Routing and Remote Access Service

The Routing and Remote Access service (RRAS) supports Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) network routing and remote user or site-to-site connectivity by using virtual private network (VPN) or dial-up connections.

Remote Access

The remote access feature provides VPN services so that users can access corporate networks securely over the Internet as if they were directly connected. Remote access also enables remote or mobile workers who use dial-up communication links to access corporate networks.

Routing

RRAS is a software router and an open platform for routing and networking. Its routing services can be used by organizations in local area network (LAN) and wide area network (WAN) environments or over the Internet by using secure VPN connections. Routing is used for multiprotocol LAN-to-LAN, LAN-to-WAN, VPN, and network address translation (NAT) routing services.

In this Help file:

  • Overview of RRAS

  • Checklists for RRAS

  • Configuring RRAS

  • Troubleshooting RRAS

  • Resources for RRAS

  • User Interface: RRAS


Overview of RRAS

The Routing and Remote Access service (RRAS) is named for the two primary networking services that it provides.

Routing

A router is a device that manages the flow of data between network segments, or subnets. A router directs incoming and outgoing packets based on the information about the state of its own network interfaces and a list of possible sources and destinations for network traffic. By projecting network traffic and routing needs based on the number and types of hardware devices and applications used in your environment, you can better decide whether to use a dedicated hardware router, a software-based router, or a combination of both. Generally, dedicated hardware routers handle heavier routing demands best, and less expensive software-based routers handle lighter routing loads.

A software-based routing solution, such as RRAS in this version of Windows, can be ideal on a small, segmented network with relatively light traffic between subnets. Enterprise network environments that have a large number of network segments and a wide range of performance requirements might need a variety of hardware-based routers to perform different roles throughout the network.

Remote access

By configuring RRAS to act as a remote access server, you can connect remote or mobile workers to your organization's networks. Remote users can work as if their computers are directly connected to the network.

All services typically available to a directly connected user (including file and printer sharing, Web server access, and messaging) are enabled by means of the remote access connection. For example, on an RRAS server, clients can use Windows Explorer to make drive connections and to connect to printers. Because drive letters and universal naming convention (UNC) names are fully supported by remote access, most commercial and custom applications work without modification.

An RRAS server provides two different types of remote access connectivity:

  • Virtual private networking. A virtual private network (VPN) is a secured, point-to-point connection across a public network, such as the Internet. A VPN client uses special TCP/IP-based protocols called tunneling protocols to make a connection to a port on a remote VPN server. The VPN server accepts the connection, authenticates the connecting user and computer, and then transfers data between the VPN client and the corporate network. Because the data traverses a public network, you must encrypt data sent over the connection to ensure privacy.

  • Dial-up networking. In dial-up networking, a remote access client makes a dial-up telephone connection to a physical port on a remote access server by using the service of a telecommunications provider, such as analog telephone or ISDN. Dial-up networking over an analog phone or ISDN is a direct physical connection between the dial-up networking client and the dial-up networking server. You can encrypt data sent over the connection, but it is not required because the phone line is typically considered secure.

Additional references

  • What’s New in RRAS (http://go.microsoft.com/fwlink/?linkid=140600)

  • Common Remote Access Scenarios

  • Common Routing Scenarios

  • Virtual Private Networking

  • Dial-Up Networking

  • Permissions for Remote Access Users

  • IP Address Assignment

  • Remote Access Authentication Protocols

  • Routing

  • Network Policies


Common Remote Access Scenarios

When you run the RRAS Setup Wizard, the wizard prompts you to choose the configuration path that most closely resembles the remote access solution that you want to deploy. If none of the wizard configuration paths meets your needs exactly, you can choose the Custom configuration option. However, if you choose this option, you must manually configure all elements of RRAS. The most common remote access solutions include virtual private network (VPN) connections, dial-up connections, and secure connections between two private networks.

Remote access

Remote access (VPN)

When remote access is enabled, RRAS allows inbound network traffic from VPN clients from across the Internet or from modems connected to the telephone system. The inbound traffic is routed to the private network. You can separately configure which VPN types are supported, how users are authenticated and authorized to access the remote access server, and what IP configuration the remote computer receives when it connects.

Network address translation

Network address translation (NAT)

When network address translation (NAT) is enabled, RRAS allows outbound network traffic from computers on the private network. It shares the Internet connection and its single public IP address with computers on the private network by translating between the public address and the IP addresses and ports used on the private network.

VPN and NAT

In this scenario, RRAS provides NAT for the private network and accepts VPN connections from remote clients.

Secure connection between two private networks

Secure connection between two private networks

An RRAS server on the perimeter of one private network can connect to a remote server through a VPN tunnel. Computers connected to the private networks behind the two servers can exchange data securely across the Internet. The connection between the two servers can be persistent (always on) or on-demand (demand-dial).

Additional references

  • Overview of RRAS


Common Routing Scenarios

You can use RRAS software routers in many different topologies and network configurations. This topic describes three typical routing scenarios.

Simple routing scenario

The following illustration shows a simple network configuration with an RRAS server that connects two local area network (LAN) segments (Networks A and B). In this configuration, a routing protocol is not required because the router is connected to all of the networks to which it needs to route packets. Routers automatically configure routes to the networks to which they are directly connected.

Simple routing scenario

Multiple-router scenario

The following illustration shows a more complex router configuration. In this configuration, there are three networks (Networks A, B, and C) and two routers (Routers 1 and 2). Router 1 is on Networks A and B, and Router 2 is on Networks B and C. Router 1 must notify Router 2 that Network A can be reached through Router 1, and Router 2 must notify Router 1 that Network C can be reached through Router 2. This information is communicated by using a routing protocol, such as the Routing Information Protocol (RIP) used for IPv4.

Multiple router scenario

When a user on Network A wants to communicate with a user on Network C, the user's computer on Network A forwards the packet to Router 1. Router 1 then forwards the packet to Router 2. Router 2 then forwards the packet to the user's computer on Network C.

Without routing protocols, a network administrator must enter static routes into the routing tables of Router 1 and Router 2. Static routes do not scale well to larger networks or recover from changes in the network topology.

Note

This version of Windows only supports static routing for Internet Protocol version 6 (IPv6).

Demand-dial routing scenario

The following illustration shows a router configuration that uses demand-dialing. Networks A and B are geographically separated and, for the amount of traffic transferred between the networks, a leased WAN link is not economical. Router 1 and Router 2 can connect over an analog phone line by using modems (or other type of connectivity, such as ISDN) on both ends. When a computer on Network A initiates communication with a computer on Network B, Router 1 establishes a connection with Router 2. The connection is maintained only as long as there are packets going back and forth. When the connection is idle, Router 1 disconnects to reduce connection costs.

Demand-dial routing scenario

Additional references

  • Overview of RRAS


Virtual Private Networking

A virtual private network (VPN) is a point-to-point connection across a private or public network, such as the Internet. A VPN client uses special TCP/IP-based protocols called tunneling protocols that establish a secure channel between two computers through which they can send data. From the perspective of the two participating computers, there is a dedicated point-to-point link between them, though in reality the data is routed through the Internet as would be any other packet. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network.

To emulate a point-to-point link, data is encapsulated, or wrapped, with a header. The header provides routing information that enables the data to traverse the shared or public network to reach its endpoint. To emulate a private link, the data being sent is encrypted for confidentiality. For more information about the tunneling protocols supported in this version of Windows, see VPN Tunneling Protocols.

For installation requirements, see Requirements for Installing RRAS as a VPN Server.

VPN connection

A VPN Connection

There are two types of VPN connections:

Remote access VPN

A remote access VPN connection enables a user working at home or on the road to access a server on a private network by using the infrastructure provided by a public network, such as the Internet. From the user’s perspective, the VPN is a point-to-point connection between the client computer and the organization’s server. The infrastructure of the shared or public network is irrelevant because it appears logically as if the data is sent over a dedicated private link.

Site-to-site VPN

A site-to-site VPN connection (sometimes called a router-to-router VPN connection) enables an organization to have routed connections between separate offices or with other organizations over a public network while helping to maintain secure communications. When networks are connected over the Internet, as shown in the following figure, a VPN-enabled router forwards packets to another VPN-enabled router across a VPN connection. To the routers, the VPN connection appears logically as a dedicated, data-link layer link.

A site-to-site VPN connection connects two private networks. The VPN server provides a routed connection to the network to which the VPN server is attached. The calling router authenticates itself to the answering router, and, for mutual authentication, the answering router authenticates itself to the calling router. In a site-to site VPN connection, the packets sent from either router across the VPN connection typically do not originate at the routers.

VPN connecting two remote sites across the Internet

VPN Connecting Remote Sites Across the Internet

Properties of VPN connections

  • Encapsulation. Private data is encapsulated with a header that contains routing information that allows the data to traverse the transit network. For examples of encapsulation, see VPN Tunneling Protocols (http://go.microsoft.com/fwlink/?linkid=140602).

  • Authentication. Authentication for VPN connections takes three different forms:

    1. User-level authentication by using Point-to-Point Protocol (PPP) authentication. To establish the VPN connection, the VPN server authenticates the VPN client that is attempting the connection by using a PPP user-level authentication method and verifies that the VPN client has the appropriate authorization. If mutual authentication is used, the VPN client also authenticates the VPN server, which provides protection against computers that are masquerading as VPN servers.

    2. Computer-level authentication by using Internet Key Exchange (IKE). To establish an Internet Protocol security (IPsec) security association (SA), the VPN client and the VPN server use the IKE protocol to exchange either computer certificates or a preshared key. In either case, the VPN client and server authenticate each other at the computer level. Computer certificate authentication is is a much stronger authentication method and is therefore highly recommended. Computer-level authentication is used by Layer Two Tunneling Protocol (L2TP)/IPsec or IKE version 2 connections.

    3. Data origin authentication and data integrity. To verify that the data sent on the VPN connection originated at the other end of the connection and was not modified in transit, the data contains a cryptographic checksum based on an encryption key known only to the sender and the receiver. Data origin authentication and data integrity are available for L2TP/IPsec and IKE version 2 connections.

  • Data encryption. To ensure confidentiality of the data as it traverses the shared or public transit network, the data is encrypted by the sender and decrypted by the receiver. The encryption and decryption processes depend on both the sender and the receiver using a common encryption key.

    Intercepted packets sent along the VPN connection in the transit network are unintelligible to anyone who does not have the common encryption key. The length of the encryption key is an important security parameter. You can use computational techniques to determine the encryption key. However, such techniques require more computing power and computational time as the encryption keys get larger. Therefore, it is important to use the largest possible key size to ensure data confidentiality.

Additional references

  • Overview of RRAS


Requirements for Installing RRAS as a VPN Server

You need to do the following before you configure an RRAS server to perform as a remote access VPN server.

  • Determine which network interface connects to the Internet and which network interface connects to your private network.

    During configuration, you will be asked to choose which network interface connects to the Internet. If you specify the incorrect interface, your remote access VPN server will not operate correctly.

  • Determine whether remote clients will receive IP addresses from a DHCP server on your private network or directly from the remote access VPN server that you are configuring.

    If you have a DHCP server on your private network, the remote access VPN server can lease 10 addresses at a time from the DHCP server and assign those addresses to remote clients. If you do not have a DHCP server on your private network, the remote access VPN server can assign IP addresses to remote clients from a predefined pool of addresses. You must determine that range based on your network infrastructure. For more information, see RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605).

  • If you are using DHCP, determine whether VPN clients are able to send DHCP messages to the DHCP server on your private network.

    If a DHCP server is on the same subnet as your remote access VPN server, DHCP messages from VPN clients will be able to reach the DHCP server after the VPN connection is established. If a DHCP server is on a different subnet from your remote access VPN server, make sure that the router between subnets can relay DHCP messages between clients and the server.

  • Determine whether you want connection requests from VPN clients to be authenticated by a Remote Authentication Dial-In User Service (RADIUS) server or by the remote access VPN server that you are configuring.

    Adding a RADIUS server is useful if you plan to install multiple remote access VPN servers, wireless access points, or other RADIUS clients to your private network. For more information, see Network Policy Server (http://go.microsoft.com/fwlink/?linkid=139764).

  • Verify that all users have user accounts that are configured for remote access.

    Before users can connect to the network, they must have user accounts on the remote access VPN server or in Active Directory® Domain Services. Each user account on a stand-alone server or a domain controller contains properties that determine whether that user can connect. On a stand-alone server, you can set these properties by right-clicking the user account in Local Users and Groups and clicking Properties. On a domain controller, you can set these properties by right-clicking the user account in the Active Directory Users and Computers console and clicking Properties.

Additional references

  • Virtual Private Networking


Dial-Up Networking

Dial-up remote access is a remote access technology that is available as part of the Routing and Remote Access service (RRAS).

Dial-up remote access provides a simple solution for organizations that want to allow employees to remotely access their corporate e-mail accounts and shared files from home or from other locations outside the corporate network. With dial-up remote access, a remote access client can use the wide area network (WAN) infrastructure to connect to a remote access server. A remote access client uses the telephone system to create a temporary physical circuit or a virtual circuit to a port on a remote access server. After the physical or virtual circuit is created, the rest of the connection parameters can be negotiated. Dial-up networking supports demand-dial routing to help reduce telephone costs.

Components of a dial-up remote access connection

A dial-up remote access connection contains the following components:

Components of a Dial-up Remote Access Connection

Remote access client

Remote access clients running Windows, UNIX, and Macintosh can connect to a RRAS remote access server.

Remote access server

The RRAS remote access server accepts dial-up connections and forwards packets between remote access clients and the network to which the RRAS server is attached.

Dial-up equipment and the WAN infrastructure

The physical or logical connection between the remote access server and the remote access client is facilitated by dial-up equipment installed at the remote access client, the remote access server, and the WAN infrastructure. The nature of the dial-up equipment and WAN infrastructure varies, depending on the type of connection. The following sections describe the most common methods for dial-up remote access.

PSTN

PSTN, also known as Plain Old Telephone Service (POTS), is the analog phone system designed to carry the minimum frequencies required to distinguish human voices.

Dial-up equipment consists of an analog modem at the remote access client and at least one analog modem at the remote access server. For large organizations, the remote access server is attached to a modem bank containing up to hundreds of modems. Because PSTN was not designed for data transmission, its transmission bit rate is limited compared to other connection methods.

Standard PSTN connection

Standard PSTN Connection
Digital links and V.90

The maximum bit rate of PSTN depends on the range of frequencies being passed by PSTN switches and the signal-to-noise ratio of the connection. The modern-day analog phone system is only analog on the local loop, the set of wires that connect the customer to the central office (CO) PSTN switch. After reaching the PSTN switch, the analog signal is converted to a digital signal.

When an RRAS server is connected to a CO by using a digital switch based on T-Carrier or ISDN rather than an analog PSTN switch, there is a higher signal-to-noise ratio because of fewer digital to analog conversions and, therefore, a higher maximum bit rate.

With this technology, called V.90, remote access clients can send data at 33.6 kilobits per second (Kbps) and receive data at 56 Kbps. In the United States, the maximum receive bit rate is 53 Kbps due to Federal Communications Commission (FCC) power rules.

To obtain V.90 speeds:

  • The remote access client must be using a V.90 modem.

  • The remote access server must be using a V.90 digital switch and must be connected to PSTN using a digital link, such as T-Carrier or ISDN.

  • There cannot be any analog-to-digital conversions in the path from the remote access server to the remote access client.

PSTN connection with V.90

PSTN Connection with V.90

See Also

  • Overview of RRAS


Permissions for Remote Access Users

After the Routing and Remote Access service (RRAS) is installed, you must specify the users who are allowed to connect to the RRAS server. RRAS authorization is determined by the dial-in properties on the user account, the network policies, or both.

You do not need to create user accounts just for remote access users. RRAS servers can use existing user accounts in the user accounts databases. In both Local Users and Groups and Active Directory Users and Computers, user accounts have a Dial-in tab on which you can configure remote access permissions. For a large number of users, we recommend that you configure network policies on a server running Network Policy Server (NPS). For more information, see Network Policy Server (http://go.microsoft.com/fwlink/?linkid=139764).

Security before the connection

The following steps describe what happens during a connection attempt from a remote access client to an RRAS server that is configured to use Windows authentication:

  1. A remote access client attempts to connect to an RRAS server.

  2. The server sends a challenge to the client.

  3. The client sends an encrypted response to the server that consists of a user name, a domain name, and a password.

  4. The server checks the response against the user accounts database.

  5. If the account is valid and the authentication credentials are correct, the server uses the dial-in properties of the user account and network policies to authorize the connection.

If the connection is dial-up and callback is enabled, the server hangs up the connection, calls the client back, and continues the connection negotiation process.

Notes
  • Steps 2 and 3 assume that the remote access client and the RRAS server use the Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) or Challenge Handshake Authentication Protocol (CHAP). The sending of client credentials varies for other authentication protocols.
  • If the RRAS server is a member of domain and the user response does not contain a domain name, then by default, the domain name of the RRAS server is used. If you want to use a domain name different from that of the RRAS server, on the remote access client, set the following registry value to the name of the domain that you want to use:
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RasMan\PPP\ControlProtocols\BuiltIn\DefaultDomain
Caution

Incorrectly editing the registry can severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Security after the connection

Credentials used for remote access only provide a communication channel to the target network. The client does not log on to the network as a result of a remote access connection. Each time the client attempts to access a network resource, it will be challenged for credentials. If it does not respond to the challenge with correct credentials, the access attempt will fail. Windows adds a feature to simplify remote access. After a successful connection, remote access clients that run Windows Vista®, Windows® 7, Windows Server® 2008, and Windows Server® 2008 R2 cache these credentials as default credentials for the duration of the remote access connection. When a network resource challenges the remote access client, the client provides the cached credentials so the user is not required to enter them again.

Additional references

  • Overview of RRAS


IP Address Assignment

When a remote access client initiates a connection to the RRAS server, the client creates a temporary logical interface (also known as a virtual interface or a virtual network adapter) and requests that the RRAS server assign an IP address to this logical interface. Both Internet Protocol version 6 (IPv6) and Internet Protocol version 4 (IPv4) addresses are supported. For more information, see IPv6 Addressing (http://go.microsoft.com/fwlink/?linkid=140606) and IPv4 Addressing (http://go.microsoft.com/fwlink/?linkid=140607).

IP address assignment can occur in one of the following ways:

From a DHCP server

The RRAS server obtains the IP address to assign to a remote client from a DHCP server on the intranet. This is the preferred method for IP address assignment. The RRAS server behaves like a DHCP client to the DHCP server and obtains 10 IP addresses at a time. As the remote access clients connect to the RRAS server, the IP addresses are assigned to the clients using Internet Protocol Control Protocol (IPCP). For more information, see RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605). DHCP can be used to assign both IPv6 and IPv4 addresses.

If a DHCP server cannot be contacted, then the RRAS server automatically assigns IPv4 addresses from the Automatic Private Internet Protocol Addressing (APIPA) range 168.254.0.1 through 169.254.255.254. If a DHCP server cannot be contacted for IPv6 addresses, then the IPv6 prefix assignment configured on the RRAS server is used by the client with a locally generated interface ID to create an IPv6 routable address.

From a server configured range of addresses

The RRAS server obtains an IPv4 address from a static pool of addresses configured on the RRAS server. If you configure a static address pool, do not use IP addresses that are already assigned to computers or that are in a range that your DHCP server might assign to another computer. The pool can be ranges of addresses that are a subset of addresses from the IP network to which the server is attached or from a separate subnet. If the static IP address pool address ranges represent a different subnet, ensure that routes to the address ranges exist on the routers of your intranet so that traffic to the logical interface of a remote client is forwarded to the remote access server.

For IPv6, only the prefix is assigned. The interface ID is generated automatically by the client, which then uses IPv6 neighbor discovery to ensure uniqueness.

From a static address specified in the user account

You can configure a static IP address for a selected client on the Dial-in tab of the user account for the remote client or in a network policy. When a remote client initiates a connection, creates a temporary logical interface, and requests that the remote access server assign an IP address to this logical interface, the remote access server assigns the IPv4 and IPv6 addresses specified in the remote client's user account. This method is best suited for a small number of remote users.

Additional references

  • Overview of RRAS


Remote Access Authentication Protocols

Remote access in this version of Windows supports the remote access authentication protocols listed in the following table. They are listed in order of decreasing security. We recommend that you use Extensible Authentication Protocol (EAP) and Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAPv2), and avoid the use of Challenge Handshake Authentication Protocol (CHAP) and Password Authentication Protocol (PAP).

Protocol | Description | Security Level
EAP | Allows for arbitrary authentication of a remote access connection through the use of authentication schemes, known as EAP types. | EAP offers the strongest security by providing the most flexibility in authentication variations. For more information, see EAP (http://go.microsoft.com/fwlink/?linkid=140608).
MS-CHAP v2 | Supports two-way mutual authentication. The remote access client receives verification that the remote access server that it is dialing in to has access to the user’s password. | MS-CHAP v2 provides stronger security than CHAP. For more information, see MS-CHAP v2 (http://go.microsoft.com/fwlink/?linkid=140609).
CHAP | Uses the Message Digest 5 (MD5) hashing scheme to encrypt the response. | CHAP is an improvement over PAP, in that the password is not sent over the PPP link. CHAP requires a plaintext version of the password to validate the challenge response. CHAP does not protect against remote server impersonation. For more information, see CHAP (http://go.microsoft.com/fwlink/?linkid=140610).
PAP | Uses plaintext passwords. Typically used if the remote access client and remote access server cannot negotiate a more secure form of validation. | PAP is the least secure authentication protocol. It does not protect against replay attacks, remote client impersonation, or remote server impersonation. For more information, seePAP (http://go.microsoft.com/fwlink/?linkid=140611).

