TMG Site-to-Site VPN

I recently deployed a TMG site-to-site VPN from our Head Office to a Hosted Environment where the majority of our production servers / services are located.

I followed the instructions on TechNet (http://technet.microsoft.com/en-us/library/bb838949.aspx) to the letter but ran into some peculiar difficulties which are not documented anywhere I searched.

Below are a list of a few tips and tricks to get the VPN up and stable:

1. You need to create a user for dial-in access as the configuration utilises the Microsoft Routing and Remote Access Service. I recommend that you create a user on each side of the tunnel with the identical name as this eliminates the confusion on which user to configure in which setup. If you running AD create local accounts on each TMG server.

2. Ensure any Firewalls configured between the two TMG servers are either disabled or allow all inbound traffic. This is particularly important if you are configuring via DSL routers.

3. Some ISP’s do not enable Generic Routing Encapsulation (GRE) on their network. Your VPN will not work if the ISP does not support this.

4. It is better to configure your VPN wizard with the IP address of the other side rather than using a DNS lookup as the timing difference causes the connection to fail in highly utilised network environments.

5. Once you have configured the VPN wizard on both TMG servers you need to access the RRAS MMC interface and start the demand-dial interface which TMG should have created. If it has not  created the interface you can manually create one or else stop and restart the service. This might take a few tries to get right and this is the most ‘fun’ you will have during the configuration.

6. When you are first setting up the VPN you may be forced to restart the RRAS service often. It is a good idea to restart the servers once all is configured to ensure the VPN comes up on its own once the servers reconnect.

That about covers the ‘undocumented’ issues I ran into while configuring the VPN and I hope this post helps someone out there.

C.

Back

It has been 2 years since I last posted anything here.

I have decided to start again and try and provide at least one article a week… let’s see how it goes. I will also use this blog as an online notebook for IT related issues I deal with on a daily basis.

DNS Amplification Attack

Attached is a great diagram which illustrates the DNS Amplification attack through the use of recursive DNS queries. The entire explanation can be found on the source site: http://securitytnt.com/dns-amplification-attack/

Security Maxims

Hi All,

Herewith a presentation by Roger Johnston on Security maxims.... some a re very good :-)

http://www.cl.cam.ac.uk/~rja14/musicfiles/preprints/Johnston/securitymaxims.ppt

Chris

Hiding Files within Images

Often you must have had some personal files that you wanted to hide but you did not want to encrypt them as they would still be visible to someone browsing your file system. Also encrypting files means that you must have the decrypting software as well as the password if you ever plan on decrypting it. The way to achieve secrecy without using any special software or the need to remember or give out passwords is to hide it in plain sight :-). Steganography, meaning exactly that, can resolve this. Imagine if you were able to hide a secret document you want to send to a colleague in a harmless picture in an e-mail attachment. This means your friend would not need decrypting software installed or the password you used to encrypt it. Anybody looking for the document would not know where it is as it is hiding inside a picture.

The secret to achieving this is simply to execute a binary copy from a regular DOS command prompt.

The text is: copy /b picname.jpg + archivename.zip secretpicname.jpg

The first part is to zip all the files you want to hide inside a zip file and then simply execute the command from a command prompt.

To extract the hidden file simply extract it using archiving software such as 7-zip, winzip, winrar etc.

Here is a cool video on how to do it: http://www.youtube.com/watch?v=q6AQL55zMR4