RADIUS authentication and VPN

I am learning this as I go along (it's taken me ages just to see the shares on the remote network), so any comments about this will be gratefully received. Also, is there anything else which I need to take into consideration when implementing the VPN?

I look forward to reading some excellent answers and comments...

you could use RADIUS if you want. Depends upon how much administration you want to do. If your running SBS 2000 I assume you have ISA 2000 running as it comes with SBS 2000. Since ISA will handle authentication for remote inbound users though VPN, using Active Directory, RADIUS is overkill imo.

If you have SBS 2000 again, you've got Exchange 2000 as part of SBS 2000 [like ISA server Exchange is part of the SBS package] I would just use Exchange 2000.

ISA or IAS?

ISA 2000 requires a couple of different things in configuration. If your going to have internal services made available to external users you "publish" that service in ISA 2000 [run the publishing wizard]. Further, you need to create site and content rules and protocol rules [these 2 rules are required for access regardless if traffic in outbound or inbound. For VPN on ISA you have to determine what VPN role ISA server will operate as. End Point [e.g. point to point between ISA and another VPN server], Accept VPN client connections e.g. ISA acts as RRAS], etc.

The thing about ISA server is that to allow internal services to be accessible to external users, you have to publish that service. ISA then accepts those inbound requests on behalf of the internal service, retrieves the requested information, then provides it to the requestor. The inbound never actually connects to the service inside the LAN therefore as I said you publish whatever service by running the publishing wizard so that ISA can accept connections for that service. Then you create site and content rules and protocol rules [site and content means who what where when with who determined by AD or whatever authentication you want, what is the service, when is the hours and days] protocol rules mean how [e.g. http, ftp, RPC, etc.]

Thats why I say RADIUS is overkill with SBS2000 because ISA server 2000 is a part of SBS 2000 as is Exchange 2000. Both work with AD on the SBS2000 box.

OK - a comment and then I'm going to suggest maybe you want to go in a different direction.

Comment - I think you and CGIT are talking at cross-purposes. ISA and IAS are two entirely different things. CGIT is definitely talking about ISA server, not IAS. You need to figure out if you are talking about two entirely different things, or you are just dyslexic.

Now, my suggestion for a different direction would be to use your SBS server as a VPN server, rather than using the router as your VPN server. This would allow you to use Windows authentication rather than a more complicated setup like RADIUS. However, it does require that your users log on with domain accounts, so if that's not what you want, then you should continue with what you're doing. And I can't help you with RADIUS because I've never used it - hope someone else has.

Hope this helps!

well I saw IAS , but he mentioned SBS 2000 which if hes running it, it has ISA server 2000 [comes with the package and you have to purposly exclude it during setup for it not to be installed], so I assumed [probably wrongfully] that it is indeed installed. Now if it is installed ISA Server 2000 is a firewall AND a proxy server. During SBS 2000 setup its installed in intergrated mode which means its a firewall AND a proxy server with web caching. Because its install as a firewall, and its install on the same box as everything else, its preset to create default access policies, site and content rules and protocol rules for Exchange as well as internet access for domain back office internet users security group members. It will block external requests over PPTP and L2TP until one runs the ISA server VPN wizard which creates site and content rules and protocol rules to allow 3 different types of VPN. End Point to End Point [ISA to another ISA or VPN server [RRAS], ISA to client or client to ISA.

Authentication is by Active Directory therefore external users require an account in Active Directory to be authenticated. Now IIS is a different story. you can publish web sites behind ISA and allow annonymous access in. Same with an FTP.

Hi

OK, there seems to be some confusion here which is my fault because:

I read IAS instead of ISA (sorry).

