What Is the Remote Access Service?

The Remote Access Service (RAS) lets workstations at remote sites access network servers transparently, as though they were physically connected to the network. Dial-Up Networking is the client version of Windows NT RAS. Remote access connections can be established over public telephone lines, X.25 networks, ISDN networks, or PPTP connections.


Remote Access Setup

The Remote Access Setup program lets you install the RAS drivers, select ports for RAS to use, and select how each port will be used (for dialing out, receiving calls, or both). If you choose to receive calls, you may choose to give callers access to the entire network or restrict access to the RAS server.

If Windows NT RAS is upgraded to version 4.0, then the modems that are already installed and configured are treated as modem.inf modems, as indicated in the Remote Access Setup dialog box as Type Modem (modem.inf). Any new modems installed after an upgrade or on a new Windows NT installation are added as Type Modem (unimodem). To add a new modem port to RAS configuration, the modem must first be added by clicking Add and then clicking Install Modem.

Click this	To do this
Add	Make a port available to RAS and install a modem or X.25 PAD for the port.
Remove	Make a port unavailable to RAS.
Configure	Change the RAS settings for the port, such as the attached device or the intended usage (dialing out only, receiving calls only, or both).
Clone	Copy the same modem setup from one port to another.
Network	Configure RAS server-wide settings. Set network access to entire network or RAS computer only. Select and configure network protocols the RAS server will support. Select network protocols the computer will use for dial out (client) connections. Set authentication and data encryption options.
Continue	Proceed to the next step in Setup when you have finished with this dialog.
Cancel	Leave the Setup program.


Add RAS Device

To add a port for RAS, select a port from the list box, and click OK.

Ports not in the list cannot be installed with Remote Access Setup. You must install them before running Remote Access Setup, using the manufacturer's installation program. For further information, see the manufacturer's documentation.

To have RAS setup automatically detect your modem on the specified port, click Install Modem.

To install an X.25 PAD for the specified port, click Install X.25 PAD.


RAS Server NetBEUI Configuration

Specify the level of access you want to grant all users who dial in to this computer using the NetBEUI protocol.

Allow remote NetBEUI clients to access

Entire network	Grants users permission to access resources on the network.
This computer only	Grants users permission to access only the resources on this computer.


Configure Port Usage

Configure the specified port to be used as a client (for dialing out as a RAS client), as a server (for receiving calls as a RAS Server), or as a router (you can dial other routers and other routers can dial you).

To configure a port

1	For the specified port and device, in the Port Usage box, specify how the port is to be used: Dial out as a RAS client, Receive calls as a RAS server, or Dial out and receive calls as a demand dial router.

2	Click OK when you are finished configuring the port.


Modem Settings

These options apply when the port is being used for receiving calls. For dialing out, set these parameters for each entry using Dial-Up Networking.

Setting	Function
Enable modem speaker	Turns on phone sounds when dialing in.
Enable hardware flow control	Enables RTS/CTS handshaking between the modem and computer. This feature increases the speed and reliability of operations because the receiver can stop data flow if it falls too far behind. When hardware flow control is not enabled, you run the risk of an overrun error.
Enable error control	Enables error checking on blocks of data through cyclic redundancy checks (CRCs). Modem error control increases efficiency by eliminating start and stop bits.
Enable modem compression	Compresses the modem-to-modem data stream, reducing the number of bytes transmitted and therefore reduces the transmission time. The reduction achieved depends on the amount of redundancy in the transmitted data.


Network Configuration

Select and configure the protocols to use on the LAN. Network protocol configuration applies to all RAS operations for all RAS-enabled ports.

The RAS computer may access a LAN as a client or as a server. You must select the LAN protocols RAS will use in each role. A RAS computer's role is determined when you specify how RAS-enabled ports will be used.

Dial out Protocols

Select the protocols to use when dialing out to a remote access server. If you do not select a protocol in the Dial Out Protocols box, you will be unable to select that protocol later when you configure a phone book entry for dialing out.

If no ports are configured for dial out, the Dial out Protocols box appears dimmed.

Server Settings

Select the protocols the RAS computer can use for servicing remote clients.

You must also configure parameters for each protocol the RAS server will support. See Help in each configuration dialog box for more information.

If no ports are configured to receive calls, the Server Settings box will not appear in the Network Configuration dialog box.

