Who will be interested in this feature?

Are there any special considerations?

 You must have a server with Windows Server 2008 installed.

 You must be a member of the Administrators group on the computer that you want to configure as a TS Gateway server.

 You must obtain an externally trusted SSL certificate for the TS Gateway server if you do not have one already. By default, on the TS Gateway server, the RPC/HTTP Load Balancing service and the IIS service use Transport Layer Security (TLS) 1.0 to encrypt communications between clients and TS Gateway servers over the Internet. For TLS to function correctly, you must install an SSL certificate on the TS Gateway server.

You do not need a certification authority (CA) infrastructure within your organization if you can use another method to obtain an externally trusted certificate that meets the requirements for TS Gateway. If your company does not maintain a stand-alone CA or an enterprise CA and you do not have a compatible certificate from a trusted public CA, you can create and import a self-signed certificate for your TS Gateway server for technical evaluation and testing purposes.

The certificate must meet these requirements:

 The name in the Subject line of the server certificate (certificate name, or CN) must match the DNS name that the client uses to connect to the TS Gateway server, unless you are using wildcard certificates or the SAN attributes of certificates. If your organization issues certificates from an enterprise CA, a certificate template must be configured so that the appropriate name is supplied in the certificate request. If your organization issues certificates from a stand-alone CA, you do not need to do this.

 The certificate is a computer certificate.

 The intended purpose of the certificate is server authentication. The Extended Key Usage (EKU) is Server Authentication (1.3.6.1.5.5.7.3.1).

 The certificate has a corresponding private key.

 The certificate has not expired. We recommend that the certificate be valid one year from the date of installation.

 A certificate object identifier (also known as OID) of 2.5.29.15 is not required. However, if the certificate that you plan to use contains an object identifier of 2.5.29.15, you can only use the certificate if at least one of the following key usage values is also set: CERT_KEY_ENCIPHERMENT_KEY_USAGE, CERT_KEY_AGREEMENT_KEY_USAGE, and CERT_DATA_ENCIPHERMENT_KEY_USAGE.

For more information about these values, see Advanced Certificate Enrollment and Management (http://go.microsoft.com/fwlink/?LinkID=74577).

 The certificate must be trusted on clients. That is, the public certificate of the CA that signed the TS Gateway server certificate must be located in the Trusted Root Certification Authorities store on the client computer.

For more information about certificate requirements for TS Gateway and how to obtain and install a certificate if you do not have one already, see the TS Gateway Server Step-by-Step Setup Guide (http://go.microsoft.com/fwlink/?linkid=85872).

 TS Gateway servers must be joined to an Active Directory domain in the following cases:

 If you configure a TS Gateway authorization policy that requires that users be domain members to connect to the TS Gateway server.

 If you configure a TS Gateway authorization policy that requires that client computers be domain members to connect to the TS Gateway server.

 If you are deploying a load-balanced TS Gateway server farm.

Additionally, keep in mind the following considerations:

 TS Gateway transmits all RDP traffic (that typically would have been sent over port 3389) to port 443 by using an HTTPS tunnel. This also means that all traffic between the client and TS Gateway is encrypted while in transit over the Internet.

 To function correctly, TS Gateway requires several role services and features to be installed and running. When you use Server Manager to install the TS Gateway role service, the following additional role services and features are automatically installed and started, if they are not already installed:

 The remote procedure call (RPC) over HTTP Proxy service.

 Web Server (IIS) [Internet Information Services 7.0]. (IIS 7.0 must be installed and running for the RPC over HTTP Proxy service to function.)

 Network Policy Server service.

You can also configure TS Gateway to use another NPS server—formerly known as a Remote Authentication Dial-In User Service (RADIUS) server—to centralize the storage, management, and validation of Terminal Services connection authorization policies (TS CAPs). If you have already deployed an NPS server for remote access scenarios such as VPN and dial-up networking, using the existing NPS server for TS Gateway scenarios as well can enhance your deployment.

How should I prepare for TS Gateway?

 You should also prepare to acquire an SSL certificate, or to issue one from your own certification authority (CA).

 You should become familiar with the TLS and SSL protocols if you are not already.

What new functionality does this feature provide?

TS CAPs

Why are TS CAPs important?

TS CAPs simplify administration and enhance security by providing a greater level of control over access to computers on your internal corporate network.

TS CAPs allow you to specify who can connect to a TS Gateway server. You can specify a user group that exists on the local TS Gateway server or in Active Directory Domain Services. You can also specify other conditions that users must meet to access a TS Gateway server. You can list specific conditions in each TS CAP. For example, you might require a user to use a smart card to connect through TS Gateway.

Users are granted access to a TS Gateway server if they meet the conditions specified in the TS CAP.

Important

You must also create a Terminal Services resource authorization policy (TS RAP). A TS RAP allows you to specify the internal network resources that users can connect to through TS Gateway. Until you create both a TS CAP and a TS RAP, users cannot connect to internal network resources through this TS Gateway server.

TS RAPs

TS RAPs allow you to specify the internal network resources that remote users can connect to through a TS Gateway server. When you create a TS RAP, you can create a computer group (a list of computers on the internal network to which you want the remote users to connect) and associate it with the TS RAP.

Remote users connecting to an internal network through a TS Gateway server are granted access to computers on the network if they meet the conditions specified in at least one TS CAP and one TS RAP.

Note

When you associate a TS Gateway-managed computer group with a TS RAP, you can support both fully qualified domain names (FQDNs) and NetBIOS names by adding both names to the TS Gateway-managed computer group separately. When you associate an Active Directory security group with a TS RAP, both FQDNs and NetBIOS names are supported automatically if the internal network computer that the client is connecting to belongs to the same domain as the TS Gateway server. If the internal network computer belongs to a different domain than the TS Gateway server, users must specify the FQDN of the internal network computer.

