New Features in Windows Server 2003
Here is the list of new routing and remote access features covered in this chapter:
Broadband has become the Internet access connection of choice for many business, organizations, and home users. Service providers take a hard look at their bottom line and demand per-user fees for traffic across the connection. Point-to-Point Protocol over Ethernet (PPPoE) provides a way to connect individual client computers to a service provider over a single broadband connection. Windows Server 2003 and XP have built-in support for making PPPoE connections.
Any computer connected to the public network needs a way to secure itself from bad guys. Servers running Windows Server 2003 and XP desktops have an integrated firewall that can be put in place when the server is configured as an Internet gateway.
Mixed Media Bridging.
Any modern Windows machine can route between different network segments, but routing requires separate subnets, which can complicate network setup, especially in a SOHO environment. Windows Server 2003, Standard or Enterprise Edition, or an XP desktop can bridge between disparate segments, merging them into a single interface with a single IP address.
Integrated 802.1x wireless security support.
The crop of wireless access points that have been released over the last few years depend on Wired Equivalent Privacy, or WEP, to protect user data. Unfortunately, WEP depends on static 40-bit or 128-bit encryption keys that can be easily cracked by wireless packet sniffers. The 802.1x standard addresses this problem by enabling dynamic keys that are exchanged using Transport Layer Security (TLS). This feature supports using either Extensible Authentication Protocol (EAP) or Protected EAP (PEAP).
Windows Server 2003 includes an IPv6 stack but the user interface has not been modified to include 128-bit addressing. The stack installs as a new protocol in the Properties window for an interface in Network Connections. This also installs two virtual interfaces for Toredo tunneling through NAT as described in draft-ietf-ngtrans-shipworm-05.txt. IPv6 addresses and routes are accessed via the Netsh utility. The syntax is netsh interface ipv6. New /ipv6 switches for ping and tracert and netstat will list any IPv6, TCPv6, and UDPv6 connections.
This feature permits the Internet Authentication Service (IAS) to forward Remote Access Dial-In User Services (RADIUS) requests to another IAS or RADIUS server. This feature permits using RADIUS for dial-in, VPN, and 802.1x wireless authentication throughout a federation of forests.
Many of the new Routing and Remote Access Services (RRAS) features in Windows Server 2003 involve improvements to existing services rather than the creation of new services. Here is a list of the major improvements covered in this chapter:
Improved smart card support.
Windows 2000 is capable of supporting smart card logons, but many of the administrative tools, especially the command line tools, still require a password. Windows Server 2003 includes smart card support for the RUNAS and NET USE commands. It also supports smart card logon in terminal server sessions, which simplifies remote administration in a smart card environment.
Simplified support for multiple RADIUS clients.
This enhancement permits you to specify an address range for RADIUS clients rather than identify each RADIUS client by IP address. With this feature, you can quickly configure a large number of Extensible Authentication Protocol (EAP) switches to use the same RADIUS server for authentication.
NetBIOS name resolution over dial-in connections.
As much as we as IT professionals would like to see the end of NetBIOS name resolution, broadcast resolution is still a suitable and effective method in small networks. A Windows Server 2003 remote access server can forward NetBIOS name broadcasts from dial-in clients to support name resolution. This feature is disabled by default.
Dynamic Host Configuration Protocol (DHCP) configuration for XP dial-in clients.
Historically, Windows servers that obtain addresses for dial-in clients from DHCP have been unable to redistribute the DHCP configuration settings to the clients. This continues to be the case in Windows Server 2003, but XP clients overcome this limitation by obtaining configuration information using DHCPINFORM packets. A Windows Server 2003 remote access server will route the DHCPINFORM packet to a selected network segment where it can find a DHCP server.