UniOTP VPN Solution: Difference between revisions
No edit summary |
No edit summary |
||
| Line 2: | Line 2: | ||
[[Category:UniOTP Building VPN Solution]] | [[Category:UniOTP Building VPN Solution]] | ||
== About | == Note == | ||
<p>The below steps apply to Windows Server 2003. For more recent versions of Windows Server, the steps may be differ slightly. | |||
== About This Guide == | |||
<!--Check server-client noun--> | <!--Check server-client noun--> | ||
<p>VPN (Virtual Private Network) refers to | <p>VPN (Virtual Private Network) refers to a computer and firewall with VPN capability that can establish a secure tunnel between the server and a client over the internet. In the tunnel initiator (server), the user's private data is encapsulated and encrypted and then transmitted through the internet; on the receiver side (client), the received data is unpacked and decrypted. VPN services are installed with Windows 2000/2003. This manual is based on the installed VPN service, named "Routing and Remote Access". This service can be found from [Start] ? [All Programs] ? [Administrative Tools] ? [Service]. | ||
</p> | </p> | ||
== Routing and Remote Access Configuration == | |||
<p>From [Start] ? [All Programs] ? [Administrative Tools] ? [Routing and Remote Access], open the Routing and Remote Access control panel. Right-Click on Routing and Remote Access] on the left-side of the panel, then select [Add server] to add a VPN server.</p> | |||
[[Image:vpnsol img01.jpg|370px]] | |||
[ | <p>Right click on the newly-added server and select [Configure and Enable Routing and Remote Access]. If the Windows Firewall/Internet Connection Sharing (ICS) service is enabled, the Routing and Remote Access service cannot be turned on, and an ICS service warning message will appear. Configure the ICS service to allow the above operation, then redo the above steps. After Routing and Remote Access is enabled, the following configuration wizard will appear.</p> | ||
<p> | <p>In the "Routing and Remote Access Server Setup Wizard" window, under the "Configuration" step, select [Remote access (dial-up or VPN)] then click [Next].</p> | ||
[[Image:vpnsol img02.jpg|370px]] | [[Image:vpnsol img02.jpg|370px]] | ||
<p> | <p>On the "Remote Access" step, select [VPN] then click [Next].</p> | ||
[[Image:vpnsol img03.jpg|370px]] | [[Image:vpnsol img03.jpg|370px]] | ||
<p>Finish | <p>Click [Finish] after completing the remainder of the wizard to complete the VPN installation.</p> | ||
== VPN Server with UniOTP == | == Configuring the VPN Server with UniOTP == | ||
<p>After | <p>After successfully setting up and configuring the VPN Server, open [Start] ? [All Programs] ? [Administrative Tools] and open the Routing and Remote Access control panel.</p> | ||
[[Image:vpnsol img06.jpg|370px]] | [[Image:vpnsol img06.jpg|370px]] | ||
<p> | <p>In the "Routing and Remote Access" window, right-click on the respective server from the directory list and select [Properties].</p> | ||
[[Image:vpnsol img07.jpg|370px]] | [[Image:vpnsol img07.jpg|370px]] | ||
<p> | <p>In the Properties window, select the [Security] tab, and under "Authentication provider", select [RADIUS Authentication] from the drop-down menu.</p> | ||
[[Image:vpnsol img08.jpg|370px]] | [[Image:vpnsol img08.jpg|370px]] | ||
<p> | <p>Click on [Configure] to configure the RADIUS Authentication server. In the configuration panel, click on [Add] to add a Radius authentication server.</p> | ||
[[Image:vpnsol img09.jpg|370px]] | [[Image:vpnsol img09.jpg|370px]] | ||
<p> | <p>Under the "Add RADIUS Server" window, fill in the UniOTP authentication server name and server details. Afterwards, click on [Change] next to "Secret" to change the RADIUS communication shared key.</p> | ||
[[Image:vpnsol img10.jpg|370px]] | [[Image:vpnsol img10.jpg|370px]] | ||
<p> | <p>In the "Change Secret" window, configure the communication shared key, then click [OK].</p> | ||
[[Image:vpnsol img11.jpg|370px]] | [[Image:vpnsol img11.jpg|370px]] | ||
<p> | <p>The RADIUS Authentication window should now a indicate a Radius server has been added. Click on [OK] to save authentication server configuration.</p> | ||
[[Image:vpnsol img12.jpg|370px]] | [[Image:vpnsol img12.jpg|370px]] | ||
<p> | <p>Returning to the Properties window, click on [Authentication Methods].</p> | ||
[[Image:vpnsol img13.jpg|370px]] | [[Image:vpnsol img13.jpg|370px]] | ||
<p>In the | <p>In the "Authentication Methods" window, check the checkboxes [Extensible authentication protocol (EAP)], [Encrypted authentication (CHAP)] and [Unencrypted password (PAP)].</p> | ||
<p> | <p>''Please Note: Authentication methods [Microsoft encrypted authentication version 2 (MS-CHAP v2)], [Microsoft encrypted authentication (MS-CHAP)] and [Shiva Password Authentication Protocol (SPAP)] are not supported.''</p> | ||
<p>Click on [OK] to apply settings and exit the window.</p> | |||
[[Image:vpnsol img14.jpg|370px]] | [[Image:vpnsol img14.jpg|370px]] | ||
<p>To apply configuration changes, restart the VPN server by right-clicking the server, selecting [All Tasks], [Restart].</p> | |||
<p>To | |||
[[Image:vpnsol img15.jpg|370px]] | [[Image:vpnsol img15.jpg|370px]] | ||
<!----> | |||
== Add VPN Client == | == Add VPN Client == | ||
| Line 127: | Line 119: | ||
[[Image:Vpnsol img25.jpg|370px]] | [[Image:Vpnsol img25.jpg|370px]] | ||
<p>Unselect “Require data | <p>Unselect “Require data encryption”?click on “OK”, and click “Connect” to start connection again. </p> | ||
[[Image:Vpnsol img26.jpg|370px]] | [[Image:Vpnsol img26.jpg|370px]] | ||
Revision as of 14:10, 28 May 2012
Note
The below steps apply to Windows Server 2003. For more recent versions of Windows Server, the steps may be differ slightly.
