Connecting Remote Users to Your Network.docx

Connecting Remote Users to Your Network.docx

《Connecting Remote Users to Your Network.docx》由会员分享，可在线阅读，更多相关《Connecting Remote Users to Your Network.docx（18页珍藏版）》请在冰豆网上搜索。

ConnectingRemoteUserstoYourNetwork

OperatingSystem

ConnectingRemoteUserstoYourNetwork

ScenarioGuide

Abstract

Businessestodaywantaccesstotheirinformationonthecorporatenetworkfromanywhereandatanytime.Whethertheyareontheroadwithcustomersorworkingfromhome,providingyouremployeeswithremoteaccesstothecorporatenetworkisbecomingcritical.ThisguideoutlineshowWindows2000canprovidetelecommutersandmobilecomputingprofessionalswithaccesstotheirprivatecorporatenetworkresources.Withintegrateddial-upservicesandvirtualprivatenetworking,Windows2000providesacompleteremoteaccesssolutionformedium-sizednetworks.

©2000MicrosoftCorporation.Allrightsreserved.

TheinformationcontainedinthisdocumentrepresentsthecurrentviewofMicrosoftCorporationontheissuesdiscussedasofthedateofpublication.BecauseMicrosoftmustrespondtochangingmarketconditions,itshouldnotbeinterpretedtobeacommitmentonthepartofMicrosoft,andMicrosoftcannotguaranteetheaccuracyofanyinformationpresentedafterthedateofpublication.

Thiswhitepaperisforinformationalpurposesonly.MICROSOFTMAKESNOWARRANTIES,EXPRESSORIMPLIED,INTHISDOCUMENT.

Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.Withoutlimitingtherightsundercopyright,nopartofthisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans（electronic,mechanical,photocopying,recording,orotherwise）,orforanypurpose,withouttheexpresswrittenpermissionofMicrosoftCorporation.

Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubjectmatterinthisdocument.ExceptasexpresslyprovidedinanywrittenlicenseagreementfromMicrosoft,thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty.

MicrosoftActiveDirectory,Windows,theWindowslogo,andWindows NTareeitherregisteredtrademarksortrademarksofMicrosoftCorporationintheUnitedStatesand/orothercountries.

Thenamesofactualcompaniesandproductsmentionedhereinmaybethetrademarksoftheirrespectiveowners.

MicrosoftCorporation•OneMicrosoftWay•Redmond,WA98052-6399•USA

0200

Contents

Introduction1

ScenarioRequirements2

ScenarioTasks2

Selectingaremoteaccesssolution3

Dial-upRemoteAccess3

VPNRemoteAccess3

setupFordial-upremoteaccessservers4

setupForvirtualprivatenetworkingservers6

ConfiguringDial-upremoteaccessandthevirtualprivatenetworking7

Overview7

EnableRemoteAccessonaInternetConnectionServer7

ConfiguringRemoteAccessServices8

Settingremoteaccesspermissions14

Clientconfigurationanddeployment16

Overview16

CreatingaDial-upClientConnection16

CreatingaVPNClientConnection17

Summary22

ForMoreInformation23

Windows2000WebSiteResources23

Introduction

Businessestodaywantaccesstotheirinformationanywhere,atanytime.Whetherontheroadwithcustomersorworkingfromhome,employees’needforremoteaccesstothecorporatenetworkisbecomingcritical.Windows2000makesiteasiertoletemployeessecurelyconnecttothecorporatenetworkbyintegratingthelatestremoteaccesstechnology.

UsingtheremoteaccessservicesofWindows 2000Server,youcanconfigureremoteaccessserversthatprovideconnectivitytothecorporatenetworkforauthorizedusers.Thistransparentconnectionallowsremoteaccessclientstoaccessresourcesfromremotelocationsasiftheywerephysicallyattachedtothenetwork.

Windows 2000remoteaccessprovidestwodifferenttypesofremoteaccessconnectivity:

1.Dial-upremoteaccess

Togainaccesstothenetworkwithdial-upremoteaccess,aremoteaccessclientusesthepublictelephonenetworktocreateaphysicalconnectiontoaportonaremoteaccessserverthatsitsonthe“edge”oftheprivatenetwork.ThisistypicallydonebyusingamodemorISDNadaptertodialintoyourremoteaccessserver.

2.Virtualprivatenetwork（VPN）remoteaccess

AVPNcanprovidesecureremoteaccessthroughtheInternet,ratherthanthroughdirectdial-upconnections.AVPNclientusesanIPinternetworktocreateanencrypted,virtual,point-to-pointconnectionwithaVPNgatewaythatexistsonthe“edge”oftheprivatenetwork.ThisistypicallydonebyconnectingtotheInternetfirst,andthencreatingtheVPNconnection.ByusingtheInternetinthisway,companiescanreducetheirlongdistancephoneexpensesandrelyonexistinginfrastructureinsteadofmanagingtheirown.

Note:

Dial-upRemoteAccessServersareoftenreferredtoasRASservers.VPNGatewaysandVPNServersareusedsynonymously.

