Vasco aXsGUARD Gatekeeper Manuel utilisateur
aXsGUARD Gatekeeper
PPTP How To
1.7
Table of Contents
1. Introduction
1.1. Audience and Purpose of this Document
1.2. Available Guides
1.3. What is the aXsGUARD Gatekeeper?
1.4. About VASCO
2. General Concepts
2.1. Overview
2.2. What is a Virtual Private Network?
2.3. What is PPTP?
2.3.1. Protocol Description
2.3.2. Key Elements of PPTP Security
2.4. Standard PPTP Deployment
2.5. Routing Scenarios
2.5.1. Overview
2.5.2. Source and Destination Address in Dierent IP Ranges
2.5.3. Source and Destination address in the Same IP Range
2.6. Firewalls and PPTP
3. PPTP Server Conguration
3.1. Overview
3.2. Activating the PPTP Server
3.3. General Conguration Settings
3.4. Authentication Settings
3.4.1. Recommended Method
3.4.2. Supported Authentication Methods
3.4.3. Conguring the Authentication Method
3.5. User Settings
3.6. PPTP Firewall Settings
3.6.1. Overview
3.6.2. Allowing PPTP Trac
3.6.3. Firewall Rights
3.6.4. Example of Firewall Settings for PPTP
3.7. Logging
© VASCO Data Security 2011 1
4. PPTP Client Conguration
4.1. Overview
4.2. Client-Side Firewall
4.3. Windows XP Conguration
4.4. Windows Vista Conguration
4.5. Windows 7 Conguration
5. Troubleshooting
5.1. Client-Side Troubleshooting
5.2. Server-Side Troubleshooting
6. Support
6.1. Overview
6.2. If you encounter a problem
6.3. Return procedure if you have a hardware failure
Alphabetical Index
© VASCO Data Security 2011 2
List of Figures
2.1. VPN Concept
2.2. PPTP Packet
2.3. PPTP Control and Data Channel
2.4. Listing the PPP Device with ipcong
2.5. PPTP Client and PPTP Server with dierent IP ranges
2.6. PPTP Client and PPTP Server in same IP Range
2.7. Consequences of Compromised Client
3.1. PPTP Feature Activation
3.2. PPTP General Conguration Settings
3.3. PPTP Authentication Settings
3.4. User Settings
3.5. Firewall Conguration
3.6. Automatic Activation of Firewall Rules
3.7. User Level Firewall Settings
3.8. PPTP Log entries
4.1. Windows XP Network Connections
4.2. Connecting to the Network at my Workplace
4.3. Virtual Private Connection
4.4. Connection Name
4.5. VPN Server Selection
4.6. PPTP VPN Properties
4.7. Require Data Encryption
4.8. Windows Vista PPTP Setup
4.9. Set up a Connection or Network
4.10. Connect to a Workplace
4.11. Use My Internet Connection
4.12. Connection IP and Description
4.13. User Name and Password Screen
4.14. Final Conguration Step
4.15. Connecting to the PPTP Server
4.16. Connection Successful
4.17. PPTP Connection Status
4.18. Windows 7 Control Panel
4.19. Windows 7 Control Panel
4.20. Windows 7 Network and Sharing Center
4.21. Set up a New Connection or Network
4.22. Connect to a Workplace
4.23. Creating a New Connection
4.24. Creating a New Connection
4.25. PPTP Connection Settings
4.26. PPTP Connection Settings
4.27. PPTP Status
5.1. Include Windows Logon Domain
5.2. PPTP Error 619
© VASCO Data Security 2011 3
List of Tables
3.1. PPTP General Settings
3.2. PPTP User Settings
3.3. User Level Firewall Settings
© VASCO Data Security 2011 4
List of Examples
3.1. Restricting access to two LAN servers
© VASCO Data Security 2011 5
Document Version. This is version 1.7 of the aXsGUARD Gatekeeper PPTP How To.
VASCO Products. VASCO Data Security, Inc. and/or VASCO Data Security International
GmbH are referred to in this document as ‘VASCO’. VASCO Products comprise Hardware,
Software, Services and Documentation. This document addresses potential and existing
VASCO customers and has been provided to you and your organization for the sole
purpose of helping you to use and evaluate VASCO Products. As such, it does not
constitute a license to use VASCO Software or a contractual agreement to use VASCO
Products.
