by David O'Leary
This chapter describes the installation and configuration procedures for Microsoft's Remote Access Service (RAS). The Remote Access Service enables authorized users to connect to your corporate network from remote locations, such as their homes, customer sites, and hotel rooms. Once connected, users can copy files, view data, send and receive e-mail, and access all network services as if they were directly connected to your LAN. This chapter provides you with the procedures and detailed information you need to get the Remote Access Service running and to keep it running reliably. For more information about RAS and how it can be used, see Chapter 11, "An Inside Look at Remote Access Service (RAS)."
NOTE: This chapter assumes that you will be setting up RAS on a Windows NT 4.0 Server; however, you will find that the setup and administration utilities for Windows NT 4.0 Workstation are identical although limited in the allowed number of concurrent connections. Also, on the server side, the Window NT 3.51 RAS utilities are very similar.
RAS can be installed automatically as a part of the initial Windows NT Server installation or after the initial Windows NT Server installation by using the Network applet in the Control Panel. The remaining portion of this chapter assumes that RAS was not installed during installation of Windows NT Server and that you now have a requirement to install it on the server.
NOTE: To be able to add and configure devices and change configuration parameters for networking, you must be logged on as a user with administrative rights to the local machine.
The chapter begins by presenting information on installing the hardware required for your RAS server. This section covers hardware for both basic and advanced RAS configurations. Information is presented for the installation and configuration of COM ports, modems, multiport hardware, and X.25 smart cards. You can skip this section if your hardware has already been properly set up and configured and is working properly.
This section provides general information and guidelines on how to set up and configure RAS-related hardware under Windows NT 4.0. This section assumes that you have already chosen your hardware and that the necessary data lines are already in place. Refer to Chapter 11 for information on choosing hardware. The following devices are discussed:
NOTE: Except for modems, most RAS-related devices are considered to be networking adapters. As such, they can be found, installed, and configured from the Adapter tab of the Network applet in the Control Panel.
If you plan on connecting more than two modems to your RAS server, you should consider using multiport hardware. Multiport hardware provides additional serial port connections, requires only a single interrupt, and, depending on which multiport device you choose, usually handles much of the processing load involved in supporting multiple modems. For more detailed information on multiport hardware and its uses, refer to Chapter 11. To install your multiport device, follow these steps:
NOTE: Although Windows NT supplies many drivers for the most common multiport hardware, you should ensure that you have the latest Windows NT 4.0 driver. Often, the best place to get this is from the hardware manufacturer's World Wide Web page or FTP site. This will be a very important part of your setup. If you get it right the first time, it could save you many future headaches.
X.25 smart cards, also known as X.25 pads, enable you to connect to a X.25 packet-switched network. X.25 pads are often used in implementing a wide area network (WAN) over a public data network (PDN). Because installation and setup procedures vary widely for X.25 adapters, you should refer to your hardware manufactures instructions or contact your hardware manufacturer for setup and configuration information under Windows NT 4.0.
In general, you will install the X.25 adapter from the Adapters tab of the Network applet in the control panel. Follow the steps given for installing multiport hardware. To ensure reliable communication, make sure you have the latest driver from the manufacturer.
NOTE: If you are using multiport hardware, refer to the manufacturers documentation for instructions on configuring its COM ports.
COM ports provide your computer with a way to communicate with external devices, such as modems. However, a COM port can also be used to communicate with an internal device, such as an internal modem. If you plan to attach a modem directly to your machine, whether internally or externally, you will need to use an available COM port and configure it match your modem's settings. This section gives detailed information on all involved configuration settings and suggests commonly used settings.
COM ports can be configured using the Control Panel of the Windows NT Server (or Workstation). To maximize your chances for successful modem connections the first time, know your modem's communication parameters before starting this procedure.
Follow these steps to configure your COM ports for RAS:
NOTE: Most modern machines, particularly servers, should have a 16550 or 16550AF UART chip that supports baud rates up to 115 Kbps. However, if you have an older machine with a 16450 UART chip, the maximum baud rate is 19,200 Bps.