ThisguideoutlinesthestepsneededtosetupremoteaccesswithWindows2000,anddiscussesdeployingremoteaccessclients.IfyoualreadyupgradedyourWindowsNT4.0RemoteAccessServertoWindows2000,thenitshouldalreadybeworkingforyourremoteusers.Inthatcase,thisdocumentmayserveonlyasaguidesettingupanotherremoteaccessserverorvirtualprivatenetworkingserver.

ScenarioRequirements

Thisguidebuildsontheconfigurationachievedbythefollowingguides.Besureyouhavesuccessfullycompletedthefollowingscenarioguidesbeforeproceeding.

“ConnectingYourNetworktotheInternet”

“UpgradingaWindowsNTDomaintoWindows2000ActiveDirectory”

Dependingonthetypeofremoteaccesssolution,youwillneedtocoordinatewithyourlocaltelecommunicationscompanyorInternetserviceprovider（ISP）tosetupremoteclientconnectioninformation.Ifyouareplanningtodeployadial-upsolution,yourTelcocansetuptelephonelinesthatdialdirectlytoyourmodem（s）.IfyouareplanningtodeployaVPNsolution,yourISPwillneedtosupporttheGREprotocolandassignapublicIPaddresstoyourVPNserverinorderforremoteclientstoconnectovertheInternet.

ToconfiguretheserverforasaRAS/VPNserver,youwillneedtoinstalltheRoutingandRemoteAccessServices（RRAS）thatisincludedwiththeOptionalWindows2000componentspackage.ToinstallthiscomponentonyourWindows2000Server,clickStart,pointtoPrograms,pointtoAdministrativeTools,clickConfigureyourserver,clickNetworkingandclickRouting.FollowtheinstructionsonthispagetoinstalltheRRAS.Youmusthavenetworkadministratorrightstoconfigurethissetup

ScenarioTasks

Inthisguideyouperformthefollowingtasks.

SetupandManagementTasks

∙Decidingwhattypeofremoteaccessyouruserswillneed

∙Settingupthenecessaryhardwareforadial-upremoteaccessserver

∙Settingupthenecessaryhardwareforavirtualprivatenetworkingserver

∙Configurationoftheremoteaccessserverandvirtualprivatenetworkingserver

∙Virtualprivatenetworkingconsiderations

∙Settingremoteaccesspermissions

∙Clientconfigurationanddeployment

Selectingaremoteaccesssolution

Whendecidingonaremoteaccesssolution,youshouldevaluateyourremoteaccessneedsandunderstandthebenefitsandfeaturesofDirectDialandVPNremoteaccess.Companiesmaychoosetouseasinglemethodforremoteaccessordeploybothascomplementingtechnologies.Forexample,somecompanieshavedeployedVPNastheirprimaryremoteaccessconnectionandfallbacktoDial-upconnectionswhenInternetaccessisunavailable.

Dial-upRemoteAccess

Dial-UpRemoteAccesswillmeettheneedsofcompaniesthathaveasmallremoteuserpopulation,thataresatisfiedwithanalogorISDNperformance,orthathaveremoteusersthatstaywithinthelocalcallingarea.Inacompanywheretheremoteuserpopulationandlongdistancetelephoneexpensesaregrowingquicklyorthereisaneedtoforadditionalbroadbandsupport,administratorsshouldconsideraVPNsolution.

VPNRemoteAccess

CompaniesthatwanttolowertheirremoteaccesscostandincreasetheirnetworkflexibilitycantakeadvantageofVPNRemoteAccess.Travelingemployeescanusethesamemodemtheyusedforlongdistancedial-up,andleveragetheInternetbydialingthelocalISPforavirtualconnectionbacktothecorporatenetwork.Thiseliminatesthelongdistancechargesortollcallsassociatedwithadial-upconnection.

Whilethisminimizesthedial-upcostfortravelingemployees,allVPNuserscanbenefitfromthetechnology’sflexibleconnectionmediumsupport.VPNssupportanalogmodemsandISDNaswellasdedicatedbroadbandconnectionslikecableandDSL

setupFordial-upremoteaccessservers

Inordertosupportdial-upmodemconnectionsintoyournetwork,youwillneedtohaveyourtelephonecompanyinstallaphonelineforeachanalogmodemthatacceptsincomingcalls.Yourremoteaccessclientswilldialthesededicatedphonenumberstoconnecttheircomputertotheremoteaccessserver.

Inaddition,eachserver-sidemodemrequiresaserialportontheremoteaccessserver.Ifyouonlywanttouseoneortwomodems,youcanjustusethebuilt-inserialportsonyourremoteaccessserverorinstallafewPCIorISAinternalmodems.

Note:

Typically,dial-upconnectionsaremadebyusinganalogmodemsorISDN.IfyouaregoingtosupportISDNdial-upaswell,youwillneedISDNlinesinstalledatyourcompanyandthesamenumberofISDNadaptersforthenumberofISDNlinesinstalled.

Ifyourequiremorethantwomodemsinyourpool,youwillneedtouseamulti-portserialadapterorahigh-densitycombinationcard.Multi-portserialadaptersallowyoutoconnectalargenumberofanalogmodemsorISDNmodemstooneremoteaccessserver.Amulti-portserialadapterallowsyoutoinstallonePCIorISAcardinyourcomputerandcreatealargenumberofserial