Setting Up Windows 2K VPN Connection Through The Symantec Raptor Firewall Firewall By: Loc Huynh Date: 24 March 2003 Table of Contents 1.0 Foreword...2 2.0 Setting VPN on VPN Server...2 3.0 Setting Symantec Raptor Firewall...3 4.0 Clients connection...3 4.1 Setting up VPN in Windows 2000 Professional...3 4.1.1 Configuration...3 4.1.2. Connecting using VPN...4 4.2 Setting up VPN in Windows NT 4 Workstation...4 4.2.1. Configuration...4 4.2.4. Connecting using VPN...5 4.3 Setting up VPN in Windows Me...5 4.3.1 Configuration...5 4.3.2 Connecting using VPN...6 4.4 Setting up VPN in Windows 98...6 4.4.1 Configuration...6 4.4.2 Connecting using VPN...7
1.0 Foreword The following will show the basic instruction of setting up the VPN on both server and client through the Symantec Raptor Firewall. Please go to Symantec Website for more information. Virtual Private Network is using the PPTP (Point to Point tunnelling Protocol) to secure the transfer of data across the network by creating a VPN tunnelling across TCP/IP base data networks. PPTP traffic uses TCP port 1723 and IP port protocol uses ID 47. PPTP can be use with most firewalls and routers by enabling traffic destine for port 1723 to be routed through the firewall or router. 2.0 Setting VPN on VPN Server 1. Open Routing and Remote Access (Under Administrative Tools) 2. Select the Server, then Right Click and select Configure and Enable Routing and Remote Acess 3. Click Next Welcome Screen 4. Select Virtual private network (VPN) server, then click Next 5. Select Yes, all of the available protocols are on the list Make sure there is at least one protocol (ie: TCP/IP), then click Next 6. Select the External IP network interface, this is allow remote client and router to access to this VPN server, then click Next 7. Select From a specified range of addresses, then click Next 8. Click on New 9. Enter a Start IP Address (ie: 192.168.1.200) 10. Enter an End IP Address (ie: 192.168.1.254) 11. Click OK 12. Select No, I don t want to set up this server to use RADIUS now, then click Next. RADIUS (Remote Authentication Dial-In User Service) is used to provide a central authentication database fro myltiple remote access servers. 13. Click Finish 14. If there is no Active Directory, there is will be a warning saying that, this server can t connect to AD. The setup is fine to work with Windows NT 4 Domain. Click OK to continue. 15. There is also a message about the DHCP, click OK to continue. 16. Connect one cross over cable from External NIC of the VPN Server to a spare NIC on Raptor Firewall server. 17. Setup the IP on External NIC of the VPN Server 18. Setup the spare IP on the Raptor Firewall. Note that: IP of VPN Server and Raptor Firewall Server are on the same subnet. Note: If you don t have L2TP setup, you will get the message within the Event Viewers about this L2PT is not enable, to stop this, right click on Ports, select L2TP and go to properties, within the Maximum ports, enter 0.
3.0 Setting Symantec Raptor Firewall Assuming: Raptor Firewall is up and running 1. Create a network entity to represent the client or clients behind the firewall that you want to have PPTP access. It can be a host, subnet, or group. It might already exist for use in other rules, filters, VPNs, or transforms (ie: we create a new Host and point to our Internal IP) 2. Create a protocol called PPTP -IP47. Base Protocol: IP Display in rules window: Checked Protocol Number: 47 3. Create a protocol called PPTP -TCP1723. Base Protocol: TCP Display in rules window: Checked Destination port: 1723 Source Port: 1024-65535 4. Create a New Rule for the Incoming packets Coming in via: the External IP From source: Universe Destined for: The Network Entity that we create in step 1. Coming out via: Any (or select the outgoing entity) Enable the allow access to services Included services: select protocol that we create in step 2 and 3 5. Create a New Rule for the Outgoing packets Coming in via: the Any From source: Protocol that we create in step 1 Destined for: Universe Coming out via: Any (or select the outgoing entity) Enable the allow access to services Included services: select all 4.0 Clients connection 4.1 Setting up VPN in Windows 2000 Professional 4.1.1 Configuration 1. Click on Start-> Settings -> Control Panel. 2. Double-click on Network and Dial-Up connections. 3. Double-click on Make New Connection and click on Next. 4. If this is the first time you have run Dialup Networking, you may be asked to enter your location and telephone area code. Enter these details (although they will not affect the VPN connection you are going to create) and click on Next or Finish as appropriate. 5. Select Connect to a private network through the Internet and click on Next. 6. If you want Windows to automatically dial up your ISP whenever you open a VPN connection, tick Automatically dial this connection and select the ISP you want to call. If you want to connect via a LAN or via an ISP connection
you have dialled manually, select Do not dial the initial connection. Click on Next. 7. Enter either the IP name or number of the VPN server and click on Next. 8. Select For all users and click on Next. 9. Type in a name for the connection (VPN to department or similar) and click on Finish. 10. At this point you may be asked to reboot the computer. 4.1.2. Connecting using VPN 1. If using manual connection, connect to the internet as usual (either via a LAN or via a dial-up connection). 2. Double-click on My Computer, double-click Control Panel, double-click on Network and Dial-up Connections and finally double-click on the VPN connection that you created in the Configuration section above. 3. Type in your NT (or Windows 2000) username and password and click on Connect 4.2 Setting up VPN in Windows NT 4 Workstation NB: You should also have at least service pack 4 installed before you start; 4.2.1. Configuration On NT Workstation, configuration is a two-stage process. Firstly you need to install Point-to-Point Tunnelling Protocol (PPTP) and the Remote Access Service (RAS), then you need to configure the VPN connection. 4.2.2. Installing PPTP and RAS 1. Click on Start-> Settings -> Control Panel. 2. Double-click on Network and click on the Protocols tab 3. Click on Add, select Point to Point Tunnelling Protocol from the list and click on OK. 4. The Point-to-Point Tunnelling Protocol will be installed (you may be prompted for the CD at this point) and a dialogue box will appear asking for the Number of Virtual Private Networks. Accept the default of 1 and click on OK. 5. A message will display saying that Remote Access Services (RAS) will be installed. Click on OK. 6. RAS will be installed and a dialogue box displayed entitled Add RAS Device. It should be showing VPN1 - RASPPTPM below the text RAS Capable Devices: If it doesn t, select this entry from the drop-down list. Click on OK. 7. In the Remote Access Setup dialogue box that appears, click on Network. 8. Make sure that there is a tick in the box against TCP/IP and that there are no ticks in the boxes against NetBEUI and IPX. Click on OK. Then click on Continue. 9. Click on OK to exit the Network Control Panel. You will be prompted to reboot the PC. If you have installed a service pack, you must reinstall it or