Unauthenticated access

RRAS also supports unauthenticated access, which means that user credentials (a user name and password) are not required. There are some situations in which unauthenticated access is useful. For more information, see Unauthenticated Access (http://go.microsoft.com/fwlink/?linkid=73649).

Security Note
  • When you enable unauthenticated access, remote access users are connected without sending user credentials. An unauthenticated remote access client does not negotiate the use of a common authentication protocol during the connection establishment process and does not send a user name or password.
  • Unauthenticated access with remote access clients can occur when the authentication protocols configured by the remote access client do not match those configured on the remote access server. In this case, the use of a common authentication protocol is not negotiated and the remote access client does not send a user name and password.

Additional references

  • Overview of RRAS


Routing

Routing is the process of receiving a network packet from the network connected to one interface and forwarding it to the network connected to a different interface.

  1. IPv4 Routing (http://go.microsoft.com/fwlink/?linkid=140614)

  2. IPv6 Routing (http://go.microsoft.com/fwlink/?linkid=140615)

  3. Static Routing (http://go.microsoft.com/fwlink/?linkid=140617)

  4. Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619)

  5. Demand-Dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)

Additional references

  • Overview of RRAS


Network Policies

Network policies, formerly known as remote access policies, are now administered from Network Policy Server (NPS). For more information, see Network Policy Server (http://go.microsoft.com/fwlink/?linkid=139764).

Additional references

  • Overview of RRAS


Checklists for RRAS

These checklists cover the main RRAS configuration tasks.

  • Checklist: Installing and Configuring an RRAS VPN Server

  • Checklist: Installing and Configuring an RRAS Router

  • Checklist: Configuring Remote Access Behind a NAT-Enabled Router

  • Checklist: Connecting Remote Sites

Additional references

  • Routing and Remote Access Service


Checklist: Installing and Configuring an RRAS VPN Server

Task | Reference
Review key concepts. | Virtual Private Networking
Gather required information. | Requirements for Installing RRAS as a VPN Server
Configure TCP/IP on the network adapters of the RRAS server. | Configure TCP/IP on the RRAS Server
Install RRAS. | Install RRAS
Enable RRAS and configure it as a VPN server. | Enable RRAS as a VPN Server
If your RRAS server is behind a perimeter firewall, or is running a host-based firewall such as Windows Firewall with Advanced Security, then configure the required firewall rules to permit virtual private network (VPN) network traffic through the firewall to the RRAS server. | Configure a Firewall for VPN Traffic (http://go.microsoft.com/fwlink/?linkid=140709)
If your RRAS server is not behind a perimeter firewall, and is not running a host-based firewall such as Windows Firewall with Advanced Security, then configure static packet filters to permit only the required VPN network traffic to the RRAS server. | Configure Static Filters for VPN Traffic (http://go.microsoft.com/fwlink/?linkid=140713)
Configure the types of VPN connections, and the number of each that your VPN server supports. By default, RRAS in this version of Windows supports 128 each of Internet Key Exchange version 2 (IKEv2), Layer Two Tunneling Protocol (L2TP), Point-to-Point Tunneling Protocol (PPTP), and Secure Socket Tunneling Protocol (SSTP) connections. If you enable VPN after installing RRAS, then the VPN ports are disabled and Windows only creates five of each connection type. Enable the ports and configure the number you need by following this procedure. | Configure Ports for Remote Access
Specify either DHCP or configure a static pool of IP addresses for VPN clients. | Configure the Way RRAS Assigns IP Addresses to VPN Clients
If you are using DHCP to supply IP addresses to remote clients, and the DHCP server is not located on the same IP subnet as the RRAS server, then configure a DHCP relay agent that forwards broadcast DHCP requests and responses through routers to the DHCP server. | Configure the IPv4 DHCP Relay Agent Configure the IPv6 DHCP Relay Agent
If you are using Network Policy Server (NPS) to centrally manage policies for your RRAS servers, then configure dial-in properties and network policies for dial-in permission, authentication, and encryption settings. | See "Checklist: Configure NPS for Dial-Up and VPN" in Network Policy Server Help.
Adjust logging levels for RRAS and for each routing protocol. | Configure Logging Levels for RRAS
(Optional) Create a Connection Manager profile to manage the client connection experience for your users and simplify troubleshooting client connections. | Connection Manager Administration Kit (http://go.microsoft.com/fwlink/?linkid=136440)
If your RRAS configuration requires any certificates for authentication, for example, when you use IKEv2 or SSTP-based VPN connections, then you must have a source for the certificates. Install Active Directory Certificate Services (AD CS) on a server on your network as an alternative to purchasing certificates from third-party root CAs. | Active Directory Certificate Services (http://go.microsoft.com/fwlink/?linkid=136444)
To support SSTP or IKEv2 certificate-authenticated VPN connections, you must install a computer certificate with the Server Authentication or All-Purpose Enhanced Key Usage (EKU) property installed on your RRAS server. | Configure RRAS with a Computer Authentication Certificate
If you initially configured your RRAS server to support Internet Protocol version 4 (IPv4) only, you can add support for Internet Protocol version 6 (IPv6) remote access. | Enable IPv6 Remote Access
(Optional) Configure your VPN server to use Network Access Protection (NAP) to enforce health requirement policies. | Configure Network Access Protection Enforcement for VPN

Additional references

  • Checklists for RRAS


Checklist: Installing and Configuring an RRAS Router

Task | Reference
Review key concepts. Decide which protocols and routing features of RRAS you want to use. | Routing IPv4 Routing (http://go.microsoft.com/fwlink/?linkid=140614) IPv6 Routing (http://go.microsoft.com/fwlink/?linkid=140615) Static Routing (http://go.microsoft.com/fwlink/?linkid=140617) Routing Information Protocol for IPv4 (http://go.microsoft.com/fwlink/?linkid=140716) Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619) Demand-Dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)
Configure TCP/IP on the network adapters of the RRAS server. | Configure TCP/IP on the RRAS Server
Install RRAS. | Install RRAS
Enable RRAS and configure it as a router | Enable RRAS as a LAN and WAN Router
(Optional) Design and deploy static IP routing. | Create a static route
(Optional) Design and deploy Routing Information Protocol for IP. | Enable and Configure RIP
(Optional) Add and configure the DHCP Relay Agent. | Configure the IPv4 DHCP Relay Agent Configure the IPv6 DHCP Relay Agent
(Optional) Configure IP multicast support. | IPv4 Multicast Routing (http://go.microsoft.com/fwlink/?linkid=140717)
(Optional) Design and deploy network address translation (NAT). | Enable and Configure NAT
(Optional) Configure IP packet filters. | Configure Static Packet Filters (http://go.microsoft.com/fwlink/?linkid=140713)
(Optional) Design and deploy demand-dial routing. | Create a Demand-Dial Interface

Additional references

  • Checklists for RRAS


Checklist: Configuring Remote Access Behind a NAT-Enabled Router

Task | Reference
Review key concepts. | Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619) and Virtual Private Networking
Gather required information. | Requirements for Installing RRAS as a VPN Server
Configure TCP/IP on the network adapters of the RRAS server. | Configure TCP/IP on the RRAS Server
Install RRAS. | Install RRAS
Enable RRAS and configure it as a VPN server and NAT router. | Install RRAS
Complete the other steps required to configure a VPN server. | Checklist: Installing and Configuring an RRAS VPN Server

Additional references

  • Checklists for RRAS


Checklist: Connecting Remote Sites

The following are tasks you must perform to allow connections from remote clients.

Choose remote site connection type:

  • Dial-up or virtual private network (VPN) connection.

  • On-demand or persistent connection.

  • One-way or two-way connection.

Choose security features:

  • Integrate the VPN server into a perimeter network.

  • Choose authentication provider.

  • Choose authentication method.

  • Choose Microsoft Point-to-Point Encryption (MPPE) or Internet Protocol security (IPsec) encryption.

  • Choose router user accounts and groups.

  • Choose remote access policy type.

Integrate the remote site connection into your network:

  • Design routing infrastructure.

  • Plan IP address assignment and name resolution.

  • Plan Active Directory Domain Services (AD DS) integration.

Deploy site-to-site connection.

Additional references

  • Checklists for RRAS

  • Connecting Remote Sites (http://go.microsoft.com/fwlink/?linkid=89362)


Configuring RRAS

The following procedures are used to configure the Routing and Remote Access service (RRAS).

  • Install RRAS

  • Open the RRAS MMC Snap-in

  • Configure a Dial-Up Remote Access Server

  • Configure a Firewall for VPN Traffic (http://go.microsoft.com/fwlink/?linkid=140709)

  • Configure the Way RRAS Assigns IP Addresses to VPN Clients

  • Configure Logging Levels for RRAS

  • Configure Network Access Protection Enforcement for VPN

  • Configure Ports for Remote Access

  • Configure RRAS with a Computer Authentication Certificate

  • Configure Static Packet Filters (http://go.microsoft.com/fwlink/?linkid=140713)

  • Configure the IPv4 DHCP Relay Agent

  • Configure the IPv6 DHCP Relay Agent

  • Configure TCP/IP on the RRAS Server

  • Create a Demand-Dial Interface

  • Create a Static Route

  • Enable and Configure NAT

  • Enable and Configure RIP

  • Enable IPv6 Remote Access

  • Enable RRAS as a LAN and WAN Router

  • Enable RRAS as a VPN Server

  • Enable RRAS as a VPN Server and a NAT Router

  • Remove RRAS from a Server

  • View Information in RRAS

Additional references

  • Checklists for RRAS

  • Routing and Remote Access Service


Install RRAS

You install RRAS by using the Add Roles wizard in Server Manager.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To install RRAS

  1. Perform one of the following two steps to start the Add Roles Wizard:

    • Start Server Manager. In the main window, under Roles Summary, click Add roles.

    • In the Initial Configuration Tasks window that appears when you first log on, under Customize This Server, click Add roles.

  2. On the Before You Begin page, click Next.

    Note

    This page does not appear if you previously selected Skip this page by default.

  3. On the Select Server Roles page, select Network Policy and Access Services, and then click Next twice.

  4. On the Select Role Services page, select Routing and Remote Access Services.

  5. On the Confirm Installation Selections page, click Install.

  6. On the Installation Results page, review the status, and then click Close.
Note

After you complete the installation, RRAS appears in the list of server roles under Network Policy and Access Services. You must now enable the service to configure your server for routing and remote access. For more information, see Enable RRAS as a VPN Server, Enable RRAS as a LAN and WAN Router, and Enable RRAS as a VPN Server and a NAT Router.

Additional references

  • Configuring RRAS


Open the RRAS MMC Snap-in

Use these procedures to open the Routing and Remote Access MMC snap-in.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To open the RRAS MMC snap-in by using Server Manager

  1. To start Server Manager, click Start, click Administrative Tools, and then click Server Manager.

  2. Expand Roles, expand Network Policy and Access Services, and then click Routing and Remote Access.
To open the RRAS MMC snap-in as a standalone console

  • Click Start, click Administrative Tools, and then click Routing and Remote Access.
Note

If you open the snap-in by using Server Manager, then Routing and Remote Access is displayed in the navigation pane. If you open the snap-in as a standalone MMC console, then the name of your RRAS server is displayed at the top. In either case, you can right-click this item to display the RRAS Server Properties page.

Additional references

  • Configuring RRAS

  • Routing and Remote Access Properties Page


Configure a Dial-Up Remote Access Server

You can use an RRAS server to provide dial-up access to your corporate intranet. If you want the remote access server to support multiple, dial-up networking TCP/IP-based connections, complete the following steps:

  • Configure the RRAS server’s LAN connection to the intranet. For more information, see Configure TCP/IP on the RRAS Server

  • Configure the connection to the dial-up networking clients, including installing dial-up modem equipment and the appropriate device drivers. For more information, see the documentation provided by the modem equipment manufacturer.

  • Configure the dial-in ports.

  • Configure the remote access server. This is similar to configuring the server for VPN access. For more information, see Checklist: Installing and Configuring an RRAS VPN Server.

  • Configure multicast support. For more information, see IPv4 Multicast Routing (http://go.microsoft.com/fwlink/?linkid=140717).

  • Configure network policies. For more information, see Network Policies.

Additional references

  • Configuring RRAS


Configure the Way RRAS Assigns IP Addresses to VPN Clients

You can use a DHCP server to assign IP addresses to VPN clients or you can configure an RRAS server to use a static pool of IP addresses for allocation to TCP/IP-based remote access and demand-dial connections. For more information, see RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605).

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To create a static IP address pool

  1. Open the RRAS MMC Snap-in.

  2. Right-click the RRAS server name, and then click Properties. If you are using Server Manager, right-click Routing and Remote Access, and then click Properties.

  3. On the Properties page, click the IPv4 tab.

  4. Under IPv4 address assignment, click Static address pool.

  5. Click Add.

  6. In Start IP address, type a starting IP address.

  7. Type either an ending IP address for the range in End IP address, or type the number of IP addresses in the range in Number of addresses, and then click OK.

  8. Click OK, and then repeat steps 5 through 7 for as many ranges as you need to add.

To configure RRAS to use addresses from a DHCP server

  1. Open the RRAS MMC Snap-in.

  2. Right-click the server name for which you want to create a static IP address pool, and then click Properties. If you are using Server Manager, right-click Routing and Remote Access, and then click Properties.

  3. On the Properties page, click the IPv4 tab.

  4. Under IPv4 address assignment, click Dynamic Host Configuration Protocol (DHCP).

  5. Click OK to save your changes.

Additional considerations

  • If the static IP address pool consists of ranges of IP addresses that are for a separate subnet, then you need to either enable an IP routing protocol on the remote access server computer or add static IP routes consisting of the {IP Address, Mask} of each range to the routers of the intranet. If the routes are not added, then remote access clients cannot receive traffic from resources on the intranet.

  • If the DHCP server is on the same subnet as the RRAS server, then you do not have to configure the DHCP relay agent. RRAS can find DHCP servers on the same subnet by using broadcast network packets.

Additional references

  • RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605)

  • Configuring RRAS


Configure Logging Levels for RRAS

RRAS log files are written to the %windir%\tracing folder. Use this procedure to control the amount of detail that RRAS writes to the log files.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure logging in RRAS

  1. In the Routing and Remote Access MMC snap-in, in the navigation pane, right-click your server, and then click Properties. If you are using Server Manager, right-click Routing and Remote Access, and then click Properties.

  2. On the Logging tab, choose one of the following options:

    • Log errors only. This option writes only events that indicate error conditions to the log files. Although this results in the minimum log file size, the file does not include information that can be useful in diagnosing some connectivity issues.

    • Log errors and warnings. In addition to errors, this option also writes events that are raised when conditions exist that are outside of expected operations, but not necessarily indicative of errors.

    • Log all events. This option writes error and warning events and all informational events to the logs.

    • Do not log any events. This option disables all logging.

    • Log additional Routing and Remote Access information (used for debugging). This option instructs RRAS to include additional diagnostic information in the logs to assist with error diagnosis, connectivity issues, or performance issues. It can result in very large log files, so we recommend that you enable this option only when you are investigating a problem.

  3. Click OK to save your changes.

Additional references

  • Configuring RRAS


Configure Network Access Protection Enforcement for VPN

Network Access Protection (NAP) includes client components and server components that allow you to define the required software and system configurations for computers that connect to your network. NAP enforces health requirements by inspecting and assessing the health of client computers, limiting network access when client computers are noncompliant, and remediating noncompliant client computers for unlimited network access. NAP enforces health requirements on client computers that are attempting to connect to a network. NAP also provides ongoing health compliance enforcement while a compliant client computer is connected to a network.

NAP enforcement occurs at the moment client computers attempt to access the network through network access servers, such as an RRAS server providing VPN services, or when clients attempt to communicate with other network resources.

NAP enforcement for VPN is deployed with a VPN enforcement server component and a VPN enforcement client component. VPN servers can enforce health policy when client computers attempt to connect to the network using a VPN connection. VPN enforcement provides strong limited network access for all computers accessing the network through a VPN connection.

Note

VPN enforcement is different from Network Access Quarantine Control, which is a feature in Windows Server 2003 and Internet Security and Acceleration (ISA) Server 2004.

For more information about NAP, see Network Access Protection (http://go.microsoft.com/fwlink/?linkid=137284) and Network Policy Server (http://go.microsoft.com/fwlink/?linkid=137283).

Deploying NAP with VPN

To deploy NAP with VPN, you must configure the following:

  • Install and configure RRAS as a VPN server.

  • In Network Policy Server (NPS), configure VPN servers as RADIUS clients. Also configure connection request policy, network policy, and NAP health policy. You can configure these policies individually using the NPS console or you can use the Network Access Protection wizard.

  • Enable the NAP VPN enforcement client and the NAP service on NAP-capable client computers.

  • Configure the Windows Security Health Validator (WSHV) or install and configure other system health agents (SHAs) and system health validators (SHVs), depending on your NAP deployment.

  • If you are using PEAP-TLS or EAP-TLS with smart cards or certificates, deploy a public key infrastructure (PKI) with Active Directory® Certificate Services (AD CS).

  • If you are using PEAP-MS-CHAP v2, issue server certificates with either AD CS or purchase server certificates from a trusted root certification authority (CA).

Configuring remote access policies

You must use NPS to create and configure remote access policies. Use the following steps to set the remote access policy to grant user access.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure the remote access policy

  1. Open the RRAS MMC Snap-in.

  2. Right-click Remote Access Logging & Policies, and then click Launch NPS.

  3. Click Network Policies.

  4. Double-click Connections to Microsoft Routing and Remote Access server.

  5. On the Overview tab, under Access Permission, click Grant access, and then click OK.

Additional references

  • Configuring RRAS

  • Network Access Protection (http://go.microsoft.com/fwlink/?linkid=137284)

  • Network Policy Server (http://go.microsoft.com/fwlink/?linkid=137283)


Configure Ports for Remote Access

An RRAS server treats the installed networking equipment as a series of devices and ports. A device represents hardware or software that can create physical or logical point-to-point connections. A port is a communication channel that can support a single point-to-point connection. You configure the types and number of ports used by RRAS by using the Ports Properties dialog box.

Note

If you enable VPN access when you install RRAS by using the RRAS Setup Wizard, then the VPN ports are already enabled for remote access connections. If you enable VPN access later, then the ports are likely disabled and you must enable them by using this procedure.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure ports for remote access

  1. Open the Routing and Remote Access MMC snap-in.

  2. In the navigation pane, expand your RRAS server.

  3. In the navigation pane, right-click Ports, and then click Properties.

  4. In the Ports Properties dialog box, click a device, and then click Configure.

  5. In the Configure Device dialog box, do one or more of the following:

    • To enable remote access, select Remote access connections (inbound only).

    • To enable demand-dial routing, select Demand-dial routing connections (inbound and outbound).

Additional references

  • Configuring RRAS

  • Ports Properties Dialog Box


Configure RRAS with a Computer Authentication Certificate

Secure Socket Tunneling Protocol (SSTP) and Internet Key Exchange version 2 (IKEv2)-based virtual private networks (VPNs) use certificate-based authentication methods. To support SSTP or IKEv2-based VPNs, you must install a properly configured certificate on the VPN server.

The computer certificate you configure on the RRAS server must have either the Server Authentication or All-Purpose enhanced key usage (EKU) property. This computer certificate is used by the VPN client to authenticate the RRAS server when the session is established.

Where to install certificates

On the RRAS server:

  • Install the root CA certificate for the certification authority (CA) that issued the server authentication certificate into the store Local Computer\Trusted Root Certification Authorities.

  • Install the server authentication certificate that was issued by the CA into the store Local Computer\Personal.

On the remote VPN client:

  • Install the root CA certificate for the CA that issued the server authentication certificate into the store Local Computer\Trusted Root Certification Authorities. This is required for the client to trust the server authentication certificate presented by the server.

  • If the client will need to use IKEv2 VPN connections to the server, then a client authentication certificate that was issued by the CA must be installed in the store Local Computer\Personal.

Important
  • For SSTP VPN connections, by default, the client must be able to confirm that the certificate has not been revoked by checking the server identified in the certificate as hosting the certificate revocation list (CRL). If the server hosting the CRL cannot be contacted, then the validation fails, and the VPN connection is dropped. To prevent this, you must either publish the CRL on a server that is accessible on the Internet or configure the client to not require CRL checking. To disable CRL checking, create a registry setting at the following location:
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sstpsvc\parameters
  • The setting must be a DWORD value named NoCertRevocationCheck. Set the value to 1.

Additional references

  • Active Directory Certificate Services (http://go.microsoft.com/fwlink/?linkid=136444)

  • Configuring RRAS


Configure the IPv4 DHCP Relay Agent

The DHCP Relay Agent component relays DHCP messages between DHCP clients and DHCP servers on different IP networks. Because DHCP is a broadcast-based protocol, by default its packets do not pass through routers. A DHCP relay agent receives any DHCP broadcasts on the subnet and forwards them to the specified IP address on a different subnet. The DHCP Relay Agent is compliant with RFC 1542, "Clarifications and Extensions for the Bootstrap Protocol." For each IP network segment that contains DHCP clients, either a DHCP server or a computer acting as a DHCP Relay Agent is required.