Enable Multilink

Dial-Up Networking Multilink combines multiple physical links into a logical "bundle." This aggregate link increases your bandwidth. The most common use is bundling ISDN channels, but you can also bundle two or more modems or a modem and an ISDN line. To use Multilink, both the clients and servers must have Multilink enabled.

Select the Enable Multilink check box to use Multilink functionality.

Note:	This check box only applies to Windows NT Server computers.

Authentication and Encryption Settings

Select the Allow any authentication including clear text option to permit connection using any authentication requested by the client (MS-CHAP, SPAP, PAP). This option is useful if you have RAS clients using different client software.

Select the Require encrypted authentication option to permit connection using any authentication requested by the client except PAP. This option requires encrypted passwords from all clients.

Select the Require Microsoft encrypted authentication option to permit connection using MS-CHAP authentication only. You can also select the Require data encryption check box to ensure that all data sent over the wire is encrypted. Windows NT RAS provides data encryption using the RSA Data Security Incorporated RC4 algorithm. Additionally, select the Require strong data encryption check box to use the strongest encryption algorithm that you have installed on your computer. For example, if 128-bit encryption is installed on your computer, checking this box forces all connections to use 128-bit encryption. Note that you cannot make a connection if the computer at the other end of the connection does not negotiate 128-bit encryption.

Note:	If you select Require strong data encryption then you force all clients (RAS clients or other routers) to connect using Microsoft strong encryption only (not a third-party strong encryption). For more information on how to make sure your clients are correctly configured to use strong encryption, see Using Strong Data Encryption on Clients.

Authentication Provider

Select Windows NT if your network uses Windows NT authentication to validate RAS clients.

Select RADIUS If your network uses Remote Authentication Dial-In User Service (RADIUS) authentication to validate RAS clients. This option enables your Windows NT Server computer to be a RADIUS client and connect to a RADIUS server. Click Configure to select the RADIUS Server you want to use.

RADIUS is a network protocol that enables remote authentication, authorization, and accounting of users who are connecting to a network access server (NAS). RADIUS clients send requests for authentication and authorization to a RADIUS server. The server responds with messages either allowing or refusing network access.


Using Strong Data Encryption
Using Strong Data Encryption on Clients

If a Windows NT router is using strong data encryption, then all RAS clients or other Windows NT routers that want to make a connection must use Microsoft strong encryption only (not a third-party strong encryption).

RAS clients must be Windows NT version 4.0 + SP3 RAS clients and routers must be Windows NT routers.

To enable RAS clients to use strong data encryption

Service Pack 3 for Windows NT version 4.0 includes a new registry parameter that can be used to force 128-bit data encryption. RAS clients must be Windows NT version 4.0 + SP3 RAS clients.

1	To add this registry parameter to a RAS client, see the knowledge base article #??.

Note:	After 128-bit encryption is enabled on the RAS client, then the client can only connect to RAS Servers that support 128-bit encryption.

2	Then, on the RAS client, open Dial-Up Networking. Edit a phonebook entry and on the Security tab click the Require data encryption check box.

To enable Windows NT routers to use strong data encryption

1	In Routing and RAS Admin, click LAN and Demand Dial Interfaces, and then right-click an interface and choose Configure Interface.

2	In the Edit Phonebook Entry dialog box, click the Security tab, and then click Require strong data encryption.


RAS Server TCP/IP Configuration

Use this dialog to specify the level of access for RAS TCP/IP clients and to specify the IP addresses for assignment to RAS clients.

Allow remote TCP/IP clients to access

These options enable users to access the network or this computer. Selecting one of these options does not grant a user permission to access a resource. Permissions for dial-in clients are granted through User Manager.

Entire network	Allow users to access the entire network.
This computer only	Allow users to access only this computer.
Use DHCP to assign remote TCP/IP client addresses

RAS servers can obtain IP addresses for remote clients from a dynamic host configuration protocol (DHCP) server. DHCP servers provide static and dynamic IP address allocation on a large network. You should select this option if a DHCP server is available.

Use static address pool

If a DHCP server is not available, a range of IP addresses can be given to a RAS server for assignment to clients.

Address: Type the IP address that specifies the starting address of the pool. This could also be considered the subnet ID. For instance, the address pool can be a subset of a LAN interfaces' subnet or of a unique subnet. .