When you have completed this procedure, the COM ports should be configured to properly support your modems.
Modems are the backbone of any RAS setup. Ensuring that you have the right modems for the job and that they are properly installed and configured will be key to the success of your RAS implementation. This section is intended to give you the information you need to make the right choices to ensure that you get the maximum reliability and bandwidth from your modems. The following steps will take you through the necessary steps to do this:
NOTE: If you are connecting an external modem to one of the existing ports on the back of your computer, you should, if possible, use a 25-pin, DB-25 serial port with a 25-pin cable. DB-25 connectors are generally found on most modems and other data communication equipment (DCE) because the serial communication standard, known as RS-232, describes a set of signals that requires a 25-pin cable to carry them.On the other hand, many modern modem protocols, such as v.34, have embedded the advanced functionality provided by the additional pins within the basic communication protocol and, therefore, require only a nine pin connection (DB-9).
NOTE: Windows NT does a good job of detecting what kind of modem you have and the COM port to which it is attached. If it is unable to detect your modem, there is most likely a problem with your modem, its physical setup, or its COM port settings.
Your modem should now be properly installed. Proceed to the next section to configure your modem for your RAS installation.
Your modem's configurable properties are determined by the driver selected when you installed your modem. Because the Properties dialog box is derived from this driver, the look and configurable settings will vary according to the type, brand, and model of the selected device. Because configurable settings may vary widely, this section will not be able to give you specific instructions as to how to configure your modem. For this reason, you should refer to your hardware manufacturer's documentation for details about your modem's configuration settings. Also, you can refer to Chapter 11, "An Inside Look At Remote Access Service (RAS)," for explanations of applicable settings and protocols, such as flow control, error detection and handling, and compression.
NOTE: In many cases, if you found the appropriate drivers for your modems, the default settings should be sufficient.
To open the modem's Properties dialog box, follow these steps:
At this point, all required hardware should be installed and working properly. It would be wise to test it to verify it is properly set up and working before installing the RAS software. You can use software supplied with your modem or a program called HyperTerminal which is supplied with both Windows NT and Windows 95. HyperTerminal can be found in the Accessories group of your Start menu. If the Setup Wizard successfully detected your modem, you should not have to worry about testing other than to ensure that your phone cords are properly attached and working.
This section walks you through the steps for installing the RAS software on your server. It presents detailed explanations of the choices offered to help you make an informed decision.
You will need the Windows NT Server CD-ROM for copying RAS files to your machine. Follow these steps to install RAS:
NOTE: DO not hit the Continue button yet; you still need to configure your modem and network settings. If you leave now, the Setup program will go through binding the service to networking protocols and several other configuration steps and then tell you to reboot the machine before you have even configured RAS to your liking.
The Remote Access Setup dialog box enables you to add, remove, and configure RAS devices, and it lets you view and edit RAS network settings. If the Remote Access Setup dialog box, shown in Figure 12.12, is not already displayed, open it by opening the Network icon from the Control Panel, selecting the Services tab, and double-clicking the Remote Access Service entry in the Network Services list.
The Remote Access Setup dialog box displays a list of the current RAS devices.
Any devices that you have previously installed should be listed in the Port/Device/Type
box.
The four buttons displayed at the bottom of the dialog box enable you to configure your ports and communication devices for use with RAS. The following list provides a description of these buttons:
To add devices, perform the following steps:
NOTE: For each device that you add, make sure you click Configure to choose how that device will be used.
The Clone button is particularly useful if you have several modems
of the same type connected to multiport hardware. To clone a RAS device, perform
the following steps:
To Configure a RAS device, perform the following steps:
TIP: You can use RAS for receiving calls and dialing out simultaneously by using multiple modems. A good method for testing your RAS installationóif you have multiple modems and linesóis to call your RAS server from your RAS server, thereby testing both the dial-out and receiving components.
Once your ports have been configured to your liking, you need to configure your RAS network settings. The next section explains how to do this.