things may not work correctly. You can reinstall it before rebooting if you wish. 4.2.3. Configuring the VPN connection 1. Open My Computer and double-click on Dialup Networking. If this is the first time you have run Dialup Networking, you will be asked to enter your location and telephone area code. Enter these details (although they will not affect the VPN connection you are going to create) and click on Next or Finish as appropriate. 2. Once the location details have been configured, you will be prompted to create a new Phonebook entry. Choose an appropriate name (e.g. VPN - Ozquest) and tick the box next to I know all about phonebook entries and would rather edit the properties directly. Then click on Finish. 3. In the New Phonebook Entry page that appears, on the Basic tab, against Phone number: enter the name or IP address of the VPN server that you will be connecting to. Against Dial using: make sure that RASPPTPM (VPN1) is selected and turn off the option to Use another port if busy. 4. Click onto the Server tab. The Dial-up server type should be PPP: Windows NT, Windows 95 Plus, Internet. Ensure that under Network protocols only TCP/IP is selected. You can leave Enable software compression and Enable PPP LCP extensions ticked. 5. Click on OK. 4.2.4. Connecting using VPN 1. If using a manual connection, connect to the internet as usual (either via a LAN or via a dial-up connection). 2. Double-click on My Computer, double-click on Dial-Up Networking and double-click on the VPN connection that you created in the Configuration section above. 3. Type in your NT username and password and click on Connect. 4.3 Setting up VPN in Windows Me 4.3.1 Configuration 1. Click on Start -> Settings -> Control Panel. 2. Double-click on add/remove programs and click on the Windows Setup tab. 3. Double-click on communications, tick Virtual Private Networking and click on OK. 4. If Dial-Up Networking is not installed, you will see a message telling you that Virtual Private Networking requires Dial-Up Networking. If so, click on Yes to add both Virtual Private Networking and any other components that it requires. 5. Click on OK. 6. Reboot the computer if required. 7. Double click on My Computer and double-click on Dial-Up Networking.
8. Double-click on Add new connection. If this is the first time that you have set up Dial-Up Networking you may be prompted to enter a locations and dialling code. Do this and click on Next or Finish as appropriate. 9. When prompted to Type a name for the computer you are dialing, enter a name for connection (for instance: VPN to Department), select the device as Microsoft VPN Adapter and click on Next. 10. In the box below Host name or IP Address you need to enter the name or address of the computer you are connecting to. This will depend on your college or department and you need to contact your IT Officer to find out what this is. When you have entered the correct details, click on Next and then on Finish. 11. Right-click on the connection that you have just created and click on Properties. 12. Click on the Server Types tab and make sure that the following are selected: Log on to network, Enable software compression, Require Data Encryption and TCP/IP. Make sure that NETBUI and IPX are not be selected. Click on OK. 4.3.2 Connecting using VPN 1. Connect to the internet as usual (either via a LAN or via a dial-up connection). 2. Double-click on My Computer, double-click on Dial-Up Networking and double-click on the VPN connection that you created in the Configuration section above. 3. Type in your NT username and password and click on Connect. 4.4 Setting up VPN in Windows 98 NB: If you are running a version of Windows 98 that is earlier than Second Edition, you will also need to download the update vpnupd.exe. To find out whether you are running Windows 98 Second Edition, click on Start -> Settings -> Control Panel and double-click on the System control panel. Make sure that the General tab is selected and check the entries under System. The first line should say Windows 98 (if you are running Windows 98); if it is Second Edition, the second line will say Second Edition. 4.4.1 Configuration 1. If you are not running Windows 98 Second Edition, double-click on vpnupd.exe and reboot when the update is complete. 2. Click on Start -> Settings -> Control Panel. 3. Double-click on add/remove programs and click on the Windows Setup tab. 4. Double-click on communications, tick Virtual Private Networking and click on OK and then click on OK again. 5. Reboot the computer if required. 6. Double click on My Computer and double-click on Dial-Up Networking. 7. Double-click on Add new connection. 8. Enter a name for connection (for instance: VPN to Department), select the device as Microsoft VPN Adapter and click on Next.
9. Enter either the IP name or number of the VPN server as the host name and click on Next and then on Finish. 10. Right-click on the connection that you have just created and click on Properties. 11. Click on the Server Types tab and make sure that the following are selected: Log on to network, Enable software compression, Require Data Encryption and TCP/IP. Make sure that NETBUI and IPX are not be selected. Click on OK. 4.4.2 Connecting using VPN 1. Connect to the internet as usual (either via a LAN or via a dial-up connection). 2. Double-click on My Computer, double-click on Dial-Up Networking and double-click on the VPN connection that you created in the Configuration section above. 3. Type in your NT username and password and click on Connect.