In a private network configuration, the ISP’s NAS forwards authentication requests to a corporate client’s IAS server, where the corporation’s authorization database resides. Both the IAS server and PPTP server are connected to the corporation’s LAN. The PPTP server has a network address on the Internet as well as on the corporation’s LAN. This enables the PPTP server to exchange packets between the dial-in user and the corporate LAN.
Note
PPTP is a protocol for creating a secure connection that allows PPP (Point-to-Point Protocol) packets (in this case, from the NAS) to be encapsulated within Internet Protocol (IP) packets and forwarded over any IP network, including the Internet.
The following diagram describes the authentication process.
The IAS server returns the authorization response through the ISP’s RADIUS server to the NAS. The authorization response contains attributes that instruct the NAS to direct the packets originating from the user’s desktop to the PPTP server or to prevent the packets from reaching a host other than the PPTP server. A PPTP connection is then established between the desktop and the PPTP server, which creates a secure channel between the user and the corporate LAN.
In creating a secure connection, one network protocol is encapsulated within another, usually to join two networks through an intermediate network.