.1fortheIPaddress,ty
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- Deploying SSTP VPN Remote Access
![提示](https://static.bdocx.com/images/bang_tan.gif)