MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure

Configuration

Chapter 9

Network Policy and Access Services in Windows Server 2008

Objectives

• Configure routing in Windows Server 2008• Configure Routing and Remote Access Services in

Windows Server 2008• Describe Network Policy Server• Discuss wireless networking with Windows Server

2008

MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

2

Configuring Routing in Windows Server 2008

• Routing and Remote Access Services (RRAS)– Role service used to configure and manage network

routing in Windows Server 2008– Recommended for use in small networks that require

simple routing directions– Not recommended for large and complex

environments

3MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Routing in Windows Server 2008 (continued)

• Activity 9-1: Installing a Windows Server 2008 Member Server

• Time Required: 75 minutes• Objective: Install a Windows Server 2008 member

server

4MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring RRAS as a Router

• Routers – Responsible for forwarding packets between

subnets, or networks with differing IP addressing schemes

5MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

6MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring RRAS as a Router (continued)

• Activity 9-2: Installing RRAS on MSN-SRV-0XX and MSN-SRV-1XX

• Time Required: 15 minutes• Objective: Install RRAS

7MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Working with Routing Tables

• Routing tables are composed of routes• Routes

– Direct data traffic to its destination based on the information it contains

• Routing tables – Can be managed in the RRAS console or from the

command line using the route command

8MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Working with Routing Tables (continued)

• Activity 9-3: Viewing the Routing Table in RRAS• Time Required: 5 minutes• Objective: View the routing table in RRAS

9MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

10MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Routes

• Static routing is limited for the following reasons– Requires manual creation and management– Should not be used on networks with more than 10

subnets– All affected routers require reconfiguration if the

network changes

11MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Routes (continued)

• Activity 9-4: Creating a Static Route• Time Required: 15 minutes• Objective: Create a static route from the command

line

12MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Routes (continued)

• Dynamic protocols– Route traffic based on information they discover

about remote networks from other routers• Routing Information Protocol version 2 (RIPv2)

– Uses partner routers, or RIP neighbors, in determining the dynamic routes it can use for forwarding packets of data

13MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring a DHCP Relay Agent

• DHCP relay agent – Manages the communication between a network’s

DHCP server and clients on subnets without a DHCP server

• With RRAS– Network adapters are added and configured to listen

for DHCP broadcast messages

14MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring a DHCP Relay Agent (continued)

• Activity 9-5: Configuring MSN-SRV-0XX as a DHCP Relay Agent

• Time Required: 15 minutes• Objective: Install a DHCP relay agent

15MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Dial-on-Demand Routing

• Demand-dial routing– Allows a server to initiate a connection only when it

receives data traffic bound for a remote network– Can use dial-up networks instead of more expensive

leased lines

16MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Remote Access Services in Windows Server 2008

• Dial-up networking– Connects remote users to their networks using a

standard phone line• Virtual Private Networks

– Allow client connections to your network from remote locations

– Works by creating a secure tunnel for transmitting data packets between two points

– VPN tunneling protocols: Point-to-Point Tunneling Protocol, Layer 2 Tunneling Protocol, Secure Socket Tunneling Protocol

17MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

18MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Remote Access Services in Windows Server 2008 (continued)

• Activity 9-6: Installing Remote Access Support for VPNs in RRAS

• Time Required: 15 minutes• Objective: Install Remote Access Support with VPN

in RRAS

19MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

20MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Configuring Remote Access Services in Windows Server 2008 (continued)

• Activity 9-7: Configuring VPN Ports• Time Required: 15 minutes• Objective: Configure VPN ports

21MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Network Address Translation

• Allows you to shield internal IP address ranges from public networks by allowing internal clients to access the Internet through a shared IP address

22MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

23MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Introduction to Network Policy Server

• Network Policy Server (NPS) – Role service that provides a framework for creating

and enforcing network access policies for client health

– Can be used to perform:• Configure a RADIUS server• Configure a RADIUS proxy• Configure and implement Network Access Protection

(NAP)

24MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Windows Server 2008 Editions and the NPS Console

• NPS Console– Central utility for managing

• RADIUS clients and remote RADIUS servers• Network health and access policies• NAP settings for NAP scenarios• Logging settings

25MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Windows Server 2008 Editions and the NPS Console (continued)

• Activity 9-8: Installing NPS• Time Required: 15 minutes• Objective: Install the NPS role service

26MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Windows Server 2008 Editions and the NPS Console (continued)

• Activity 9-9: Creating a Network Access Policy for VPN Connections

• Time Required: 15 minutes• Objective: Create a network access policy

27MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Introduction to RADIUS

• RADIUS– Industry-standard protocol that provides centralized

authentication, authorization, and accounting for network access devices

• Components of RADIUS– RADIUS clients– Network access servers– RADIUS proxy– RADIUS server– User account database

28MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

29MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

30MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

31MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

32MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

RADIUS Server

• Used on networks to perform authentication, authorization, and accounting for RADIUS clients

• RADIUS client– Can be an NPS, which replaces the IAS from

previous versions of Windows Server

33MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

RADIUS Server (continued)

• RADIUS – Standardized network protocol that centralizes the

following process for user connections• Authentication• Authorization• Accounting

34MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

RADIUS Proxy

• NPS – Can be configured as a RADIUS proxy

• RADIUS proxies – Route RADIUS messages between RADIUS clients

and RADIUS servers

35MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

NAP

• Network Access Protection (NAP)– Provides a tool for you to block external and internal

network threats– Can be broken into three parts

• Health policy validation• Health policy compliance• Limited access

36MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Authentication Protocol

• Supported authentication protocols in Windows Server 2008– Extensible Authentication Protocol–Transport Layer

Security (EAP-TLS)– Protected Extensible Authentication Protocol–

Transport Layer Security PEAP-TLS– Protected PEAP–Microsoft Challenge Handshake

Authentication Protocol version 2 (PEAP-MSCHAPv2)

37MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Wireless Access Configuration in Windows Server 2008

• 802.1x standard– Developed by the Institute of Electrical and

Electronics Engineers (IEEE)• On 802.1x networks

– Network access control provides an authentication mechanism to allow or deny network access based on port connection

38MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Wireless Access Configuration in Windows Server 2008 (continued)

• Categories of EAP implementations– EAP over local area network (LAN)– EAP over wireless

• 802.1x uses a three-component model for authenticating access to networks– Supplicant– Authenticator– Authentication server

39MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

40MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

Summary

• RRAS– Role service used to configure and manage network

routing in Windows Server 2008• Routers

– Responsible for forwarding packets between subnets, or networks with differing IP addressing schemes

• To process traffic– Router uses routing tables to determine where to

send traffic

MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

41

Summary (continued)

• Routers – Use dynamic routing protocols and preconfigured

static routes to deliver packets using the best route possible between two subnets

• Most modern networks – Support the passing of DHCP broadcast messages

between subnets without a DHCP server to subnets that contain a DHCP server

• Demand-dial routing – Allows a server to initiate a connection only when it

receives data traffic bound for a remote networkMCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration

42

Summary (continued)

• VPNs– Provide secure network access for remote clients

over the Internet through the use of tunneling protocols

• NAT – Allows you to shield internal IP address ranges from

public networks• NAP

– Provides a framework for you to block external and internal network threats

43MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration