Subject: Win2K as LNS w/o IPSEC

From: "Mike Wronski" <[email-masked]>
Date: Thu, 20 Apr 2000 16:29:52 -0500

I am looking for a firm answer on this question. My search on  M$'s
knowledgedbase has not given great results.

Can someone confirm or deny that Windows 2K can act as an LNS for L2TP and
NOT use IPSEC?  Everything I read states that Win2k does (L2TP)/IPSEC.

If this is possible, is there a pointer to the required configs on the win2k
side?

Thanks,
-M

---

From: [email-masked]
Date: Thu, 20 Apr 2000 15:35:57 -0700

Hi Everyone,

I've been working with L2TP and L2TP over IPsec (or should I say IPsec over
L2TP)  with Win2K for a while and here is how you do it....

There are two ways to get L2TP to work under Win2K.
1) L2TP without IPsec (no security)
2) L2TP with IPsec (provides good security). L2TP with IPsec requires the use of
digital certificates. So, you need to configure the remote L2TP VPN user to
request and install a certificate before an L2TP/IPsec tunnel can be
established.

L2TP without IPsec:
By default, L2TP requires IPsec which requires the use of certificates for
authentication. To make L2TP work without IPsec, you need to disable IPsec on
BOTH the L2TP client and the L2TP server. To disable IPsec, you need to edit the
registry. We need to add an entry to the registry called ProhitbitIpSec and set
its value to 1. So, do the following:
a- Click on Start--> Run and type "regedt32" and click OK. This will launch the
registry editor.
b- Goto to HKEY_LOCAL_MACHINE - System - CurrentControl Set - Service - RasMan -
Parameters
c- Click on Edit - Add Value... and type "ProhibitIpSec" EXACTLY LIKE THAT...
(ProhibitIpSec)
d- Set the Data Type to REG_DWORD, then click OK
e- Type 1 and click OK.
Now, you should see the following entry to the right hand side: ProhibitIpSec:
REG_DWORD: 0x1

YOU MUST REBOOT THE MACHINE FOR THIS ENTRY TO TAKE EFFECT...So, reboot the
machine now.

After you do this on BOTH the client and server, the client will then be able to
establish an L2TP tunnel with the VPN server WITHOUT IPsec.

L2TP with IPsec:
To get L2TP to work with IPsec, we need to use certificates.You need to request
a certificate from a CA and install that certificate. In this example, I am
going to cover the Win2K CA.... All the work that we will do here will be mainly
done on the client. I assume you already have a Win2K CA up and running....There
are several things that needs to be done of the client to get L2TP with IPsec
working. We need to launch MMC add the certificate services, then request a
certificate and install a certificate (after it has been approved) then
establish the L2TP-IPsec tunnel. Note that our server has both the L2TP VPN
sever as well as CA (certificate authority) and IIS (which is needed for the CA
to work). So, do the following:
1) On the client PC, click on Start--> Run and type MMC, then click OK. This
will launch the Microsoft Management Console (MMC).
2) Click on Console --> Add/Remove Snap-in..., then click on Add... and select
"Certificates" and click Add, select "Computer account" and click Next and click
Finish, click Close and click OK.
3) Double click on "Certificates (Local computer)" and you will see six folders
starting with "Personal" and ending with "SPC". The two folders that we care
about are "Personal" and "Trusted Root Certification Authorities".  If you look
inside the Personal folder you will see that it is empty... That we are going to
do is request a certificate from the CA and install the certificate. Once the
certificate gets installed it will appear in the Personal folders, AND the root
CA certificate will be installed in the "Trusted Root Certification Authorities"
AUTOMATICALLY!
4) Let's save our setup for now. Click on Console---> Save As... Type in
"Policy1" and save it on the desktop for easy access.