However, I still have a problem. When originally installing the OS (Win2k server and SBS2k were installed at the same time), AD kept falling over. It would not last more than a week. What was happening was that Exchange kept encountering an error during installation, and also, according to a consultant we hired in, because we had not set up user accounts he said that AD did not have anything to work with. Hence the errors. This also had repercussions for the Internet services which although part of the OS, we did not need. So, on the 5th installation attempt(!), I did a custom install and left off Exchange and web services etc, then spent several hours creating user accounts for all our staff. Since this last installation attempt the AD has worked fine. When the server was originally bought we only required it to be used as a file server for a small network.

Another limitation is that the file server has only ever had one network card. We did try installing a modem at one point but this repeatedly resulted in a BSOD. This was the main reason we bought a router. The router would provide a firewall, internet connectivity, and VPN services. Therefore, I cannot install ISA server, nor use the SBS as a VPN server simply because it does not have a second card which can be dedicated to this. Also, my boss did not want to put any more pressure on the server than was absolutely neccessary.

What has been especially frustrating for me is that virtually every documented resource regarding setting up VPN with Win2k server assumes the use of Win2k server as a VPN server, and that the server has two cards.

Now, according to Draytek's site (our router is a Vigor 2600 made by Draytek), we should not have to configure any port forwarding on the router to access a network. This is true, as I can see the network shares on the server and other machines on our network. However, after setting up IAS (not ISA), I forwarded 1723 and 47 to the server's IP address, but as you now know this did not help.

As I said earlier, this is completely new to me and I really appreciate the help you folks have given so far, but I would really appreciate some more pointers.

Another comment:

I've just checked and discovered that ISA Server IS installed. However, I'm also getting mspadmin.exe errors and following up a MS article have discovered that the msplat.txt file is missing. I cannot reinstall or repair because I cannot find the CD key (weep). Can I copy the one that's on the CD do you think? Will it even make any difference to what I'm trying to do?

You do not need ISA, IAS or two NICs in the server to use your Win2K server as a VPN server. All you need is to have Routing and Remote Access installed and configured on the server. This is a normal part of installing Win2K unless you deselected it during the install. The normal install automatically creates a number of VPN ports (too many - I think it's about 10) for each protocol - IPSEC and PPTP. If all of this is already there, all you have to do is configure the ports for routing and remote access and configure the port forwarding on your router for whichever tunnelling protocol you are using. You would need to use PPTP, not IPSEC, with the mixture of remote clients that are going to be connecting. There are plenty of good articles on how to configure RRAS for VPN on the MS support website (support. microsoft.com).

Hope this helps!

you have a multitude of problems of which the most was the consultant advising you that you have to have user accounts created. Thats just plain wrong.

Small Business Server is designed to run with 2 NICs plain and simple. Probably most of your problems resulted in NOT initially having 2 NICs in it when you first setup the server. . As a matter of fact, it doesn't configure itself right unless you have 2 NICs in it during the setup phase which would account for the problem with exchange server 2000. Further, you should not get a BSOD while installing a modem as SBS 2000 has shared fax and modem services.

Next problem is ISA server which you say is installed and you don't have 2 NICs. ISA server can not function properly was a proxy server with just one [though it can work because the NIC can TX/RX simultaneously in full duplex, ISA will run "on the mumbo" when trying to figure out if the traffic is local or remote.

ALSO! I don't know how long you've run this setup but if you really really want SBS 2000 to have all the capabilities, Exchange Server 2000, ISA server 2000, shared fax and modem services, I would backup everything, install and second NIC, then reinstall SBS 2000 from scratch. Will save you tons and tons of headaches that your now having and you won't need to mess with IAS RADIUS.

Thanks very much both of you for your valuable advice.

I'm going to drop this for the time being and try to persuade my boss to reinstall everything. Persuing this topic has made me realise this is a neccessary procedure as the server is almost bursting at the seams which is almost certainly agravating the situation.

As CG IT has said, all the services I left off are quite important (I wish I knew then what I know now!!). Still, sometimes it's better to learn the hard way.

ALSO! I have have also posted several answers and comments to other questions, and they have mysteriously disappeared into the ether as well...

Anyway, once again, thank you very much. This will certainly help me when I do set this up in the near furture.