Best Practices

• The commands NETSH ras set tracing * enabled and NETSH ras set tracing * disabled can be used to enable and disable RRAS tracing.

• Check the Windows Application Event log to view RRAS-specific information that may not be listed in the ISA logs.

• The command netsh ipsec dynamic set config ikelogging 1 can be used to turn on IKE logging. The log file is located in C:\WINDOWS\debug\oakley.log. The command netsh ipsec dynamic set config ikelogging 0 can be used to turn off IKE logging.

• Use L2TP encryption with PKI certificates whenever possible, rather than PPTP or L2TP with shared key.