How to install and Turn on a VPN Server:To install and turn on a VPN server, follow these steps:
1. Click
Start, point to
Administrative Tools,
and then click
Routing and Remote Access.
2. Click the server icon that matches the local server name in the left pane of
the console. If the icon has a red circle in the lower-left corner, the Routing
and Remote Access service has not been turned on. If the icon has a green arrow
pointing up in the lower-left corner, the Routing and Remote Access service has
been turned on. If the Routing and Remote Access service was previously turn on,
you may want to reconfigure the server. To reconfigure the server:
a) Right-click the server object, and then click
Disable Routing and Remote Access. Click Yes to
continue when you are prompted with an informational message. b) Right-click the server icon, and then click
Configure and Enable Routing and Remote Access to start the Routing and
Remote Access Server Setup Wizard. Click Next to continue. c) Click Remote access (dial-up or VPN) to
turn on remote computers to dial in or connect to this network through the
Internet. Click Next to continue.3. Click to select
VPN or
Dial-up depending on
the role that you intend to assign to this server.
4. In the VPN Connection window, click the network interface which is connected
to the Internet, and then click
Next.
5. In the
IP Address Assignment window, click
Automatically if a DHCP server will be used to assign addresses to
remote clients, or click
From a specified range of
addresses if remote clients must only be given an address from a
pre-defined pool. In most cases, the DHCP option is simpler to administer.
However, if DHCP is not available, you must specify a range of static addresses.
Click
Next to continue.
6. If you clicked
From a specified range of addresses, the
Address Range Assignment dialog box opens. Click
New. Type the first IP address in the range of addresses that you want to use in the
Start IP address box. Type the last IP address in the range in the
End IP address box. Windows calculates the number of addresses automatically. Click
OK to return to the
Address Range Assignment window. Click
Next to continue.
7. Accept the default setting of
No, use Routing and
Remote Access to authenticate connection requests, and then click
Next to continue. Click
Finish to turn on the
Routing and Remote Access service and to configure the server as a Remote Access
server.
How to Configure the VPN Server:To continue to configure the VPN server as required, follow these steps.
How to Configure the Remote Access Server as a Router:For the remote access server to forward traffic properly inside your network,
you must configure it as a router with either static routes or routing
protocols, so that all of the locations in the intranet are reachable from the
remote access server.
To configure the server as a router:
1. Click
Start, point to
Administrative Tools,
and then click
Routing and Remote Access.
2. Right-click the server name, and then click
Properties.
3. Click the
General tab, and then click to select
Router under
Enable this computer as a.
4. Click
LAN and demand-dial routing, and then
click
OK to close the
Properties dialog box.
How to Modify the Number of Simultaneous Connections:The number of dial-up modem connections is dependent on the number of modems
that are installed on the server. For example, if you have only one modem
installed on the server, you can have only one modem connection at a time.
The number of dial-up VPN connections is dependent on the number of simultaneous
users whom you want to permit. By default, when you run the procedure described
in this article, you permit 128 connections. To change the number of simultaneous connections, follow these steps:
1. Click
Start, point to
Administrative Tools,
and then click
Routing and Remote Access.
2. Double-click the server object, right-click
Ports, and then
click
Properties.
3. In the
Ports Properties dialog box, click
WAN
Miniport (PPTP), and then click
Configure.
4. In the
Maximum ports box, type the number of VPN connections
that you want to permit.
5. Click
OK, click
OK again, and then close
Routing and Remote Access.
How to Manage Addresses and Name Servers:The VPN server must have IP addresses available to assign them to the VPN
server's virtual interface and to VPN clients during the IP Control Protocol (IPCP)
negotiation phase of the connection process. The IP address assigned to the VPN
client is assigned to the virtual interface of the VPN client.
