howto://configure pptp vpn support on tmg 2010

In this post, we’re going to go through setting up our TMG 2010 server to support client PPTP VPN. We’ll go over why PPTP is a good choice for many businesses, the basic network setup involved, and then finally, how to actually configure our TMG server to support PPTP clients.

Much of what we will cover here is the same for other VPN protocols. You can either use this post and skip ahead to configuring the other protocols, or stay tuned…we’ll be covering L2TP/IPSEC,  SSTP, and IKEv2 in upcoming posts. If this sounds like the post for you, please read on.

Finding the right balance between security and usability

I am sure that some of you are reading this and thinking I am off my nut for recommending PPTP over SSTP, L2TP/IPSec, or IKEv2. I may be off my nut, but not about this. Here is why. PPTP is the one VPN protocol that is the common denominator or universal dialect amongst all our diverse platforms. Whether you have any version of Windows, Mac OSX, Linux, iPod Touch, iPhone, or Droid, you have PPTP support, and you have it built-in (or in the case of some Linux distros, a simple package add away.) TMG offers other protocols, but they are Windows-focused. PPTP support means you can supply a secure connection to any device you have. Using MPPE with 128bit encryption and authenticating against AD using MS-CHAP2, and with a strong password policy and account lockout, should cover your bases in all but the most stringent requirements. Yes, you do NOT get mutual authentication with PPTP (unless you implement some EAP methods that will reduce the ubiquity of this solution,) but this post is more about supporting diverse clients securely, and less about just how thick the tinfoil hat is. If your situation requires 3DES or AES, and mutual authentication, skip this post and come back in a few….I should have something on that soon. If your situation includes trying to support the VP of Marketing’s Mac, and your Linux box, and your boss’s iPhone….well this post is for you. Been there, done that, wrote the post.

Prerequisites

In this post, our TMG 2010 server is directly connected to the Internet on its external NIC (live ip.addr, no other firewall in front of it) and we have an another NIC directly connected to the internal network. We’re using the DHCP service provided by another server on the internal network which is assigning VPN clients ip.addrs directly on the internal segment. In other words, a fairly vanilla setup. Also, we’re not split-tunneling. All traffic comes home once the VPN client is connected, and anything destined for the Internet will route back out. Why, you ask? There are times when I have to use an open wireless network. I’d much rather tunnel ALL of my traffic over the VPN, than only protect what I am sending home. See this post if you’d like to know more about the dangers of open wireless hotspots. I think you’ll agree that it is worth the extra bandwidth to provide more protection to our users.

Setting it up

The TMG Management Console divides this up into six sections, which makes for a pretty straightforward setup until you find that many of the steps take you to different tabs on the same dialog. We’re going to hit them the first time they pop up instead of running this strictly by the numbers. Browse down to Remote Access Policy (VPN), click it and then click on Configure Address Assignment Method to begin.

Step One-Configure Address Assignment Method

Click on the Configure Address Assignment Method, which brings up a new dialog that we begin on the second tab, which is kind of strange, but we can work with it. Here, since we are using a DHCP server on the internal network, we select the radio button for DHCP, and choose the Internal network from the drop down list for name resolution services.

If you want to set a static range, click that a radio button, select your server from the dropdown, enter your starting and ending address, and then click OK. Then clicked the Advanced button at the bottom of this tab to enter DNS and WINS server information.

Step Two-Access Networks

Click the Access Networks tab and make sure that both External and Internal networks are checked. That allows our VPN clients to connect from both our internal network (useful for testing) and the Internet.

Step Three-Authentication

Now click on the Authentication tab. To get PPTP up and running with the most secure password encryption, we’re going to only check MS-CHAPv2.

Since we are not going to use RADIUS in this post, click OK.

Step Four-Specify Windows Users

Click on Specify Windows Users and once again, land on the second tab of the dialog box. Here, you can add the AD group(s) that you want to permit to connect to your VPN. If that is everybody, select Domain Users.

Then click on the General tab, make sure the check box is set to Enable VPN client access, and enter the maximum number of concurrent connections you want to allow.

Then click the Protocols tab. Since today we are only doing PPTP, that is all you need to check.

User Mapping is for RADIUS and EAP, and we’re not using either this time. Quarantine is something to play with AFTER you get connections working so for now, resist the urge to click anything else except OK. Since a lot of what quarantine can do is limited to domain computers, we’re going to leave that for another post on another day.

Step Five-Configure your firewall policy

Click on View Firewall Policy for the VPN Clients Network to go back to your Firewall Policy. You can restrict access to the Internet for VPN clients, and if you put them on a different network segment than the internal, you can even limit their connections to the internal network. Since I am setting this up for trusted clients that already have full access to the internal network, and open access to the Internet, I just need to make sure that they TMG defined network “VPN Clients” is in the AllowAllOutbound rule that I created back here.

Make any desired changes to this for your level of comfort, and then click back on Remote Access Policy (VPN) to continue.

Step Six-View Network Rules

If you are connecting your VPN clients directly to the Internal network, they will be sharing the internal interface of your TMG. If you want to create a virtual subnet for VPN clients, you can either decide to route that traffic bi-directionally through your TMG, or you can NAT the VPN clients to the inside network. Here is where you define that. Since we are connecting VPN clients directly, we choose the Route option, which should be selected by default.

Step Seven-Test it out

Get a client on another network, and setup your connection from your client to your TMG using PPTP. If there is another edge device between your TMG and the Internet, you want to make sure that inbound TCP 1723 and bidirectional IP type 47 (GRE) are both open. If all goes well, you will be prompted for your username and password. This happens over TCP 1723 and is encrypted using MS-CHAPv2. Enter your creds and (assuming you have valid credentials for a user who is a member of a permitted group) if GRE is also open, you should be connected. Yay! If you’re not, here’s some troubleshooting tips.

You can use the live logging in TMG to focus on VPN client connections. Browse down to Logs & Reports, edit your filter to look at VPN Client sessions. I like to do this live while the client connects, but you can also look at historical records if you wish.

Always look first for authentication errors. I can’t tell you how many hours I have wasted assuming the user had good information, only to find out they didn’t. Also look for protocol errors, and make sure the client is setup for MS-CHAPv2 to match your requirements.

If you’re having other problems, here’s the links to our VPN troubleshooting series (part one, part two, and part three.) You can check them out, or leave a comment below if you’d like some more help. Until next time, while you are tunneling data securely, enjoy the best song Springsteen’s ever done.

Bruce Springsteen – Tunnel Of Love
Uploaded by jpdc11. – Watch more music videos, in HD!
Direct link for RSS and email subscribers…http://www.dailymotion.com/video/x1ubwj_bruce-springsteen-tunnel-of-love_music

You might also enjoy:

1. howto://configure sstp vpn support on tmg 2010
2. howto://configure Exchange 2010 as an SMTP relay
3. howto://Installing Microsoft Forefront TMG 2010, part two
4. Let me out! Configuring outbound access rules in TMG 2010

Tagged as: firewalls & vpn, howto, isa & tmg