Windows Server 2008 R2 networking : Routing and Remote Access

Windows Server 2008 R2 includes Routing and Remote Access features to provide basic IPv4 and IPv6 routing as well as remote access services, such as VPN and dial-up. These access features allow remote users to connect to the corporate network and access network resources, such as file servers, print servers, and intranet Web sites. VPN and dial-up services can also be used to provide site–site connectivity within the corporate network. Additionally, you can use the routing features in Routing and Remote Access to create a router between two separate subnets. Networks are rarely composed of a single subnet and require a router to send traffic between subnets. Most organizations deploy dedicated router appliances to create this functionality, but Windows Server 2008 R2 Routing and Remote Access can be used to fulfill the same needs to route traffic between two separate logical subnets.

Installing Routing and Remote Access

Routing and Remote Access is installed by adding the Network Policy and Access Services role. To install Routing and Remote Access, perform the following:

1.	Open Server Manager by selecting Start | Administrative Tools | Server Manger.
2.	The Server Manager window will open. Select the Roles node, then click the Add Roles link in the middle pane.
3.	The Add Roles Wizard will launch. Click Next to continue.
4.	Select the Network Policy and Access Services role as seen in Figure 1. Then click Next. Figure 1. Add Network Policy and Access Services Role.
5.	This will take you to the role summary screen. Click Next to continue.
6.	Select the Routing and Remote Access role service (see Figure 2). Then click Next. Figure 2. Routing and Remote Access Role Services.
7.	Verify the selection and then click Install. When the installation is complete, click Close.
8.	You can manage Routing and Remote Access by opening Server Manager and selecting Roles | Network Policy and Access Services | Routing and Remote Access as seen in Figure 3. Figure 3. Routing and Remote Access Management Console.

Configuring Routing and Remote Access to support Remote Access VPN

You can set up Routing and Remote Access to provide remote users access to your network via VPN services. The following exercise will take you through configuring Routing and Remote Access to support VPN connectivity. You will need to ensure that your VPN server has two network adapters (NICS) installed prior to configuring Routing and Remote Access to support VPN.

1.	Launch Server Manager by opening Start | Administrative Tools | Server Manager.
2.	Select the Routing and Remote Access node from Roles | Network Policy and Access Services | Routing and Remote Access.
3.	Right click the Routing and Remote Access node and select the option Configure and Enable Routing and Remote Access (see Figure 4). Figure 4. Configure and Enable Routing and Remote Access.
4.	The Routing and Remote Access Setup Wizard will launch. Click Next to begin configuration.
5.	Select the first option—Remote Access (dial-up or VPN). Then click Next.
6.	Since we will be providing only VPN services, select only the VPN option for remote access (see Figure 5). Then click Next. Figure 5. VPN Access Option.
7.	Select a network interface that connects the VPN server to the Internet (see Figure 6). Routing and Remote Access will use the Internet-connected adapter to accept incoming VPN connections and use the other adapter to route inbound VPN traffic to the corporate network. Leave the option Enable security on the selected interface by setting up static packet filters checked. This will set up packet filters to ensure that only VPN traffic is allowed to communicate to the Internet-facing interface, providing a greater level of security. Click Next to continue. Figure 6. Select Internet Interface.
8.	Select how you would like to assign IP addresses to clients connecting to the network via VPN (see Figure 7). You can choose to have the computers request an address either from your existing DHCP pools or from a range of specific addresses. For this example, we will use DHCP . Then click Next. Figure 7. Automatic IP Assignment.
9.	Select how you want the VPN server to authenticate. Here you can choose whether to have the VPN server authenticate users or send the authentication to a Remote Authentication Dial-in User Service (RADIUS) server. In larger deployments, you may want to use RADIUS. RADIUS can provide a greater level of security and management by handling authentication for VPN connections instead of allowing them to authenticate directly to your AD domain. In our example, we will allow the VPN server to authenticate users (see Figure 8). Select the option No, and use Routing and Remote Access to authenticate connection requests. Then click Next. Figure 8. Routing and Remote Access Authentication.
10.	Verify your settings on the summary page, and then click Finish.
11.	The server is now configured to support VPN connections via Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Secure Socket Tunneling Protocol (SSTP).

Notes From the Field

Consider DirectAccess

Windows Server 2008 R2 continues the tradition of supporting remote dial-up and connectivity services. If you have Windows 7 clients on your network, you may want to consider setting up DirectAccess instead or along with traditional VPN access. DirectAccess provides a secure remote connection back to the corporate network without the need for traditional VPN services.