For Windows Server 2003-based VPN servers, the IP addresses assigned to VPN
clients are obtained through DHCP by default. You can also configure a static IP
address pool. The VPN server must also be configured with name resolution
servers, typically DNS and WINS server addresses, to assign to the VPN client
during IPCP negotiation.
How to Manage AccessConfigure the dial-in properties on user accounts and remote access policies to
manage access for dial-up networking and VPN connections.
NOTE: By default, users are denied access to dial-up
networking.
Access by User Account:To grant dial-in access to a user account if you are managing remote access on a
user basis, follow these steps:
1. Click
Start, point to
Administrative Tools,
and then click
Active Directory Users and computers.
2. Right-click the user account, and then click
Properties.
3. Click the
Dial-in tab.
4. Click
Allow access to grant the user permission to dial in. Click
OK.
Access by Group Membership:If you manage remote access on a group basis, follow these steps:
1. Create a group with members who are permitted to create VPN connections.
2. Click
Start, point to
Administrative Tools,
and then click
Routing and Remote Access.
3. In the console tree, expand
Routing and Remote Access, expand the server name, and then click
Remote Access Policies.
4. Right-click anywhere in the right pane, point to
New, and
then click
Remote Access Policy.
5. Click
Next, type the policy name, and then click
Next.
6. Click
VPN for Virtual Private Access access method, or click
Dial-up for dial-up access, and then click
Next.
7. Click
Add, type the name of the group that you created in
step 1, and then click
Next.
8. Follow the on-screen instructions to complete the wizard.
If the VPN server already permits dial-up networking remote access services, do
not delete the default policy. Instead, move it so that it is the last policy to
be evaluated.
How to Configure a VPN Connection from a Client Computer:To set up a connection to a VPN, follow these steps. To set up a client for
virtual private network access, follow these steps on the client workstation:
NOTE: You must be logged on as a member of the Administrators
group to follow these steps.
NOTE: Because there are several versions of Microsoft Windows,
the following steps may be different on your computer. If they are, see your
product documentation to complete these steps.
1. On the client computer, confirm that the connection to the Internet is
correctly configured.
2. Click
Start, click
Control Panel, and then
click
Network Connections. Click
Create
a new connection under
Network Tasks, and then click
Next.
3. Click
Connect to the network at my workplace to create the dial-up connection. Click
Next to continue.
4. Click
Virtual Private Network connection, and
then click
Next.
5. Type a descriptive name for this connection in the
Company name dialog box, and then click
Next.
6. Click
Do not dial the initial connection if the computer is
permanently connected to the Internet. If the computer connects to the Internet
through an Internet Service Provider (ISP), click
Automatically dial this initial connection, and then click the name of
the connection to the ISP. Click
Next.
7. Type the IP address or the host name of the VPN server computer (for example,
VPNServer.SampleDomain.com).
8. Click
Anyone's use if you want to permit any
user who logs on to the workstation to have access to this dial-up connection.
Click
My use only if you want this connection to
be available only to the currently logged-on user. Click
Next.
9. Click
Finish to save the connection.
10.Click
Start, click
Control Panel, and then
click
Network Connections.
11. Double-click the new connection.
12. Click
Properties to continue to configure options for the
connection. To continue to configure options for the connection, follow these
steps:
a) If you are connecting to a domain, click the Options
tab, and then click to select the Include Windows logon
domain check box to specify whether to request Windows Server 2003
logon domain information before trying to connect. b) If you want the connection to be redialed if the line is dropped, click
the Options tab, and then click to select the
Redial if line is dropped check box.To use the connection, follow these steps:
1. Click
Start, point to
Connect to, and then click the new connection.
2. If you do not currently have a connection to the Internet, Windows offers to
connect to the Internet.
3. When the connection to the Internet is made, the VPN server prompts you for
your user name and password. Type your user name and password, and then click
Connect.
Your network resources must be available to you in the same way they are when
you connect directly to the network.
NOTE: To disconnect from
the VPN, right-click the connection icon, and then click
Disconnect