Note

You cannot use the DHCP Relay Agent component on a computer that is running the DHCP service, the network address translation (NAT) routing protocol component with automatic addressing enabled, or Internet Connection Sharing (ICS).

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure the IPv4 DHCP relay agent

  1. Open the RRAS MMC Snap-in.

  2. In the Routing and Remote Access MMC snap-in, expand IPv4, and then click DHCP Relay Agent.

  3. Add the network interfaces on which the server might receive DHCP requests that you want to send to the DHCP server. Right-click DHCP Relay Agent, click New Interface, select the appropriate network interface, and then click OK.

  4. In the DHCP Relay Properties dialog box, select Relay DHCP packets, and then click OK.

  5. In the navigation pane, right-click DHCP Relay Agent, and then click Properties.

  6. On the General tab, enter the IPv4 address of the DHCP servers that you want to provide DHCP services for the RRAS server’s clients, click Add, and then click OK.

Additional references

  • Configuring RRAS

  • RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605)


Configure the IPv6 DHCP Relay Agent

The DHCPv6 Relay Agent component relays Dynamic Host Configuration Protocol (DHCP) messages between DHCPv6 clients and DHCPv6 servers on different Internet Protocol version 6 (IPv6) networks. For each IPv6 network segment that contains DHCPv6 clients, either a DHCPv6 server or a computer acting as a DHCPv6 relay agent is required.

Note

You cannot use the DHCPv6 Relay Agent component on a computer that is running the DHCP service, the network address translation (NAT) routing protocol component with automatic addressing enabled, or Internet Connection Sharing (ICS).

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure the IPv6 DHCP relay agent

  1. In the Routing and Remote Access MMC snap-in, expand IPv6, right-click General, and then click New Routing Protocol.

  2. In the New Routing Protocol dialog box, select DHCPv6 Relay Agent, and then click OK.

  3. In the navigation pane, right-click DHCPv6 Relay Agent, and then click New Interface.

  4. Add the network interfaces on which the server might receive DHCPv6 requests that you want to send to the DHCP server. Right-click DHCPv6 Relay Agent, click New Interface, select the appropriate network interface, and then click OK.

  5. In the DHCPv6 Relay Properties dialog box, select Relay DHCP packets, and then click OK.

  6. In the navigation pane, right click DHCPv6 Relay Agent, and then click Properties.

  7. On the Servers tab, enter the IPv6 address of the DHCP servers that you want to provide DHCP services for the RRAS server’s clients, click Add, and then click OK.

Additional references

  • Configuring RRAS

  • RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605)


Configure TCP/IP on the RRAS Server

Before you configure an RRAS server as a remote access server, you must configure the TCP/IP settings for the Internet or perimeter network interface and for the intranet interface.

Note

We recommend that you do not use automatic DHCP to configure a VPN server. Instead, either manually configure TCP/IP, or use DHCP with MAC address reservations to keep the TCP/IP configuration of the VPN server stable.

Configure the Internet interface of the VPN server with a default gateway. Configure the TCP/IP settings with a public IP address, a subnet mask, and the default gateway of either the firewall (if the VPN server is connected to a perimeter network) or an ISP router (if the VPN server is connected directly to the Internet). Do not configure a default gateway for the intranet interface. Doing so might cause conflicts with the default route that points to the Internet. The procedures in this topic describe how to configure Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) manually.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

Configuring TCP/IP on the VPN server

Configure IPv6 for the Internet interface

Configure IPv4 for the Internet interface

Configure IPv6 for the intranet interface

Configure IPv4 for the intranet interface

To configure IPv6 for the Internet interface

  1. In Control Panel, under Network and Internet, click View network status and tasks.

  2. In the Network and Sharing Center, click Change adapter settings.

  3. In Network Connections, right-click the network adapter that you want to configure, and then click Properties.

  4. Select Internet Protocol Version 6 (TCP/IPv6), and then click Properties.

  5. Click Use the following IPv6 address.

  6. In the boxes, type the IPv6 address, the subnet prefix length of the address (typically 64), and the IPv6 address of the default gateway on the attached link.

  7. Type the IPv6 addresses of the DNS servers that support IPv6 (AAAA) host records.

  8. Click Advanced to display the Advanced TCP/IP Settings dialog box.

  9. If you need to add additional IPv6 addresses, on the IP Settings tab, under IP addresses, click Add. If there are multiple routers to other links connected on the attached link, under Default gateways, click Add, and then enter the addresses.

  10. Click the DNS tab.

  11. If you need to add additional DNS servers, click Add, and then enter the addresses.

  12. To prevent the VPN server from dynamically registering the public IP address of its Internet (public) interface with an intranet DNS server, clear the Register this connection’s addresses in DNS check box. This check box is selected by default.

  13. Click OK to close any open dialog boxes.
To configure IPv4 for the Internet interface

  1. In Control Panel, under Network and Internet, click View network status and tasks.

  2. In the Network and Sharing Center, click Change adapter settings.

  3. In Network Connections, right-click the network adapter that you want to configure, and then click Properties.

  4. Select Internet Protocol Version 4 (TCP/IPv4), and then click Properties.

  5. On the General tab, select Use the following IP address, and then type the IP address, subnet mask, and default gateway.

    The IP address must be a public IP address assigned by your ISP. As an option, you can configure the VPN server with a private IP address but assign it a published static IP address by which it is known on the Internet. When packets are sent to and from the VPN server, a network address translation (NAT) device that is positioned between the Internet and the VPN server translates the published IP address to the private IP address.

    When you configure a VPN connection, give your VPN servers names that can be resolved to IP addresses using DNS.

  6. Click Advanced to display the Advanced TCP/IP Settings dialog box.

  7. To prevent the VPN server from dynamically registering the public IP address of its Internet (public) interface with an intranet DNS server, on the DNS tab, clear the Register this connection’s addresses in DNS check box. This check box is selected by default.

  8. To prevent the VPN server from registering the public IP address of its Internet interface with intranet WINS servers, on the WINS tab, select Disable NetBIOS over TCP/IP.

  9. Click OK to close any open dialog boxes.
To configure IPv6 for the intranet interface

  1. In Control Panel, under Network and Internet, click View network status and tasks.

  2. In the Network and Sharing Center, click Change adapter settings.

  3. In Network Connections, right-click the network adapter that you want to configure, and then click Properties.

  4. On the General tab, select Use the following IPv6 address, and then type the IPv6 address, subnet prefix length, and DNS server address.

    Important

    When you configure IPv6 for the intranet interface of the VPN server, do not configure the default gateway on the intranet connection. This will prevent default route conflicts with the default route pointing to the Internet.

  5. If you have additional IPv6 addresses or additional DNS servers to assign to this interface, click Advanced, and then add them to the IP Settings or DNS tabs, as appropriate.
To configure IPv4 for the intranet interface

  1. In Control Panel, under Network and Internet, click View network status and tasks.

  2. In the Network and Sharing Center, click Change adapter settings.

  3. In Network Connections, right-click the network adapter that you want to configure, and then click Properties.

  4. On the General tab, select Use the following IP address, and then type the IPv4 address, subnet mask, and DNS server address.

    Important

    When you configure IPv4 for the intranet interface of the VPN server, do not configure the default gateway on the intranet connection. This will prevent default route conflicts with the default route pointing to the Internet.

  5. Click Advanced to display the Advanced TCP/IP Settings dialog box.

  6. On the WINS tab, configure the IP addresses of your WINS servers.

Additional references

  • Configuring RRAS

  • IPv6 Addressing (http://go.microsoft.com/fwlink/?linkid=140606)

  • IPv4 Addressing (http://go.microsoft.com/fwlink/?linkid=140607)

  • IPv6 Routing (http://go.microsoft.com/fwlink/?linkid=140615)

  • IPv4 Routing (http://go.microsoft.com/fwlink/?linkid=140614)


Create a Demand-Dial Interface

Demand-dial interfaces connect routers on either public or private networks. A demand-dial interface can be either on-demand (activated only when needed) or persistent (always connected) and initiate one-way or two-way connections.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To add a demand-dial interface

  1. In the RRAS MMC snap-in, expand Your Server Name. If you are using Server Manager, then expand Routing and Remote Access.

  2. Right-click Network Interfaces, and then click New Demand-dial interface.

  3. Follow the instructions in the Demand-Dial Interface wizard.

To use the demand-dial interface, create a route that uses the new demand-dial interface as the interface to the destination network.

To configure a demand-dial interface to be persistent or on-demand

  1. In the RRAS MMC snap-in, in the navigation pane, click Network Interfaces.

  2. Right-click the demand-dial network interface, and then click Properties.

  3. In the Interface Name Properties dialog box, select the Options tab.

  4. Under Connection type, select one of the following:

    • Demand-dial. This option specifies that the connection is established only when needed and is disconnected after being idle for the number of minutes specified in Idle time before hanging up.

    • Persistent connection. This option specifies that the connection is established immediately and is reestablished whenever the Routing and Remote Access service starts.
To configure a demand-dial interface to use specified security settings

  1. In the RRAS MMC snap-in, in the navigation pane, click Network Interfaces.

  2. Right-click the demand-dial network interface, and then click Properties.

  3. In the Interface Name Properties dialog box, select the Security tab.

  4. Under Type of VPN, select the type of virtual private network (VPN) that you want the connection to use.

  5. Under Data encryption, specify the encryption requirements for this connection.

  6. Under Authentication, select one of the following options:

    • Extensible Authentication Protocol (EAP). Click Properties to configure this option.

    • Allow these protocols. Select the authentication protocols to configure this option.

Additional references

  • Configuring RRAS

  • Demand-dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)

  • Demand-Dial Interface Wizard


Create a Static Route

Creating a static route informs the router of a specified network, the address of the gateway that serves as the next hop, and the interface to use to forward packets sent to that network.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To create an IPv4 static route

  1. In the RRAS MMC snap-in, expand IPv4, right-click Static Routes, and then click New Static Route.

  2. In the Interface list, select the interface that should be used to forward packets to the network for which you are creating the route.

  3. In Destination, type the Internet Protocol version 4 (IPv4) address of the network.

  4. In Network mask, type the network mask that corresponds to the network address.

  5. In Gateway, type the IPv4 address of the router that serves as the next hop for forwarded packets.

  6. In Metric, type the number that reflects the cost of using this route. Typically, this value is the number of routers between this server and the destination network. When RRAS must select between multiple valid routes, the route with the lowest metric is the one selected.

  7. Click OK to save your changes. The new route appears in Static Routes.
To create an IPv6 static route

  1. In the RRAS MMC snap-in, expand IPv6, right-click Static Routes, and then click New Static Route.

  2. In the Interface list, select the interface that should be used to forward packets to the network for which you are creating the route.

  3. In Destination, type the Internet Protocol version 6 (IPv6) network address of the network using a format similar to 21DA:D3:0:2F3B::.

  4. In Prefix length, type the number of bits in the destination address that represent the network address. This value is typically 64, but can also be a value less than 64 when creating a summarized route.

  5. In Gateway, type the IPv6 address of the router that serves as the next hop for forwarded packets.

  6. In Metric, type the number that reflects the cost of using this route. Typically, this value is the number of routers between this server and the destination network. When RRAS must select between multiple valid routes, the route with the lowest metric is the one selected.

  7. Click OK to save your changes. The new route appears in Static Routes.

Additional references

  • Configuring RRAS

  • Static Routing (http://go.microsoft.com/fwlink/?linkid=140617)


Enable and Configure NAT

Network address translation (NAT) allows you to share a connection to the public Internet through a single interface with a single public IP address. The computers on the private network use private, non-routable addresses. NAT maps the private addresses to the public address.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable network address translation addressing

  1. In the RRAS MMC snap-in, expand Your Server Name. If you are using Server Manager, expand Routing and Remote Access.

  2. Expand IPv4, right-click NAT, and then click Properties.

  3. If you do not have a DHCP server on the private network, then you can use the RRAS server to respond to DHCP address requests. To do this, on the Address Assignment tab, select the Automatically assign IP addresses by using the DHCP allocator check box.

  4. To allocate addresses to clients on the private network by acting as a DHCP server, in IP address and Mask, configure a subnet address from which the addresses are assigned. For example, if you enter 192.168.0.0 and a subnet mask of 255.255.255.0, then the RRAS server responds to DHCP requests with address assignments from 192.168.0.1 through 192.168.0.254.

  5. (Optional) To exclude addresses in the configured network range from being assigned to DHCP clients on the private network, click Exclude, click Add, and then configure the addresses.

  6. To add the public interface to the NAT configuration, right-click NAT, and then click New Interface. Select the interface connected to the public network, and then click OK.

  7. On the NAT tab, click Public interface connected to the Internet and Enable NAT on this interface, and then click OK.

  8. If you want to add additional public addresses assigned to this interface or configure service and port mappings to computers on the private network, see IPv4 - NAT - Interface - Properties Page.

  9. To add the private interface to the NAT configuration, right-click NAT, and then click New Interface. Select the interface connected to the private network, and then click OK.

  10. On the NAT tab, click Private interface connected to private network, and then click OK.

Additional references

  • Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619)

  • Configuring RRAS


Enable and Configure RIP

Configure Routing Information Protocol (RIP) to enable the RRAS server to exchange routing information with other routers. By default, RIP is not enabled on an RRAS server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable and configure RIP

  1. In the RRAS MMC snap-in, expand IPv4, right-click General, and then click New Routing Protocol.

  2. Select RIP Version 2 for Internet Protocol, and then click OK. RIP now appears in the navigation pane under IPv4.

  3. Right-click RIP, and then click New Interface.

  4. Select the interface connected to a subnet on which the remote router is connected, and then click OK.

  5. RIP is configured with default settings. If these are satisfactory, click OK to save your changes. For information about configuring the RIP options for this interface, see IPv4 - RIP - Interface - Properties Page.

  6. If you want to customize logging or configure the list of routers with which this server can exchange information, right-click RIP, and then click Properties.

Additional references

  • Configuring RRAS

  • Routing Information Protocol for IPv4 (http://go.microsoft.com/fwlink/?linkid=140716)

  • IPv4 - RIP - Properties Page


Enable IPv6 Remote Access

By default, RRAS is configured to accept Internet Protocol version 4 (IPv4) connections only. Use this procedure to configure RRAS to add support for Internet Protocol version 6 (IPv6) connections.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable IPv6 connections

  1. Open the RRAS MMC Snap-in.

  2. Right-click Your Server Name, and then click Properties. If you are using Server Manager, right-click Routing and Remote Access, and then click Properties.

  3. On the General tab, click IPv6 Router or IPv6 Remote access server, or both, depending on your requirements.

  4. If you are configuring remote access for IPv6, on the IPv6 tab, type the IPv6 prefix that is to be assigned to incoming IPv6 remote clients (for example: 2001:1234:5678:90ab::).

  5. Click OK, and then click Yes to restart RRAS.

Additional references

  • Configuring RRAS

  • Virtual Private Networking

  • IPv6 Addressing (http://go.microsoft.com/fwlink/?linkid=140606)

  • IPv6 Routing (http://go.microsoft.com/fwlink/?linkid=140615)


Enable RRAS as a LAN and WAN Router

RRAS provides multiprotocol LAN-to-LAN, LAN-to-WAN, virtual private network (VPN), and network address translation (NAT) routing services. RRAS is intended for use by system administrators who are already familiar with routing protocols and services.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable LAN and WAN routing

  1. Open the RRAS MMC Snap-in.

  2. Right-click the server name for which you want to enable routing, and then click Properties. If you are using Server Manager, right-click Routing and Remote Access, and then click Properties.

  3. On the General tab, select the IPv4 Router or IPv6 Router check boxes, and then under each one that you enable, do one of the following:

    • To enable only LAN routing without support for demand-dial connections, click Local area network (LAN) routing only.

    • To enable both LAN routing and WAN routing by using demand-dial connections, click LAN and demand-dial routing.

  4. Click OK to save your changes.

  5. If you are prompted to restart RRAS, click Yes. The service stops and automatically restarts.

Additional references

  • Configuring RRAS

  • Routing


Enable RRAS as a VPN Server

After you install the RRAS server role, it is initially in a disabled state. Use the first procedure to enable the service and to configure it to provide virtual private network (VPN) services.

If you have already installed and enabled RRAS and want to add the remote access feature, use the second procedure.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable RRAS and configure it as a VPN server

  1. Open the RRAS MMC Snap-in.

  2. Right-click the server name for which you want to enable routing, and then click Configure and Enable Routing and Remote Access. If you are using Server Manager, right-click Routing and Remote Access, and then click Configure and Enable Routing and Remote Access.

  3. On the Welcome page, click Next.

  4. On the Configuration page, click Remote Access (dial-up or VPN), and then click Next.

  5. On the Remote Access page, select VPN, and then click Next.

  6. On the VPN Connection page, select the network interface that is connected to the public Internet from which remote VPN clients will connect to this server.

  7. To configure packet filters that restrict network access through the specified public network adapter to only the ports required by VPN clients, select Enable security on the selected interface by setting up static packet filters. This option is different from firewall rules that you create by using Windows Firewall with Advanced Security.

    Important
    • If you intend to protect your RRAS server by using a firewall instead, do not select this option. We recommend that do not you use both RRAS packet filters and firewall rules at the same time.
    • If you enable this option, then by default you will not be able to ping the IP address of the public network adapter because Internet Control Message Protocol (ICMP) is not permitted by the packet filters created by this option.

  8. On the Network Selection page, select the private network to which remote VPN clients are to be granted access. The network adapter and its IP address are displayed to help you determine which to select.

  9. On the IP Address Assignment page, specify the way in which the RRAS server will acquire IP addresses for the remote VPN clients. If you have a DHCP server with a range of addresses available, click Automatic. If you want the RRAS server to manage the IP addresses itself, click From a specified range of addresses.

  10. Note

    If you selected Automatic in step 9, then skip step 10.

    On the Address Range Assignment page, click New, and then type starting and ending IP addresses to create the range from which remote VPN clients are assigned addresses. You can enter multiple ranges if required. Click Next when you have created the address ranges.

  11. On the Managing Multiple Remote Access Servers page, select whether you want to use a centralized RADIUS server for authentication of your network clients. If you select No, then RRAS uses its local account database or, if the RRAS server is joined to an Active Directory domain, the RRAS server uses the domain account database. To use Active Directory Domain Services (AD DS), you must join the RRAS server to a domain, and then add the computer account of this server to the RAS and IAS Servers security group in the domain of which this server is a member. The domain administrator can add the computer account to the RAS and IAS Servers security group by using Active Directory Users and Computers or by using the netsh ras add registeredserver command.

  12. On the Completing page, click Finish.
To configure an existing RRAS server to support VPN remote access

  1. Open Server Manager.

  2. Expand Roles, and then expand Network Policy and Access Services.

  3. Right-click Routing and Remote Access, and then click Properties.

  4. Select IPv4 Remote access Server or IPv6 Remote access server, or both.

    Note

    If you select IPv6 Remote access server, then you must also specify an IPv6 prefix. On the IPv6 tab, in This server assigns the following IPv6 prefix, type the 64-bit IPv6 prefix that the server is to assign to connected clients. The address assigned to a client is a combination of this prefix and a host identifier chosen by the client (typically either derived from the MAC address or randomly generated).

  5. When you are prompted to restart RRAS, click Yes.

Additional references

  • Configuring RRAS


Enable RRAS as a VPN Server and a NAT Router

After you install the RRAS server role, it is initially in a disabled state. Use the first procedure to enable the service and to configure it to provide virtual private network (VPN) and network address translation (NAT) services. If you have already installed and enabled RRAS, and want to add the VPN and NAT router features, use the second procedure. For more information, see Virtual Private Networking, and Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619).

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To enable RRAS and configure it as both a VPN server and a NAT router

  1. Open the RRAS MMC Snap-in.

  2. Right-click the server name for which you want to enable routing, and then click Configure and Enable Routing and Remote Access. If you are using Server Manager, right-click Routing and Remote Access, and then click Configure and Enable Routing and Remote Access.

  3. On the Welcome page, click Next.

  4. On the Configuration page, click Virtual Private Network (VPN) access and NAT, and then click Next.

  5. On the VPN Connection page, select the network interface that is connected to the public network from which remote VPN clients will connect to this server.

  6. On the IP Address Assignment page, specify the way in which the RRAS server will acquire Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) addresses for the remote VPN clients. If you have a DHCP server with a range of addresses available, click Automatic. If you want the RRAS server to manage the IP addresses itself, click From a specified range of addresses.

  7. Note

    If you selected Automatic in step 6, then skip step 7.

    On the Address Range Assignment page, click New, and then type starting and ending IP addresses to create the range from which remote VPN clients are assigned addresses. You can enter multiple ranges if required. Click Next when you have created the address ranges.

