Using the Terminal Services Gateway Lesson 10

Transcription

1 Using the Terminal Services Gateway Lesson 10

2 Skills Matrix Technology Skill Objective Domain Objective # Deploying a TS Gateway Server Configure Terminal Services Gateway 2.2

3 Terminal Services (TS) Web Access The Terminal Services (TS) Web Access interface is particularly useful with RemoteApp because it enables users to launch applications by doubleclicking icons on a Web page. Instead of creating RDP files and deploying them to clients using Group Policy or some other method, you can simply select a checkbox for the RemoteApp applications you want to deploy using TS Web Access, and the service adds the appropriate icons to its default Web page.

4 Terminal Services (TS) Web Access

5 Installing TS Web Access In addition to installing the dependent IIS 7 role services and features, the Add Roles Wizard creates an IIS Web application for TS Web Access, adds it to the Default Web site, and assigns to it the URL This application generates a default Web page containing the controls that enable users to access terminal server features. You can modify this site or add the application to another site to incorporate TS Web Access functionality into your existing Web content.

6 Installing TS Web Access

7 Adding Computers to TS Web Access Computers Group For TS Web Access to deploy terminal server sessions from another computer, it must have the appropriate permissions. Therefore, you must add the TS Web Access computer to the TS Web Access Computers local security group on the terminal server computer.

8 Computer Management Console

9 TS Web Access Computers Group

10 TS Web Access Computers Group

11 Configure TS Web Access to Use an External Terminal Server

12 Publishing RemoteApp Applications TS Web Access can simplify the process of deploying RemoteApp applications to your clients by publishing them on your Web site. When you add applications to the RemoteApp Programs list in the TS RemoteApp Manager console, you must select the RemoteApp program is available through TS Web Access checkbox on the Properties sheet for each application that you want to appear on the TS Web Access Web page.

13 Publishing RemoteApp Applications

14 Publishing a Terminal Server Desktop In addition to RemoteApp programs, TS Web Access can provide clients with access to standard terminal server desktops.

15 TS RemoteApp Manager Console

16 RemoteApp Deployment Settings Dialog Box

17 Terminal Services Gateway A new Windows Server 2008 Terminal Services role service that enables Internet users to access terminal servers on private networks, despite intervening firewalls and network access translation (NAT) servers. TS Web Access enables clients to connect to Windows Server 2008 terminal services using a Web browser.

18 Terminal Services Gateway It might appear as though the computer is using a standard Hypertext Transfer Protocol (HTTP) connection to run RemoteApp programs and remote desktops. This would mean that TS Web Access could enable any client to connect to the terminal server, whether the client is located on the same intranet or on the Internet.

19 TS Gateway Server The TS Gateway role service is essentially a tunnel through your network s defenses, which enables specific users on the Internet to pass through your firewalls, proxy servers, NAT routers, and other protective devices to reach the terminal servers on your private, internal network.

20 TS Gateway Server on a Perimeter Network

21 Using the TS Gateway Server

22 Using the TS Gateway Server

23 Installing TS Gateway

24 TS Gateway Server Authentication Certificate Page

25 TS Gateway Authorization Policies Page

26 TS Gateway User Groups Page

27 TS CAP Page

28 TS RAP Page

29 Installing a Certificate For Internet clients to connect to a TS Gateway server using SSL, the server must have a digital certificate issued by a source that the client computers trust. You can use any one of the following three ways to obtain a certificate for a TS Gateway server. Create a self-signed certificate on the TS gateway computer. Generate a certificate using an enterprise certification authority (CA) on your network. Obtain a certificate from a trusted public certification authority. It is recommended to use a commercial public CA or a CA deployed on your network.

30 SSL Certificate Tab of a TS Gateway Server Properties Sheet

31 Create Self-Signed Certificate Dialog Box

32 Install a TS Gateway Certificate

33 Certificates Snap-in Page

34 Select Computer Page

35 Add or Remove Snap-ins Dialog Box with the Certificates Snap-in

36 Certificates Snap-ins Subfolders

37 File to Import Page

38 Certificate Store Page

39 Certificate Snap-in with an Imported Certificate

40 Creating TS Gateway Authorization Policies Connection Authorization Policies (CAPs) Specify the Internet users allowed to use the server. Resource authorization policies (RAPs) Specify the terminal servers on the private network that the users are permitted to access.

41 Creating TS Gateway Authorization Policies

42 The Connection Authorization Page

43 Create Authorization Policies

44 Connection Authorization Policy page

45 Requirements Page

46 Device Redirection Page

47 Confirm Policy Creation

48 Displaying the Resource Authorization Policies Pane

49 Resource Authorization Policy Page

50 User Groups Page

51 Computer Group Page

52 TS Gateway-Managed Group Page

53 Allowed Ports Page

54 Configuring a TS Gateway Client To access a terminal server on a private network from the Internet using a TS Gateway server, first you must configure Remote Desktop Connection 6.x on the client computer.

55 Remote Desktop Connection

56 Ts Gateway Server Settings

57 Install a Certificate If the certificate you are using for your TS Gateway server is not trusted by your clients, such as when you create a self-signed certificate, you must install it into the client computer s certificate store.

58 Terminal Services Session using a TS Gateway Server

59 Summary Terminal Services (TS) Web Access is a role service that, with IIS 7, creates an alternative client interface to your terminal servers. TS Web Access enables users to launch RemoteApp programs simply by doubleclicking icons on a Web page.

60 Summary If you install the TS Web Access role service on the same computer as the Terminal Server role service, the Add Roles Wizard automatically populates the TS Web Access Web page. If you want to use TS Web Access with a terminal server running on another Windows Server 2008 computer, you must configure both computers to work together.

61 Summary Terminal Services Gateway is a new Windows Server 2008 Terminal Services role service that enables Internet users to access terminal servers on private networks despite intervening firewalls and network access translation (NAT) servers.

62 Summary The TS Gateway role service enables Terminal Services to support Internet clients securely using the same tunneling concept as a VPN connection, except that the computers encapsulate RDP traffic within Secure Sockets Layer (SSL) packets.

63 Summary To deploy a TS Gateway server, you must perform the following tasks: install the TS Gateway role service, obtain and install a certificate for the TS Gateway server, create connection authorization policies, create resource authorization policies, and configure the client to use the TS Gateway.

64 Summary TS Gateway uses connection authorization policies (CAPs) that specify the Internet users that are allowed to use the server as well as resource authorization policies (RAPs) that specify the terminal servers on the private network that users are permitted to access.