The Network button on the Remote Access Setup dialog box brings
you to the RAS Network Configuration dialog box, as shown in Figure 12.14. This dialog
box allows you to select which networking protocols to use for both the client and
the server. Client settings will only be enabled if you have at least one modem configured
for dial-out. The server section will not even be seen unless you have at least one
modem configured for receiving calls.
The Network Configuration dialog box enables you to configure networking options for RAS. Server settings will only be visible if you have at least one modem configured for dial-out. Client settings will be grayed if no modems are configured for dial-out.
For both dialing out and receiving calls, you will need to choose the networking protocols to use. The available options are listed and explained as follows:
See "NetBEUI," [Ch 4]
See "Transmission Control Protocol/Internet Protocol (TCP/IP)," [Ch 4]
See "Internet Packet Exchange/Sequenced Package Exchange (IPX/SPX)," [Ch 4]
Configuring Dial-Out Protocols
In the Dial-Out Protocols section at the top of the Network Configuration dialog box, check the appropriate boxes for enabling different dial-out protocols based on your preferences. This section only enables you to choose which protocols to use; setting the parameters of these protocols can be done with the RAS client software supplied with Windows NT or whatever operating system is being used. Client software is covered in Chapter 13, "Implementing Dial-Up Networking Clients."
Configuring RAS Server Network Protocol Settings
The options available under Server Settings enable you to determine and configure your RAS server's available networking protocols and encryption settings. The choice of protocols depends on your enterprise needs and available protocols being used on your existing network. Do not enable any unnecessary network protocols, as each protocol requires additional network bandwidth and can cause significant performance loss as additional queries must be issued when locating a network resource.
TIP: The RAS clients can also specify what protocols they want to use for remote connectivity to prevent unnecessary overhead. (Usually, just one is needed.)
Configuration options and procedures for each of the available networking protocols are discussed in the following sections.
If you want to have users connect to your RAS serveróand optionally, the corporate networkóusing NetBEUI, perform these steps:
The Network Configuration dialog box reappears so that you can configure additional protocols.
To configure Transmission Control Protocol/Internet Protocol, perform the following steps:
NOTE: Each protocol Configuration dialog box contains a section for enabling network access options for the selected protocol.
- Use
DHCP to Assign Remote TCP/IP Client AddressesóDHCP stands for Dynamic Host Configuration Protocol. This option enables DHCP assignment of TCP/IP addresses. This enables the RAS server to dynamically obtain TCP/IP addresses from the DHCP server for assignment to remote user PCs connecting to the network using RAS. This method is most useful for minimizing administration overhead.
- Use
Static Address PoolóAssign TCP/IP client addresses from a static pool of available addresses. The static pool sets aside a range of TCP/IP addresses for use by the RAS server for assignment to remote user PCs. Use theBegin andEnd boxes to specify the static pool address range. You can also use theFrom and theTo boxes to exclude certain addresses from the assigned pool. This provides added flexibility for best using available TCP/IP addresses.
- A
llow Remote Clients to Request a Predetermined IP AddressóWith this option enabled, users can request a specific IP address. This enables users to always use the same IP address.Click OK to close the RAS Server TCP/IP Configuration dialog box and complete your TCP/IP configuration for RAS.
The Network Configuration dialog box reappears so that you can configure additional protocols.
See "Dynamic Host Configuration Protocol (DHCP)," [Ch 9]
The IPX check box enables you to configure the options for enabling
IPX/SPX connections using RAS. To configure IPX, follow these steps:
- Allocate Network Numbers
AutomaticallyóRAS software uses the NetWare Router Information Protocol (RIP) to determine unique network numbers that are available for allocation. The RAS Server then allocates that number to the remote client. This method is useful because it requires the least administration overhead for assigning IPX addresses.
- Alloca
te Network NumbersóThis is the manual method of allocating the network numbers. This method can be the best choice if you want to have more control over network number assignments for security and monitoring purposes. To exercise this alternative, simply click the appropriate option button and then enter the first network number in theFrom box. The RAS Server automatically calculates the ending number for you based on number of available ports.
