To demonstrate how corporations can use Internet Connection Services for RAS to build Virtual Private Networks, this section uses a fictitious company named Humongous Insurance (HI). HI is a large company that sells all types of insurance to both consumers and corporate clients. Using dedicated lines and large modem pools, Humongous Insurance offered its employees remote access to the corporate network.
Unfortunately, the cost of supporting modem pools, dedicated phones lines, and toll-free numbers was very expensive. To reduce costs, Humongous Insurance partnered with a local Internet service provider and deployed Internet Connection Services for RAS to out-source their remote access needs. The Internet service provider they chose to work with was Acme, Inc, an international service provider with access numbers all over the world (through their partnerships with other ISPs).
To get started, Humongous Insurance purchased Microsoft Windows NT version 4.1 software with support for Point-to-Point Tunneling Protocol (PPTP). PPTP provides a highly secure, encrypted connection across a public network, such as the Internet.
The network administrators at HI set up two computers on their corporate network, a dedicated PPTP server and an Internet Authentication Services. Both computers were set up on the same domain as the HI corporate domain controller. A domain controller uses a Windows NT Server user database to control access to the network. When Internet Authentication Services is set up on a network, it automatically integrates with the domain controller to authenticate employees.
At the same time, the network operators at AI implemented the Microsoft Windows NT 4.0 Option Pack, including Internet Connection Services for RAS, on their own network. They also set up a Remote Authentication Dial-In User Service (RADIUS) proxy server. After it was set up, they configured it to recognize authentication requests from Humongous Insurance employees and forward them to the Internet Authentication Services on the HI network. This way, HI can maintain control over the remote access permissions associated with their employees.
The network operators at AI were also responsible for implementing Connection Manager and Connection Point Services. Using the Connection Manager Administration Kit, they built a custom dialer for Humongous Insurance employees. To make the connection experience both secure and simple, the dialer includes automatic support for PPTP. It also includes corporate and ISP support numbers and customized Help files. To help HI employees easily recognize the dialer, AI added the Humongous Insurance logo to the Windows desktop, a process known as branding.
When HI employees start Connection Manager, all they have to do is type their user name. The custom dialer is pre-configured to automatically add their corporate realm, @ai.com, to their user name. This reduces the complexity of the single login experience for the employee. It also reduces support costs for Acme, Inc.
To help support employees at Humongous Insurance, AI integrated the Connection Manager dialer with Connection Point Services. Every time a new access number is added to the AI Internet service, it is automatically transferred to each employee through the Connection Manager dialer. Having up-to-date access numbers makes it easy for HI employees to access their corporate resources and for AI to seamlessly update and expand their network with more local access numbers.
Using Internet Connection Services for RAS, HI employees are able to make a secure, local connection to their private corporate network from anywhere in the world. When they want to connect to their network, they simply use their custom-built Connection Manager to dial a local AI access number. A RADIUS proxy server located on the AI network recognizes them as a Humongous Insurance employee and forwards the authentication request to the Internet Authentication Services on the HI network. The HI Internet Authentication Services uses the company’s local domain controller to grant or deny access to specific areas on the corporate network. During this process, a secure connection is established between the employee and the PPTP-enabled server on the HI corporate network, using MS-CHAP authentication. All of these operations are completely transparent to the HI employee.
The following picture describes how Humongous Insurance and Acme, Inc. used Internet Connection Services for RAS to build secure connections over the Internet to the HI corporate private network.