  8. On the Managing Multiple Remote Access Servers page, select whether you want to use a centralized RADIUS server to authenticate your network clients. If you select No, then RRAS uses its local account database or, if the RRAS server is joined to an Active Directory domain, the RRAS server uses the domain account database. To use Active Directory Domain Services (AD DS), you must join the RRAS server to the domain and add the computer account of this server to the RAS and IAS Servers security group in the domain of which this server is a member. The domain administrator can add the computer account to the RAS and IAS Servers security group by using Active Directory Users and Computers or by using the netsh ras add registeredserver command.

  9. On the Completing page, click Finish.
To configure an existing RRAS server to support both VPN remote access and NAT routing

  1. Open Server Manager.

  2. Expand Roles, and then expand Network Policy and Access Services.

  3. Right-click Routing and Remote Access, and then click Properties.

  4. Select IPv4 Remote access Server or IPv6 Remote access server, or both.

    Note

    If you select IPv6 Remote access server, you must also specify an IPv6 prefix. On the IPv6 tab, in This server assigns the following IPv6 prefix, type the 64-bit IPv6 prefix that the server is to assign to connected clients. The address assigned to a client is a combination of this prefix and a host identifier chosen by the client (typically either derived from the MAC address or randomly generated).

  5. When you are prompted to restart RRAS, click Yes.

    Important

    IPv6 does not support NAT. If your server is IPv6 only, then skip the steps in the rest of this procedure.

  6. After the RRAS service has been restarted, expand IPv4, right-click General, and then click New Routing Protocol.

  7. In Routing protocols, click NAT, and then click OK.

  8. Right-click NAT, and then click New Interface.

  9. Select the interface that connects to your private intranet, and then click OK.

  10. Select Private interface connected to private network, and then click OK.

  11. Right-click NAT, and then click New Interface again.

  12. Select the interface that connects to the public Internet, and then click OK.

  13. Select both Public interface connected to the Internet and Enable NAT on this interface, and then click OK.

For information about advance NAT configuration settings, see IPv4 - NAT - Interface - Properties Page - Address Pool Tab and IPv4 - NAT - Interface - Properties Page - Services and Ports Tab.

Additional references

  • Configuring RRAS


Remove RRAS from a Server

If you need to reconfigure your server for a different role, you can remove existing server roles. When you remove the remote access VPN server role, your server will no longer provide dial-up or VPN access for remote access clients. Remote users will not be able to connect to your private network, and the computers on your private network might not be able to connect to the Internet.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To remove the remote access VPN server role

  1. In Server Manager, under Roles Summary, click Remove roles.

  2. In the Remove Roles Wizard, advance to the Remove Server Roles page.

  3. Clear Network Policy and Access Services, and then click Next.

  4. On the Confirm Removal Selections page, click Remove, and then click Close.

  5. In the confirmation dialog box, click Yes to restart your computer.

Additional references

  • Configuring RRAS


View Information in RRAS

Every computer that runs TCP/IP makes routing decisions. These decisions are controlled by the IP routing table. The routing table is a series of entries that contain information about other IP networks and IP hosts.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To view the routing table

  1. In the RRAS MMC snap-in, expand IPv4 or IPv6.

  2. Right-click Static Routes, and then click Show IP Routing Table.

The following table shows the detail views that are available in RRAS by right-clicking a component in the navigation pane. The entries in the Views column show the information that can be displayed by clicking one of the entries in the menu that appears.

Component | Views
[IPv4 or IPv6]/General | TCP/IP information
 | Multicast forwarding table
 | Multicast statistics
[IPv4 or IPv6]/General/Interface | TCP/IP information
 | Address translations
 | IP addresses
 | IP routing table
 | TCP connections
 | UDP listener ports
[IPv4 or IPv6]/Static Routes | IP routing table
[IPv4 or IPv6]/RIP | Neighbors
IP Routing/NAT | DHCP Allocator information
 | DNS Proxy information
[IPv4 or IPv6]/NAT/Interface | Mappings
[IPv4 or IPv6]/IGMP | Group table
[IPv4 or IPv6]/IGMP/Interface | Interface group table

Additional references

  • Configuring RRAS


Troubleshooting RRAS

  • Troubleshooting Remote Access (http://go.microsoft.com/fwlink/?linkid=140769)

  • Troubleshooting Routing (http://go.microsoft.com/fwlink/?linkid=140770)

  • Using the Ping Command (http://go.microsoft.com/fwlink/?linkid=140771)

Additional references

  • Routing and Remote Access Service


Resources for RRAS

For more information about Routing and Remote Access, VPN, and network routing, see the following topics in the Windows Server Technical Library:

  • Step-by-step instructions for resolving RRAS server and client events is available from Routing and Remote Access Service Infrastructure (http://go.microsoft.com/fwlink/?LinkId=142239)

  • Routing and Remote Access Blog (http://go.microsoft.com/fwlink/?LinkId=141415)

  • Network Policy and Access Services (http://go.microsoft.com/fwlink/?LinkId=48552)


User Interface: RRAS

This section describes the user interface for components in the Routing and Remote Access service (RRAS).

  • RRAS Setup Wizard

  • Entries in the RRAS MMC Snap-in

  • Demand-Dial Interface Wizard

  • Other Dialog Boxes

Additional references

  • Routing and Remote Access Service


RRAS Setup Wizard

This section describes the pages in the Routing and Remote Access Setup Wizard.

To get to this wizard

  1. Open Server Manager. Click Start, click Administrative Tools, and then click Server Manager.

  2. If you have not yet installed RRAS, follow the procedure in Install RRAS.

  3. After RRAS is installed, right-click Routing and Remote Access, and then click Configure and Enable Routing and Remote Access.
  • RRAS Setup Wizard - Configuration Page

  • RRAS Setup Wizard - Remote Access

  • RRAS Setup Wizard - Remote Access - Dial-up - Network Selection

  • RRAS Setup Wizard - Remote Access - IP Address Assignment

  • RRAS Setup Wizard - Remote Access - Managing Multiple Remote Access Servers

  • RRAS Setup Wizard - Remote Access - VPN Connection Page

  • RRAS Setup Wizard - Custom Configuration

  • RRAS Setup Wizard - Address Range Assignment

  • RRAS Setup Wizard - NAT Internet Connection Page

  • RRAS Setup Wizard - Demand-Dial Connections Page

  • RRAS Setup Wizard - Closing Page

Additional references

  • User Interface: RRAS


RRAS Setup Wizard - Configuration Page

Use this page to select the primary service to be provided by your RRAS server. If you select one of the four predefined services, the wizard pages step you through the main configuration tasks for that service. Alternatively, you can select Custom configuration, and select from among all of the RRAS component services.

Additional references

  • RRAS Setup Wizard

  • Common Remote Access Scenarios


RRAS Setup Wizard - Remote Access

This page appears when you select Remote access (dial-up or VPN) on the Configuration page.

Use this page to specify the kind of remote access clients your RRAS server supports.

Additional references

  • RRAS Setup Wizard

  • Virtual Private Networking

  • Dial-Up Networking


RRAS Setup Wizard - Remote Access - Dial-up - Network Selection

This wizard page appears if you select Dial-up on the Remote Access wizard page.

Use this wizard page to specify the network to which dial-up network clients are logically connected. To provide dial-up clients access to your organization's intranet, you must have a network adapter installed and connected to your intranet. If you have multiple network adapters installed, select the network adapter that is connected to the network to which the server provides access.

Additional references

  • RRAS Setup Wizard - Remote Access

  • RRAS Setup Wizard


RRAS Setup Wizard - Remote Access - IP Address Assignment

Use this wizard page to configure the way in which the RRAS server provides IP addresses to virtual private network (VPN) and dial-up remote access clients.

Option | Description
Automatically | Select this option to specify that the RRAS server uses a DHCP server to assign Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) addresses to remote access VPN and dial-up network clients. To specify the DHCP servers that are used, you must enable and configure the DHCP Relay Agent. For more information, see IPv4 - DHCP Relay Agent or IPv6 - DHCPv6 Relay Agent. For more information about how RRAS and DHCP work together, see RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605).
From a specified range of addresses | Select this option to specify that the RRAS server provides an address from a static pool of addresses. You configure these addresses by using the Address Range Assignment wizard page.

Additional references

  • RRAS Setup Wizard


RRAS Setup Wizard - Remote Access - Managing Multiple Remote Access Servers

Use this wizard page to configure the source of authentication for RRAS.

  • If you select No, then the RRAS server performs its own authentication. The user credentials sent by users attempting connections are authenticated using typical Windows authentication mechanisms, and the connection attempt is authorized using the remote client’s user account properties and network policies. The remote access server must be joined to a domain to authenticate with Active Directory Domain Services (AD DS). Permissions for VPN and dial-up users are configured in Active Directory Users and Computers, on the Dial-in tab of the User Properties dialog box. By default, the Active Directory setting refers to Network Policy Server (NPS), but can be configured to allow or deny access to a user account.

  • If you select Yes, then Remote Authentication Dial-In User Service (RADIUS) performs authentication for the RRAS server. User credentials and parameters for the connection request are sent as RADIUS request messages to a RADIUS server. The RADIUS server receives a user-connection request from the RRAS server and authenticates and authorizes the connection attempt. The RADIUS server must be joined to a domain to authenticate with AD DS.

    If you have more than one remote access server, instead of administering the network policies of all the remote access servers separately, you can configure a single server with NPS as a RADIUS server and configure the remote access servers as RADIUS clients. The server running NPS provides centralized remote access authentication, authorization, accounting, and auditing.

Additional references

  • Network Policy Server (http://go.microsoft.com/fwlink/?linkid=139764)

  • RRAS Setup Wizard


RRAS Setup Wizard - Remote Access - VPN Connection Page

This page appears if you select VPN on the Remote Access page of the wizard.

Use this page to identify the interface that connects to the public network.

Dialog box element | Description
Network Interfaces | Select the interface that remote access clients will use to access the RRAS server. This is typically the interface connected to the public Internet.
Enable security on the selected interface by setting up static packet filters | If you select this check box, the Routing and Remote Access service is automatically configured with filters that allow only virtual private network (VPN) traffic into the selected network interface. To customize the static filters, see IPv4 - General - Interface - Properties Page - General Tab or IPv6 - General - Interface - Properties Page. For more information about static filters, see Configure Static Packet Filters (http://go.microsoft.com/fwlink/?linkid=140713).

Additional references

  • RRAS Setup Wizard


RRAS Setup Wizard - Custom Configuration

Use this wizard page to enable the individual components of RRAS that you want to use. This page appears if you select Custom Configuration on the Configuration page of the RRAS Setup Wizard.

Note

Selecting Custom Configuration and then selecting options on this page does not cause any additional wizard pages to appear. All of the selected RRAS components are installed, but must be configured manually after the installation of the RRAS server role.

Dialog box element | Description
VPN access | Select this option to configure the RRAS server to allow remote access clients to connect to the private network across the Internet.
Dial-up access | Select this option to configure the RRAS server to allow remote access clients to connect to the private network by dialing into a modem bank or other dial-up equipment.
Demand-dial connections (used for branch office routing) | Select this option to configure the RRAS server to initiate and receive demand-dial connections.
NAT | Select this option to configure the RRAS server to share an Internet connection with computers on the private network and to translate traffic between its public address and the private network.
LAN routing | Select this option to configure the RRAS server to forward network packets from one LAN network segment to another.

Additional references

  • RRAS Setup Wizard

  • RRAS Setup Wizard - Configuration Page

  • Common Remote Access Scenarios

  • Common Routing Scenarios

  • Virtual Private Networking

  • Dial-Up Networking

  • Routing

  • Demand-Dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)

  • Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619)


RRAS Setup Wizard - Address Range Assignment

Use this wizard page to configure static Internet Protocol version 4 (IPv4) address pools that are used to provide addresses to virtual private network (VPN) and dial-up remote access clients. Only IPv4 addresses can be configured this way. To configure Internet Protocol version 6 (IPv6) addresses, you must use DHCPv6.

  • To create a new range, click New, and then provide a starting and ending address, or a starting address and the number of desired addresses. If you specify the desired number of addresses, RRAS will calculate the ending address for you.

  • To modify an existing range, click Edit.

  • To remove a range from use, click Delete.

Additional references

  • RRAS Setup Wizard


RRAS Setup Wizard - NAT Internet Connection Page

This wizard page appears when you select Network Address Translation (NAT) on the Configuration page of the RRAS Setup Wizard.

Use this wizard page to configure the network interface that connects the RRAS server and its private networks to the Internet. The interface can be a physical network adapter or you can create a new demand-dial interface.

Option | Description
Use this public interface to connect to the Internet | Select this option to configure a physical network adapter as the public interface from the RRAS server to the Internet. Network address translation (NAT) translates addresses and ports from the private networks to the public addresses associated with this public connection. You can configure this option after installation by selecting Public interface connected to the Internet on the NAT tab of the IPv4-NAT-Interface-Properties page.
Create a new demand-dial interface to the Internet | Select this option to specify that a demand-dial interface is used to connect the RRAS server to the Internet. After the steps in this wizard are complete and RRAS is started, the Demand-Dial Interface Wizard is displayed.

Additional references

  • RRAS Setup Wizard

  • Configuration page

  • Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619)

  • Demand-Dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)


RRAS Setup Wizard - Demand-Dial Connections Page

This wizard page appears if you select Secure connection between two private networks on the Configuration page of the RRAS Setup Wizard.

When configuring RRAS to securely connect two private networks over a public network, use this wizard page to specify whether the interface to the public network from the local RRAS server is a demand-dial or physical network interface.

Option | Description
Yes | Select this option to specify that the RRAS server uses a demand-dial interface to connect to the remote network. After the steps in the RRAS Setup Wizard are complete, you must define a new demand-dial interface by using the Demand-Dial Interface Wizard.
No | Select this option to specify that the RRAS server does not use a demand-dial interface to connect to the remote network.

Additional references

  • RRAS Setup Wizard

  • Demand-Dial Interface Wizard


RRAS Setup Wizard - Closing Page

After an RRAS server is installed, you must specify the users from which the server can accept a remote access connection. Authorization is determined by the dial-in properties of the user account, network policies, or both. For more information, see Network Policy Server (http://go.microsoft.com/fwlink/?linkid=139764) and Permissions for Remote Access Users.

Additional references

  • RRAS Setup Wizard


Entries in the RRAS MMC Snap-in

These sections describe the user interface for the components in the RRAS MMC snap-in.

  • Routing and Remote Access Properties Page

  • Network Interfaces

  • Ports

  • Remote Access Clients

  • Remote Access Logging & Policies

  • IPv4

  • IPv6

Additional references

  • User Interface: RRAS


Routing and Remote Access Properties Page

Use the RRAS Server Properties page to configure the main operational settings for the Routing and Remote Access service (RRAS).

  • General tab

  • Security tab

  • IPv4 tab

  • IPv6 tab

  • IKEv2 tab

  • PPP tab

  • Logging tab

See Also

  • Entries in the RRAS MMC Snap-in


RRAS Server Properties Page - General Tab

Dialog box element | Description
IPv4 Router | Specifies whether this computer is enabled as a router. A router can forward network packets from one network segment to another.
Local area network (LAN) routing only | Specifies that this computer is a LAN-only router and does not require demand-dial or virtual private network (VPN) connections.
LAN and demand-dial routing | Specifies that this computer is a LAN and demand-dial router and supports VPN connections.
IPv6 Router | Specifies whether this computer is enabled as a router for Internet Protocol version 6 (IPv6) traffic. A router can forward network packets from one network segment to another.
Local area network (LAN) routing only | Specifies that this computer is a LAN-only router for IPv6 traffic and does not require demand-dial or VPN connections.
LAN and demand-dial routing | Specifies that this computer is a LAN and demand-dial router for IPv6 traffic and supports VPN connections.
IPv4 Remote access server | Specifies whether this computer is enabled as a remote access server, which supports either dial-up or VPN connections.
IPv6 Remote access server | Specifies whether this computer is enabled as a remote access server for IPv6 traffic, which supports either dial-up or VPN connections.

Additional references

  • Routing and Remote Access Properties Page


RRAS Server Properties Page - Security Tab

Dialog box element Description

Authentication provider

Lists the available authentication providers for remote access or demand-dial authentication.

  • Windows Authentication: The RRAS server uses either its local account database (if not a member of a domain) or an Active Directory domain account database to authenticate remote access or demand-dial connection credentials. The server logs connection authentication information in log files that are configured in the properties of the Remote Access Logging folder.

  • RADIUS Authentication: The RRAS server uses a Remote Authentication Dial-In User Service (RADIUS) server to authenticate remote access or demand-dial connection credentials.

Configure

Click to configure the selected authentication provider. In the RADIUS Authentication dialog box, use Add and Edit to display the Add RADIUS Server dialog box.

Authentication Methods

Click to configure the authentication methods for remote access and demand-dial connections by using the Authentication Methods dialog box.

Accounting provider

Lists the available accounting providers for remote access or demand-dial connections.

  • RADIUS Accounting: The server sends connection accounting information to a RADIUS server.

  • Windows Accounting: The server logs connection accounting information in log files that are configured in the properties of the Remote Access Logging folder.

Configure

Click to configure the selected accounting provider. In the RADIUS Accounting dialog box, use Add and Edit to display the Add RADIUS Server dialog box.

Allow custom IPsec policy for L2TP connection

Specifies whether a Layer Two Tunneling Protocol (L2TP) connection uses a custom Internet Protocol security (IPsec) policy. If you select this check box, you must specify a pre-shared key for use by all connections that use the custom IPsec policy.

Pre-shared Key

A pre-shared key for use with a custom IPsec policy. This pre-shared key must be configured on each client computer that will connect using this policy.

Use HTTP

Specifies that Secure Socket Tunneling Protocol (SSTP) uses the same certificate that the computer uses for HTTP. Selecting this option disables the certificate list.

Certificate

Specifies the certificate that SSTP uses to authenticate the server to virtual private network (VPN) clients. Click View to see details about the selected certificate.

Additional considerations

If Network Policy Server (NPS) is installed on this server, only Authentication Methods and Allow custom IPsec policy for L2TP connection will be displayed. You use NPS to configure authentication and accounting providers by creating or modifying authentication policies.

Additional references

  • Routing and Remote Access Properties Page

  • Dialog Box - Add RADIUS Authentication Server

  • Dialog Box - Authentication Methods


RRAS Server Properties Page - IPv4 Tab

Dialog box element | Description
Enable IPv4 Forwarding | Specifies whether this server can route Internet Protocol version 4 (IPv4) packets from one routing interface to another. You must enable IP routing in order for local area network (LAN) and demand-dial routing to occur. If you want IP-based remote access clients to access the entire network to which this server is attached, enable IP routing. If you want IP-based remote access clients to access this server only, you can disable IP routing.
Dynamic Host Configuration Protocol (DHCP) | Specifies that the server uses DHCP to obtain IP addresses for remote access and demand-dial connections.
Static address pool | Specifies that the server uses a configured static pool of IP addresses for allocation to TCP/IP-based remote access and demand-dial connections. Configure the addresses that make up the pool by using Add, Edit, and Remove.
Enable broadcast name resolution | Enables or disables the broadcast name resolution service. When enabled, this service allows remote access clients to resolve TCP/IP names on a single subnet LAN without the use of local Windows Internet Name Service (WINS) or Domain Name System (DNS) servers.
Adapter | Lists the available adapters. The selected adapter is used to obtain the IP addresses for allocation (if configured to use DHCP) and the IP addresses of DNS and WINS servers for assignment to remote access clients and demand-dial routers. By default, Allow RAS to select adapter is selected, which means that the server randomly selects an adapter when RRAS is started.

Additional references

  • Routing and Remote Access Properties Page


RRAS Server Properties Page - IPv6 Tab

Dialog box element | Description
Enable IPv6 Forwarding | Specifies whether this RRAS server routes Internet Protocol version 6 (IPv6) packets from one routing interface to another. You must enable IP routing in order for local area network (LAN) and demand-dial routing to occur. If you want IP-based remote access clients to access the entire network to which this server is attached, enable IP routing. If you want IP-based remote access clients to access this server only, you can disable IP routing.
Enable Default Route Advertisement | Specifies whether a default route is advertised on this server. A default route is a route for the zero-length prefix.
IPv6 prefix assignment | Type the IPv6 prefix that will be assigned to all remote access clients (for example, 2001:1234:5678:9ABC::).
Adapter | Lists the available adapters. The selected adapter is used to obtain the IP addresses for allocation (if configured to use DHCP) and the IP addresses of DNS and WINS servers for assignment to remote access clients and demand-dial routers. By default, Allow RAS to select adapter is selected, which means that the server randomly selects an adapter when RRAS is started.

Additional references

  • Routing and Remote Access Properties Page


RRAS Server Properties Page - IKEv2 Tab

Dialog box element | Description
Idle time-out (minutes) | Specifies the maximum amount of time, in minutes, that an Internet Key Exchange version 2 (IKEv2) client connection can be idle before it is terminated. The default value is 5 minutes.
Network outage time (minutes) | Specifies the maximum amount of time, in minutes, that IKEv2 packets are retransmitted without a response before the connection is considered lost. Higher values support connection persistence through network outages. The default value is 30 minutes.
SA expiration time (minutes) | Specifies the time, in minutes, after which a security association (SA) expires for IKEv2 client connections. An SA expires within the SA expiration time (minutes) or when the SA data size limit (MB) is reached, whichever occurs first. When the SA expires, a new quick mode negotiation must succeed before the two computers can continue to exchange data. The default value is 480 minutes.
SA data size limit (MB) | Specifies the maximum amount of network traffic that can be sent through an SA for an IKEv2 client connection. An SA expires within the SA expiration time (minutes) or when the SA data size limit (MB) is reached, whichever occurs first. When the SA expires, a new quick mode negotiation must succeed before the two computers can continue to exchange data. The default value is 100 megabytes (MB).

