Networks

Ask something
Discussion Locked

NT Domain login over VPN

0 helpful
3 replies

by labrat 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This is my first office-to-office VPN over the Internet setup. I have basic VPN training but... "In theory, there is no difference between Theory and Practice. In practice, there is!" I'll give points to all responses that offer explainations and/or practical advice about my planned setup.

It is simple. A branch office will intiate a VPN tunnel between the office routers. The branch systems will use an ICA client to login on a NT 4.0 Terminal Server/Metaframe Server domain.

Network:
The routers hold the tunnel. The offices are on different networks. Main is 10.1.1.X and the Branch is 192.168.1.X. Also, the Main has a static IP and the Branch is dynamic. Internet is thru cable modems with 3Mbps download/500KMbps upload.

1. Should I change the Branch network to match the Main or do the routers handle that? Can I just point the ICA client at the Metaframe server on the different network and the client will handle the difference? If both are possible, what differences do I look for when deciding? Do I just add static routes in the router tables?Actually, I don't really understand this. Can someone walk thru how the client points thru the tunnel and logs in? I've looked thru Micosoft website and Googled but it is not clear. Info for NT domain login thru VPN is not extensive or precise.

2. I worked in a shop that had VPNs that were setup so the branch was required to initiate the connection because they had a dynamic IP. It would drop and I would have them restart their router. With these new routers, I haven't found a setting to specify who initiates but the routers do support DDNS. Is DDNS the way current routers deal with dynamic IP or am I missing something with the initiation setting?

3 replies

by cg it

This is a simplistic basic description less security configurations of the concept behind VPN.

VPN was a lower cost, secure alternative to dial in access to a network using the internet. It was created to reduce long distance telephone toll charges for a travelling sales force that needed access to their companies network. VPN uses the internet in which to create a connection to a remote network. A tunnel using the public internet is established using the PPTP or L2TP protocols between a client and a remote access server. Data is passed between the client and server via the tunnel. The client connection is as if they are on the private network. To achieve this, an address pool of IP addresses is created on the remote access server to be assigned to remote access clients. This provides the remote access client an IP address on the remote network for access to the remote network resources.

Dynamic IP addresses on the client side are not a concern however dynamic IP addresses on the server side are. Remote access servers are found by clients via IP addresses [or a domain name]. When a connection is created in network connections, the ip address must be included. Static addresses preclude users from having to change network connection properties and uses having to find out what a new address is.

RRAS security default settings is deny access. One must create policies in the RRAS server to provide access for clients.

There are a couple of different methods of creating VPN remote access. One can use a client server connection, where the client initiates the session. There is also the router to router endpoint [with many variations of this ]where 2 access routers establish and maintain a tunnel between themselves and clients access the tunnel to obtain network resources.

This discussion is closed to new replies.