Microsoft Windows XP Networking Inside Out

Chapter 17: Remote Access and Virtual Private Networking

The following list defines each protocol.

●Extensible Authentication Protocol (EAP). EAP provides security extensions, such as authentication based on token cards, that administrators can use in addition to the security technologies built into Windows servers.

●Password Authentication Protocol (PAP). PAP is a clear-text authentication scheme. The hosting server asks for the user name and password, and the PAP process returns the user response in an unencrypted or clear-text format. This authentication method is not robust, and it is certainly not secure. Malicious users can use a packet sniffer or similar tool to obtain the user name and password passed with PAP because they are unencrypted. Note that this authentication scheme does not work if the option Require Encryption (Disconnect If Server Declines) is selected in the Data Encryption field.

●Shiva Password Authentication Protocol (SPAP). This protocol is used with Shiva (now Intel) remote access servers, but does not work with the Require Encryption (Disconnect If Server Declines) setting.

●Challenge Handshake Authentication Protocol (CHAP). CHAP is an encrypted authentication mechanism that does not transmit the password across the connection. The remote access server sends a request known as a challenge to the potential remote access client. This information includes a session ID and an arbitrary challenge string. The remote access client

responds with its user name and a Message Digest 5 (MD5) hash of the password, the challenge string, and the session ID. In this way, proof of knowledge of the user’s password is sent without actually sending the password. To calculate the MD5 hash, passwords must be stored on the server in a reversibly encrypted form. A malicious user using a network sniffer to capture the CHAP traffic will only find a user name followed by the MD5 hash.

●Microsoft CHAP (MS-CHAP). The MS-CHAP protocol makes use of an encrypted authentication process that is in many ways similar to CHAP. Two key differences exist between CHAP and MS-CHAP. Passwords are encrypted using both the MD4 hash algorithm and the Data Encryption Standard (DES) algorithm. MS-CHAP also makes use of encrypted server/ client messaging that allows the client to securely change its password from a remote location.

●Microsoft CHAP version 2 (MS-CHAP v2). Version 2 of the MS-CHAP protocol utilizes a more complex authentication system that provides twoway authentication. Not only does the server verify that the client is using the correct password for the provided user name, but the client also verifies

5: Advanced Networking

Chapter 17

For more information on the best ways to secure remote access connections, see “Securing Remote Access Connections,” page 586.

Understanding Virtual Private Networking

A VPN is an extension of a private network that encompasses links across shared or public networks such as the Internet. This virtual network allows the connected users to interact as if they were all on the same private network. To compare VPN connections to other network types, think of a VPN connection as a WAN link that exists by tunneling traffic through the Internet. The individual VPN connection behaves in the same manner as a direct point-to-point link, such as a leased line or a Frame Relay link.

To emulate a point-to-point link, data is encapsulated in a manner that allows it to traverse the Internet and reach the other VPN host. To ensure that the data on this private network remains private, encryption is used. If a malicious user intercepts the packets traveling between a VPN client and server, the data will be meaningless because it requires an encryption key to decrypt.

VPN connections are extremely useful because a computer can use virtually any Internet connection to reach the private network. Whether using a residential high-speed Internet connection or using a dial-up modem from a hotel room, the process is the same (of course the speed of the connection will vary). The user can connect to the protected network as needed. This is not only useful to telecommuters and traveling employees, but VPN connections can also allow a company to leverage cheaper, high-speed access methods (cable and DSL for example) to connect remote offices instead of using expensive leased lines or building its own Frame Relay network.

When building a remote network infrastructure, most companies and individuals will want to preserve the security requirements that they have for the existing LAN or WAN. A proper VPN implementation will allow the connection of remote users without compromising internal security. In fact, VPN connections are often more secure because of their encryption than normal LAN or WAN traffic. The following features make VPN traffic secure:

●Authentication. A VPN server will verify the VPN client’s identity and prevent access from being assigned to unknown or unauthorized users. Most VPN servers have the capability to log all users who have connected. As an example, Microsoft Windows 2000 Server VPN services can log the user name, the IP address the user is connecting from, the IP address assigned to the VPN tunnel, the connection time, the connection duration, and other features of each VPN connection session.

●Address management. VPN servers, using Windows 2000 as an example, assign the network addresses to VPN clients (such as IP addresses).

Chapter 17

17 Chapter

●Encryption. Because the information transmitted using a VPN connection must cross a public medium, it is important to protect the data. Encryption of the transmitted data is used to secure it from prying eyes.

●Key management. Dynamic encryption keys are generated as part of the authentication process.

A VPN connection makes use of tunneling to transport data securely. Tunneling is the act of moving data destined for one network over the infrastructure of another network. The following is an example. Traffic from a computer on network #1 is delivered to another computer on network #1 using the components of network #2. Most virtual private networking solutions make use of one of two tunneling protocols. The protocols most widely used are Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) with Internet Protocol Security (IPSec) because they are flexible and widely supported. The VPN client encapsulates packets that are destined to be routed between the two tunnel endpoints. The information that is added during the encapsulation process allows the VPN packets to traverse the intermediate network to the VPN server.

Understanding VPN Protocols

What are the differences between the two VPN protocols supported by Windows XP, and when should you use each?

PPTP was developed by Microsoft and was originally delivered with Windows NT 4.0. It builds upon the foundations of standard PPP to both encapsulate and encrypt IP traffic (as well as other protocols). When configured to use MS-CHAP v2, PPTP is quite secure. Few non-Microsoft platforms can use PPTP tunneling without buying commercial VPN client software.

L2TP/IPSec uses a newer, Internet standard-based protocol for establishing remote VPN connections. L2TP/IPSec provides an extremely secure environment because it encrypts and authenticates each password transmitted across the network. In addition, it is supported by multiple platforms including UNIX-based and Macintosh systems.

It does, however, require an infrastructure for allocating computer encryption certificates. Only Windows 2000, Windows XP, and later Windows operating systems support L2TP/IPSec.

Not sure which protocol to use? If you must support older Windows VPN clients, or you cannot maintain a certificate distribution system, PPTP is your best choice. However, if you want to support multiple platforms and are only using very recent Windows clients, and your network administrators are willing to maintain a certificate system, L2TP/ IPSec might be the way to go.

configure the firewall device to allow inbound traffic from a series of IP addresses that you specify. Unless you have a static IP address (or set of static addresses) from which you want to guarantee inbound connectivity, this solution is less than ideal because it’s normally impossible to determine which IP addresses you’ll be given by a Dynamic Host Configuration Protocol (DHCP) server, particularly if you travel with a laptop or use a number of remote networks. Even if you do have one or more static IP addresses that you want to grant access to, this solution is of limited value unless you can guarantee that only machines that you manage will use those addresses. You must also guarantee that those machines will always be well patched and not run any malicious Internet worms or Trojan horse applications. Additionally, a clever hacker could determine the range of IP addresses that are commonly connecting to your network and configure his system to spoof, or appear to be connecting from, one of those addresses to penetrate your firewall.

Another option is to configure your firewall device to be managed remotely (via the Internet or a WAN connection). Then, whenever you want to connect remotely, you simply determine your local client’s IP address and reconfigure the firewall to allow inbound traffic from that address. Again, this solution is less than ideal because it requires a number of steps, it leaves your firewall vulnerable to hackers who might attempt to gain control of it remotely, and it requires you to remember to disable those addresses when you’re done.

Yet another option is to place the computer that provides the VPN connection in the firewall’s demilitarized zone (DMZ). Computers that have been configured to use the firewall’s DMZ are completely exposed to the outside network (and if the firewall is also providing network address translation [NAT], a computer in the DMZ is exposed using the firewall’s external IP address). This computer should be locked down tightly using a software firewall and should be configured to provide only VPN server services. This will allow external computers to establish a VPN connection safely into the network.

If the firewall is also providing NAT, the firewall could instead be configured to forward VPN traffic to the VPN server behind the firewall. External hosts cannot directly request access to hosts on a private LAN, so the firewall is left to play matchmaker and ensure that the incoming requests are forwarded to the correct internal server and nowhere else. Most software firewalls offer relatively simple interfaces for configuring the incoming ports, whereas many hardware firewalls (especially business class equipment) can require moderate expertise to configure them correctly.

You might also want to consider purchasing a firewall/gateway/switch device that includes a built-in VPN server. These devices are becoming increasingly common and allow for the greatest ease of setup when you want to provide secure VPN services to a small-to-medium size network.

For more information on configuring firewalls to work with a VPN, see the white paper “Virtual Private Networking with Windows 2000: Deploying Remote Access VPNs,” available at www.microsoft.com/windows2000/techinfo/planning/incremental/vpndeploy.asp.

Chapter 17