Mask: Type the IP address for the Mask. This specifies how large the pool will be. This mask is the same concept as used for IP subnet addressing. If you are using an address pool from your local LAN, this mask must not match the mask on your network adapter. If the mask is written in binary, a "1" is masked off (hidden or covered up) as part of the network ID. Also, if the mask is written in binary, a "0" is part of the host ID or a "0" defines the addresses that fall into this RAS scope.  Example

Range: This value is the calculated range of addresses for the IP address pool. This range is calculated based on your entries in the Address and Mask fields.

Number of addresses for clients: This value is the calculated number of dial-in users or routers that this router will support based on your Address and Mask fields. You can change this number by changing the entries in the Address and Mask fields. See the example for more help.

Allow remote clients to request a predetermined IP address

RAS servers can allow clients to request a specific address. Clients specify the address by entry in Dial-Up Networking.


Example of a static address pool:

Note:	If you are not familiar with subnetting see a TCP/IP textbook.

Assume that the LAN interface on a router is 192.168.1.1 with a 255.255.255.0 mask, and that you have not assigned the last 32 address of this subnet which is being saved for the RAS pool.

For the RAS pool, in the Address box type 192.168.1.224 and in the Mask box type 255.255.255.224. This makes the RAS pool 192.168.1.224 to .255. (Note that 224 and 255 will not be used.)

To understand subnetting further, you can view the mask in binary. The mask 255.255.255.224 in binary is 11111111.1111111.1111111.11100000.

The zeros define the subnet size. You can calculate the size by adding the values for the last 5 bits: 16+8+4+2+1 = 32. So therefore, 32 is the subnet size.

Because the subnet size is 32, using the 255.255.255.224 mask, you have eight subnets. So, in the Address box, you could have used the second subnet (or the third, fourth, etc.) instead of the last as the RAS scope. The fist subnet starts with zero and would be 192.168.1.0, the second would be 192.168.1.32, the third would be 192.168.1.64, the fourth would be 192.168.1.96, the fifth would be 192.168.1.128, the sixth would be 192.168.1.160, the seventh would be 192.168.1.192, and the eighth would be 192.168.1.224.

Note:	The first and last address of a subnet are not used and one address is used by the router itself. This leaves you with 29 addresses with the 255.255.255.224 mask. See the following table for an example of the number of addresses you have available for clients with different masks.

Mask	Mathematical Subnet Size	Number of clients or routers supported with this mask
255.255.255.252	4	1
255.255.255.248	8	5
255.255.255.240	16	13
255.255.255.224	32	29
255.255.255.192	64	61
255.255.255.128	128	125
255.255.255.0	256	253
255.255.254.0	512	509
255.255.252.0	1024	1021


RAS Server IPX Configuration

Use this dialog to specify the level of access for RAS IPX clients and to specify an IPX network number assignment method for RAS clients.

The RAS server provides clients connecting to an IPX network with an IPX network number and must act as their SAP agent. Use this dialog box to specify how the RAS server provides IPX net numbers to clients and whether the RAS server should also provide access to the network (act as an IPX router for RAS clients only).

Allow remote IPX clients to access

Entire network	Grants users permission to access resources on the network.
This computer only	Grants users permission to access only the resources on this computer.
Allocate network numbers automatically

An IPX network number not currently in use is determined by the RAS server and assigned to the RAS client.

Allocate network numbers

Ranges of IPX network numbers can be given to a RAS server for assignment to clients. Allocated IPX address pools are useful if you want to identify RAS clients on the network by number.

Provide the beginning network number in the From box. RAS automatically determines the number of available ports and calculates the end number.

Assign same network number to all IPX clients

Select this check box to assign the same network number to all IPX clients. This will reduce the size of RIP announcements on the network. If this box is selected, only one network number is added to your routing table for all active RAS clients. If this box is not selected, a network number is added to your routing table for each active RAS client.

Allow remote clients to request IPX node number

Select this check box to allow the remote client to request its own IPX node number rather than use the node number provided by the RAS server. Allowing remote clients to specify their own node number is a potential security threat to your network. Choosing their own node number allows a client to impersonate a previously connected client and access network resources accessed by the other client.


Install X.25 PAD

Use this dialog box to add an X.25 port to RAS.

Specify a port name.

Specify an X.25 PAD and click OK.

If you do not see the PAD name you want in the Choose X.25 PAD Name box, you can edit the PAD names in PAD.INF. For more information, see the section on X.25 PAD Support in the Windows NT Server Networking Supplement..


Detect Modem

RAS detected more than one modem.  Please select the correct modem from the list.