5) Now we are ready to request a certificate from the CA. We can do the
certificate request through a Web browser. So, launch Internet Explore. If you
are launch Internet Explorer for the first time, then do the following steps,
otherwise, got step 6.
     a) When you launch it for the firs time, you will see "Welcome to the
     Internet Connection Wizard", select the "I want to setup my Internet
     connection manually, or I want to connect through a local area network
     (LAN)." and click Next.
     b) Select "I connect through a local area network (LAN)" and click on Next.
     c) Uncheck the "Automatic discovery of proxy server (recommended)" box
     (make it empty), then uncheck the "Manual Proxy Server" box (make it empty
     too) and click on Next.
     d) Select No and click Next.
     e) Click on Finish and Internet explorer will be automatically launched.

6) Type the URL of the certitifcate server ex: http://x.x.x.x/certsrv and hit
enter.
7) "Request a certificate" is selected by default (which is the action that we
want to take right now). Click Next.
8) Select "Advanced request" and click Next.
9) "Submit a certificate request to this CA using a form" is selected which is
what we want to do right now, so click Next.
10) In the Name field type in your name and leave the other fields blank.
11) Under "Intended Purpose" click on "Client Authentication Certificate" and
then select "IPsec Certificate"
12) Under Key Options: YOU MUST CHECK THE "Use local machine store" box. DON'T
LEAVE IT EMPTY.
13) Click Submit and your request will be sent to the CA for approval.

At this point, we need to go to the CA and approve this request. So go to the
VPN server and do the following:
1) Start --> Programs --> Administrative Tools --> Certification Authority
2) Double click "Certification Authority (Local)", then double click the name of
the CA (which in our case we called it 3Com). After that you will see four
folders starting with "Revoked Certificates" and ending with "Failed
Certificates".
3) Click on the "Pending Requests" folder and to the right hand side you will
see the certificate request that we sent towards the end of step 13 earlier...
4) Select that certificate, and right click on it, select ALL Tasks, then select
Issue. Now, this certificate request has been approved and the certificate has
moved to the "Issued Certificate" folder.
5) That's all what need to be done at the server... now, we need to go back to
the client and install the certificate.

Now, at the client do the following:
14) We are now at step 14 (continuation of step 13 earlier). Point Internet
Explorer to the following URL  http://x.x.x.x/certsrv
15) Select "Check on pending certificate" and click Next...
16) You will now see you IPsec certificate, click on Next.
17) Now, you are ready to install the certificate. Click on "Install this
certificate" and in few seconds your IPsec certificate will be installed on your
system. That certificate will be located in the "Personal" folder.
18) Goto the MMC program where we saved our configuration in Policy1 and look
inside the "Personal" folder and you will see the IPsec certificate that you
have just downloaded. If you can't see it, simply right click on "Personal" and
select Refresh, then double click on Personal you should then see a folder
called Certificates. Double click on that, and you will see your IPsec
certificate. Double click on the certificate and you will see various info about
the certificate.
19) Goto the "Trusted Root Certification Authorities", and right click on it,
then select Refresh. Double click on the "Trusted Root Certification
Authorities", then double click on "Certificates" and locate the certificate for
the CA that issued you the certificate. It must be there....

There is one more thing left to do before the client can establish an L2TP IPsec
tunnel with the VPN Server.
We MUST set the ProhibitIpSec entry in the registry to 0 (Zero). So set the
ProhibitIpSec to 0 on BOTH the client AND server.

Very important: The VPN server MUST also have an IPsec certificate for
L2TP/IPsec to work. That means, the VPN server must also request and install an
IPsec certificate so that the L2TP client can connect to the L2TP server and use
IPsec for security. So, you pretty much have to repeat steps 1 - 19 on the VPN
server...

After all of the above is taken care of, you can now have the client establish
an L2TP tunnel with the VPN server and automatically all traffic will be
protected via Ipsec. By default you get ESP DES. If you apply the ?High
Encryption Pack?, then you get ESP 3DES.

Hope this will fix your problem...

Regards,
Peter

"Mike Wronski" <[email-masked]> on 04/20/2000 02:29:52 PM

Sent by:  "Mike Wronski" <[email-masked]>

To:   [email-masked]
cc:    (Peter Rizk/HQ/3Com)
Subject:  Win2K as LNS w/o IPSEC

Thanks,
-M