Some research companies, notably IDC, predict that nearly 100 percent of Internet traffic will be encrypted by 2005. Although a portion of this traffic will consist of credit card transactions, pretty good privacy (PGP)–encrypted email, and encrypted file transfers, most will be protected because of the increasing use of VPNs—between company sites, business partners, or the office and employees' homes. Many companies that use Microsoft Internet Security and Acceleration (ISA) Server 2000 as a firewall and proxy server ask me whether they can also use the product to establish an Internet VPN. The product's robust and useful wizards can indeed help you quickly establish a client-to-gateway or gateway-to-gateway VPN. Still, setting up an ISA Server VPN involves many steps as well as Certificate Services, DHCP, DNS, and RRAS, so the process is more complex than just setting up a firewall.
VPN Tunneling
If you've never set up a VPN, the way in which they work can seem a bit awkward. First, you must use hardware or software to establish endpoints—one or more VPN clients and a VPN server. You typically can establish a VPN's physical and data-link layers (i.e., Layers 1 and 2 of the Open System Interconnection—OSI—model) over a dial-up line or a high-speed dedicated digital line. The endpoints don't need to use the same vendor's solution, but they must use the same tunneling protocol. Most VPN implementations use Layer Two Tunneling Protocol over IP Security (L2TP/IPSec), as the sidebar "ISA Server VPN Protocols," page 2, explains, and can partner with one another, but interoperability conflicts still abound, especially for ISA Server VPNs. (Most vendors' L2TP implementations vary at least slightly, like different dialects within a language.) The key to interoperability is that both endpoint solutions must support the same IPSec protocol and configuration options. (See the Web-exclusive sidebar "IPSec Protocols and Modes," http://
www.winnetmag.com/windowssecurity, InstantDoc ID 40596, for a discussion of IPSec protocols.) . . .
Register