About This Guide
VPN (Virtual Private Network) refers to a computer and firewall with VPN capability that can establish a secure tunnel between the server and a client over the internet. In the tunnel initiator (server), the user's private data is encapsulated and encrypted and then transmitted through the internet; on the receiver side (client), the received data is unpacked and decrypted. VPN services are installed with Windows 2000/2003. This manual is based on the installed VPN service, named "Routing and Remote Access". This service can be found from [Start] ? [All Programs] ? [Administrative Tools] ? [Service].
Routing and Remote Access Configuration
From [Start] ? [All Programs] ? [Administrative Tools] ? [Routing and Remote Access], open the Routing and Remote Access control panel. Right-Click on Routing and Remote Access] on the left-side of the panel, then select [Add server] to add a VPN server.
Right click on the newly-added server and select [Configure and Enable Routing and Remote Access]. If the Windows Firewall/Internet Connection Sharing (ICS) service is enabled, the Routing and Remote Access service cannot be turned on, and an ICS service warning message will appear. Configure the ICS service to allow the above operation, then redo the above steps. After Routing and Remote Access is enabled, the following configuration wizard will appear.
In the "Routing and Remote Access Server Setup Wizard" window, under the "Configuration" step, select [Remote access (dial-up or VPN)] then click [Next].
On the "Remote Access" step, select [VPN] then click [Next].
Click [Finish] after completing the remainder of the wizard to complete the VPN installation.
Configuring the VPN Server with UniOTP
After successfully setting up and configuring the VPN Server, open [Start] ? [All Programs] ? [Administrative Tools] and open the Routing and Remote Access control panel.
In the "Routing and Remote Access" window, right-click on the respective server from the directory list and select [Properties].
In the Properties window, select the [Security] tab, and under "Authentication provider", select [RADIUS Authentication] from the drop-down menu.
Click on [Configure] to configure the RADIUS Authentication server. In the configuration panel, click on [Add] to add a Radius authentication server.
Under the "Add RADIUS Server" window, fill in the UniOTP authentication server name and server details. Afterwards, click on [Change] next to "Secret" to change the RADIUS communication shared key.
In the "Change Secret" window, configure the communication shared key, then click [OK].
The RADIUS Authentication window should now a indicate a Radius server has been added. Click on [OK] to save authentication server configuration.
Returning to the Properties window, click on [Authentication Methods].
In the "Authentication Methods" window, check the checkboxes [Extensible authentication protocol (EAP)], [Encrypted authentication (CHAP)] and [Unencrypted password (PAP)].
Please Note: Authentication methods [Microsoft encrypted authentication version 2 (MS-CHAP v2)], [Microsoft encrypted authentication (MS-CHAP)] and [Shiva Password Authentication Protocol (SPAP)] are not supported.
Click on [OK] to apply settings and exit the window.
To apply configuration changes, restart the VPN server by right-clicking the server, selecting [All Tasks], [Restart].
Add VPN Client
Right click on the Network icon to open network connection control panel.
Clicking on “Create a new connection”, a set up window will pop up.
Select “Connect to the network at my workplace”, and then click “Next”
Select “Virtual Private Network connection”, and then click on “Next”
Enter the VPN name or IP address, and click on “Next”.
You can choose “Add a shortcut to this connection to my desktop” in the following window and click “Finish”.
After configuration, a window will appear.
If you have added a VPN access user, and bound this user to a dynamic token, you can use that dynamic password and PIN (if OTP+PIN authentication method has been selected) to connect to the VPN. When following this manual, a Guest account has been added to VPN Server and to the UniOTP dynamic password authentication system, therefore Guest and OTP + PIN (for Guest account the authentication method is OTP + PIN) need to be filled into this window. Please Click “Connect”
The following error may happen:
To solve this error, please click “Properties”
Unselect “Require data encryption”?click on “OK”, and click “Connect” to start connection again.
After connecting to VPN server successfully, on the lower right corner of the screen, the following information will appear indicating that the configuration of VPN with UniOTP authentication has been completed successfully.
Appendix
Common errors upon VPN clients connecting to the server
| Error Code |
Reason |
| 800 |
Unable to establish the VPN connection. The VPN server may be un-reachable, or security parameters may not be configured properly for this connection |
| 619 |
In most cases, it is caused by that the NAT-T function used for client to connect to internet is turned off or bad VPN support that does not support NAT-T in GRE and PPTP protocol. To solve this problem, you can turn on the gateway’s NAT-T. If this error happens frequently, please change the gateway equipment. |
| 721 |
In most cases, this problem is caused by client system. If users are using Windows XP SP2, this problem may happens, and you can solve it through modifying registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\<000x>. <000x> is the network adapter of the Satellite WAN port (PPTP) driver. In this key, create a new DWORD value, name ValidataAddress and value 0. If the configuration of the PPP protocol on the server is not correct, it will cause this problem as well. |
| 718 |
Wrong user name or password when dial-up, or authentication service errors occur on authentication server. |
| 734 |
Mostly it is caused by VPN configuration problem, such like PPP configuration, unsupported or bad supported MPPE. |
