A VPN is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization's network. A VPN works by using the shared public infrastructure while maintaining privacy through security procedures and tunneling protocols such as the Layer Two Tunneling Protocol (L2TP) or PPTP. In effect, the protocols, by encrypting data at the sending end and decrypting it at the receiving end, send the data through a "tunnel" that cannot be "entered" by data that is not properly encrypted.
Although not every edition of Windows 7 supports DirectAccess, every edition of Windows 7 supports VPN using the PPTP, L2TP/IPsec, SSTP, and IKEv2 protocols which are discussed below:
Point-to-Point Tunneling Protocol (PPTP) - Based on PPP, the Point to Point Tunneling Protocol (PPTP) provides for the secure transfer of data from a remote client to a private server by creating a multi-protocol Virtual Private Network(VPN) which encapsulates PPP packets into IP datagrams. PPTP is considered to have weak encryption and authentication, therefore, IPsec is typically preferred.
Layer 2 Tunneling Protocol (L2TP) / IP security (IPsec): - L2TP is the next-generation tunneling protocol partially based on PPTP. To provide encryption, L2TP acts as a data link layer (layer 2 of the OSI model) protocol for tunneling network traffic between two peers over an existing network (usually the Internet). It is common to carry Point-to-Point Protocol (PPP) sessions within an L2TP tunnel. L2TP does not provide confidentiality or strong authentication by itself. IPsec is often used to secure L2TP packets by providing confidentiality, authentication and integrity. The combination of these two protocols is generally known as L2TP/IPsec. IPSec ensures confidentiality, integrity, and authenticity of data communications across a public network. IPSEC is made of two different protocols: AH and ESP. AH (Authentication header) is responsible for authenticity and integrity, while ESP (Encapsulating Security payload) encrypts the payload.
Secure Socket Tunneling Protocol (SSTP) - A tunneling protocol that uses the HTTPS protocol over TCP port 443 to pass traffic through firewalls and Web proxies that might block PPTP and L2TP/IPsec traffic. SSTP provides a mechanism to encapsulate PPP traffic over the Secure Sockets Layer (SSL) channel of the HTTPS protocol. The use of PPP allows support for strong authentication methods, such as EAPTLS. SSL provides transport-level security with enhanced key negotiation, encryption, and integrity checking.
Internet Key Exchange (IKEv2) - IKEv2 is a tunneling protocol that uses the IPsec Tunnel Mode protocol over UDP port 500. An IKEv2 VPN is useful when the client moves from one wireless hotspot to another or when it switches from a wireless to a wired connection. The use of IKEv2 and IPsec provide strong authentication and encryption methods. Windows 7 is the first Microsoft operating system to support this protocol.
By default, the VPN type is set to Automatic. You can configure a connection to use a specific VPN protocol, but if you do this, Windows 7 does not try to use other VPN protocols if the protocol you select is not available. When a VPN connection type is set to Automatic, Windows 7 attempts to make a connection using the most secure protocol.
VPN Authentication Protocols:
Remote access in Windows 7 supports the authentication protocols listed in the following table. They are listed in order of increasing security.
Protocol
Description
PAP
This protocol uses plaintext passwords. Typically used if the remote access client and remote access server cannot negotiate a more secure form of validation. PAP is the least secure authentication protocol. It does not protect against replay attacks, remote client impersonation, or remote server impersonation. PAP is not enabled by default for Windows 7 and is not supported by remote access servers running Windows Server 2008.
CHAP
CHAP uses a 3-way handshake in which the authentication agent sends the client program a key to be used to encrypt the user name and password. CHAP uses the Message Digest 5 (MD5) hashing scheme to encrypt the response. CHAP is an improvement over PAP, in that the password is not sent over the PPP link. CHAP requires a plaintext version of the password to validate the challenge response. CHAP does not protect against remote server impersonation. Although remote access servers running Windows Server 2008 do not support this protocol, it is enabled by default for Windows 7 VPN connections for legacy VPN connections.
MS-CHAP v2
Supports two-way mutual authentication. The remote access client receives verification that the remote access server that it is dialing in to has access to the user’s password. MS-CHAP v2 provides stronger security than CHAP.
EAP-MS-CHAPv2
Allows for arbitrary authentication of a remote access connection through the use of authentication schemes, known as EAP types. EAP offers the strongest security by providing the most flexibility in authentication variations. This protocol requires the installation of a computer certificate on the VPN server.
Just like the VPN protocols, by default, Windows first tries to use the most secure authentication protocol that is
enabled, and then falls back to less secure protocols if the more secure ones are unavailable.
Configuring a VPN Connection:
When configuring a VPN, you need to know the IP address or fully qualified domain name (FQDN) of the remote access server to which you are connecting. The steps for creating the VPN connection to a Windows Server 2008 computer are as follows:
Open the Control Panel, select Network and Internet then Network and Sharing Center.
Click Set up a new connection.
Click Connect to a workplace and then click Next.
Select Use my Internet connection (VPN).
Enter the hostname or IP Address for the VPN Server and enter a name for the connection. You can also configure the option to use a smart card for authentication, allow other people to use your VPN connection, and instruct the wizard not to connect you to the VPN now.
Next, you will need to enter a username and password to connect to the network. Click Create to finish the wizard.
Once the connection is created, you can modify additional settings such as the authentication protocols and sharing by following these steps:
In the Network and Sharing Center, click Connect to a network.
From the list of networks, right click on your VPN and click Properties.
VPN Reconnect:
In previous versions of Windows, when Internet connectivity is lost, the VPN connection is also lost. This means that if the user was working with an application or had a document open when the interruption occurred, the user's work would be lost. In Windows 7, VPN Reconnect uses IKEv2 technology to provide seamless and consistent VPN connectivity, automatically re-establishing a VPN when users temporarily lose their Internet connections. Users who connect using wireless mobile broadband will benefit most from this capability.
Only VPN servers running Windows Server 2008 R2 support IKEv2. You can configure VPN Reconnect with a maximum timeout of 8 hours. After the period specified in the Network Outage Time setting has expired, the user must reconnect manually.
NAP Remediation:
NAP enforces health requirements by monitoring and assessing the health of client computers when they attempt to connect or communicate on a network. Client computers that are not in compliance with the health policy can be provided with restricted network access until their configuration is updated and brought into compliance with policy. Typical problems might include having Windows Firewall turned off, missing or out-of-date virus protection, uninstalled security updates, etc.
On NAP client computers running Windows 7, NAP is integrated into Action Center. If a NAP client computer is determined to be noncompliant with network health polices, you can obtain more information by reviewing the Network Access Protection category under Security. NAP client computers that are compliant with health requirements and computers that are not running the NAP Agent service do not display NAP information in Action Center.
With regard to VPN connections, achieving compliance often requires access to a remediation network. A remediation network hosts necessary services that can allow the client to achieve compliance. Noncompliant clients can communicate with hosts on the remediation network but not other hosts on the internal corporate network. A remediation network might include a Windows Server Update Services (WSUS) server, Antivirus signature server, System Center component server, etc.
A VPN is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization's network. A VPN works by using the shared public infrastructure while maintaining privacy through security procedures and tunneling protocols such as the Layer Two Tunneling Protocol (L2TP) or PPTP. In effect, the protocols, by encrypting data at the sending end and decrypting it at the receiving end, send the data through a "tunnel" that cannot be "entered" by data that is not properly encrypted.