Additional references

  • Routing and Remote Access Properties Page


RRAS Server Properties Page - PPP Tab

Dialog box element | Description
Multilink connections | Specifies whether the server uses the Point-to-Point Protocol/Multilink Protocol (PPP/MP), which allows remote access clients and demand-dial routers to combine multiple physical connections into a single logical connection.
Dynamic bandwidth control using BAP or BACP | Specifies whether the server uses the Bandwidth Allocation Protocol (BAP) and Bandwidth Allocation Control Protocol (BACP) to negotiate the dynamic addition or deletion of multiple physical connections for remote access clients and demand-dial routers.
Link control protocol (LCP) extensions | Specifies whether the server uses Link Control Protocol (LCP) extensions. Clearing this check box prevents LCP from sending Time-Remaining and Identification packets and requesting callback during LCP negotiation.
Software compression | Specifies whether the server uses the Microsoft Point-to-Point Compression Protocol (MPPC) to compress data sent on the remote access or demand-dial connection.

Additional references

  • Routing and Remote Access Properties Page


RRAS Server Properties Page - Logging Tab

Dialog box element | Description
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log all events | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Do not log any events | Specifies that no events are logged in the System Log in Event Viewer.
Log additional Routing and Remote Access information | Specifies whether the events in the Point-to-Point Protocol (PPP) connection establishment process for remote access and demand-dial routing connections are written to the PPP.LOG file stored in the systemroot\Tracing folder (the default location).

Additional references

  • Routing and Remote Access Properties Page

  • Troubleshooting RRAS


Network Interfaces

Network interfaces enable an RRAS server to communicate with other computers over private or public networks. The physical hardware, such as a network adapter, and the network interface configuration are of particular interest when configuring RRAS.

In RRAS, network interfaces are categorized as follows:

  • Private interface. A private interface is a network adapter that is physically connected to a private network. Most private networks are configured with a private network IP address range, and the private interface is also configured with a private address. Because a private network is, in theory, composed of known users and computers, you generally have fewer security considerations for a private interface than for a public interface.

  • Public interface. A public interface is a network adapter that is physically connected to a public network, such as the Internet. The public interface is configured with a public IP address. You can configure a public interface to perform network address translation (NAT). Because a public interface is theoretically accessible to anyone on the public network, security considerations are generally higher for a public interface than for a private interface.

  • Demand-dial interface. Demand-dial interfaces connect specified routers on either public or private networks. A demand-dial interface can be either on-demand (activated only when needed) or persistent (always connected).

When you select Network Interfaces, the details pane displays the currently detected and installed interfaces.

  • The RRAS server detects physical network adapters automatically when you run the RRAS Setup Wizard. If you install an additional network adapter after the wizard has been run, you can add and configure the interface using the RRAS MMC snap-in.

  • To create a new demand-dial interface, right-click Network Interfaces, click New Demand-dial Interface, and then follow the steps in the Demand-Dial Interface Wizard.

Interfaces for physical network adapters cannot be configured in this window.

To configure a demand-dial interface, right-click the interface, click Properties, and then configure the settings on the Demand-Dial Properties page.

You can also configure packet filters for demand-dial interfaces. Right-click the interface, and then click either Set IP Demand-dial Filters or Set IPv6 Demand-dial Filters.

Additional references

  • Entries in the RRAS MMC Snap-in

  • Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619)

  • Demand-Dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)

  • Demand-Dial Interface Wizard

  • Demand-dial Interface - Properties Page

  • Network Interfaces - Demand-dial - Set IP Demand-dial Filters

  • Network Interfaces - Demand-dial - Set IPv6 Demand-dial Filters

  • Configure Static Packet Filters (http://go.microsoft.com/fwlink/?linkid=140713)


Demand-dial Interface - Properties Page

Use the Demand-dial Interface Properties page to configure the settings for an existing demand-dial interface. To open the Demand-dial Interface Properties page, click Network Interfaces, in the details pane, right-click the interface, and then click Properties.

  • General tab

  • Options tab

  • Security tab

  • Networking tab

Additional references

  • Network Interfaces


Network Interfaces - Demand-dial - Properties Page - General Tab

Dialog box element | Description
Host name or IP address of destination (for VPN type) | Type the address or name of the computer you are tunneling to. If you enter an Internet Protocol version 4 (IPv4) address, VPN over IPv4 is selected. If you enter an Internet Protocol version 6 (IPv6) address, VPN over IPv6 is selected.
Service (for PPPoE type) | Type the service name provided by your Point-to-Point Protocol over Ethernet (PPPoE) Internet service provider.

Additional references

  • Demand-dial Interface - Properties Page


Network Interfaces - Demand-dial - Properties Page - Options Tab

Dialog box element | Description
Demand dial | Specifies that an idle time disconnect setting is used for nonpermanent dial-up connections.
Idle time before hanging up | Lists the available time periods for the idle time setting. The remote router that is called also has an idle time setting, which may be shorter than the setting here. In that case, the remote router will disconnect an idle connection before the time you set here.
Persistent connection | Specifies that the demand-dial connection is always in a connected state. The connection is established when RRAS is started and is never disconnected by the calling router.
Redial attempts | Type the number of times to automatically redial the phone number. You can also click the arrows to select the number of redial attempts.
Average redial intervals | Lists the available time periods to wait between redial attempts.
Callback | Click to configure callback settings.
PPP settings | Click to configure settings for Point-to-Point Protocol (PPP) connections.

Additional references

  • Demand-dial Interface - Properties Page


Network Interfaces - Demand-dial - Properties Page - Security Tab

Dialog box element Description

Type of VPN

Lists the available remote access server types you can call. Choices vary, depending on the type of connection.

If a host name or Internet Protocol version 4 (IPv4) address is entered in the General tab, the type of VPN allowed is: Automatic, PPTP, or L2TP/IPsec.

If an Internet Protocol version 6 (IPv6) address is entered in the General tab, the type of VPN allowed is: Automatic or L2TP/IPsec.

If you are not sure which type to select, click Automatic. Point-to-Point Tunneling Protocol (PPTP) is attempted first, and then Layer Two Tunneling Protocl (L2TP). If you know the type of VPN server to which you are trying to connect, then select the appropriate server type.

In order to connect to an L2TP server, the Trusted Root Certification Authorities certificate store on your computer must contain the certificate of the root authority for the certification authority (CA) that issued your computer certificate and the certificate for the L2TP server.

If you select Automatic or Layer 2 Tunneling Protocol with IPsec (L2TP/IPsec), then you can specify the IPsec authentication settings by clicking Advanced Settings.

Data encryption

Specifies whether the connection requires the use of data encryption. You can specify that encryption is not used, that encryption is optional, that encryption is required, or that maximum strength encryption is required.

Authentication

Specifies the authentication methods that are used to establish the VPN. You can select one of the following options:

  • Use Extensible Authentication Protocol (EAP). EAP supports smart cards or computer certificates. The currently installed authentication types are displayed in the list. If the EAP type you need is not on the list, then you must install it. To configure EAP, click Properties.

  • Allow these protocols. You can select any of the following authentication options:

    • Unencrypted password (PAP). Password Authentication Protocol (PAP) uses plaintext passwords and is the least secure authentication protocol.

      Security Note

      Because PAP sends passwords over the network in plaintext, we recommend that you use this option only if another option cannot be used.

    • Challenge Handshake Authentication Protocol (CHAP). CHAP negotiates a secure form of encrypted authentication. CHAP uses challenge-response with one-way Message-Digest algorithm 5 (MD5) hashing on the response. In this way, you can prove to the server that you know your password without actually sending the password over the network.

    • Microsoft CHAP Version 2 (MS-CHAP v2). MS-CHAP-V2 provides mutual authentication, stronger initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAP v2 drops support for the MS-CHAP password change and does not transmit the encoded password.

      For VPN connections, MS-CHAP v2 is offered before MS-CHAP. Windows client computers accept MS-CHAP v2 when it is offered. Dial-up connections are not affected.

Additional references

  • Demand-dial Interface - Properties Page


Network Interfaces - Demand-dial - Properties Page - Networking Tab

Dialog box element Description

This connection uses the following items

Lists the available network components that your connection can use. Network components are the clients, services, and protocols you use to communicate with servers on your network after you are connected to a server.

To enable the use of a network component, select the check box next to the name of the component. To disable the use of a network component, clear the check box next to the name of the component.

More than one network protocol may be listed.

Additional references

  • Demand-dial Interface - Properties Page


Network Interfaces - Demand-dial - Set IP Demand-dial Filters

Dialog box element Description

Only for the following traffic

Specifies that a demand-dial connection is initiated only when IP packets forwarded over this demand-dial interface match one of the listed filters. When the demand-dial interface is in a disconnected state, all packets forwarded to the demand-dial interface are compared to the filters listed. If a packet matches any of the filters, the demand-dial connection is initiated and the packet is forwarded across the demand-dial connection. If the packet does not match any of the filters, the demand-dial connection is not initiated and the packet is discarded.

This option applies to all the filters that you have added. You cannot change this option for individual filters.

You can select this option only after you have added at least one filter.

For all traffic except

Specifies that a demand-dial connection is not initiated for IP packets forwarded to this demand-dial interface if the packets match any of the filters listed. When the demand-dial interface is in a disconnected state, all packets forwarded by using the demand-dial interface are compared to the filters listed. If the packet matches any of the filters, the demand-dial connection is not initiated and the packet is discarded. If a packet does not match any filter, the demand-dial connection is initiated and the packet is forwarded across the demand-dial connection.

This option applies to all the filters that you have added. You cannot change this option for individual filters.

You can only configure this option after you have added at least one filter.

New

Click to add a filter. You can set a filter based on where the packet is coming from (the source), where the packet is going (the destination), or which protocol the packet is using. You can set all three of these values for a filter or set any combination of the three, depending on the level of control that you want. For more information, see Add or Edit IP Filter.

Edit

Click to modify the settings for a selected filter. For more information, see Add or Edit IP Filter.

Delete

Removes a selected filter from the list.

Add or Edit IP Filter

Dialog box element | Description
Source network | Specifies whether the filter checks the network address from which the packet is coming. After selecting this check box, you must specify a network IP address and subnet mask.
Destination network | Specifies whether the filter checks the network address to which the packet is going. After selecting this check box, you must specify a network address and subnet mask.
IP address | Specifies the IP address of the network from which the packet was sent or to which the packet is going. You must also specify a subnet mask.
Subnet mask | Specifies the subnet mask that corresponds to the network IP address.
Protocol | Lists the available protocol types that you can base a filter on. The default is Any protocol. If you select Other, you must type a protocol identifier in Protocol number.
Source port | For TCP, TCP (established), and UDP protocols, provides a space for you to type the port number specified by the source to be used by the filter. Some applications use well-known ports to send and receive packets. You can set a filter for one of these ports if you know which numbers the application uses for the protocol specified in Protocol. For example, you can try to block FTP traffic or allow only PPTP traffic.
Destination port | For TCP, TCP (established), and UDP protocols, type the port number used by the destination for the packet.
ICMP type | Specifies the ICMP type.
ICMP code | Specifies the ICMP code.
Protocol number | Specifies the IP protocol number.

Additional references

  • Network Interfaces


Network Interfaces - Demand-dial - Set IPv6 Demand-dial Filters

Dialog box element Description

Only for the following traffic

Specifies that a demand-dial connection is initiated only when IP packets forwarded to this demand-dial interface match one of the listed filters. When the demand-dial interface is in a disconnected state, all packets forwarded to the demand-dial interface are compared to the listed filters. If a packet matches any of the filters, the demand-dial connection is initiated and the packet is forwarded across the demand-dial connection. If the packet does not match any of the filters, the demand-dial connection is not initiated and the packet is discarded.

This option applies to all the filters that you have added. You cannot change this option for individual filters.

You can only configure this option after you have added at least one filter.

For all traffic except

Specifies that a demand-dial connection is not initiated for IP packets forwarded to this demand-dial interface that match one of the listed filters. When the demand-dial interface is in a disconnected state, all packets forwarded to the demand-dial interface are compared to the listed filters. If the packet matches any of the filters, the demand-dial connection is not initiated and the packet is discarded. If a packet does not match any of the filters, the demand-dial connection is initiated and the packet is forwarded across the demand-dial connection.

This option applies to all the filters that you have added. You cannot change this option for individual filters.

You can only configure this option after you have added at least one filter.

New

Click to add a filter. You can set filters based on where the packet is coming from (the source), where the packet is going (the destination), or which protocol the packet is using. You can set all three of these values for a filter or set any one or combination of the three, depending on the level of control that you want. For more information, see Add or Edit IPv6 Filter.

Edit

Click to modify the settings for a selected filter. For more information, see Add or Edit IPv6 Filter.

Delete

Removes a selected filter from the list.

Add or Edit IPv6 Filter

Dialog box element | Description
Source network | Specifies whether the filter checks the network address from which the packet is coming. After selecting this check box, you must specify an Internet Protocol version 6 (IPv6) network address and prefix length.
Destination network | Specifies whether the filter checks the network to which the packet is going. After selecting this check box, you must specify an IPv6 network address and prefix length.
IPv6 address | Type the IPv6 address of the network from which the packet was sent or to which the packet is going.
Prefix length | Type the prefix length. The prefix is the part of the address that indicates the network identifier and is typically 64.
Protocol | Lists the available protocol types that you can base a filter on. The default is Any protocol. If you select Other, you must type a protocol identifier in Protocol number.
Source port | For TCP, TCP (established), and UDP, type the port number specified by the source to be used by the filter. Some applications use well-known ports to send and receive packets. You can set a filter for one of these ports if you know which numbers the application uses for the protocol specified in Protocol. For example, you can try to block FTP traffic or allow only PPTP traffic.
Destination port | For TCP, TCP (established), and UDP, type the port number used by the destination for the packet.
ICMP type | For ICMP, type the ICMP type.
ICMP code | For ICMP, type the ICMP code.
Protocol number | For the Other protocol, type the IP protocol number.

Additional references

  • Network Interfaces


Ports

An RRAS server views the installed networking equipment as a series of devices and ports. Ports displays the currently installed ports, the device to which each is associated, and status.

  • Device

    A device is the hardware or software that provides ports that remote access connections can use to establish point-to-point connections. Devices are physical, such as a modem, or virtual, such as virtual private network (VPN) protocols. Devices can support a single port, such as a modem, or multiple ports, such as modem bank hardware that can terminate 64 different incoming analog phone calls. Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) are examples of virtual multiport devices. These tunneling protocols support multiple VPN connections.

    To see the installed devices, you can view the properties of Ports in the RRAS MMC snap-in.

  • Port

    A port is a channel of a device that can support a single point-to-point connection. For single-port devices such as modems, the device and the port are indistinguishable. For multiport devices, the port is the subdivision of the device over which a separate point-to-point connection is possible. For example, Primary Rate Interface (PRI) ISDN adapters support two separate channels called B channels. The ISDN adapter is a device. Each B channel is a port because a separate point-to-point connection can occur over each B channel.

    You can view the dial-up ports by clicking Ports in the RRAS MMC snap-in.

To see detailed status information for a port, double-click it in Ports, or right-click the port and then click Status. The Port Status dialog box is displayed.

You can configure the number of available ports for devices that support multiple ports.

To configure the number of ports for a device

  1. In the RRAS MMC snap-in, right-click Ports, and then click Properties.

  2. In the Ports Properties dialog box, select the device whose ports you want to manage, and then click Configure.

  3. Configure the ports for the device by using the Configure Device dialog box.

Additional references

  • Entries in the RRAS MMC Snap-in

  • Dialog Box - Port Status


Remote Access Clients

Use Remote Access Clients to view the currently active sessions from remote clients to your RRAS server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete these procedures.

To view connected remote access clients

  • In Remote Access Clients, right-click a user name, and then click Status.
To disconnect a remote access client

  • In Remote Access Clients, right-click a user name, and then click Disconnect.

You can view additional details about the clients by adding columns to the view. To do so, click View, and then click Add/Remove Columns.

Additional references

  • Entries in the RRAS MMC Snap-in


Remote Access Logging & Policies

Remote Access logging and policy configuration is now performed by using Network Policy Server (NPS). For more information, see Network Policy Server (http://go.microsoft.com/fwlink/?linkid=139764).

Additional references

  • Entries in the RRAS MMC Snap-in


IPv4

This displays the components that are enabled for Internet Protocol version 4 (IPv4). The entries that appear here depend on the choices that were made when RRAS was enabled and configured.

You can add other IPv4 routing protocols by right-clicking General, and then clicking New Routing Protocol.

  • IPv4 - General

  • IPv4 - Static Routes

  • IPv4 - DHCP Relay Agent

  • IPv4 - IGMP

  • IPv4 - NAT

  • IPv4 - RIP

See Also

  • Entries in the RRAS MMC Snap-in


IPv4 - General

RRAS uses a routing interface to forward unicast and multicast IP packets. There are two types of routing interfaces. Each available interface is displayed in the General pane, along with its type, assigned IP address, the amount of network traffic through it, and status information. To add an interface that is not currently listed, right-click General, and then click New Interface.

  • LAN interfaces. A LAN interface is a physical interface that typically represents a local area connection that uses local area networking technology such as Ethernet or token ring. A LAN interface reflects an installed network adapter. An installed WAN adapter is sometimes represented as a LAN interface. For example, some Frame Relay adapters create a separate logical LAN interface for each configured virtual circuit. LAN interfaces are always active and typically do not require an authentication process to become active.

  • Demand-dial interfaces. A demand-dial interface is a logical interface that represents a point-to-point connection. The point-to-point connection is based on either a physical connection, such as two routers connected over an analog phone line that uses modems, or a logical connection, such as two routers connected over a virtual private network (VPN) connection that uses the Internet. Demand-dial connections are either on-demand (the point-to-point connection is only established when needed) or persistent (the point-to-point connection is established and then remains in a connected state). Demand-dial interfaces typically require an authentication process to become connected. The equipment required by a demand-dial interface is a port on a device.

To configure server-wide Internet Protocol version 4 (IPv4) properties, under IPv4, right-click General, and then click Properties to display the IPv4 – General - Properties page.

To configure IPv4 properties for an individual interface, under IPv4, click General. In the details pane, right-click the interface you want to configure, and then click Properties to display the IPv4 – General – Interface – Properties page.

Additional references

  • IPv4

  • IPv4 - General - Properties Page

  • IPv4 - General - Interface - Properties Page


IPv4 - General - Properties Page

Use the IPv4 General Properties page to configure server-wide settings for Internet Protocol version 4 (IPv4).

  • Logging tab

  • Preference Levels tab

  • Multicast Scopes tab

Additional references

  • IPv4 - General


IPv4 - General - Properties Page - Logging Tab

Use this tab to configure the amount of detail that Internet Protocol version 4 (IPv4) includes in RRAS events that are written to the System Log in Event Viewer.

Dialog box element | Description
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log all events | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Disable event logging | Specifies that no events are logged in the System Log in Event Viewer.

Additional references

  • IPv4 - General - Properties Page

  • Troubleshooting RRAS


IPv4 - General - Properties Page - Preference Levels Tab

Use this tab to configure ranks for various route sources. Routes that come from sources with lower rank scores are preferred over routes that come from sources with higher rank scores.

Dialog box element | Description
Route Source | Lists the preference level of the route sources. If two routes exist to the same destination, the route learned by the route source with a lower rank score is preferred regardless of the route metric.
Move Up | Increases the rank score for a selected route source, which lowers its preference.
Move Down | Decreases the rank score for a selected route source, which raises its preference.

Additional references

  • IPv4 - General - Properties Page


IPv4 - General - Properties Page - Multicast Scopes Tab

Use this tab to view and configure scopes of multicast addresses.

Dialog box element | Description
Scope Name | Lists the configured multicast scopes. A multicast scope is a named range of IP multicast addresses that is expressed with an IP address and mask. After multicast scopes are configured, you can use them to create scope-based multicast boundaries in the properties of an IP routing interface.

Add Scoped Boundary

Dialog box element | Description
Scope name | The name of the scope to use when configuring multicast boundaries. A scope is a range of multicast IP addresses.
IP address | The IP address for the administrative multicast scope (in dotted decimal notation). Valid administrative, nonlocal, multicast scopes must be in the range 239.0.0.0 through 239.254.255.255.
Mask | The mask for the scope (in dotted decimal notation).

Additional references

  • IPv4 - General - Properties Page

  • IPv4 Multicasting (http://go.microsoft.com/fwlink/?linkid=140717)


IPv4 - General - Interface - Properties Page

Use this page to configure Internet Protocol version 4 (IPv4) settings for an individual interface.

  • General tab

  • Multicast Boundaries tab

  • Multicast Heartbeat tab

Additional references

  • IPv4 - General


IPv4 - General - Interface - Properties Page - General Tab

Use this tab to configure Internet Protocol version 4 (IPv4) settings for an individual interface.

Dialog box element | Description
Enable IP router manager | Specifies whether TCP/IP is enabled on this interface. Select this check box to set the Administrative Status of the interface to Up. Clear this check box to set the Administrative Status of the interface to Down.
Enable router discovery advertisements | Specifies whether Internet Control Message Protocol (ICMP) router discovery advertisements are enabled over this interface. Router discovery clients use these messages to dynamically configure their default gateways. Router discovery is implemented by using multicast ICMP router advertisement messages.
Advertisement lifetime (minutes) | The number of minutes that a router discovery advertisement from this router and this interface is valid. The default is 30 minutes.
Level of preference | The preference level of using this interface as the default gateway. A higher number means that this gateway is more preferred by router discovery clients as the default gateway.
Minimum time (minutes) | The minimum number of minutes between router discovery advertisement packets. The default is 7 minutes. The router advertisement is sent at a random interval between the minimum time and the maximum time.
Maximum time (minutes) | The maximum number of minutes between router discovery advertisement packets. The default is 10 minutes. The router advertisement is sent at a random interval between the minimum time and the maximum time.
Enable fragmentation checking | Specifies whether the router discards all fragmented IP packets that do not correspond with traffic allowed by the filters configured for this interface.
Inbound Filters and Outbound Filters | Click to configure filters for inbound or outbound network traffic by using the Inbound and Outbound Filters dialog box.

Additional references

  • IPv4 - General - Interface - Properties Page


IPv4 - General - Interface - Properties Page - Multicast Boundaries Tab

Use this tab to limit the range of a multicast scope by specifying a Time-to-Live (TTL) limit or a rate limit for traffic sent to the scope.

Dialog box element | Description
Scope | Lists the available multicast scopes that are configured on the Multicast Scopes tab on the IP Routing/General properties page. A multicast scope is a named range of IP multicast addresses that is defined by an IP address and mask.
Scope Name | Lists the scopes for the multicast traffic that will not be forwarded out this interface.
Activate TTL boundary | Specifies whether the router performs TTL scoping to prevent the forwarding of IP multicast traffic out this interface with a TTL less than a specified value. TTL scoping applies to all multicast packets regardless of the multicast group.
TTL value | The maximum TTL for multicast traffic that is forwarded out this interface.
Rate limit (KBps) | The maximum rate (in kilobytes per second) for all multicast traffic forwarded by this interface.

Additional references

  • IPv4 - General - Interface - Properties Page

  • IPv4 Multicasting (http://go.microsoft.com/fwlink/?linkid=140717)


IPv4 - General - Interface - Properties Page - Multicast Heartbeat Tab

Use this tab to enable the interface to listen for multicast heartbeat network packets for a specified multicast group.

Dialog box element | Description
Enable multicast heartbeat detection | Specifies whether the router listens for a regular multicast notification that is sent to a configured IP multicast group address to verify that IP multicast connectivity is available on the network. Multicast heartbeat listens for a periodic multicast announcement to a specified group address. If the announcement is not received by the quiet time, the router sets the multicast heartbeat status on the configured interface to inactive. The multicast heartbeat status for the interface can be polled by a program to provide notification that the multicast heartbeat is no longer present.
Multicast heartbeat group | The IP address (in dotted decimal notation) of the multicast group.
Quiet time before alerting (minutes) | The number of minutes the router waits before setting the multicast heartbeat status on the interface to inactive.

Additional references

  • IPv4 - General - Interface - Properties Page

  • IPv4 Multicasting (http://go.microsoft.com/fwlink/?linkid=140717)


IPv4 - Static Routes

A static routed Internet Protocol version 4 (IPv4) network does not use routing protocols such as Routing Information Protocol (RIP) for IP to communicate routing information between routers. All of the routing information is stored in a static routing table on each router. You need to ensure that each router has the appropriate routes in its routing table so that traffic can be exchanged between any two endpoints on the IP network.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To create a new static route

  1. In the RRAS MMC snap-in, expand IPv4, right-click Static Routes, and then click New Static Route.

  2. Use the IPv4 Static Route dialog box to configure the route.

  3. To edit the route after you create it, right-click the route, and then click Properties. Use the IPv4 Static Route dialog box to make the changes to the route.
To view the currently defined static routes

  1. In the RRAS MMC snap-in, expand IPv4, and then click Static Routes.

  2. The details pane shows the following information about the currently defined routes:

    • Destination – the IP address of the network or host to which the route points.

    • Network mask – the mask for the destination IP address.

    • Gateway – the IP address of the next hop toward the destination.

    • Interface – the interface on the local router on which the gateway can be reached and on which the forwarded packet is sent.

    • Metric – a measure of the cost of using the route. When multiple routes that can reach a destination exist, the route with the lowest metric is selected.

Additional references

  • IPv4

  • Static Routing (http://go.microsoft.com/fwlink/?linkid=140617)

  • IPv4 - Static Routes - New IPv4 Static Route


IPv4 - Static Routes - New IPv4 Static Route

Use this dialog box to configure a static route to an Internet Protocol version 4 (IPv4) network.

Dialog box element | Description
Interface | Lists the available local area network (LAN) or demand-dial interfaces. Select the one to be used to forward the IP packet if this route is selected.
Destination | Type the destination for the route. The destination can be a host address, subnet address, network address, or the destination for the default route (0.0.0.0).
Network mask | Type the network mask for the static route. A mask of 255.255.255.255 means that only an exact match of the destination number can use this route. A mask of 0.0.0.0 means that any destination can use this route.
Gateway | Type the forwarding IPv4 address for the next hop for this route. For LAN interfaces, the gateway address must be configured and must be a directly reachable IP address for the network segment of the selected interface. For demand-dial interfaces, the gateway address is not configured or used.
Metric | Type the metric, which is the cost associated with this route to reach the destination. The metric is commonly used to indicate the number of routers (hops) to the destination. When deciding between multiple routes to the same destination, the route with the lowest metric is selected as the best route.
Use this route to initiate demand-dial connections | Select this option to specify that the router initiates a demand-dial connection when this route is selected for packets being forwarded. This check box is only available when a demand-dial interface is selected in Interface.

Additional references

  • IPv4 - Static Routes

  • Routing

  • Static Routing (http://go.microsoft.com/fwlink/?linkid=140617)


IPv4 - DHCP Relay Agent

DHCP relay agents listen for the DHCP messages that are broadcast on the local subnet and route them to a DHCP server on a different subnet. Because broadcast packets do not typically traverse routers, without a DHCP relay agent you would need to install a DHCP server on every network subnet on which DHCP clients reside. DHCP relay allows you to consolidate your DHCP servers into the much smaller number that you need for load balancing and fault tolerance.

For more information, see Configure the IPv4 DHCP Relay Agent.

  • IPv4 - DHCP Relay Agent - Properties Page

  • IPv4 - DHCP Relay Agent - Interface - Properties Page

Additional references

  • IPv4

  • RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605)


IPv4 - DHCP Relay Agent - Properties Page

Use this dialog box to configure the IP addresses of the DHCP servers to which you want the RRAS DHCP relay agent to forward DHCP requests.

Dialog box element Description

Server address

The IP address of the DHCP server you want to add.

Server address list

Lists the IP addresses of DHCP servers on the network to which you want to forward DHCP requests from clients. The router acts as a DHCP relay agent by relaying DHCP messages between DHCP clients and the DHCP servers specified in this list. You must add at least one address to be a relay agent.

For the DHCP relay agent to work, you must select the Relay DHCP packets check box on at least one interface that has been added to the DHCP Relay Agent routing protocol.

Additional references

  • IPv4 - DHCP Relay Agent


IPv4 - DHCP Relay Agent - Interface - Properties Page

Use this dialog box to configure DHCP relay agent options for a specified interface.

Dialog box element Description

Relay DHCP packets

Specifies whether DHCP messages are relayed from DHCP clients on the subnet to which this interface is attached.

After you select this check box, you must configure at least one DHCP server address in DHCP Relay Agent Properties. To open that dialog box, right-click DHCP Relay Agent, and then click Properties.

Hop-count threshold

The maximum number of DHCP relay agents that will handle DHCP relayed traffic. You can also click the arrows to select a new setting. The default value is 4 hops. The maximum value is 16 hops.

Boot threshold (seconds)

The number of seconds the relay agent waits before forwarding DHCP messages. You can also click the arrows to select a new setting. The default value is 4 seconds.

This option is useful when you want a local DHCP server to respond first, but if the local DHCP server does not respond, you want to forward messages to a remote DHCP server.

Additional references

  • IPv4 - DHCP Relay Agent

  • DHCP Relay Agent – Properties Page


IPv4 - IGMP

Internet Group Management Protocol (IGMP) is a protocol used to manage host membership in Internet Protocol version 4 (IPv4) multicast groups on a network segment. An IPv4 multicast group is a set of hosts that listen for IP traffic destined for a specified IP multicast address. IP multicast traffic is sent to a single MAC address but processed by multiple IP hosts. A host listens on a specified IP multicast address and receives all packets to that IP address.

The information that appears under IGMP in the RRAS MMC snap-in is the list of interfaces that are currently listening for IGMP messages from hosts on the attached subnet.

  • To configure an interface with IGMP to listen for IGMP messages from hosts on the attached subnet, right-click IGMP, and then click New Interface. Select the interface on which you want to listen for IGMP messages, and then click OK.

  • To configure the amount of information logged by IGMP, right-click IGMP, and then click Properties to display the IGMP Properties page.

  • To configure the way IGMP is configured on an interface, click IGMP, right-click the interface that you want to configure, and then click Properties to display the IGMP Interface Properties page.

  • IGMP Properties page

  • IGMP Interface Properties Page

Additional references

  • IPv4

  • Internet Group Management Protocol (IGMP) (http://go.microsoft.com/fwlink/?linkid=140814)


IPv4 - IGMP - Properties Page

Use this dialog box to configure the amount of diagnostic information that Internet Group Management Protocol (IGMP) includes in the RRAS events written to the System Log in Event Viewer.

Dialog box element | Description
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log all events | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Disable event logging | Specifies that no events are logged in the System Log in Event Viewer.

Additional references

  • IPv4 - IGMP

  • Troubleshooting RRAS


IPv4 - IGMP - Interface - Properties Page

Use this dialog box to configure per-interface Internet Group Management Protocol (IGMP) options.

  • General Tab

  • Router Tab

Additional references

  • IPv4 - IGMP


IPv4 - IGMP - Interface - Properties Page - General Tab

Use this tab to enable or disable Internet Group Management Protocol (IGMP) on the interface and configure the role it performs.

Dialog box element | Description
Enable IGMP | Specifies whether IGMP is enabled for multicast forwarding on this interface. Enabling IGMP on this interface allows the router to either listen for IGMP messages sent by hosts or forward IGMP messages received on other interfaces.
IGMP router | Specifies that IGMP router mode is enabled on this interface. An interface in IGMP router mode listens for IGMP messages from hosts and updates the TCP/IP multicast forwarding table.
IGMP proxy | Specifies that IGMP proxy mode is enabled on this interface. An interface in IGMP proxy mode acts as a host, forwarding IGMP host membership messages for all IGMP host membership messages received on all other interfaces on which IGMP router mode is enabled. Additionally, all nonlocal multicast traffic received on all other interfaces (on which IGMP router mode is enabled) is forwarded over the IGMP proxy mode interface.
IGMP protocol version | Lists the version of IGMP supported on this interface. This setting only applies when the interface is configured for IGMP router mode.

Additional references

  • IPv4 - IGMP - Interface - Properties Page


IPv4 - IGMP - Interface - Properties Page - Router Tab

Use this tab to configure IGMP router mode settings on the specified interface.

Note

The controls on this tab are available for configuration only when the IGMP router mode is enabled on the General tab.

Dialog box element Description

Robustness variable

The robustness variable is a way of indicating the lossy nature of the subnet to which this interface is attached. IGMP can recover from lost IGMP packets (robustness variable is set to 1). You should set the robustness variable to a value of 2 or greater. The default robustness variable is 2.

Query interval (seconds)

The query interval is the amount of time, in seconds, between IGMP General Query messages sent by the router (if the router is the querier on this subnet). The default query interval is 125 seconds.

Query response interval (seconds)

The query response interval is the maximum amount of time, in seconds, that the IGMP router waits to receive a response to a General Query message. The default query response interval is 10 seconds and must be less than the query interval.

Last member query interval (milliseconds)

The last member query interval is the amount of time, in milliseconds, that the IGMP router waits to receive a response to a Group-Specific Query message. The last member query interval is also the amount of time, in seconds, between successive Group-Specific Query messages. The default last member query interval is 1 second.

Startup query interval (seconds)

The startup query interval is the amount of time, in seconds, between successive General Query messages sent by a querier during startup. The default startup query interval is ¼ of the query interval.

Startup query count

The startup query count is the number of general query messages sent at startup.

Last member query count

The last member query count is the number of Group-Specific Query messages sent before the router assumes there are no members of the host group being queried on this interface. The default last member query count is 2.

Automatically recalculate defaults

Specifies whether the values in Startup query interval, Startup query count, and Last member query count are calculated automatically based on the following:

  • The startup query interval is ¼ of the value for the query interval.

  • The startup query count is the same value as the robustness variable.

  • The last member query count is the same value as the robustness variable.

Group membership interval (seconds)

Displays the calculated group membership interval. The group membership interval is the number of seconds that must pass before a multicast router determines that there are no more members of a host group on a subnet. The group membership interval is (robustness variable) * (query interval) + (query response interval).

Other querier present interval

Displays the calculated other querier present interval. The other querier present interval is the number of seconds that must pass before a multicast router determines that there is no other multicast router that should be the querier. The other querier present interval is (robustness variable) * (query interval) + (query response interval)/2.

Additional references

  • IPv4 - IGMP - Interface - Properties Page


IPv4 - NAT

Network address translation (NAT) is used to allow hosts on a private subnet to share a single IP address configured on the public interface of a NAT-enabled router.

The information displayed under NAT in the RRAS MMC snap-in includes the interfaces on the RRAS server that are configured to perform NAT and statistics about the translated network traffic passing through them. By default, NAT does not appear under IPv4 in the MMC snap-in until you install it.

  • NAT Properties Page

  • NAT Interface Properties Page

Note

If you use multiple IP routing protocols, configure only a single routing protocol per interface.

To install NAT

  1. In the RRAS MMC snap-in, expand IPv4, right-click General, and then click New Routing Protocol.

  2. In the New Routing Protocol dialog box, select NAT, and then click OK.
  • To configure server-wide NAT settings, right-click NAT, click Properties, and then configure the settings on the NAT Properties page.

  • To add NAT functionality to an interface, right-click NAT, and then click New Interface. Select the interface from the list, and then click OK. Configure the NAT role of the interface by configuring the settings on the NAT Interface Properties page.

  • To change the configuration of an existing NAT interface, right-click the interface, and then click Properties to display the NAT Interface Properties page.

Additional references

  • IPv4

  • Network Address Translation (NAT) (http://go.microsoft.com/fwlink/?linkid=140619)


IPv4 - NAT - Properties Page

Use this dialog box to configure server-wide network address translation (NAT) settings.

  • General Tab

  • Translation Tab

  • Address Assignment Tab

  • Name Resolution Tab

Additional references

  • IPv4 - NAT


IPv4 - NAT - Properties Page - General Tab

Use this tab to configure the amount of diagnostic information that network address translation (NAT) includes in the RRAS events written to the System Log in Event Viewer.

Dialog box element | Description
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log all events | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Disable event logging | Specifies that no events are logged in the System Log in Event Viewer.

Additional references

  • IPv4 - NAT - Properties Page

  • Troubleshooting RRAS


IPv4 - NAT - Properties Page - Translation Tab

Use this tab to configure the timeouts for translation mappings that are idle.

Dialog box element | Description
Remove TCP mapping after (minutes) | The number of minutes that a dynamic mapping for a TCP session remains in the translation table for the router. You can also click the arrows to select a new setting. The default value for TCP sessions is 1,440 minutes (24 hours).
Remove UDP mapping after (minutes) | The number of minutes that a dynamic mapping for a UDP message remains in the translation table for the router. You can also click the arrows to select a new setting. The default value for UDP messages is 1 minute.
Reset Defaults | Sets the timeout values for dynamic mappings for TCP traffic to 1,440 minutes (24 hours) and UDP traffic to 1 minute.

Additional references

  • IPv4 - NAT - Properties Page


IPv4 - NAT - Properties Page - Address Assignment Tab

Use this tab to configure a static range of addresses that are provided to computers on the private network.

Dialog box element | Description
Automatically assign IP addresses by using the DHCP allocator | Specifies whether the router provides addresses from the configured address range to DHCP clients on the private network.
IP address | Specifies the IP network address for the range of addresses to be assigned to DHCP clients on the private network. The network you configure here should be a private network or a subnet of a private network. The RFC-specified private network addresses are 10.0.0.0 with a subnet mask of 255.0.0.0, 172.16.0.0 with a subnet mask of 255.240.0.0, and 192.168.0.0 with a subnet mask of 255.255.0.0. The default IP network is 192.168.0.0.
Mask | Specifies the subnet mask that corresponds to the range of addresses to be assigned to hosts on the private network. The default subnet mask is 255.255.255.0. If you change the IP address, ensure that you also change the subnet mask to a value appropriate for the IP address.
Exclude | Click to specify any addresses within the configured range of addresses that should not be assigned to DHCP clients on the private network because they are already in use. Hosts that cannot use DHCP are typically assigned static addresses. The manually configured addresses can be in the range specified on this tab as long as you exclude them so that they cannot be assigned to another host.

Additional references

  • IPv4 - NAT - Properties Page


IPv4 - NAT - Properties Page - Name Resolution Tab

Use this tab to specify that the RRAS server is to forward DNS requests from hosts on the private network to the DNS server configured for the RRAS server.

Dialog box element | Description
Clients using Domain Name System (DNS) | This setting specifies whether the RRAS router relays DNS name resolution requests from hosts on the private network to the configured DNS server for the router.
Connect to the public network when a name needs to be resolved | If the configured DNS server is on the public network and accessed through a demand-dial interface, this setting specifies that the connection is to be made when a DNS name resolution request is received by a host on the private network.
Demand-dial interface | This is a list of the demand-dial interfaces that are configured on the router. Select the one that connects to the configured DNS server.

Additional references

  • IPv4 - NAT - Properties Page


IPv4 - NAT - Interface - Properties Page

Use this dialog box to configure the network address translation (NAT) settings for the specified interface.

  • NAT Tab

  • Address Pool Tab

  • Services and Ports Tab

Additional references

  • IPv4 - NAT


IPv4 - NAT - Interface - Properties Page - NAT Tab

Use this tab to configure the network address translation (NAT) role that the interface performs.

Dialog box element | Description
Private interface connected to private network | Specifies that this interface is a private interface that is connected to the private network. The NAT protocol translates IP packets sent from this network to the public network by mapping them to the single public IP address and an arbitrary port number. The RRAS server maintains a table with these mappings so that the reply from the server on the public network can be forwarded back to the originating host on the private network.
Public interface connected to the Internet | Specifies that this interface is the public interface that is connected to the Internet.
Enable NAT on this interface | Specifies whether the router performs TCP port and UDP port translation in addition to IP address translation. If you only have a single public IP address, you must select this check box. Otherwise, network traffic from hosts on the private network cannot be properly translated to Internet traffic. This check box is enabled only when you select Public interface connected to the Internet.

Additional references

  • IPv4 - NAT - Interface - Properties Page

  • Network Address Translation (http://go.microsoft.com/fwlink/?linkid=140619)


IPv4 - NAT - Interface - Properties Page - Address Pool Tab

Note

This tab appears only when Public interface connected to the Internet is selected on the NAT tab.

If your Internet service provider (ISP) provides you with a range of public IP addresses instead of a single address, use this tab to configure the addresses on the public NAT-enabled interface.

Dialog box element | Description
Address list | Lists the configured ranges of public IP addresses assigned to you by your ISP.
Reservations | Click to reserve specific public IP addresses from the configured ranges that cannot be used for address translation. Reserved public IP addresses can be used for Internet Web servers that are placed on the private network. You cannot configure a reservation until you configure at least one IP address pool.

Additional references

  • IPv4 - NAT - Interface - Properties Page

  • IPv4 - NAT - Interface - Properties Page - NAT Tab

  • Dialog Box - Reserve Addresses


IPv4 - NAT - Interface - Properties Page - Services and Ports Tab

After selecting the network interface, this tab appears when Public interface connected to the Internet is selected on the NAT tab.

Use this tab to create, modify, and activate mappings between public IP addresses and ports, and services running on hosts on the private network at specified IP addresses and ports.

The list shows currently configured services.

  • To configure one of the predefined services and activate the mapping, select the box next to the service in the list. The Edit Service dialog box is displayed. You must complete or confirm the mapping configuration before you can activate the service mapping.

  • To configure one of the predefined services and activate the mapping, select the service in the list, and then click Edit to display the Edit Service dialog box.

  • To define a new service and activate the mapping, click Add to display the Add Service dialog box.

Additional references

  • IPv4 - NAT - Interface - Properties Page

  • Dialog Box - Add or Edit Service


IPv4 - RIP

The information displayed under RIP in the RRAS MMC snap-in includes the interfaces that can send and receive router table updates by using the Routing Information Protocol (RIP).

  • IPv4 - RIP – Properties Page

  • IPv4 - RIP - Interface – Properties Page

By default, RIP does not appear under IPv4 in the MMC snap-in until you install it.

Note

If you use multiple IP routing protocols, configure only a single routing protocol per interface.

To install RIP

  1. In the RRAS MMC snap-in, expand IPv4, right-click General, and then click New Routing Protocol.

  2. In the New Routing Protocol dialog box, select RIP Version 2 for Internet Protocol, and then click OK.
  • To configure server-wide settings for RIP, right-click RIP, click Properties, and then configure the settings on the IPv4 - RIP – Properties page.

  • To configure an interface to use RIP, right-click RIP, click New Interface, select the interface on which you want to enable RIP, and then click OK.

  • To configure RIP settings for a single interface, click RIP. In the list of RIP interfaces, right-click the interface, and then click Properties to display the IPv4 - RIP - Interface – Properties page.

Additional references

  • IPv4

  • Routing Information Protocol for IPv4 (http://go.microsoft.com/fwlink/?linkid=140716)


IPv4 - RIP - Properties Page

Use this dialog box to configure server-wide settings for Routing Information Protocol (RIP).

  • General Tab

  • Security Tab

Additional references

  • IPv4 - RIP


IPv4 - RIP - Properties Page - General Tab

Use this tab to configure the triggered update interval for Routing Information Protocol (RIP) and the amount of diagnostic information that RIP includes in RRAS events in the System Log of Event Viewer.

Dialog box element | Description
Maximum delay | The interval, in seconds, between triggered RIP updates. Triggered updates are sent when the entries in a routing table change. The default is 5 seconds.
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log the maximum amount of information | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Disable event logging | Specifies that no events are logged in the System Log in Event Viewer.

Additional references

  • IPv4 - RIP - Properties Page

  • Troubleshooting RRAS


IPv4 - RIP - Properties Page - Security Tab

Use this tab to configure the servers from which Routing Information Protocol (RIP) accepts routing updates. RIP updates from servers that are not approved are ignored.

Dialog box element | Description
Accept announcements from all routers | Specifies that announcements from all routers are accepted. This is the default.
Accept announcements from listed routers only | Specifies that only announcements from the routers listed are accepted. Any announcements from routers that are not on the list are ignored. Use this option to accept RIP announcements only from specified RIP routers.
Ignore announcements from all listed routers | Specifies that announcements from the routers listed are ignored. Announcements from all other routers are accepted. Use this option to exclude the announcements from specified RIP routers.
Router IP address | The IP address of the router. Type an address and click Add to place it in the list. Select an existing address and click Remove to delete an entry.
List | Lists the IP addresses of the RIP routers that you have added.

Additional references

  • IPv4 - RIP - Properties Page


IPv4 - RIP - Interface - Properties Page

Use this tab to configure Routing Information Protocol (RIP) settings for an individual interface.

  • General Tab

  • Security Tab

  • Neighbors Tab

  • Advanced Tab

Additional references

  • IPv4 - RIP


IPv4 - RIP - Interface - Properties Page - General Tab

Use this tab to configure basic Routing Information Protocol (RIP) settings for the interface, including the RIP operational mode, and the version of RIP used.

Dialog box element Description

Operation mode

Lists the available operation modes. You can select one of two operation modes:

  • Auto-static update mode sends out RIP announcements only when other routers request an update. Routes learned over RIP while in auto-static mode are marked as static routes when they are stored in the routing table. If you start and stop the router or if RIP is disabled, these routes remain in the routing table until they are manually deleted. Auto-static update mode is the default for demand-dial interfaces.

  • Periodic update mode sends out RIP announcements periodically, as specified in Periodic announcement interval on the Advanced tab. Routes learned over RIP while in periodic mode are marked as RIP routes and are removed if the router is stopped and restarted. Periodic update mode is the default for local area network (LAN) interfaces.

Outgoing packet protocol

Lists the available protocols for outgoing RIP announcements. You can use the following protocols to send route announcements over the interface:

  • RIP version 1 broadcast: RIP version 1 announcements are sent as broadcasts.

  • RIP version 2 broadcast: RIP version 2 announcements are sent as broadcasts. If you have a mixed environment with RIP versions 1 and 2, select this protocol.

  • RIP version 2 multicast: RIP version 2 announcements are sent as multicasts. Select this protocol only if all the neighboring RIP routers on the network that is connected to this interface are also RIP version 2 routers that are configured for RIP version 2. A RIP version 1 router cannot process a RIP version 2 multicast announcement.

  • Silent RIP: Disables outgoing RIP announcements on this interface. In silent mode, the computer listens to RIP announcements and updates its routing table but does not announce its own routes.

Incoming packet protocol

Lists the available protocols for incoming RIP announcements. You can use the following protocols to receive RIP packets from other routers:

  • Ignore incoming packets: Ignores announcements. If you want a router that only announces routes, select this option.

  • RIP version 1 and 2: Accepts announcements of both types.

  • RIP version 1 only: Accepts only RIP version 1 announcements.

  • RIP version 2 only: Accepts only RIP version 2 announcements.

Added cost for routes

The cost associated with sending packets over this interface. Type a value, or click the arrows to select a new value. When routes are added to the routing table, this number is added to the hop count as advertised in the RIP message. By default, this value is 1 to indicate the additional hop as created by the receiving router. If you want to associate a higher cost with the route, set a higher cost (for example, if you have a heavily trafficked route that you do not want used unless other routes are unavailable). The accumulated costs/hops for the farthest nodes on the IP network must not exceed 15.

Tag for announced routes

A tag number for the routes advertised on this interface. Use this option if you want all packets sent over this interface to include a tag in RIP version 2 announcements.

Activate authentication

Specifies whether you want to enable authentication by using a plaintext password for RIP version 2 announcements over this interface. All incoming and outgoing RIP version 2 packets must contain the same plaintext password. Therefore, you must enable this option and configure the same password for all routers that are connected to this interface. This option is a form of identification. It is not a security option.

Password

A password between 1 and 16 characters long. This password is sent as plaintext in the RIP version 2 message for authentication between neighboring RIP version 2 routers.

Additional references

  • IPv4 - RIP - Interface - Properties Page


IPv4 - RIP - Interface - Properties Page - Security Tab

Use this tab to configure the routes Routing Information Protocol (RIP) is allowed to advertise or accept.

Dialog box element Description

Action

Allows you to specify that the options below the list are for incoming or outgoing route announcements. All of the options on this tab are specific to the direction you select. To set security for accepting routes, click For incoming routes, and then configure the security options. To set security for announcing routes, click For outgoing routes, and then reconfigure the security options.

Accept all routes (incoming)

Announce all routes (outgoing)

For incoming routes: Specifies that the router looks at every route entry in an incoming RIP announcement to determine whether to update its routing table.

For outgoing routes: Specifies that the router includes all appropriate route entries in outgoing RIP announcements.

Accept all routes in the ranges listed (incoming)

Announce all routes in the ranges listed (outgoing)

For incoming routes: Specifies that the router looks at each route entry in an incoming RIP announcement and processes the route only if the route falls between one of the ranges listed.

For outgoing routes: Specifies that the router includes a route in the outgoing RIP announcement only if the route falls into one of the ranges listed.

Ignore all routes in the ranges listed (incoming)

Do not announce all routes in the ranges listed (outgoing)

For incoming routes: Specifies that the router looks at each route entry in an incoming RIP announcement and discards the route if it falls into one of the ranges listed.

For outgoing routes: Specifies that the router excludes a route from the outgoing RIP announcement if the route falls into one of the ranges listed.

From

The IP address for the lower end of the range. For example, if you want to exclude all routes to the private network ID 10.0.0.0, you type 10.0.0.0 in From.

To

The IP address for the higher end of the range. For example, if you want to exclude all routes to the private network ID 10.0.0.0, you type 10.255.255.255 in To.

List

For incoming routes: Lists the route ranges to filter in the incoming RIP announcements.

For outgoing routes: Lists the route ranges to filter in the outgoing RIP announcements.

Additional references

  • IPv4 - RIP - Interface - Properties Page


IPv4 - RIP - Interface - Properties Page - Neighbors Tab

Use this tab to configure the way in which Routing Information Protocol (RIP) communicates with the other routers on its subnets.

Dialog box element | Description
Use broadcast or multicast only | Specifies that all RIP announcements are sent by using the outgoing packet protocol specified on the General tab.
Use neighbors in addition to broadcast or multicast | Specifies that RIP announcements are unicasted to specified neighboring routers by using the outgoing packet protocol specified on the General tab . Configure addresses of neighboring routers in the IP address list.
Use neighbors instead of broadcast or multicast | Specifies that RIP announcements are only unicasted to the specified neighboring routers. RIP announcements are not sent according to the outgoing packet protocol specified on the General tab. Configure addresses of neighboring routers in the IP address list. If you have non-broadcast networks such as Frame Relay and want to enable RIP between routers, you should select this option.
IP address | Specifies the IP address of the neighboring RIP router.
List | Lists the configured RIP neighbor IP addresses.

Additional references

  • IPv4 - RIP - Interface - Properties Page


IPv4 - RIP - Interface - Properties Page - Advanced Tab

Use this tab to configure additional Routing Information Protocol (RIP) configuration options for the specified interface.

Dialog box element | Description
Periodic announcement interval | The number of seconds between periodic RIP announcements. Type a value or click the arrows to select a new value. The default value is 30 seconds. You can set this value from 15 seconds through 86,400 seconds (24 hours). This option applies only if you select Periodic update mode on the General tab.
Time before routes expire | The lifetime (in seconds) of a route that is learned through RIP. Type a value or click the arrows to select a new value. The default value is 180 seconds. You can set this value from 15 seconds through 259,200 seconds (72 hours). If a route is not updated with another RIP announcement within the time set, the route expires and is marked as an invalid route. This value should be greater than the Periodic announcement interval or routes will expire before they can be refreshed. This option applies only if you select Periodic update mode on the General tab.
Time before route is removed | The amount of time (in seconds) after which a RIP-learned route that has expired is removed from the routing table. Type a value or click the arrows to select a new value. The default value is 120 seconds. You can set this value from 15 seconds through 259,200 seconds (72 hours). This option applies only if you select Periodic update mode on the General tab.
Enable split-horizon processing | Selecting this option specifies that routes learned on a network are not announced in RIP announcements sent to that same network. If this option is not selected, routes learned on a network are announced on the same network. By default, split horizon is enabled.
Enable poison-reverse processing | Selecting this option specifies that routes learned on a network are announced with a metric of 16 (unreachable) in RIP announcements sent to that same network. By default, poison reverse is enabled. The poison-reverse option is available only after split horizon is enabled.
Enable triggered updates | Selecting this option specifies that new routes and metric changes trigger an immediate update that includes only the changes. This is called a triggered update. The maximum time between triggered updates depends on the value of Minimum seconds between triggered updates on the IPv4 –RIP – Properties Page – General Tab.
Send clean-up updates when stopping | Selecting this option specifies that, if RIP is stopping on this interface, RIP sends an announcement with all routes that are marked with a metric of 15. This enables neighboring routers to immediately update their routing tables to indicate that the routes available through the router that is stopping are no longer reachable. By default, this check box is selected.
Process host routes in received announcements | Selecting this option specifies that host routes in received RIP announcements are accepted. By default, host routes are ignored.
Include host routes in sent announcements | Selecting this option specifies that host routes are included in RIP announcements. By default, host routes are not included.
Process default routes in received announcements | Selecting this option specifies that default routes in received RIP announcements are accepted. By default, default routes are ignored.
Include default routes in sent announcements | Selecting this option specifies that default routes are included in RIP announcements. By default, default routes are not included.
Disable subnet summarization | Selecting this option specifies that subnet routes are not summarized in the form of the class-based network ID when announced on a network that is not a subnet of the class-based network ID. By default, subnet summarization is disabled. This option is only available if the Outgoing packet protocol on the General tab is set to either RIP version 2 broadcast or RIP version 2 multicast.

Additional references

  • IPv4 - RIP - Interface - Properties Page

  • IPv4 - RIP - Interface - Properties Page - General Tab

  • IPv4 - RIP - Properties Page - General Tab


IPv6

This displays the components that are enabled for Internet Protocol version 6 (IPv6). The entries that appear here depend on the choices that were made when RRAS was enabled and configured.

Additional routing protocols can be added by right-clicking General, and then clicking New Routing Protocol.

  • IPv6 - General

  • IPv6 - Static Routes

  • IPv6 - DHCPv6 Relay Agent

Additional references

  • Entries in the RRAS MMC Snap-in


IPv6 - General

RRAS uses a routing interface to forward unicast and multicast IP packets. There are two types of routing interfaces. Each available interface is displayed in the General pane, along with its type, assigned IP address, the amount of network traffic through it, and status information. To add an interface that is not currently listed, right-click General, and then click New Interface.

  • LAN interfaces. A LAN interface is a physical interface that typically represents a local area connection that uses local area networking technology such as Ethernet or token ring. A LAN interface reflects an installed network adapter. An installed WAN adapter is sometimes represented as a LAN interface. For example, some Frame Relay adapters create a separate logical LAN interface for each configured virtual circuit. LAN interfaces are always active and typically do not require an authentication process to become active.

  • Demand-dial interfaces. A demand-dial interface is a logical interface that represents a point-to-point connection. The point-to-point connection is based on either a physical connection, such as two routers connected over an analog phone line that uses modems, or a logical connection, such as two routers connected over a virtual private network (VPN) connection that uses the Internet. Demand-dial connections are either on-demand (the point-to-point connection is only established when needed) or persistent (the point-to-point connection is established and then remains in a connected state). Demand-dial interfaces typically require an authentication process to become connected. The equipment required by a demand-dial interface is a port on a device.

  • IPv6 - General – Properties Page

  • IPv6 – General – Interface – Properties Page

To configure server-wide Internet Protocol version 6 (IPv6) properties, under IPv6, right-click General, and then click Properties to display the IPv6 – General – Properties page.

To configure IPv6 properties for an individual interface, under IPv6, click General. In the details pane, right-click the interface you want to configure, and then click Properties to display the IPv6 – General – Interface – Properties page.

Additional references

  • IPv6


IPv6 - General - Properties Page

Use this dialog box to configure the amount of detail that Internet Protocol version 6 (IPv6) includes in RRAS events that are written to the System Log in Event Viewer.

Dialog box element | Description
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log all events | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Disable event logging | Specifies that no events are logged in the System Log in Event Viewer.

Additional references

  • IPv6 - General


IPv6 - General - Interface - Properties Page

Use this dialog box to configure the Internet Protocol version 6 (IPv6) settings for an individual interface.

Dialog box element | Description
Enable IPv6 router manager | Specifies whether TCP/IPv6 is enabled on this interface. Select this check box to set the Administrative Status of the interface to Up. Clear this check box to set the Administrative Status of the interface to Down.
Inbound Filters and Outbound Filters | Click to configure filters for inbound or outbound network traffic by using the Inbound and Outbound Filters dialog box.

Additional references

  • IPv6 - General


IPv6 - Static Routes

A static routed Internet Protocol version 6 (IPv6) network does not use routing protocols for IPv6 to communicate routing information between routers. Instead, the routing information is stored in a static routing table on each router. You need to ensure that each router has the appropriate routes in its routing table so that traffic can be exchanged between any two endpoints on the IP network.

  • IPv6 - Static Routes – New IPv6 Static Route

To create a new static route

  1. In the RRAS MMC snap-in, expand IPv6, right-click Static Routes, and then click New Static Route.

  2. Use the IPv6 Static Route dialog box to configure the route.

  3. To edit the route after you create it, right-click the route, and then click Properties. Use the IPv6 Static Route dialog box to make the changes to the route.
To view the currently defined static routes

  1. In the RRAS MMC snap-in, expand IPv6, and then click Static Routes.

  2. The details pane displays the following information about the currently defined routes:

    • Destination – the IP address of the network or host to which the route points.

    • Prefix length– the number of bits in the address that represent the network address. This is typically 64.

    • Gateway – the IP address of the next hop toward the destination.

    • Interface – the interface on the local router on which the gateway can be reached and on which the forwarded packet is sent.

    • Metric – a measure of the cost of using the route. When multiple routes exist that can reach a destination, the route with the lowest metric is selected.

Additional references

  • IPv6

  • Static Routing (http://go.microsoft.com/fwlink/?linkid=140617)


IPv6 - Static Routes - New IPv6 Static Route

Use this dialog box to configure a static route to an Internet Protocol version 6 (IPv6) network.

Dialog box element | Description
Interface | Lists the available LAN or demand-dial interfaces. Select the one to be used to forward the IP packet if this route is selected.
Destination | Type the destination for the route. The destination can be a host address, network address, or the destination for the default route (::).
Prefix length | Type the prefix length of the destination. The prefix is the part of the address that specifies the network identifier. The prefix length identifies how many bits of the destination address in an IPv6 packet must match the Destination field in this route. A prefix length of 128 means that only an exact match of the destination address can use this route. A prefix length of 0 means that any destination address can use this route.
Gateway | Type the IPv6 address for next hop for this route. For LAN interfaces, the gateway address must be configured and must be a directly reachable IP address on the network segment of the selected interface. For demand-dial interfaces, the gateway address is not configured or used.
Metric | Type the metric, which is the cost associated with this route to reach the destination. The metric is commonly used to indicate the number of routers (hops) to the destination. When deciding between multiple routes to the same destination, the route with the lowest metric is selected as the best route.
Use this route to initiate demand-dial connections | Select this option to specify that the router initiates a demand-dial connection when this route is selected for packets being forwarded. This check box is only available when a demand-dial interface is selected in Interface.

Additional references

  • IPv6 - Static Routes


IPv6 - DHCPv6 Relay Agent

DHCPv6 relay agents listen for the DHCPv6 messages that are broadcast on the local subnet and route them to a DHCPv6 server on a different subnet. Because DHCPv6 packets do not typically traverse routers, without a DHCPv6 relay agent you would need to install a DHCPv6 server on every network on which DHCPv6 clients reside. DHCPv6 relay allows you to consolidate your DHCPv6 servers into the much smaller number that you need for load balancing and fault tolerance.

  • DHCPv6 Relay Agent – Properties Page

  • DHCPv6 Relay Agent – Interface – Properties

To configure the RRAS server to act as a DCHPv6 relay agent

  1. In the RRAS MMC snap-in, expand IPv6.

  2. If DHCPv6 Relay Agent does not appear under IPv6, right-click General, click New Routing Protocol, select DHCPv6 Relay Agent, and then click OK.

  3. Right-click DHCPv6 Relay Agent, and then click Properties.

  4. On the DHCPv6 Relay Agent – Properties Page – Servers tab, add the IPv6 addresses of the DHCPv6 servers that are configured with IPv6 address scopes for the subnets to which the RRAS server is connected.

  5. Right-click DHCPv6 Relay Agent, and then click New Interface.

  6. Select the interface on which you want the DHCPv6 relay agent to listen for DHCPv6 requests, and then click OK. The interface is added to the list.

  7. Right-click the interface you just added, and then click Properties. Use the DHCPv6 Relay Agent – Interface – Properties dialog box to adjust the default settings, if needed.

Additional references

  • IPv6

  • RRAS and DHCP (http://go.microsoft.com/fwlink/?linkid=140605)


IPv6 - DHCPv6 Relay Agent - Properties Page

Use this dialog box to configure server-wide DHCPv6 Relay Agent settings.

  • General Tab

  • Servers Tab

Additional references

  • IPv6 - DHCPv6 Relay Agent


IPv6 - DHCPv6 Relay Agent - Properties Page - General Tab

Use this tab to configure the amount of detail that the IPv6 Relay Agent includes in RRAS events that are written to the System Log in Event Viewer.

Dialog box element | Description
Log errors only | Specifies that only errors are logged in the System Log in Event Viewer.
Log errors and warnings | Specifies that errors and warnings are logged in the System Log in Event Viewer.
Log the maximum amount of information | Specifies that the maximum amount of information is logged in the System Log in Event Viewer.
Disable event logging | Specifies that no events are logged in the System Log in Event Viewer.

Additional references

  • IPv6 - DHCPv6 Relay Agent - Properties Page


IPv6 - DHCPv6 Relay Agent - Properties Page - Servers Tab

Use this dialog box to configure the IP addresses of the DHCPv6 servers to which you want the RRAS DHCPv6 relay agent to forward DHCPv6 requests.

Dialog box element Description

Server address

Type the IPv6 address of the DHCPv6 server you want to add.

Server address list

Lists the IPv6 addresses of DHCPv6 servers on the network to which you want to forward DHCPv6 requests from clients. You must add at least one address to be a relay agent.

For the DHCPv6 relay agent to work, you must select the Relay DHCP packets check box on at least one interface that has been added to the DHCPv6 Relay Agent routing protocol.

Additional references

  • IPv6 - DHCPv6 Relay Agent - Properties Page


IPv6 - DHCPv6 Relay Agent - Interface - Properties Page

Use this dialog box to configure DHCPv6 relay agent options for a specified interface.

Dialog box element Description

Relay DHCP packets

Specifies whether DHCPv6 messages are relayed between DHCPv6 clients on the subnet to which this interface is attached and DHCPv6 servers.

After you select this check box, you must configure the DHCPv6 server addresses on the DHCPv6 Relay Agent - Properties Page – Servers tab.