Disclaimer of Warranties and Limitations of Liabilities. VASCO Products are
provided ‘as is’ without warranty or conditions of any kind, whether implied, statutory, or
related to trade use or dealership, including but not limited to implied warranties of
satisfactory quality, merchantability, title, non-infringement or tness for a particular
purpose. VASCO, VASCO DISTRIBUTORS, RESELLERS AND SUPPLIERS HAVE NO LIABILITY
UNDER ANY CIRCUMSTANCES FOR ANY LOSS, DAMAGE OR EXPENSE INCURRED BY YOU,
YOUR ORGANIZATION OR ANY THIRD PARTY (INCLUDING, WITHOUT LIMITATION,
DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF DATA) ARISING
DIRECTLY OR INDIRECTLY FROM THE USE, OR INABILITY TO USE VASCO SOFTWARE,
HARDWARE, SERVICES OR DOCUMENTATION, REGARDLESS OF THE CAUSE OF THE LOSS,
INCLUDING NEGLIGENCE, EVEN IF VASCO HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES, OR IF THEY WERE FORESEEABLE. OUR MAXIMUM AGGREGATE LIABILITY
TO YOU, AND THAT OF OUR DISTRIBUTORS, RESELLERS AND SUPPLIERS SHALL NOT
EXCEED THE AMOUNT PAID BY YOU FOR THE PRODUCT. THE LIMITATIONS IN THIS
SECTION SHALL APPLY WHETHER OR NOT THE ALLEGED BREACH OR DEFAULT IS A
BREACH OF A FUNDAMENTAL CONDITION OR TERM, OR A FUNDAMENTAL BREACH. THIS
SECTION WILL NOT APPLY ONLY WHEN AND TO THE EXTENT THAT APPLICABLE LAW
SPECIFICALLY REQUIRES LIABILITY DESPITE THE FOREGOING EXCLUSIONS AND
LIMITATIONS.
Intellectual Property and Copyright. VASCO Products contain proprietary and
condential information. VASCO Data Security, Inc. and/or VASCO Data Security
International GmbH own or are licensed under all title, rights and interest in VASCO
Products, updates and upgrades thereof, including copyrights, patent rights, trade secret
rights, mask work rights, database rights and all other intellectual and industrial property
rights. No part of these Products may be transferred, disclosed, reproduced or
transmitted in any form or by any means, electronic, mechanical or otherwise, for any
purpose, except as expressly permitted by VASCO or its authorized licensee in writing.
This document is protected under US and international copyright law as an unpublished
work of authorship. No part of it may be transferred, disclosed, reproduced or
transmitted in any form or by any means, electronic, mechanical or otherwise, for any
purpose, except as expressly permitted in writing by VASCO or its authorized licensee.
Trademarks. VASCO®, VACMAN®, IDENTIKEY®, aXsGUARD™, DIGIPASS®, DIGIPASS as
a Service™ and the ® logo are registered or unregistered trademarks of VASCO
Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other
countries. Other company brand or product names or other designations, denominations,
labels and/or other tags, titles, as well as all URLs (Internet addresses) linked to such
designations or communications (irrespective of whether protected by intellectual
property law or not), mentioned in VASCO Products may be the trademarks or registered
trademarks or be part of any other entitlement of their respective owners.
RADIUS Disclaimer. Information on the RADIUS server provided in this document
relates to its operation in the DIGIPASS as a Service environment. We recommend that
you contact your NAS/RAS vendor for further information.
Copyright © 2011 VASCO Data Security, Inc, VASCO Data Security International GmbH. All rights
reserved.
© VASCO Data Security 2011 6
In this How To, we explain the basic principles of PPTP and how to deploy the
aXsGUARD Gatekeeper PPTP server in your network. This documents is intended
for technical personnel and network administators.
In Chapter 2, General Concepts, we briey explain the concept of Virtual Private
Networking (VPN) and PPTP.
In Chapter 3, PPTP Server Conguration, we explain the dierent conguration
settings of the PPTP server, such as acceptable IP ranges, DNS settings and
recommended user settings. We also explain how to implement DIGIPASS
authentication for PPTP, as this is the most secure authentication method.
In Chapter 4, PPTP Client Conguration, we explain how to congure your
Windows XP, Windows Vista and Windows 7 client to successfully establish a
PPTP connection with the aXsGUARD Gatekeeper PPTP server.
In Chapter 5, Troubleshooting, some solutions are oered to solve diculties.
In Chapter 6, Support, we explain how to request support and return hardware
for replacement.
As software development is an ongoing process, the screens
included in this guide may slightly dier from the software version
installed on your aXsGUARD Gatekeeper appliance.
Other documents in the set of aXsGUARD Gatekeeper documentation include:
• aXsGUARD Gatekeeper Installation Guide, which explains how to set up
the aXsGUARD Gatekeeper, and is intended for technical personnel or
system administrators.
• How to guides, which provide detailed information on the conguration of
each of the features available as add-on modules (explained in
Section 1.3, “What is the aXsGUARD Gatekeeper?”). These guides cover
specic features such as:
• aXsGUARD Gatekeeper Authentication
• aXsGUARD Gatekeeper Firewall
• aXsGUARD Gatekeeper Single Sign-On
• aXsGUARD Gatekeeper VPN
• aXsGUARD Gatekeeper Reverse Proxy
• aXsGUARD Gatekeeper Directory Services
Chapter 1. Introduction
1.1. Audience and Purpose of this Document
1.2. Available Guides
© VASCO Data Security 2011 7
Access to aXsGUARD Gatekeeper guides is provided through the permanently
on-screen Documentation button in the aXsGUARD Gatekeeper Administrator
Tool.
Further resources available include:
• Context-sensitive help, which is accessible in the aXsGUARD Gatekeeper
Administrator Tool through the Help button. This button is permanently
available and displays information related to the current screen.
• Training courses covering features in detail can be organized on demand.
These courses address all levels of expertise. Please see
http://www.vasco.com for further information.
Welcome to aXsGUARD Gatekeeper security.
The aXsGUARD Gatekeeper is an authentication appliance, intended for small
and medium sized enterprises. In addition to strong authentication, the
aXsGUARD Gatekeeper has the potential to manage all of your Internet security
needs. Its modular design means that optional features can be purchased at
any time to support, for example, e-mail and Web access control. The
aXsGUARD Gatekeeper can easily be integrated into existing IT infrastructures
as a stand-alone authentication appliance or as a gateway providing both
authentication services and Internet Security.
Authentication and other features such as rewall, e-mail and Web access, are
managed by security policies, which implement a combination of rules, for
example, whether a user must use a DIGIPASS One-Time Password in
combination with a static password for authentication. Security Policies are
applied to specic users or groups of users and can also be applied to specic
computers and the entire system.
VASCO is a world leader in strong authentication and e-signature solutions,
specializing in online accounts, identities and transactions. As a global software
company, VASCO serves a customer base of approximately 10,000 companies in
over 100 countries, including approximately 1,500 international nancial
institutions. In addition to the nancial sector, VASCO’s technologies secure
sensitive information and transactions for the enterprise security, e-commerce
and e-government industries.
For further information, please visit http://www.vasco.com.
1.3. What is the aXsGUARD Gatekeeper?
1.4. About VASCO
© VASCO Data Security 2011 8
In this section, we explain the general concepts of Virtual Private Networking
(VPN), in particular the Point to Point Tunneling Protocol (PPTP). Topics covered
in the section include:
• The key elements underpinning PPTP: authentication, tunneling and
encryption.
• The standard PPTP deployment: how a PPTP client interacts with a PPTP
server.
A Virtual Private Network (VPN) is a network which uses a public (inherently
insecure) network infrastructure, such as the Internet, to provide a private
(secured) connection between hosts and network applications. A VPN also
ensures the integrity of data as it traverses the Internet, through authentication,
tunneling and encryption. In other words, a VPN allows roaming or remote users
to securely connect to corporate LAN resources, such as shared folders,
applications, databases or e-mail. Several VPN protocols are available, such as
the PPTP protocol explained in this manual.
Chapter 2. General
Concepts
2.1. Overview
2.2. What is a Virtual Private Network?
Figure 2.1. VPN Concept
© VASCO Data Security 2011 9
Table des matières
Autres manuels Vasco Porte
Manuels Porte populaires d'autres marques
LST
LST M500RFE-AS Manuel utilisateur
Kinnex
Kinnex Media Gateway Manuel utilisateur
2N Telekomunikace
2N Telekomunikace 2N StarGate Manuel utilisateur
Mitsubishi Heavy Industries
Mitsubishi Heavy Industries Superlink SC-WBGW256 Manuel utilisateur
ZyXEL Communications
ZyXEL Communications ZYWALL2 ET 2WE Manuel utilisateur
Telsey
Telsey CPVA 500 - SIP Manuel utilisateur
