ePipe VPN and Security Product Documentation: Secure Remote Access

ePipe VPN and Security Products:
Secure Remote Access

Introduction
Network Setup
Server Setup
Client Setup

Introduction

SRA enables mobile workers and telecommuters to securely and cost-effectively access corporate LAN resources from anywhere in the world, through the Internet. Using PPTP (Point-to-Point Tunnelling Protocol), SRA provides session-based authentication and MPPE (Microsoft Point-to-Point Encryption) for PPTP clients (Windows 95/98/NT/2000/ME notebook computers and PCs), allowing PPTP clients to act as workstations on remote networks, using the Internet to transport the (encrypted) data.

PPTP is the easiest and most common method of establishing a connection for casual VPN access. PPTP however, provides a less secure VPN tunnel than IPSec making it unsuitable for permanent or network-to-network connections. IPSec is available in the ePipe Site to Site VPN (SSV) feature set for permanent VPN connections between networks. In order to activate the PPTP, the SRA feature set must be purchased.

Back to Top

SRA Network Setup

In this typical SRA setup, the LAN to which the mobile workers need access is using the IP network address 192.168.1.0, subnet mask 255.255.255.0. The ePipe is 192.168.1.1 on the LAN, and 203.4.149.43 to the Internet. The address range of 192.168.2.1 to 192.168.2.10 is assigned to incoming PPTP connections in the SRA setup wizard on the ePipe. Once an incoming connection is made, the network looks like this:

Back to Top

SRA Server Setup

Before starting the SRA Setup Wizard you will need to have, or consider the following:

An ePipe with the SRA feature set activated - learn more about SRA in the 'Using ePipe' section of the documentation. Alternatively if you are seeking to enable SRA, see the Feature Set Activation area on the ePipe website.
A permanent or fixed IP address on one of the ePipe's connections to the Internet. This is required so that the address can be contacted by the PPTP client. Contact your ISP about obtaining a fixed IP address.
A range of IP addresses for the PPTP server and clients to use. These can either be IP addresses on the same subnet as the rest of your LAN, or on a separate subnet. The ePipe will route automatically between the two subnets. The range of addresses should be large enough to have an address for each client that will be connected at any one time, and a single address for the server (the server will take the first address in the range).
The type of authentication you wish to use for your PPTP connections. In situations where you have a large number of users it may be wise to consider using a RADIUS server and having the ePipe authenticate all connections against it. If you prefer to configure the user accounts in the ePipe then you may want to have one account for all connections or a separate account for each user. In either case, you will need to choose your accounts and their matching passwords. For information on RADIUS servers, consult the various vendors of RADIUS servers that are currently on the market. RADIUS servers are software applications that run on operating systems such as Windows NT/2000, Linux and most UNIX variants.

SRA setup is relatively simple. To set up SRA, go to the Setup page in the ePipe Management Assistant and start the SRA Setup Wizard, then click on the Secure Remote Access (PPTP Server) option. If you require help during the setup process, the Information button on each screen will provide help for each option.

If required, PPTP setup can be accomplished and checked on through the Command Line Interface, using the change internet pptp command, and status of the PPTP server can be checked using the show internet pptp command. PPTP users or sessions can be logged out with the logout port pptp command.

Back to Top

SRA Client Setup

Introduction

Client set-up will differ according to the operating system on the client computer. Setting up a PPTP client will require information about the network to which it will be connected. Client machine settings such as login name, domain, etc. must be obtained from the person responsible for maintaining the network. We recommend asking your system administrator for assistance in setting up your SRA connection. Configuring a PPTP tunnel in a Microsoft Windows environment is, in many ways, similar to a Dial Up Networking (DUN) connection, but utilizes an existing Internet connection rather than dialling directly into the remote network.

PPTP is available through Microsoft Windows’ Dial-up Networking, which is included with Windows 95, 98, ME, NT and 2000. Some versions of Windows may require the installation of a networking software upgrade to enable PPTP. Windows 95 will require both the Dial-Up Networking 1.3 update and the Virtual Private Networking Update. Windows 98 only requires the Virtual Private Networking Update. For Windows NT4 we recommend you install Service Pack 6. These upgrades are available from the Microsoft Web site. Windows 98SE, Windows ME and Windows 2000 all come with PPTP included in an up to date form.

See the Application Notes available in the support area on the ePipe website for further details.

Windows Operating System requirements to act as a PPTP client:

The following table specifies the minimum requirements needed by a windows operating system in order for it to act as a PPTP client. Also listed are links to comprehensive client setup guides for WIndows 95/98/ME/2000.

Windows 2000 Client Setup
Windows 95/98/ME Client Setup

Operating System	Minimum requirements
Windows 95	Microsoft Dial Up Networking1.3 Security and Performance Update. VPN update for Windows 95 and 98. Microsoft DUN 1.3 and Winsock2 Year 2000 Update. See the following URL: http://www.microsoft.com/windows95/downloads/
Windows 98	VPN update for Windows 95 and 98. See the following URL: http://www.microsoft.com/windows98/downloads/corporate.asp
Windows 98 SE (Second Edition)	No additional software required.
Windows NT 4.0	Install Windows NT 4 Service Pack 6a for the latest updates. See the following URL: http://www.microsoft.com/ntserver/nts/downloads/
Windows ME	No additional software required.
Windows 2000	No additional software required.

Back to Top

ePipe VPN and Security Products: Secure Remote Access

Introduction

SRA Network Setup

SRA Server Setup

SRA Client Setup

Introduction

ePipe VPN and Security Products:
Secure Remote Access