Together, TS CAPs and TS RAPs provide two different levels of authorization to provide you with the ability to configure a more specific level of access control to computers on an internal network.

Security groups and TS Gateway-managed computer groups associated with TS RAPs

Remote users can connect through TS Gateway to internal network resources in a computer group. The computer group can be any one of the following:

 Members of an existing security group. The security group can exist in Local Users and Groups on the TS Gateway server, or it can exist in Active Directory Domain Services.

 Members of an existing TS Gateway–managed computer group or a new TS Gateway-managed computer group. You can configure the TS Gateway–managed computer group by using TS Gateway Manager.

A TS Gateway-managed computer group will not appear in Local Users and Groups on the TS Gateway server, nor can it be configured by using Local Users and Groups.

When you add an internal network computer to the list of TS Gateway-managed computers, keep in mind that if you want to allow remote users to connect to the computer by specifying either its computer name or its IP address, you must add the computer to the computer group twice (by specifying the computer name of the computer and adding it to the computer group and then specifying the IP address of the computer and adding it to the computer group again). If you specify only an IP address for a computer when you add it to a computer group, users must also specify the IP address of that computer when they connect to that computer through TS Gateway.

Important

To ensure that remote users connect to the internal corporate network computers that you intend, we recommend that you do not specify IP addresses for the computers, if the computers are not configured to use static IP addresses. For example, you should not specify IP addresses if your organization uses DHCP to dynamically reconfigure IP addresses for the computers.

 Any network resource. In this case, users can connect to any computer on the internal corporate network that they could connect to when they use Remote Desktop Connection.

To ensure that the appropriate users have access to the appropriate network resources, plan and create computer groups carefully. Evaluate the users who should have access to each computer group, and then associate the computer groups with TS RAPs to grant users access as needed.

Monitoring capabilities

You can use TS Gateway Manager to view information about active connections from Terminal Services clients to internal network resources through TS Gateway. This information includes:

 The connection ID. The connection ID is displayed in the format , where "a" is the tunnel ID that uniquely identifies a specific connection to the TS Gateway server and "b" is the channel ID. The tunnel ID represents the number of connections that the TS Gateway server has received since the Terminal Services Gateway service has been running. Each time the TS Gateway server receives a new connection, the tunnel ID is incremented by 1.

 The domain and user ID of the user logged on to the client.

 The full name of the user logged on to the client.

 The date and time when the connection was initiated.

 The length of time the connection was active.

 The length of time that the connection is idle, if applicable.

 The name of the internal network computer to which the client is connected.

 The IP address of the client.

Note

If your network configuration includes proxy servers, the IP address that appears in the Client IP Address column (in the Monitoring details pane) might reflect the IP address of the proxy server, rather than the IP address of the Terminal Services client.

 The port on the internal network computer to which the client is connected

You can also specify the types of events that you want to monitor, such as unsuccessful or successful connection attempts to internal corporate network computers through a TS Gateway server.

When these events occur, you can monitor the corresponding events by using Windows Event Viewer. TS Gateway events are stored in Event Viewer under Application and Services Logs\Microsoft\Windows\Terminal Services-Gateway\.

Group Policy settings for TS Gateway

You can use Group Policy and Active Directory Domain Services to centralize and simplify the administration of TS Gateway policy settings. You use the Local Group Policy Editor to configure local policy settings, which are contained within Group Policy objects (GPOs). You use the Group Policy Management Console (GPMC) to link GPOs to sites, domains, or organizational units (OUs) in Active Directory Domain Services.

Group Policy settings for Terminal Services client connections through TS Gateway can be applied in one of two ways. These policy settings can either be suggested (that is, they can be enabled, but not enforced) or they can be enabled and enforced. Suggesting a policy setting allows users on the client to enter alternate TS Gateway connection settings. Enforcing a policy setting prevents a user from changing the TS Gateway connection setting, even if they select the Use these TS Gateway server settings option on the client.

The following three Group Policy settings are available for TS Gateway server:

 Set the TS Gateway Server Authentication Method: Enables you to specify the authentication method that Terminal Services clients must use when connecting to internal network resources through a TS Gateway server.

 Enable Connections Through TS Gateway: Enables you to specify that, when Terminal Services clients cannot connect directly to an internal network resource, the clients will attempt to connect to the internal network resource through the TS Gateway server that is specified in the Set the TS Gateway server address policy setting.

 Set the TS Gateway Server Address: Enables you to specify the TS Gateway server that Terminal Services clients use when they cannot connect directly to an internal network resource.

Important

If you disable or do not configure this policy setting, but enable the Enable connections through TS Gateway policy setting, client connection attempts to any internal network resource will fail if the client cannot connect directly to the network resource.

Directory: uploads
uploads -> 587 Return function, r i(X) r i(0) r i(1) r i(2) r i(3) 1 0 2 4 6 Thermal Station, I 2 0 1 5 6 3 0 3 5 6 10
uploads -> Department of science and humanities department of mathematics part-a questions and answers
uploads -> The Case Against the nypd’s Quota-Driven ‘Broken Windows’ Policing What Is It?
uploads -> For want of a nail
uploads -> Ownership Models There are two different types of ownership models
uploads -> Police Militarization
uploads -> City of rising star regular meting thursday, july 14, 2016
uploads -> Township of winfield
uploads -> Stop Militarizing Law Enforcement Act of 2014
uploads -> The Black Panther Party’s Ten-Point Program What We Want Now!

Download 1.83 Mb.

Share with your friends: