Windows 2000 RRAS Networking Capabilities

Microsoft Windows 2000 Routing and Remote Access Service (RRAS) is an integrated server technology that provides software-based routing and remote access capabilities for local and wide area networks. This article details the primary networking features of Windows 2000 RRAS, covering its routing protocols, virtual private network (VPN) support, dial-up connectivity, Network Address Translation (NAT), and integrated security mechanisms.

Multi-Protocol Routing

Windows 2000 RRAS functions as a full-featured software router supporting both IP and IPX/SPX traffic. Its core routing capabilities include:

  • Unicast Routing Protocols: Native support for Routing Information Protocol (RIP) version 1 and version 2, as well as Open Shortest Path First (OSPF) for IP environments. For IPX networks, it supports RIP for IPX and Service Advertising Protocol (SAP).
  • Static Routing: Administrators can manually configure static IP and IPX routes, static ARP entries, and default gateways.
  • Multicast Support: Includes support for the Internet Group Management Protocol (IGMP) in router and proxy modes, enabling efficient delivery of IP multicast streams.
  • Demand-Dial Routing: Enables cost-effective branch-office connectivity by automatically establishing temporary dial-up or VPN links only when outbound traffic is detected, terminating the connection after an idle period.

Remote Access and Dial-Up Services

RRAS serves as a centralized remote access server, allowing remote clients to connect to a corporate network.

  • Dial-Up Networking: Supports traditional telecommunications interfaces, including analog modems, Integrated Services Digital Network (ISDN), and X.25 connections.
  • Connection Pooling: Supports multilink configurations using Bandwidth Allocation Protocol (BAP) and Bandwidth Allocation Control Protocol (BACP) to combine multiple physical communication channels into a single logical pipeline for increased bandwidth.

Virtual Private Networking (VPN)

Windows 2000 RRAS provides secure remote connectivity over public networks through two primary tunneling protocols:

  • Point-to-Point Tunneling Protocol (PPTP): Utilizes Microsoft Point-to-Point Encryption (MPPE) to secure communications, offering widespread compatibility with legacy and client systems.
  • Layer 2 Tunneling Protocol (L2TP) over IPsec: Introduces enterprise-grade security by pairing L2TP for encapsulation with IPsec for encryption (using DES or 3DES) and data integrity verification, requiring public key infrastructure (PKI) or pre-shared certificates.

Network Address Translation (NAT)

RRAS includes built-in NAT routing, allowing an entire private network to share a single public IP address to access the internet. The NAT implementation includes:

  • Addressing Allocation: A simplified, built-in DHCP allocator for private clients.
  • Name Resolution: A DNS proxy service that forwards internal DNS queries to external DNS servers.
  • Application Layer Gateways (ALGs): Basic protocol editors supporting applications with embedded IP addresses, such as FTP and ICMP.

Security, Authentication, and Access Control

Networking security in Windows 2000 RRAS is closely integrated with the Windows security subsystem:

  • Authentication Protocols: Supports Extensible Authentication Protocol (EAP), MS-CHAPv1, MS-CHAPv2, CHAP, and PAP.
  • RADIUS Integration: Fully compatible with Remote Authentication Dial-In User Service (RADIUS) via Windows 2000 Internet Authentication Service (IAS) or third-party servers, centralizing accounting and authentication.
  • Packet Filtering: Provides IP and IPX packet filtering based on source address, destination address, TCP/UDP ports, and ICMP types to restrict inbound and outbound traffic.
  • Remote Access Policies: Integrates with Active Directory to enforce connection rules based on user group membership, time of day, connection type, and required encryption levels.