up vote 0 down vote favorite
share [g+] share [fb]

I need to connect a remote computer (physically outside of the domain) to the infrastructure at our data center which is controlled by active directory. I can VPN to the data center just fine, but I want to find out how I can setup this computer to automatically connect through the VPN to the data center and then via active directory so that the computer is authenticated and that the logins can be processed by AD. Can Windows handle this automatically, or do I need to purchase some sort of router that will establish a VPN connection and just provide that to the computer?

FYI - The reason for this is I am setting up a remote secondary backup machine to the network at the datacenter and Microsoft DPM requires that the machine be on AD network.

I am running Windows Server 2008 R2 SP1 on the remote machine and the VPN server and Server non-R2 on the domain controllers.

link|improve this question
100% accept rate
feedback

3 Answers

up vote 1 down vote accepted

I'd probably be more tempted to set up a Site-to-Site VPN, and use a router to terminate the VPN connection for the external site.

Basically, this way you'd have a more stable (theoretically) VPN connection that doesn't rely on AD to authenticate. There's no reason that this would be less secure than an AD Authenticated VPN connection, but it would be a damnsight easier to set up, especially in an automatic fashion

link|improve this answer
thanks. Do you know of any articles on how to set that up? Does it require a special router? If so, what type? Will this scenario allow the remote location to connect to the existing PPTP Windows based VPN I have setup at the data center? I am hoping to accomplish this with no changes to the data center structure. – bmccleary Jan 22 at 21:57
Hmm. thinks It's a bit of a broad topic.. and quite a specialised one. I quite like this Draytek router, it supports a variety of VPN types draytek.co.uk/products/vigor2820.html but I've not tried it specifically with PPTP. Theoretically you shouldn't have to change much / anything, but i could be mistaken. – Tom O'Connor Jan 22 at 22:42
as I expressed to Robin, what what specific technical feature am I looking for in a router that would allow it to act as a VPN client to an existing VPN server? I am looking at the Draytek, but would like to see if there are other routers local to me that I could get that would do the job. I just don't know the right term to use in my search. – bmccleary Jan 23 at 16:57
How about asking on some pre-sales vendors' support channels? – Tom O'Connor Jan 23 at 17:36
feedback
up vote 0 down vote

I agree with Tom - I tried setting PC's up pretty much as described in the question for remote sites that only had one PC - I found the VPN often dropped. There are options to automatically restart the VPN, but I found a router would do the job better.

Also I set them up to automatically start VPN using scheduled tasks, but occasionally/randomly this wouldn't actually work.

Anther advantage of using a router is that if for some reason the PC is turned off, you can remotely wake it using WoL.

If you want a cheap router for the remote site, I know a Draytek Vigor 2820 has a PPTP client that works with a Windows PPTP VPN server and can use either ethernet or ADSL for WAN. I used to deploy these for remote sites and they normally were ok, but every now and then they could occasionally need a reboot. If you have a lot of VPN traffic however, you may wish to look at something better.

Also whatever router you use, make sure to specify your AD DNS server(s), or even better have a local DC.

link|improve this answer
@Robin... thanks for the info. Regarding "looking at something better", what specific technical feature am I looking for in a router? I think that "VPN pass through" (which most of the router have when I search for "Router VPN") only means that VPN traffic will go through the router, but not that the router can become the a VPN client that connects to a VPN server. Is that correct? What is the terminology that I can use to search for other routers that would contain the feature I need? – bmccleary Jan 23 at 16:57
The specific feature you are looking in for in the router is a PPTP VPN client that is compatible with a Windows PPTP server. – Robin Gill Jan 24 at 0:27
feedback
up vote 0 down vote

If your looking for another solution, Sonicwall have a solution for their range of hardware which enables single sign on to authenticate. Install the router and configure it. Then download and install "Directory Connector" from Sonics website. This enables the router to be populated with users and groups from AD. VPN permissions can be given or revoked through the user or group interface.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.