Please help with VPN

hello,

i have questions regarding company network doing work on , wondering if may of assistance.

here basic rundown of architecture. there vmware esxi hypervisor several vm's running various servers. ill explain ones seem important issue. there ms windows server 2008r2 dc active directory and there is ms windows server 2008r2 terminal server.

there remote location several users connect main office terminal server rdp client. questions begin. the remote location uses a cisco firewall/router (cant remember model) , main location uses same appliance.

the user turns his/her machine on in morning and at windows desktop user is connected to the internet. these machines have only 3 basic functions, anti-virus application, cisco vpn client , rdp shortcut on desktop.

i told users turned pc on ->clicked on vpn client -> put in password and establish tunnel. the user -> double clicks rdp client , logs terminal server. ready work.

after going out visit 1 of remote locations found every user in office is not performing routine. users are turning machine on -> double clicking on rdp client, logging in , getting work. ***they bypassing vpn connection altogether. needless quite surprised.

this bit confused , need assistance.

1st- in scenario (not using vpn client @ all), if i'm not mistaken, none of data traveling , forth encrypted, true? 

2nd - why/how able use rdp internal ip (192.168.1.15) to log on terminal server without launching vpn client. before doing step have turned pc on , have not put in credentials. can browse internet if browse network devices , try access of them asked credentials so.

a side note: users can log network after turning their pc on typing "fqdn\username" in username field , ad password. way can browse network services/devices without being asked credentials.

3rd - is benefit in having users login domain before starting vpn? can assume not recommended. 

4th - if remote users on domain/internet when turn pc's on, how does rdp client know use vpn tunnel instead of internet connection active on pc.

5th - there way make users cannot connect rdp until vpn established (most important because data being transferred personal in nature). can/is this policy established at terminal server, domain controller of cisco router.

any on any of these matters appreciated. if have other questions try best help.

thank you. 

gary

---

gam

hi gary,

the information given have indicated didn't know doing handled original setup, if have 2 cisco firewall's in place - i'm going guess they're out of asa line-up, the better approach would have been create site-to-site vpn between cisco devices.

in creating site-to-site vpn connection between 2 firewall appliances, you've got an entirely internally routable network, meaning usage of private ip ranges non-issue nothing's routing directly to internet. rather, internal traffic 1 site encapsulated in vpn tunnel, sent across internet encapsulated, expanded on firewall device @ other end , routed destination. kind of water going through hose.

it sounds has set site-to-site vpn why users remote site not have initiate cisco vpn client yet can connect straight away remote desktop server.

as far encryption goes, there's 2 levels of encryption happening already:

1. vpn tunnels encrypted. cryptographic suite chosen govern how weak or strong encryption is, encrypted.
2. rdp uses encryption default.

i wouldn't concerned side of things.

a couple of questions relate reinstatement of vpn client approach, i'd say: don't go model unless there's kind of compelling cost-based reason (i.e. maintaining "always on" vpn tunnel proves costly) it's inferior solution.

cheers,
lain

Windows Server  >  Windows Server General Forum