-
The VPN client contacts the VPN server.
In the first stage of a VPN connection attempt, the VPN
client attempts to contact the VPN server. Successful completion
of this stage requires the client to be properly configured with
the IP address of the VPN server. The VPN server also needs to be
publicly available. If the VPN server is located behind a
firewall, the firewall needs to be configured to allow the VPN
client access.
-
The VPN tunnel is negotiated.
After the VPN client contacts the VPN server, it submits a
request for a tunnel type. A VPN network connection can be set to
any of five settings: Automatic, PPTP, L2TP/IPSec, SSTP, and
IKEv2, as shown in Figure 1.
The default setting is Automatic. According to this setting,
the VPN connection makes VPN protocol requests in the following
order: IKEv2, SSTP, PPTP and L2TP/IPSec. The VPN type that is
negotiated eventually is the first for which the VPN server can
answer the request.
During this phase, the authentication protocol is also
negotiated. For IKEv2 VPNs, the EAP-MSCHAPv2 authentication
protocol is used. For other VPN types, MS-CHAPv2 is preferred if
it is also available on the VPN server. Otherwise, CHAP is
requested.
Finally, encryption is negotiated during this phase. Like
authentication settings, encryption settings are defined on the
Security tab in a VPN connection Properties dialog box in Windows
7, as shown in Figure 2. For
encryption to be negotiated properly, the client settings defined
here must be compatible with those defined on the VPN server. For
example, if Maximum Strength Encryption is defined on the client,
the server must be able to provide maximum strength encryption or
the VPN connection fails.
-
The VPN tunnel is created.
If the VPN tunnel type, authentication protocol, and
encryption strength can be agreed upon, the VPN tunnel is created
between the VPN client and VPN server. After this point, all
exchanges are encrypted.
In the case of IKEv2 and SSTP VPNs, the tunnel creation is
performed with the help of the VPN server's computer certificate.
The VPN client must therefore be able to validate the certificate;
to do so, the certificate of the issuing root CA must be installed
in the Trusted Root Certification Authorities store on the VPN
client computer.
In the case of L2TP/IPSec VPNs, preshared keys or computer
certificates are used to create the encryption terms for the
tunnel. These elements must therefore be configured properly for
the negotiation to work. (PPTP VPNs use Microsoft Point-to-Point
Encryption to create the secure tunnel and do not require a
PKI.)
A final requirement for a VPN tunnel to be negotiated is
that the VPN client-server communication must be able to traverse
the network elements that lie between them. For example, if a
firewall is located between the VPN client and server, the ports
used by the VPN protocol must be left open. If a NAT device is
located between the VPN client and server, the VPN protocol must
be able to traverse that NAT device.
-
Remote access authentication is performed.
During this phase, the user credentials submitted with the
VPN connection request are sent to the VPN server by using the
previously agreed upon authentication protocol. The VPN server
then either performs the authentication locally, or forwards the
authentication request to an available domain controller, or
forwards the authentication request to a RADIUS server. For this
step to occur, the VPN user must submit proper credentials, and
the VPN server must be configured to forward the authentication to
the appropriate location.
-
Remote access authorization is performed.
In this phase, the user account properties are checked to
verify that the user is authorized for remote access. Then, the
list of network policies configured on the VPN server or NPS
server is checked. The first policy whose conditions match the
connection request is applied to that request and then either
allows or denies the request. Note that constraints (such as time
of day) that affect the authorization of the connection request
might also be defined in the policy.
-
The VPN connection is established.
If the remote access connection request is authorized, the
VPN server allows the VPN user to log on to the domain. After
domain logon occurs, the VPN user has access to the corporate
network.
