---
title: '08 Configuring Remote Access Services'
disqus: hackmd
---

:::info
ST2612 Secure Microsoft Windows
:::

08 Configuring Microsoft Windows
===

<style>
img{
/* border: 2px solid red; */
margin-left: auto;
margin-right: auto;
width: 80%;
display: block;
}
</style>

## Table of Contents

[TOC]

Introduction to Remote Access
---
- remote access service (RAS) role
- enables remote access through 3 means
- virtual priv networking
- directaccess
- web app proxy
- virtual priv network (VPN)
- like tunnel through larger network that's restricted to designated member clients only
- related topics
- directaccess
- established 2 tunnels for connecting to direct access server used in remote access
- transparent to users & always on
- web app proxy
- publishing apps so users external to org can access these apps on org's servers
- NOTE
- many vendors providing vpn implementations
- most production sites use firewalls/routers based vpn
- Eg. SP using cisco anyconnect vpn; SoC using PaloAlto global protect vpn
- microsoft servers provides few build-in vpn protocols via remote access services (RA) role

### Using Remote Access Protocols
- remote access protocols carries network packets over wan link
- encapsulates packets like ip datagram so can be transmitted from 2 pts in wan
- IP is most commonly used transport protocol
- many remote access protocols used by winserver2016 & its remote clients
- early basic remote access protocol in use is PPP
- __point-to-point protocol (PPP)__
- used in legacy remote comms involving modems
- enables auth of conns & encryptions for network comms, but not considered as secure as modern options
- can auto negotiate comms with several network comm layers at once
- when implementing winserver2016 vpn server, can choose 3/4 remote access tunneling protocols (4 built-in vpn protocol you can use to implement remote access in winserver)
- pt to pt tunneling protocol
- layer 2 tunneling protocol
- secure socket tunneling protocol
- ike v2 protocol
- ipsec, tunnel mode, ikev2
- ike v2 is newer ver of ipsec with more options in config
- NOTE
- lan and wan uses diff medium, hardware devices, bandwidth and topologies so run on diff set of network protocols
- remote access protocol needs to cater for lan to wan protocol conversions
- to allow 2 remote parties to comm seamlessly as if both on same lan

#### Point-to-Point Tunneling Protocol (PPTP)
- offers PPP based auth techniques
- encryptes data carried by pptp through __Microsoft Pt to Pt Encryption (MPPE)__
- NOTE
- PPTP is easiest to setup protocol, most network devices support it
- but not good for setting up vpn channel that needs long/near permenant session

#### Layer 2 Tunnneling Protocol (L2TP)
- similar to PPTP
- use layer 2 forwarding that enables forwarding on basis of mac addressing
- uses ipsec for extra auth & data encryption
- ipsec is set of ip based secure comms & encryption standards created through IETF

#### Secure Socket Tunneling Protocol (SSTP)
- employs PPP auth techniques
- encapsulates data packet in http through web comms
- uses ssl channel for secure comms
- ssl is data encryption technique employed between server & client
- ssl now evolved into transport layer security (TLS)
- more secure than PPTP or L2TP
- uses port 443 only to operate
- hence most firewall friendly vpn protocol

#### Internet Key Exchange Version 2 Protocol (IKE v2)
- employs ipsec in tunnel mode protocol over udp port 500 & 4500
- encapsulates datagrams using ipsec ESP or AH headers for transmission over network
- encryption
- AES 256, 192, 128 & 3DES encryption algo
- 3des not recommended
- pros
- faster & extremely secured protocol
- support mobility conns (Eg. MOBIKE)
- Eg. remote clients are constantly moving
- is the only built-in vpn protocol that supports this
- more resilient to changing network connectivity
- switch between access pts/wired to wireless conn
- cons
- proprietary like sstp
- but there's open source implementation
- support by some network devices vendor

- these built-in vpn protocols can be implemented in RAS server concurrently
- can config ras server to support remote client using any of the 4 vpn protocols to your site

Implementing Virtual Private Network
---
- vpns can use internet conn/internal network conn as transport medium to establish conn with vpn server
- vpn uses lan protocols and tunneling protocols
- to encapsulate data as its sent across pub network like internet
- benefits of vpn
- users can connect to local ISP & connect through ISP to local network
- vpn used to ensure any data sent across pub network like internet is secure
- vpn creates encrypted tunnel between client & RAS server
- vpn server uses 2 or more NICs for comm
- 1 nic used to connect to priv network inside org that uses priv ip addressing
- other NIC connects to external pub network
- to create this tunnel, client 1st connects to internet by establishing conn using remote access protocol
- once connected to internet, client establishes 2nd conn with vpn server
- client & vpn server agree on how data encapsulated & encrypted across virtual tunnel
- limitations
- dont use dc as vpn server
- vpn server is pub facing so shld be in dmw segment
- NOTE
- typical vpn use cases
- ensure secured comm between 2 sites
- ensure secured comm between site with remote clients
- to allow remote client to access res offered by site
- provide secured internet conn to remote client
- remote client establishes vpn conn to site then use gateway of site to access internet
- network security between remote client & internet cared for by security measure implemented on site
- typical config
- use windows server with 2 NIC to implement vpn server
- AKA multi-homed dual NIC deployment
- vpn may or may not be part of domain
- if windows server part of domain, can directly use active dir for client auth

#### Examples
- this diagram shows 3 diff remote clients to site vpn implementations
- top - firewall based vpn for remote client access to office network
- middle - router based firewall
- bottom - microsoft RAS based vpn (use basic router)
- NOTE
- smw covers microsoft ras based vpn only

- this diagram shows how remote client connects to site (Eg. staff remote access to office network via vpn)
- effect after vpn established:
- remote client assigned with set of local IP settings (IP addr, gateway, dns)
- remote client can access to all services offered by site as if connected to lan directly
- by default, outgoing traffic from remote client will 1st go to vpn server via internet

### Configuring a VPN Server
- general steps
- install network policy & access services role
- config winserver2016 as vpn server
- includes configuring right protocols to provide vpn access to clients
- config vpn server as __dhcp relay agent__ for tcp/ip comms
- config vpn server properties
- config remote access policy for security

- simulated vpn setup
- 4 vms
- 3 windows
- 1 linux (virtual router)

### Configuring Server's Firewall
- vpn server must send comms through network
- early config step is to make sure comms can go through firewall setup at server
- if using windows firewall on server
- tcp & udp ports used by vpn are unblocked by default when configuring a vpn server
- though impt to make sure they unblocked
- NOTE
- for simple vpn setup, server firewall configs may all be completed by installation wizard
- in production system, extra protections usually in place with firewall devices
- hence need understand config requirement for various types of vpn protocols

### Configuring VPN Properties
- RAS demo 2
- https://web.microsoftstream.com/video/3d1a4030-6bc9-41e5-8557-b7f68747d984
- after vpn server setup
- config wizard invoked to guide through config
- RAS demo 3 - https://web.microsoftstream.com/video/c3d88644-ebdd-4618-b8e6-a29a6a1a3f82
- after initial setup, can further config from routing and remote access tool
- right click vpn server in tree and click properties

### Configuring DHCP Relay Agent
- dhcp relay agent
- broadcasts ip config info between dhcp server on network and client acquiring address
- can config vpn server as dhcp relay agent using routing & remote access tool
- basic terms
- client contacts vpn server to make conn
- vpn server as dhcp relay agent contacts dhcp server for ip addr for client
- dhcp server notifies vpn server of ip addr
- vpn server relays this ip assignment to client

### Configuring VPN Security
- can setup vpn secrity through __remote access policy__
- greatly reduces admin overhead
- more flexibility & control for authorising conn attempts
- elements of remote access policy
- access perm
- conditions
- constraints
- settings
- 1st step to evaluating access is determine if access perms enabled at vpn server
- default perm for this policy set to deny access
- change default perm to grant access in default remote access policy
- conditions of remote access policy - set of attributes that are compared with attributes of conn attempt
- if conn attempt matches conditions of remote access policy, constraints are evaluated
- settings in remote access policy are then examined
- settings include ip filters, encryption, ip settings etc.
- NOTE
- remote access policy can be setup to allow/deny access requests
- by default, remote access policy set to deny all
- hence even ras services up and running, remote clients wont be able to connect until remote access policy configed correctly

#### Establishing Remote Access Policy
- use __routing and remote access tool__ to create & config remote access policy
- to create new remote access policy, click to activate then right click remote access logging & policies folder in tree under vpn server
- click launch nps to launch network policy server tool


### Monitoring VPN Users
- after configuring vpn server & placed in production,
- shld periodically monitor users connected
- use routing and remote access tool to monitor connected users
- with tool open,
- expand elements under server name in left panel
- click remote access clients in left pane
- right pane shows users connected
- right click and select disconnect to disconnect user

### Troubleshooting VPN Installations
- troubleshooting vpn comms prob can be divided into hardware & software tips

#### Hardware Solutions
- use device manager to make sure network adapters and wan adapters working
- also make sure adapter has no res conflicts
- for external DSL adapter or combined DSL adapter and router
- make sure device properly configured and connected
- check monitor lights for probs
- call ISP to determine if probs present on ISP's wan

#### Software Solutions
- use services tool or server manager to make sure following services started
- ip helper, remote access conn manager, IKE and authIP ipsec keying modules, routing and remote access, netlogon, remote access management service, basic filtering engine, windows firewall & secure socket tunneling protocol service
- ensure windows firewall setup to allow remote access
- make sure vpn server enabled
- check remote access policy and make sure access perm granted
- make sure vpn server started
- in routing and remote access tool, check network interface
- make sure ip params correct to provide address pool for either vpn server
- check remote access policy consistent with users' access needs
- open remote access management console & click dashboard in left pane
- if only certain clients but not all having conn probs, try these
- ensure clients using same comms protocol as server
- if manage access to vpn server using security grps, make sure ea user acc or comp acc that needs access is in correct grp
- NOTE
- basically re-check overall hardware conns & system configs
- checking needs thorough understanding of network infrastructure, vpn protocols, windows and/or active dir operations

Remote Desktop Services
---
### Connecting through Remote Desktop Services
- __remote desktop services (RDS) server__
- enables clients to run session-based desktops, virtual desktops and software apps on winserver2016 instead of client
- using session-based desktops
- client accesses rds server to run apps during conn session
- virtual desktops
- used with accessing virtual machines on virtual server through hyper-v
- multiple virtual desktops can be in pool of desktops for diff purposes
- 4 main components that enable remote desktop server connectivity
- winserver2016 multiuser remote desktop services
- remote desktop services client
- remote desktop protocol (rdp)
- remote desktop services admin tools
- when installing rds, can install diff role services
- remote desktop session host
- remote deskto web access
- remote desktop virtualisation host
- remote desktop licensing
- remote desktop gateway
- remote desktop conn broker

- NOTE
- rds is viable options to offer remote access services to remote clients
- unique func - remote desktop session created and run on remote desktop server
- remote client act as viewer to allow user to observe & operate desktop session that runs on remote desktop server
- this way of remote access offers 2 extra features that vpn doesnt support
- allow thin client conns
- enables server admins to know details of remote clients activities

#### RemoteApp
- RDS server employs __RemoteApp__
- feature that enables client to run app w/o loading remote desktop on client
- programs appears to be just another program in windows running on local comp
- remoteapp program started by clients through
- icon on client's desktop
- client's start menu
- link on website via remote desktop web access
- as .rdp (remote desktop protocol) file


### Uses & Purposes
- used for 3 purposes
- run apps on server instead of client
- support thin clients
- centralise program access
- __thin clients__
- downsized PCs with minimal windows based OS that access winserver2016 so most CPU-intensive operations performed on server
- generally used to save money & reduce training & support requirements
- also used for portable field/handheld remote devices
- centralise control of how programs used
- highly classified/sensitive documents can be stored & modified only on server
- server can be configed to provide high lvl of security
- RDS not only support thin clients, but also other OSes
- win10
- winserver2016
- unix/unix based X-terminals
- linux
- mac os
- table os

### Installing Remote Desktop Services
- when installing the remote desktop services role, also need install RDS licensing role service
- to manage num of terminal server user licenses obtained from microsoft
- rds licensing role server can be installed when u install remote desktop services role
- licenses can be purchased per user acc or by client device
- when installing rds role, implement __network level auth (NLA)__
- enables auth before rds conn established
- designed to eliminate mitm atks
- another element to consider before installing rds role is who will be allowed to access rds server
- create grps of user accs in advance so can add these grps during installation
- if operating in active dir env
- consider creating domain local grp (Eg. RDS Users)
- next create diff global grps of users
- like global grp for ea department that will access rds server
- add appropriate user accs for ea department's global grp
- finally add global grps to single domain local grp

- all these features are high on res demands

### Configuring Remote Desktop Services
- after installing rds role & associated role services
- use server manager to complete basic config in activity 9-9 (prac)

### Build-In Remote Desktop Services
- installation of full scale remote desktop services may be highly demanding of system resources
- remote desktop role and features
- for all windows servers & some win10 editions, there's build-in remote desktop services
- limited num of conns
- simplified config options
- runs on same remote desktop protocol

### Accessing RDS Server from Client
- rds client comps can signin using __remote desktop connection (RDC)__ client
- rdc client installed in win vista-10 & winserver2016
- steps to start rdc client
- start > accessories folder
- click remote desktop conn
- enter comp name to access & click connect
- provide username & password. click ok

Summary
---

###### tags: `SMW` `DISM` `School` `Notes`