- Assign
Same Network Number to All IPX ClientsóEnable this check box to assign the same network number to all IPX clients using either the automatic or manual methods.
- Allow Remote Clients to Request
IPX Node NumberóEnable this check box to allow remote clients to request a specific IPX number. This method presents a potential security risk. It enables a remote client to use a previously connected client's node number and potentially impersonate his or her access privileges.
See "Internet Packet Exchange/Sequenced Package Exchange (IPX/SPX)," [Ch 4]
This section discusses the encryption techniques used by RAS for authenticating user logon and password information. Encryption settings are one aspect RAS security options used to prevent unauthorized users from gaining access to your server and/or domain. Users can only log on to your RAS server if they are using a RAS enabled account for the domain. Encryption settings are used to prevent someone from capturing logon and password information by "listening in" to a logon session. To set encryption options, perform the following steps:
- Allow
Any Authentication Including Clear TextóEnabling this option button permits remote clients to connect using clear text based authentication. This method presents a security risk because the logon ID and password are transmitted over an unsecured connection using regular text
- Require
Encrypted AuthenticationóEnabling this option button permits remote clients to connect using encrypted authentication. This method encrypts the logon ID and password before transmission over the connection line.
NOTE: With Require Encrypted Authentication selected, Microsoft supports a variety of encryption algorithms including MS_CHAP, DES, and SPAP. To force the use of MS_CHAPóthe most secure password authentication protocol supported by RASóselect Require Microsoft Encrypted Authentication. All the above protocols are described in Chapter 11, "An Inside Look at Remote Access Service (RAS)."
- Require
Microsoft Encrypted AuthenticationóEnabling this option button permits connection using the Microsoft security model. The logon ID and password are authenticated by the Windows NT Server logon service.
NOTE: As discussed in Chapter 11, RAS uses the RC4 encryption algorithm for encrypting and decrypting data. RC4 is popular because of its speed and proven security. As RC4 does require some rather involved computations for encryption, it will slow system performance somewhat. If you are not transmitting sensitive information, you can improve performance by leaving this option disabled.
The final setting in the Network Configuration dialog box is the Enable Multilink
check box. Multilink allows one network session to occur over multiple physical connections.
The most common use of multilink in to bundle the two B-channels of an ISDN modem
into a single logical connection. Multilink can also be used to bundle any two modems
together to increase bandwidth.
See "RAS Multilink PPP," [Ch 11]
All configuration steps should now be complete. To finish your installation, perform the following steps:
The installation and configuration of your RAS server is now complete.
The Remote Access Admin tool included with RAS enables you to set user permissions and monitor active connections on RAS servers throughout your enterprise. If you have multiple RAS servers in your organizations, you can manage all of them from a single Windows NT Server or Windows NT Workstation computer. If you want to configure network settings, or add, remove, or configure devices, you will need to refer to the previous section "Configuring RAS."
TIP: If you are familiar with the Remote Access tool provided in Windows NT 3.51, you'll find that except for the new Windows 95 look and feel, the tool is almost exactly the same.
The Remote Access Admin tool can be started from the Administrative Tools group in the Start menu. Figure 12.18 shows the main screen for the Remote Access Admin program.
Remote Access Admin tool can be used to administer all of your RAS servers on the enterprise network.
The Remote Access Admin tool displays the following information about available RAS servers:
NOTE: The Remote Access Admin tool is installed by default as part of the RAS server installation process.
The following sections detail some of the administration and monitoring capabilities of the Remote Access Admin tool.
The Remote Access Admin tool enables you to select the RAS server you want to administer by selecting the appropriate PC or domain. You can select a single RAS server to manage, or you can select a complete domain, which would include administering and monitoring all RAS servers within that domain.
NOTE: If you are running RAS on a Windows NT domain controller machine, the default option is to manage RAS servers in the domain. If you are running RAS on a Windows NT Server, the default option is to manage the RAS server on that machine only.
To select a RAS server or domain for administration, perform the following steps:
After you have selected the RAS server or domain, you can administer them or monitor their operation using the Remote Access Admin tool.
From a machine with the Remote Access Admin tool, you can start, stop, pause, and continue the RAS service any machine that you proper access rights for.
Starting a RAS Service
To start RAS services, perform the following steps in Remote Access Admin:
Stoping a RAS Service
To stop RAS services, perform the following steps in Remote Access Admin:
NOTE: Stopping or pausing a RAS service while users are connected will disconnect those users. If possible, you should use the Remote Access Admin tool to send a message to connected users stating that you will be stopping the RAS service and, if appropriate, give them an appropriate amount of time and a phone number where they can contact you if they need you to wait a few additional minutes while they finish a transmission.
Pausing a RAS Service
Pausing allows you to prevent any additional users from connecting to the Server, while allowing existing connections to remain. This is useful in cases where you know you will need to shut down the server but do not need to do it immediately and you do not want to force disconnections.
To pause RAS services, perform the following steps in Remote Access Admin:
Continuing a RAS Service
Continuing a paused RAS Service will allow new users to connect to the RAS Server. To continue RAS services, perform the following steps in Remote Access Admin:
You can perform the preceding steps on any available RAS server within your enterprise network from a central computer.
The Remote Access Admin tool can be used to monitor the status of your RAS ports periodically to determine their status and user activity. To monitor RAS ports using Remote Access Admin, perform the following steps:
NOTE: You should always warn users before forcing a disconnection. To do this you can use the Admin tool's Send Message button. If possible, give them the time and a method to reply to you before disconnecting them. Forcing a disconnection may cause the user to lose important information or may require them to restart a lengthy download process.
RAS enables you to monitor all remote connections by user or by domain. To monitor users connected to your RAS servers, follow these steps:
The Remote Access Admin tool enables administrators to set up access privileges and dial-in permissions for user accounts in the Windows NT domain. A remote user must have an account on the RAS server or the Windows NT domain to be able to dial-in using RAS.
RAS uses the Windows NT integrated security model to authenticate user logon IDs and passwords. However, you must use the Remote Access Admin tool to set up dial-in permissions for remote users. Use the following procedure to set up dial-in permissions for remote users:
NOTE: TheGrant All and Revoke All buttons are not available when using a Low Speed Connection. You must set permissions for one user at a time.
TIP: The callback feature is useful for users who must make long distance calls to connect to the server. Remote users can use the callback option to charge long distance connect charges to a central office number rather than their personal phone numbers. This has the added benefit of consolidating billing records.Callback is also an effective security measure. Individual user accounts can be configured so as to require the RAS Server to call the user back at a predetermined number before allowing access to the network, making it extremely difficult for an intruder to use the account from another location.
No Call BackóUsers dial-in and connect to the RAS server.
Set By CalleróUsers provide the server with the call-back phone numbers. When this option is enabled, the RAS Server prompts the caller for a call-back number. This is useful for remote users who travel from place to place and do not have access to a regular number. This can also be an effective security measure as all call back numbers are logged.
Preset ToóWhen this option is enabled, the RAS Server initiates a call back to the client at the number indicated in the box. This is a very effective security measure as it only allows users to call from a specified number. However, it can not be used for mobile users or users who need to dial-in from multiple locations.
The Remote Access Admin tool is a powerful program for administering and monitoring your enterprise-wide RAS servers. Its single point of management and simplicity of use make it an ideal tool for the job.
This chapter provides information on the implementation and administration of the Server side of Windows NT Remote Access Service. Configuration details are explained, and many of the available configuration options are described to give you a better understanding of some of the more common protocol constraints and settings. The Remote Access Admin tool is also described, and several of the common administrative procedures using this tool are detailed. For more information on these and related issues, see the following chapters:
© Copyright, Macmillan Computer Publishing. All rights reserved.