Point-to-Point Tunneling Protocol

Next, the Client
Now that you have successfully configured your server to accept PPTP traffic, you need to configure each workstation you plan to use. Install PPTP following the same steps you did for the server. Add your VPN device to RAS, but this time, configure the VPN device for Dial out only, as Screen 6 shows. Click Network to modify the protocols RAS can use to dial out. Be sure to include TCP/IP and the protocols you want to access on your private network (IPX or NetBEUI).

As I mentioned earlier, the client must have a functioning Internet connection. Connect your client to the Internet now.

Now you need to create a new entry in the DUN phone book to define the PPTP connection. Select Dial-Up Networking from Programs, Accessories. Create a new DUN connection using your VPN port, but instead of entering a phone number, enter the server's IP address or fully qualified domain name (if it is registered in Domain Name System--DNS), as Screen 7 shows. On the Server tab, select all the protocols (TCP/IP, IPX, and NetBEUI) on your private network that you need to access. On the Security tab, select the Accept only Microsoft encrypted authentication and Require data encryption options shown in Screen 8. Another option is Use current username and password. You can use this option if you expect your username and password on this workstation to be the same as they are in the domain you're dialing into. If you have configured everything correctly, you can now dial up your PPTP connection and connect to your private network.

A Word About Security and Performance
Now, before you tell your CIO that you plan to route your company's sensitive remote-access data over the Internet, make sure that you can answer some obvious questions. I can't cover these issues in depth, but let's review some basics of security and performance.

Microsoft's RAS server uses 40-bit RSA RC4 data encryption, derived from what is called a "shared secret"--your password. The client encrypts its data using your password, and the server does the same with its copy of your password from the security database. Because both systems (client and server) know what your password is, it never has to travel across the Internet unencrypted. This function solves a major security problem, key distribution. Both systems simply use that shared key to perform their encryption. This encryption method is extremely secure (as secure as it can be without exceeding US federal export regulations) so you can feel safe about your data being encrypted with this method. Thousands of credit card transactions occur on the Internet every day using encryption based on similar technologies. For more information on RSA encryption, or PPTP's use of RSA encryption, you can read RSA's FAQ 3.0 on Cryptography at http://www.rsa.com/rsalabs/newfaq, or view Microsoft's PPTP FAQ at http://www.microsoft.com/ntserver/info/pptpfaq.htm.

Obviously, performance over the public Internet won't be as fast as your dedicated dial-up circuits. First, you share a finite amount of bandwidth with several million other users. Keep in mind that the Internet is getting slower as time goes on. Second, running a tunneling protocol has unavoidable overhead, although Microsoft has designed PPTP to minimize overhead.

Because several factors come into play, I can't give you a rule of thumb about how PPTP will affect your system's performance. You will have to try PPTP for a while so you can weigh the cost benefits against the performance hits to determine whether PPTP is a workable solution for your organization.

The Future of PPTP
Although you can't underestimate Microsoft's marketing muscle, you need to evaluate the future of any new technology before rushing headlong into an implementation. In developing and promoting the PPTP standard, Microsoft has joined with several partners, including such name-brand players as 3Com, Ascend Communications, U.S. Robotics, and major ISPs such as UUNET. The primary competition for PPTP is a protocol called Layer 2 Forwarding (L2F). Cisco Systems developed L2F, and the protocol has gained support from Shiva and Northern Telecom. Each protocol has its strengths and weaknesses, and both protocols will meet your VPN needs adequately. To make things even more confusing, the Internet Engineering Task Force (IETF) apparently hasn't endorsed either protocol. Instead, IETF will release a final draft of a hybrid protocol, Layering 2 Tunneling Protocol (L2TP), later this year.

Microsoft currently supports PPTP only for NT 4.0. Microsoft originally expected to have support for Windows 95 by the end of 1996, but that date slipped into mid-1997 and is now expected as part of Memphis. In the interim, you have some options. Some ISPs are implementing PPTP services, so that you need to make only a PPP connection to these services. They will handle the tunneling back to your corporate network. Ask your ISP whether it offers PPTP and how you can configure the service.

As Easy As...
Here's another scenario for you. Joe, a manager in your company, tells you that he absolutely must have dial-in access to the company's network from his home PC, some bargain-basement clone you've never heard of. He can't quite tell you how it's configured, but he knows the PC is beige. Ideally, here is your conversation:

You: Can you surf the Net with your PC?

Joe: Oh, yeah. I configured it all myself. I'm running Netscape 97.

You (after rolling your eyes): Great. Here's our PPTP server's IP address. See you on the network.

I admit I'm oversimplifying. But as industry support for PPTP continues to grow, that scenario isn't unthinkable in the near future.