Connecting Remote Users to Your Network.docx
《Connecting Remote Users to Your Network.docx》由会员分享,可在线阅读,更多相关《Connecting Remote Users to Your Network.docx(18页珍藏版)》请在冰豆网上搜索。
![Connecting Remote Users to Your Network.docx](https://file1.bdocx.com/fileroot1/2023-4/2/8527f7fc-084b-441c-bc4b-b025f658e322/8527f7fc-084b-441c-bc4b-b025f658e3221.gif)
ConnectingRemoteUserstoYourNetwork
OperatingSystem
ConnectingRemoteUserstoYourNetwork
ScenarioGuide
Abstract
Businessestodaywantaccesstotheirinformationonthecorporatenetworkfromanywhereandatanytime.Whethertheyareontheroadwithcustomersorworkingfromhome,providingyouremployeeswithremoteaccesstothecorporatenetworkisbecomingcritical.ThisguideoutlineshowWindows2000canprovidetelecommutersandmobilecomputingprofessionalswithaccesstotheirprivatecorporatenetworkresources.Withintegrateddial-upservicesandvirtualprivatenetworking,Windows2000providesacompleteremoteaccesssolutionformedium-sizednetworks.
©2000MicrosoftCorporation.Allrightsreserved.
TheinformationcontainedinthisdocumentrepresentsthecurrentviewofMicrosoftCorporationontheissuesdiscussedasofthedateofpublication.BecauseMicrosoftmustrespondtochangingmarketconditions,itshouldnotbeinterpretedtobeacommitmentonthepartofMicrosoft,andMicrosoftcannotguaranteetheaccuracyofanyinformationpresentedafterthedateofpublication.
Thiswhitepaperisforinformationalpurposesonly.MICROSOFTMAKESNOWARRANTIES,EXPRESSORIMPLIED,INTHISDOCUMENT.
Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.Withoutlimitingtherightsundercopyright,nopartofthisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recording,orotherwise),orforanypurpose,withouttheexpresswrittenpermissionofMicrosoftCorporation.
Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubjectmatterinthisdocument.ExceptasexpresslyprovidedinanywrittenlicenseagreementfromMicrosoft,thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty.
MicrosoftActiveDirectory,Windows,theWindowslogo,andWindows NTareeitherregisteredtrademarksortrademarksofMicrosoftCorporationintheUnitedStatesand/orothercountries.
Thenamesofactualcompaniesandproductsmentionedhereinmaybethetrademarksoftheirrespectiveowners.
MicrosoftCorporation•OneMicrosoftWay•Redmond,WA98052-6399•USA
0200
Contents
Introduction1
ScenarioRequirements2
ScenarioTasks2
Selectingaremoteaccesssolution3
Dial-upRemoteAccess3
VPNRemoteAccess3
setupFordial-upremoteaccessservers4
setupForvirtualprivatenetworkingservers6
ConfiguringDial-upremoteaccessandthevirtualprivatenetworking7
Overview7
EnableRemoteAccessonaInternetConnectionServer7
ConfiguringRemoteAccessServices8
Settingremoteaccesspermissions14
Clientconfigurationanddeployment16
Overview16
CreatingaDial-upClientConnection16
CreatingaVPNClientConnection17
Summary22
ForMoreInformation23
Windows2000WebSiteResources23
Introduction
Businessestodaywantaccesstotheirinformationanywhere,atanytime.Whetherontheroadwithcustomersorworkingfromhome,employees’needforremoteaccesstothecorporatenetworkisbecomingcritical.Windows2000makesiteasiertoletemployeessecurelyconnecttothecorporatenetworkbyintegratingthelatestremoteaccesstechnology.
UsingtheremoteaccessservicesofWindows 2000Server,youcanconfigureremoteaccessserversthatprovideconnectivitytothecorporatenetworkforauthorizedusers.Thistransparentconnectionallowsremoteaccessclientstoaccessresourcesfromremotelocationsasiftheywerephysicallyattachedtothenetwork.
Windows 2000remoteaccessprovidestwodifferenttypesofremoteaccessconnectivity:
1.Dial-upremoteaccess
Togainaccesstothenetworkwithdial-upremoteaccess,aremoteaccessclientusesthepublictelephonenetworktocreateaphysicalconnectiontoaportonaremoteaccessserverthatsitsonthe“edge”oftheprivatenetwork.ThisistypicallydonebyusingamodemorISDNadaptertodialintoyourremoteaccessserver.
2.Virtualprivatenetwork(VPN)remoteaccess
AVPNcanprovidesecureremoteaccessthroughtheInternet,ratherthanthroughdirectdial-upconnections.AVPNclientusesanIPinternetworktocreateanencrypted,virtual,point-to-pointconnectionwithaVPNgatewaythatexistsonthe“edge”oftheprivatenetwork.ThisistypicallydonebyconnectingtotheInternetfirst,andthencreatingtheVPNconnection.ByusingtheInternetinthisway,companiescanreducetheirlongdistancephoneexpensesandrelyonexistinginfrastructureinsteadofmanagingtheirown.
Note:
Dial-upRemoteAccessServersareoftenreferredtoasRASservers.VPNGatewaysandVPNServersareusedsynonymously.
