For many years, I lived with PPTP as my remote access VPN protocol, despite its security weaknesses. With the arrival of Windows 2000, I looked forward to trying Layer Two Tunneling Protocol (L2TP) but I soon became painfully aware of some problems when using L2TP with Network Address Translation (NAT)—more about that later.
You can use L2TP to establish a fully manageable, highly secure remote access VPN that supports Windows 95 and later clients. You will, however, need to tackle certain problems associated with remote users who are behind a NAT firewall, client configuration, certificate configuration, authentication, and locking everything down. Keep in mind that while I was writing this article, I used the beta version of Windows Server 2003; the final version is now available. Let's begin by looking at L2TP as a core component of a secure remote access VPN.
Advancing Encryption Protocols
PPTP is vulnerable to man-in-the-middle attacks related to data integrity and data origination, but the biggest problem is that it supports only single-factor, password-based authentication. As a result, if an intruder steals or guesses an employee's password, that intruder can access your company's network. Two-factor authentication, which consists of something you know (e.g., a password) and something you have (e.g., a secure key card, a certificate), is much more difficult to compromise. You can use Extensible Authentication Protocol–Transport Layer Security (EAP-TLS) in Windows XP and later with PPTP and thereby replace user passwords with user certificates. However, PPTP with EAP-TLS is still single-factor authentication and doesn't address PPTP's network vulnerabilities. Also, certificates aren't portable. As a result, if a user needs to borrow a coworker's notebook or you need to replace a broken laptop for a user who's on the road, you run into complications because you must install the user-specific certificate on the computer before that user can connect to the VPN to access your network.
Although Microsoft has bandaged PPTP over the years to keep it viable (see "Is PPTP Safe?," May 1999, http://www.winnetmag.com, InstantDoc ID 5188), L2TP relies on a much more solid, standards-based foundation of strong two-factor authentication, encryption, and data integrity. When you use L2TP to connect to a VPN server, L2TP uses the client and server computers' certificates to authenticate the systems. Upon successful authentication, L2TP sets up an IP Security (IPSec) connection in Encapsulating Security Payload (ESP) mode. (As you might be aware, IPSec is a highly respected protocol that provides privacy, data integrity, and authentication for every packet.) To this point, L2TP has encrypted all of the data traveling through the VPN on the Internet, protected the connection from man-in-the-middle attacks, and completed the first level of authentication. If you're concerned about the obvious requirement to provision all your computers with certificates, don't be—Microsoft provides some great tools (e.g., Group Policy to automate certificate enrollment, Connection Manager Administration Kit—CMAK—to automate the rollout of VPN clients) to help you accomplish this task and many others that relate to deploying an industrial-strength remote access VPN.
Next, L2TP authenticates the user. You have several methods to choose from, but let's discuss using the user's network account password. You must also select which authentication protocol L2TP will use to verify the user's password. At first glance, that decision might seem unimportant because you're already using IPSec. However, don't forget that your VPN server must communicate with the domain controller (DC) to complete user-level authentication. As a result, the authentication protocol can be an important factor in protecting the user's password from being stolen by an eavesdropper on your internal network. After L2TP successfully authenticates the user, you'll have a secure tunnel over the Internet to your network; this tunnel will provide the same access you have when you connect locally, albeit a bit slower.
Although I was excited about the arrival of L2TP with Win2K, I soon discovered a problem. After I set up L2TP, I was able to connect to my VPN server from the road when I connected to the Internet through my global ISP. However, when I plugged in my laptop to a client's LAN and tried to connect to my VPN server, L2TP failed with error code 791: The L2TP connection attempt failed because security policy for the connection was not found. The problem occurred because like many companies, my client uses NAT to hide the internal network from the Internet. Because NAT changes TCP and UDP port numbers when you pass packets between the Internet and intranet, IPSec's data-integrity checking fails with L2TP. This limitation prevents many companies from using L2TP as a viable remote access protocol because many remote users connect from other business partner LANs or from home networks, both of which commonly use NAT.
To solve this problem, industry leaders, including Microsoft, Nortel Networks, F-Secure, and Cisco Systems, developed NAT-Transversal (NAT-T); a draft document for this new standard is available at the Internet Engineering Task Force (IETF) Web site at http://www.ietf.org/internet-drafts/draft-ietf-ipsec-udp-encaps-06.txt. NAT-T provides a way for two computers to detect the presence of one or more NAT devices between them and then switch to encapsulating the usual IPSec packets inside UDP port 4500 packets. At the time of publication, Microsoft plans to support Win98 and later as VPN clients by using L2TP with NAT-T. Although you can use earlier clients and Win2K DCs and Certificate Authorities (CAs), your VPN server must run Windows 2003.
Creating a Sample L2TP VPN Configuration
To demonstrate how to set up an L2TP VPN, let's look at a sample configuration. For starters, let's assume our domain is hosted by Win2K DCs with a mix of XP, Windows NT, and Win9x clients all on one LAN segment, as Figure 1 shows. To provide L2TP/NAT-T–capable access to remote users, you need to add a Windows 2003 server. All Windows 2003 editions, except for Windows 2003, Web Edition, support at least 1000 simultaneous VPN connections.
Previous
Register
