Re: Establish external trust over a NAT device

Thanks Herb,

Of course you are right. I probably should have said "usually". Of course
the PPTP tunnel itself is capable carrying any kind of traffic in either or
both directions, but most implementations I've seen pretty much spec a
server which allows multiple individual connections to be made. I have
successfully shared a PPTP client connection which allows the whole side
access, but I've not found where the windows client can do this as a part of
its regular decorum (at least not from the usual "wizard"). There are some
brands of routers that support PPTP client and server modes, but even they
generally recommend IPSec for fully bi-directional network-to-network. I
would be really interested in how to set this up using a Windows RRAS server
and a Windows client if you have any links.

Thanks,

....kurt


"Herb Martin" <news@xxxxxxxxxxxxxx> wrote in message
news:uEey8m2wGHA.5056@xxxxxxxxxxxxxxxxxxxxxxx
"Kurt" <lorentzenkurt@xxxxxxxxxxxxxxxxxx> wrote in message
news:12ectmtfi3gip01@xxxxxxxxxxxxxxxxxxxxx

For a tust to work you'll need a lot more than just netbios traffic.The
BEST way is to use NAT devices (also called routers) that will allow you
to set up an IPSec tunnel between networks, otherwise your trust will be
more or less useless because Windows PPTP VPNs connect hosts to networks,
not networks to networks.

While I agree with the first part about setting up a tunnel, the
latter part is wrong.

Both Windows PPTP and L2TP can be used to setup fully functioning
Router-Router connections which can be used to tunnel traffic.

IPSec tunnels are moderately HARDER to setup since this is not
covered in the RRAS Console and must be setup more or less
manually.

Of course the difficulty of setting up any kind of tunnel will vary on
a purpose built router, but Windows (especially Server) can do this
quite well.

Doesn't change the recommendation probably but the details were just
not correct.



--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

...kurt



"Leif P" <anon@xxxxxxxx> wrote in message
news:e$oLyyqwGHA.3964@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I have seen several posts on the internet claiming that it is not
possible to create an external trust between 2 windows server 2003
domains over a NAT device.

I read this article: http://support.microsoft.com/kb/172227 as it should
be possible if the NAT device also replaces the NETBios owner IP
address.

Is it possible to create an external trust over a NAT device if the NAT
device replaces the owner IP address in the NETBios packets??

Leif P







.

Relevant Pages

  • [NT] Unchecked Buffer in PPTP Implementation Could Enable Denial of Service Attacks
    ... Windows 2000 and Windows XP natively support Point-to-Point Tunneling ... Protocol (PPTP), a Virtual Private Networking technology that is ... The vulnerability could be exploited against any server that offers PPTP. ...
    (Securiteam)
  • Re: Establish external trust over a NAT device
    ... the PPTP tunnel itself is capable carrying any kind of traffic in either ... L2TP and routing over it with or without NAT on that connection. ... This last requires giving the "dial" router the ...
    (microsoft.public.win2000.active_directory)
  • Microsoft PPTP Server and Client remote vulnerability
    ... Microsoft PPTP Server and Client remote vulnerability ... Microsoft Windows 2000 and XP running either a PPTP Server or Client. ... This advisory does not claim to be complete or to be usable for any ...
    (NT-Bugtraq)
  • Microsoft PPTP Server and Client remote vulnerability
    ... Microsoft PPTP Server and Client remote vulnerability ... Microsoft Windows 2000 and XP running either a PPTP Server or Client. ... This advisory does not claim to be complete or to be usable for any ...
    (Bugtraq)
  • VPN server over windows XP
    ... I am trying to setup a windows xp machine as a vpn server that accepts ... multiple ipsec tunnels from other windows xp machines. ... The first problem I faced is that windows xp does not support ipsec tunnel ...
    (Linux-Kernel)