ThisguideoutlinesthestepsneededtosetupremoteaccesswithWindows2000,anddiscussesdeployingremoteaccessclients.IfyoualreadyupgradedyourWindowsNT4.0RemoteAccessServertoWindows2000,thenitshouldalreadybeworkingforyourremoteusers.Inthatcase,thisdocumentmayserveonlyasaguidesettingupanotherremoteaccessserverorvirtualprivatenetworkingserver.
ScenarioRequirements
Thisguidebuildsontheconfigurationachievedbythefollowingguides.Besureyouhavesuccessfullycompletedthefollowingscenarioguidesbeforeproceeding.
“ConnectingYourNetworktotheInternet”
“UpgradingaWindowsNTDomaintoWindows2000ActiveDirectory”
Dependingonthetypeofremoteaccesssolution,youwillneedtocoordinatewithyourlocaltelecommunicationscompanyorInternetserviceprovider(ISP)tosetupremoteclientconnectioninformation.Ifyouareplanningtodeployadial-upsolution,yourTelcocansetuptelephonelinesthatdialdirectlytoyourmodem(s).IfyouareplanningtodeployaVPNsolution,yourISPwillneedtosupporttheGREprotocolandassignapublicIPaddresstoyourVPNserverinorderforremoteclientstoconnectovertheInternet.
ToconfiguretheserverforasaRAS/VPNserver,youwillneedtoinstalltheRoutingandRemoteAccessServices(RRAS)thatisincludedwiththeOptionalWindows2000componentspackage.ToinstallthiscomponentonyourWindows2000Server,clickStart,pointtoPrograms,pointtoAdministrativeTools,clickConfigureyourserver,clickNetworkingandclickRouting.FollowtheinstructionsonthispagetoinstalltheRRAS.Youmusthavenetworkadministratorrightstoconfigurethissetup
ScenarioTasks
Inthisguideyouperformthefollowingtasks.
SetupandManagementTasks
∙Decidingwhattypeofremoteaccessyouruserswillneed
∙Settingupthenecessaryhardwareforadial-upremoteaccessserver
∙Settingupthenecessaryhardwareforavirtualprivatenetworkingserver
∙Configurationoftheremoteaccessserverandvirtualprivatenetworkingserver
∙Virtualprivatenetworkingconsiderations
∙Settingremoteaccesspermissions
∙Clientconfigurationanddeployment
Selectingaremoteaccesssolution
Whendecidingonaremoteaccesssolution,youshouldevaluateyourremoteaccessneedsandunderstandthebenefitsandfeaturesofDirectDialandVPNremoteaccess.Companiesmaychoosetouseasinglemethodforremoteaccessordeploybothascomplementingtechnologies.Forexample,somecompanieshavedeployedVPNastheirprimaryremoteaccessconnectionandfallbacktoDial-upconnectionswhenInternetaccessisunavailable.
Dial-upRemoteAccess
Dial-UpRemoteAccesswillmeettheneedsofcompaniesthathaveasmallremoteuserpopulation,thataresatisfiedwithanalogorISDNperformance,orthathaveremoteusersthatstaywithinthelocalcallingarea.Inacompanywheretheremoteuserpopulationandlongdistancetelephoneexpensesaregrowingquicklyorthereisaneedtoforadditionalbroadbandsupport,administratorsshouldconsideraVPNsolution.
VPNRemoteAccess
CompaniesthatwanttolowertheirremoteaccesscostandincreasetheirnetworkflexibilitycantakeadvantageofVPNRemoteAccess.Travelingemployeescanusethesamemodemtheyusedforlongdistancedial-up,andleveragetheInternetbydialingthelocalISPforavirtualconnectionbacktothecorporatenetwork.Thiseliminatesthelongdistancechargesortollcallsassociatedwithadial-upconnection.
Whilethisminimizesthedial-upcostfortravelingemployees,allVPNuserscanbenefitfromthetechnology’sflexibleconnectionmediumsupport.VPNssupportanalogmodemsandISDNaswellasdedicatedbroadbandconnectionslikecableandDSL
setupFordial-upremoteaccessservers
Inordertosupportdial-upmodemconnectionsintoyournetwork,youwillneedtohaveyourtelephonecompanyinstallaphonelineforeachanalogmodemthatacceptsincomingcalls.Yourremoteaccessclientswilldialthesededicatedphonenumberstoconnecttheircomputertotheremoteaccessserver.
Inaddition,eachserver-sidemodemrequiresaserialportontheremoteaccessserver.Ifyouonlywanttouseoneortwomodems,youcanjustusethebuilt-inserialportsonyourremoteaccessserverorinstallafewPCIorISAinternalmodems.
Note:
Typically,dial-upconnectionsaremadebyusinganalogmodemsorISDN.IfyouaregoingtosupportISDNdial-upaswell,youwillneedISDNlinesinstalledatyourcompanyandthesamenumberofISDNadaptersforthenumberofISDNlinesinstalled.
Ifyourequiremorethantwomodemsinyourpool,youwillneedtouseamulti-portserialadapterorahigh-densitycombinationcard.Multi-portserialadaptersallowyoutoconnectalargenumberofanalogmodemsorISDNmodemstooneremoteaccessserver.Amulti-portserialadapterallowsyoutoinstallonePCIorISAcardinyourcomputerandcreatealargenumberofserial