Hop-count threshold

Type a value for the maximum number of DHCPv6 relay agents that will handle DHCPv6 relayed traffic. You can also click the arrows to select a new setting. The default value is 4 hops. The maximum value is 16 hops.

Elapsed-time threshold (centi-seconds)

Type the number of centi-seconds that the DHCPv6 relay agent waits before forwarding DHCPv6 messages. You can also click the arrows to select a new value. The default value is 3200 hundredths of a second (32 seconds).

This option is useful when you want a local DHCPv6 server to respond first, but if the local DHCPv6 server does not respond, you want to forward messages to a remote DHCPv6 server.

Additional references

  • IPv6 - DHCPv6 Relay Agent


Demand-Dial Interface Wizard

This section describes the Demand-Dial Interface Wizard pages in RRAS.

To get to this wizard

  • In the RRAS MMC snap-in, right-click Network Interfaces, and then click New Demand-dial Interface.
  • Demand-Dial Interface Wizard - Connection Type Page

  • Demand-Dial Interface Wizard - VPN Type Page

  • Demand-Dial Interface Wizard - Protocols and Security Page

Additional references

  • User Interface: RRAS

  • Demand-Dial Routing (http://go.microsoft.com/fwlink/?linkid=140603)


Demand-Dial Interface Wizard - Connection Type Page

For dial-up networking access, the dial-up server must have at least one modem or a multiport adapter and analog telephone lines or other WAN connections.

Dialog box element | Description
Connect using a modem, ISDN adapter, or other physical device | A dial-up connection connects you to a network or the Internet through a device that uses the telephone network. This device can be a modem that uses a standard phone line, an ISDN adapter with a high-speed ISDN line, DSL, broadband, or a cable modem.
Connect using a virtual private network (VPN) | A virtual private network (VPN) extends the capabilities of a private network to encompass links across shared or public networks such as the Internet. With a VPN, you can send data between two computers across a shared or public network in a manner that emulates a point-to-point link on a private network.
Connect using PPP over Ethernet (PPPoE) | Using Point-to-Point Protocol over Ethernet (PPPoE) and a broadband modem, LAN clients can gain individual authenticated access to high-speed data networks. By combining Ethernet and Point-to-Point Protocol (PPP), PPPoE provides an efficient way to create a separate connection to a remote server for each user. Access, billing, and choice of service are managed on a per-user basis, rather than a per-site basis. Clients can create both dial-up and dial-on-demand connections using PPPoE.

Additional references

  • Demand-Dial Interface Wizard


Demand-Dial Interface Wizard - VPN Type Page

Use this wizard page to specify the type of virtual private network (VPN) that you want the demand-dial interface to use.

Option | Description
Automatic selection | Select this option to specify that the server negotiates with the remote host to determine the VPN tunnel type.
Point to Point Tunneling Protocol (PPTP) | Select this option to specify that the VPN connection to the remote server is made by using Point-to-Point Tunneling Protocol (PPTP).
Layer 2 Tunneling Protocol | Select this option to specify that the VPN connection to the remote server is made by using Layer Two Tunneling Protocol (L2TP)/Internet Protocol security (IPsec).

Additional references

  • Demand-Dial Interface Wizard

  • Virtual Private Networking


Demand-Dial Interface Wizard - Protocols and Security Page

Dialog box element | Description
Route IP packets on this interface | Specifies whether IP routing, the forwarding of IP packets from one routing interface to another, is enabled on this interface. You must enable IP routing in order for LAN and demand-dial routing to occur.
Add a user account so a remote router can dial in | Any user calling the RRAS server must be authenticated and authorized. Authentication is based on the caller's set of credentials that are passed during the connection establishment process. The credentials that are passed must correspond to a user account. Authorization is granted based on the dial-in permission of the user account and network policies.
Send a plain-text password if that is the only way to connect | Use this option if the remote router does not support encryption or the type of encryption supported by the local router.
Use scripting to complete the connection with the remote router | Scripts can be used to automate the logon process and other connection tasks.

Additional references

  • Demand-Dial Interface Wizard


Other Dialog Boxes

This section describes the user interface options on RRAS dialog boxes.

  • Dialog Box - Add Address Pool

  • Dialog Box - Add or Edit IPv4 Filter

  • Dialog Box - Add or Edit IPv6 Filter

  • Dialog Box - Add or Edit Service

  • Dialog Box - Add RADIUS Accounting Server

  • Dialog Box - Add RADIUS Authentication Server

  • Dialog Box - Add Reservation

  • Dialog Box - Authentication Methods

  • Dialog Box - Configure Device

  • Dialog Box - Inbound and Outbound Filters

  • Dialog Box - Port Status

  • Dialog Box - PPP Settings

  • Dialog Box - Reserve Addresses

  • Dialog Box - Smart Card or Other Certificate Properties

  • Dialog Box - VPN Advanced Properties

Additional references

  • User Interface: RRAS


Dialog Box - Add Address Pool

Use this dialog box to configure the public addresses for the NAT protocol when your Internet service provider (ISP) provides you with multiple public addresses.

Dialog box element | Description
Start address | The IP address of the starting number of your public address pool.
Mask | The subnet mask for your public address pool.
End address | The IP address (in dotted decimal notation) of the ending number of your public address pool.

Additional references

  • IPv4 - NAT - Interface - Properties Page - Address Pool Tab


Dialog Box - Add or Edit IPv4 Filter

Use this dialog box to configure a filter that allows or blocks network traffic that matches a specified address or protocol.

Dialog box element | Description
Source network | Select this option to specify that the filter checks the network from which the packet is coming. You must also specify an Internet Protocol version 4 (IPv4) network address and subnet mask.
Destination network | Select this option to specify that the filter checks the network to which the packet is sent. You must also specify an IPv4 network address and subnet mask.
IP address | The IP address of the network from which the packet was sent or to which the packet is going. You must also specify a subnet mask.
Subnet mask | The subnet mask that corresponds to the network IP address.
Protocol | Lists the available protocol types that you can base a filter on. The default is Any protocol. If you select Other, you must type a protocol identifier in Protocol number.
Source port | For TCP, TCP (established), and UDP protocols, provides a space for you to type the port number specified by the source to be used by the filter. Some applications use well-known ports to send and receive packets. You can set a filter for one of these ports if you know which numbers the application uses for the protocol specified in Protocol. For example, you can try to block FTP traffic or allow only PPTP traffic.
Destination port | For TCP, TCP (established), and UDP protocols, type the port number used by the destination for the packet.
ICMP type | For the ICMP protocol, type the ICMP type number.
ICMP code | For the ICMP protocol, type the ICMP code number.
Protocol number | For the Other protocol, type the IP protocol number.

Additional references

  • Dialog Box - Inbound and Outbound Filters

  • IPv4 - General - Interface - Properties Page - General Tab


Dialog Box - Add or Edit IPv6 Filter

Use this dialog box to configure a filter that allows or blocks network traffic that matches a specified Internet Protocol version 6 (IPv6) address or protocol.

Dialog box element | Description
Source network | Select this option to specify that the filter checks the network from which the packet is coming. You must also specify an IPv6 network address and prefix length.
Destination network | Select this option to specify that the filter checks the network to which the packet is sent. You must also specify an IPv6 network address and prefix length.
IPv6 address | Type the IPv6 address of the network from which the packet was sent or to which the packet is going.
Prefix length | Type the prefix length. The prefix is the part of the IPv6 address that indicates the bits that specify the network identifier.
Protocol | Lists the available protocol types upon which you can base a filter. The default is Any protocol. If you select Other, you must type a protocol identifier in Protocol number.
Source port | For TCP, TCP (established), and UDP protocols, type the port number specified by the source to be used by the filter. Some applications use well-known ports to send and receive packets. You can set a filter for one of these ports if you know which numbers the application uses for the protocol specified in Protocol. For example, you can try to block FTP traffic or allow only PPTP traffic.
Destination port | For TCP, TCP (established), and UDP protocols, type the port number used by the destination for the packet.
ICMP type | For the ICMP protocol, type the ICMP type number.
ICMP code | For the ICMP protocol, type the ICMP code number.
Protocol number | For the Other protocol, type the IP protocol number.

Additional references

  • Dialog Box - Inbound and Outbound Filters

  • IPv6 - General - Interface - Properties Page


Dialog Box - Add or Edit Service

Use this dialog box to configure a mapping between a public IP address and port and a service running on a host on the private network at a specified IP address and port. To activate the mapping, you must select the check box for the service on the Service and Ports tab.

Dialog box element | Description
On this interface | Specifies that the incoming IP address is the public IP address that is assigned to this interface.
On this address pool entry | Specifies that the incoming IP address is from the public address pool. Type the appropriate public IP address from the public address pool.
Protocol | Specifies the transport layer protocol used for data reception and transmission.
Incoming port | The destination port number of incoming public traffic. For example, for a Web server on your private network, the incoming port number is typically 80.
Private address | The IP address for the private network computer to which this network traffic is to be forwarded.
Outgoing port | The destination port number of the private traffic. For example, for a Web server on your private network, the outgoing port number is typically 80.

Additional references

  • IPv4 – NAT – Interface – Properties Page - Service and Ports tab


Dialog Box - Add RADIUS Accounting Server

Dialog box element | Description
Server name | Type the DNS name or IP address of the RADIUS server to be used for accounting.
Shared secret | Displays the obscured shared secret that is used for secure communications between the RRAS server and the RADIUS server. You must configure the same shared secret on both the RRAS server and the RADIUS server for successful RADIUS communications to occur. The shared secret is case-sensitive.
Time-out (seconds) | Type the amount of time (in seconds) that the RRAS server tries to obtain responses from the RADIUS server before trying another RADIUS server. You can also click the arrows to select a new setting.
Initial score | Type the initial responsiveness score of the RADIUS server. You can also click the arrows to select a new setting. The score increases or decreases based on the ongoing responsiveness of the RADIUS server.
Port | Type the UDP port that is used by the RADIUS server for incoming RADIUS accounting messages. The default value of 1813 is based on RFC 2139. For older RADIUS servers, set the port to 1646.
Send RADIUS Accounting On and Accounting Off messages | Specifies whether RADIUS Accounting-On and Accounting-Off messages are sent to the RADIUS server when the Routing and Remote Access service starts up and shuts down. You should verify that the RADIUS server supports these messages before selecting this check box.

Additional references

  • RRAS Server Properties Page - Security Tab


Dialog Box - Add RADIUS Authentication Server

Dialog box element Description

Server name

The DNS name or IP address of the RADIUS server to be used for authentication.

Shared secret

Displays the obscured shared secret that is used for secure communications between the RRAS server and the RADIUS server. You must configure the same shared secret on both the RRAS server and the RADIUS server for successful RADIUS communications to occur. The shared secret is case-sensitive.

Time-out (seconds)

Type the amount of time (in seconds) that the RRAS server tries to obtain responses from the RADIUS server before trying another RADIUS server. You can also click the arrows to select a new setting.

Initial score

The initial responsiveness score of the RADIUS server. You can also click the arrows to select a new setting. The score increases or decreases based on the ongoing responsiveness of the RADIUS server.

Port

The UDP port that is used by the RADIUS server for incoming RADIUS authentication requests. The default value of 1812 is based on RFC 2138. For older RADIUS servers, set the port value to 1645.

Always use message authenticator

Specifies whether a message authenticator based on the shared secret is sent with each RADIUS message. Extensible Authentication Protocol (EAP) messages are always sent with a message authenticator. Make sure that your RADIUS servers are capable of and configured to receive message authenticators.

You must select this option if your RADIUS server is running Network Policy Server (NPS) and the RADIUS client that is configured for this server has the Request must contain the Message Authenticator attribute option selected.

Additional references

  • RRAS Server Properties Page - Security Tab


Dialog Box - Add Reservation

Use this dialog box to configure addresses that are part of the public address range assigned by your Internet service provider (ISP), but are assigned to other hosts that must be accessible from the public interface and that must not be used for address translation.

Dialog box element | Description
Reserve this public IP address | The IP address in the public address pool that is being reserved and should not be used for address translation.
For this computer on the private network | The IP address of the private network computer that you want to make available to public network users.
Allow incoming sessions to this address | Specifies whether sessions from the public network are allowed. If you are setting up a server, such as a Web server, and you want to make it accessible for Internet users, select this check box. Normally, the only traffic that is allowed from the public network is traffic sent in response to sessions initiated from the private network.

Additional references

  • Dialog Box - Reserve Addresses

  • IPv4 - NAT - Interface - Properties Page - Address Pool Tab


Dialog Box - Authentication Methods

Dialog box element | Description
Extensible authentication protocol (EAP) | Specifies whether the server uses EAP to authenticate remote access and demand-dial connections.
Microsoft encrypted authentication version 2 (MS-CHAP v2) | Specifies whether the server uses Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 2 to authenticate remote access and demand-dial connections. MS-CHAP v2 provides mutual authentication and stronger encryption and is required for encrypted Point-to-Point (PPP) or Point-to-Point Tunneling Protocol (PPTP) connections.
Encrypted authentication (CHAP) | Specifies whether the server uses the Message Digest 5 (MD-5) Challenge Handshake Authentication Protocol (CHAP) to authenticate remote access and demand-dial connections.
Unencrypted password (PAP) | Specifies whether the server uses the Password Authentication Protocol (PAP) to authenticate remote access and demand-dial connections. During a PAP authentication, passwords are sent in plaintext, or unencrypted, form. You should use this authentication protocol only if you must support PAP remote access clients.
Allow remote systems to connect without authentication | Specifies whether the server allows unauthenticated connections. Unauthenticated connections do not require a user name or password.
Security Note

We recommend that you do not use CHAP or PAP in your production RRAS deployments. They are included for backward compatibility only.

Additional references

  • RRAS Server Properties Page - Security Tab

  • Remote Access Authentication Protocols


Dialog Box - Configure Device

Use this dialog box to configure the settings for the remote access ports for this device.

Option Description

Remote access connections (inbound only)

Select this option to specify that inbound remote access connections are allowed for the ports of this device.

Demand-dial routing connections (inbound and outbound)

Select this option to specify that both inbound and outbound demand-dial connections are allowed for the ports of this device.

Demand-dial routing connections (outbound only)

Select this option to specify that only outbound demand-dial connections are allowed for the ports of this device.

Phone number for this device

The phone number of this device. The phone number is used as the Called Station ID and in Bandwidth Allocation Protocol (BAP)-enabled connections. When a BAP-enabled remote access client requests another connection, the remote access server sends back a message that contains the phone number to dial for the new connection.

For the Called Station ID, you need to manually configure the called number if:

  • You are using the Called-Station-Id attribute in a network policy.

  • Your phone line, dial-up hardware, and driver for your dial-up hardware do not support the identification of the called number.

The number typed here must match the number typed in the Called-Station-Id attribute of the network policy. Otherwise, the connection is rejected. If your phone line, dial-up hardware, and driver for your dial-up hardware support the identification of the called number, then the number typed here is ignored.

For Layer Two Tunneling Protocol (L2TP) or Point-to-Point Tunneling Protocol (PPTP) ports, the number you type here is the IP address that is assigned to the interface of the virtual private network (VPN) server on which VPN connections are received.

Maximum ports

The maximum number of ports for this device. You can also click the arrows to select a new setting. You can only configure this option on devices that support a variable number of ports.


Dialog Box - Inbound and Outbound Filters

Dialog box element Description

Receive all packets except those that meet the criteria below

For inbound filters: Specifies that all incoming packets that match the filters listed are discarded. All incoming packets are compared to the filters listed. If a packet matches a filter, the packet is dropped. If the packet does not match a filter, the packet is accepted.

For outbound filters: Specifies that all outgoing packets that match the filters listed are discarded. All outgoing packets are compared to the filters listed. If a packet matches a filter, the packet is dropped. If the packet does not match a filter, the packet is transmitted.

This option applies to all the filters that you have added. You cannot change this option for individual filters.

You can only configure this option after you have added at least one filter.

Drop all packets except those that meet the criteria below

For inbound filters: Specifies that all incoming packets that match the filters listed are accepted. All incoming packets are compared to the filters listed. If a packet matches a filter, the packet is accepted. If the packet does not match a filter, the packet is dropped.

For outbound filters: Specifies that all outgoing packets that match the filters listed are transmitted. All outgoing packets are compared to the filters listed. If a packet matches a filter, the packet is transmitted. If the packet does not match a filter, the packet is dropped.

This option applies to all the filters that you have added. You cannot change this option for individual filters.

You can only configure this option after you have added at least one filter.

New

Click to add a filter by using the Add or Edit IPv4 Filter dialog box or the Add or Edit IPv6 Filter dialog box. You can set filters based on where the packet is coming from (the source), where the packet is going (the destination), or which protocol the packet is using. You can set all three of these values for a filter or set any one or a combination of the three, depending on the level of control that you want.

Additional references

  • IPv4 - General - Interface - Properties Page - General Tab

  • Add or Edit IPv4 Filter

  • Add or Edit IPv6 Filter


Dialog Box - Port Status

Use this dialog box to view information about the selected device such as port condition, line speed, call duration, network statistics, errors, and the network protocols being used.

Dialog box element | Description
Device | Select the device for which to display status information. You can use this to view status for other devices without closing the dialog box and selecting another port in Ports.
Refresh | Click to update the display of port statistics and port errors.
Reset | Click to set all port statistics and port errors to zero.
Disconnect | Ends the active connection on the selected port.

Additional references

  • Ports


Dialog Box - PPP Settings

Use this dialog box to configure options for Point-to-Point Protocol (PPP) connections.

Dialog box element Description

Enable LCP extensions

Specifies whether Link Control Protocol (LCP) extensions are enabled. LCP extensions may cause problems when you call servers with older PPP software. If persistent problems occur, clear the check box.

If you clear the check box, LCP cannot send Time-Remaining and Identification packets and request callback during the LCP negotiation of PPP.

Enable software compression

Specifies whether software compression is enabled.

Network Connections offers software data compression in addition to support for modem compression. Therefore, you do not have to turn on modem compression to benefit from faster throughput.

Negotiate multi-link for single link connections

Specifies whether Multilink negotiation is enabled for a single link connection. If your remote access server supports this feature, you may notice improved audio quality. If you enable this option, you may not be able to connect to other remote access servers.


Dialog Box - Reserve Addresses

Use this dialog box to view configured reservations. Each reservation maps a specific public IP address from the public address pool to a specific private address. Reserved public IP addresses are not used for dynamically mapped traffic.

  • To add addresses to the list, click Add to display the Add Reservation dialog box.

  • To modify an existing reservation, select the reservation, and then click Edit.

  • To delete a reservation from the range, select the reservation, and then click Remove.

Additional references

  • IPv4 - NAT - Interface - Properties Page - Address Pool Tab

  • Dialog Box - Add Reservation


Dialog Box - Smart Card or Other Certificate Properties

Use this dialog box to configure settings for Extensible Authentication Protocol (EAP).

Dialog box element Description

Use my smart card

Specifies that the certificate that resides on your smart card is presented to your server for authentication.

Use a certificate on this computer

Specifies that the certificate that resides in the certificate store on your computer is presented to your server for authentication.

Use simple certificate selection

Simplifies certificate selection for the user by grouping certificates with the same subject and selecting the most recently issued certificate in each group. If only one group exists, then the most recent certificate in this group is automatically selected for authentication.

Validate server certificate

Specifies whether to verify that the server certificate presented to your computer has not expired and is still valid. During the certificate authentication process, your computer presents its certificate to the server, and the server presents its certificate to your computer.

Connect to these servers

Specifies the server or servers to which your computer will automatically connect. The server name specified must exactly match the server name on the certificate. You can specify multiple server names, separated with semicolons.

Type the name of the server as it appears in the certificate properties. This could be a short name or a fully qualified domain name (FQDN), for example, server.microsoft.com.

Trusted Root Certification Authorities

Lists the available trusted root certification authorities (CAs). Trusted root CAs have passed through multiple layers of verification and are considered the most secure.

Use a different user name for the connection

Specifies whether to use a different user name when the user name in the smart card or certificate is not the same as the user name in the domain that you are logging on to.

Do not prompt user to authorize new servers or trusted certification authorities

Specifies whether to notify that the server certificate presented to your computer is not trusted. Untrusted certificate authentication attempts will silently fail.


Dialog Box - VPN Advanced Properties

Use this dialog box to configure authentication settings for virtual private networks (VPNs) used for demand-dial connections between RRAS routers.

Dialog box element Description

Use preshared key for authentication

This method uses a secret set of characters (the key) that has been agreed upon by two users.

Security Note
  • We recommend that you do not use preshared key authentication because it is a relatively weak authentication method. Preshared key authentication creates a master key that is less secure (that might produce a weaker form of encryption) than certificates. In addition, preshared keys are stored in plaintext in the registry. In Active Directory Domain Services (AD DS), preshared keys are stored in readable hexadecimal format.
  • Preshared key authentication is provided for interoperability and to meet Internet Protocol security (IPsec) standards. We recommend that you use certificates in a production environment instead and use preshared keys for testing only.

Key

Type the preshared key. This option is available only if the Use preshared key for authentication check box is selected.

Use certificate for authentication

This method uses a certificate issued by a specified certification authority (CA).

Verify the Name and Usage attributes of the server's certificate

Specifies whether the server verifies the validity of the certificate used for Internet Key Exchange (IKE) with the CA certificate the server has in its certificate store.