Windows Server 2008 R2 : Choosing Between Traditional VPN Technologies and DirectAccess

Within the VPNs technologies are a number of choices, primarily whether to use L2TP/IPSec or PPTP.

Advantages of L2TP/IPSec

Although PPTP users significantly outnumber L2TP/IPSec users, because of a higher level of security in L2TP/IPSec as well as several other benefits of L2TP/IPSec, organizations that are seeking to improve secured remote connectivity are beginning to implement L2TP/IPSec VPN as their remote and mobile access standard. The following are the advantages of using L2TP/IPSec over PPTP:

• IPSec provides per-packet data authentication (proof that the data was sent by the authorized user), data integrity (proof that the data was not modified in transit), replay protection (prevention from resending a stream of captured packets), and data confidentiality (prevention from interpreting captured packets without the encryption key). PPTP provides only per-packet data confidentiality.

• L2TP/IPSec connections provide stronger authentication by requiring both computer-level authentication through certificates and user-level authentication through a PPP authentication protocol.

• PPP packets exchanged during user-level authentication are never sent unencrypted because the PPP connection process for L2TP/IPSec occurs after the IPSec security associations are established. If intercepted, the PPP authentication exchange for some types of PPP authentication protocols can be used to perform offline dictionary attacks and determine user passwords. If the PPP authentication exchange is encrypted, offline dictionary attacks are possible only after the encrypted packets have been successfully decrypted.

Advantages of PPTP

Although L2TP/IPSec is more secure than a PPTP VPN session, there are significant reasons organizations choose PPTP over L2TP/IPSec. The following are advantages of PPTP over L2TP/IPSec:

• PPTP does not require a certificate infrastructure. L2TP/IPSec, SSTP, and DirectAccess require a certificate infrastructure for issuing computer certificates to the VPN server computer (or other authenticating server) and all VPN client computers.

• PPTP can be used by all Windows desktop platforms (Windows Server 2008, Windows Server 2008 R2, Windows Server 2003, Windows 2000 Server, Windows 7, Windows Vista, Windows XP, Windows 2000 client, Windows NT 4.0, Windows Millennium Edition [Me], Windows 98, and Windows 95 with the Windows Dial-Up Networking 1.3 Performance and Security Update). Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 2000 Server, Windows 7, Windows Vista, Windows XP, and Windows 2000 Workstation VPN clients are the only clients that support L2TP/IPSec and the use of certificates. Windows 7 is the only client that supports DirectAccess.

IPSec functions at a layer below the TCP/IP stack. This layer is controlled by a security policy on each computer and a negotiated security association between the sender and receiver. The policy consists of a set of filters and associated security behaviors. If a packet’s IP address, protocol, and port number match a filter, the packet is subject to the associated security behavior.

Advantages of SSTP

The SSTP protocol in Windows Server 2008 R2 gives administrators the capability to establish tunnels across the majority of corporate networks, bypassing many of the technical hurdles that stop PPTP and L2TP.

The advantages of SSTP are as follows:

• SSTP helps lower administrative costs by reducing the technical steps needed to tunnel between organizations. Because HTTPS is allowed through most firewalls and proxy servers, there is no additional infrastructure changes needed to support SSTP.

• SSTP is certificate-based security implemented via SSL. However, certificates only need to be issued to the servers rather than the clients. This provides the security benefits of L2TP, but with almost the ease of configuration of PPTP.

The benefits are offset by the requirement that the client Certificate Authority requirements and the operating system requirement. The client requirement is that it trusts the CA issuing the certificates and that it can access the certificate revocation list.

Support for SSTP in clients is available in Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows XP SP3 or later, and Windows Vista SP1 or later.

Advantages of DirectAccess

DirectAccess is a new technology introduced with Windows Server 2008 R2 and is a completely new idea for remote access. Essentially, DirectAccess is a transparent always-on remote access. It allows users to always appear to be on the corporate network and appear as if they are in the office. In addition, it allows administrators to manage systems as local systems through tools like Group Policy and Microsoft System Center Configuration Manager (SCCM). From a user perspective, this is the easiest remote access solution. Once configured, they don’t need to perform any action; it just works. From an administrator point of view, however, this solution is the most complex due to the IPv6 and certificate requirements.

The advantages of DirectAccess are as follows:

• DirectAccess provides seamless connectivity wherever a remote system has an Internet connection. No user interaction is required.

• System administrators can manage remotely connected systems as if they were internal systems.

• DirectAccess allows folder redirection so that all critical data is maintained inside the corporate network and backed up using enterprise tools.

• DirectAccess uses a new technology, Name Resolution Policy Table (NRPT), to determine the appropriate DNS server for connection requests. Combined with split-tunneling, this makes for a truly transparent solution.

Despite these benefits, DirectAccess can be somewhat complex to implement. If most of the pieces, such as IPv6, PKI, and Windows 7 on the desktop are already in place, DirectAccess might be the best overall remote access solution for Windows Server 2008 R2.

Ports Affecting the VPN Connectivity

Frequently, RRAS servers operating as VPN servers have two network cards, one of which is plugged into the external network or DMZ. This is simpler, as there are typically few restrictions on communicating with that externally facing interface. The RRAS server is firewalled and the externally facing interface is hardened as a matter of best practice to mitigate the potential risks. In fact, this is a requirement for DirectAccess servers.

However, even with mitigation steps, this externally facing interface can present an unacceptable level of risk to some organizations. In those cases, the VPN infrastructure must remain entirely within the internal network. In that configuration, the firewall must be configured to allow the appropriate traffic to the RRAS server.

Table 1 and Table 2 list the relevant firewall rules needed for the PPTP and L2TP protocols. The IP address for each of the rules is the RRAS server address, which is the destination if the direction is inbound and the source if the direction is outbound.

The SSTP protocol is simple and only requires that TCP port 443 be permitted inbound to the RRAS server.