Creating a VPN Connection with Windows XP Professional

Windows XP Professional, like Windows 2000, contains integrated support for VPN clients using with L2TP or IPSec protocols. VPN connections, like other types of network connections, are created and configured through the Network Connections folder.

Before you can set up a connection to a VPN server, you need to know the following information:

• The IP address or host name of the server

• Your username and password

• The security settings used by the remote server

• The PPP settings used by the remote server

Note

The default configuration a Windows XP VPN client uses is designed to enable you to connect with many VPN clients without adjusting security or PPP settings. However, if you cannot connect successfully using the default settings, you can adjust these settings through the Properties dialog for the VPN connection.

Setting Up and Using a VPN Connection in Windows XP

In Windows XP, VPN connections are created using the same New Connection Wizard used for other types of network connections. To set up a VPN connection in Windows XP, follow this procedure:

1.	Click Create a New Connection from the Network Tasks menu in the Network Connections folder.
2.	From the opening dialog, click Next to continue.
3.	Select Connect to the Network at My Workplace, and click Next.
4.	Select Virtual Private Network Connection, and click Next.
5.	Enter a descriptive name for the connection. This is the name that is displayed in Network Connections. Click Next.
6.	If you use a dial-up, ISDN, or PPPoE connection, select Automatically Dial This Initial Connection and select the connection to use from the pull-down menu. If you use an always-on connection, select Do Not Dial the Initial Connection, and click Next.
7.	Enter the host name or IP address for the VPN server. Click Next.
8.	To add a shortcut to the desktop, click the Add a Shortcut to This Connection to My Desktop check box. Click Finish to complete the setup.

When you click Finish, a Connect dialog appears. Enter your username and password, and click Connect to try your connection. If you want to save your credentials, click the Save This User Name and Password... check box. Specify Me Only if you want to restrict the use of this VPN connection to the current user only. Click Anyone... to enable any user of this computer to use the connection.

To configure the VPN connection, click Properties on the Connect dialog, or right-click the connection icon in Network Connections and select Properties.

Caution

The default properties for a VPN connection are designed to enable you to connect to many VPN servers, particularly those running Windows, without adjustments. Make sure you know which, if any, settings must be changed before you make changes. If you are able to connect successfully without making any changes, there is no need to adjust these properties. Making unnecessary changes could prevent you from making a connection.

VPN ConnectionGeneral Tab

Use this tab to change the host name or IP address of the remote VPN server. If you use a dial-up or other connection that requires you to log in first, such as an ISDN or PPPoE connection, use the First Connect portion of the dialog to select the connection to open before starting the VPN connection. You need to do this if you change to a different dial-up or other provider that requires a manual login after you created your VPN connection.

By default, an icon appears in the notification area (system tray) of your desktop when you are connected. Clear the Show Icon... check box if you prefer not to see a notification icon.

VPN ConnectionOptions Tab

Use this tab to adjust dialing and redialing options, such as if the line is busy or the connection is dropped. Keep in mind, however, that this dialog is also used to specify whether you are prompted for username and password, security certifications (enabled), and whether to include the Windows logon domain (disabled). If necessary, adjust the defaults to match the requirements of your VPN server.

VPN ConnectionSecurity Tab

Use this tab to adjust the VPN security defaults used by Windows XP. This is necessary only if you receive an error message such as "The remote computer does not support the required data encryption type" when you attempt to connect.

The default (Typical) settings used by Windows XP's VPN client include Require Secured Password and Require Data Encryption. If you use a smart card, select Use Smart Card instead of Require Secured Passport.

If you need to adjust data encryption, logon security, or allowed protocols, select Advanced, and click the Settings button. Before making any changes, be sure you know the settings required by the remote VPN server. Table 46.1 lists the default and optional settings for the Advanced Security Settings dialog.

Table 46.1. Advanced Security Settings for Windows XP VPN Client

Setting	Default	Options	Notes
Data Encryption	Require Encryption (Disconnect if Server Declines)	No Encryption Allowed, Optional Encryption, or Maximum Strength Encryption	Use the setting recommended by your VPN server; if Optional is selected, you could make an unprotected connection without realizing it.
Logon Security	No default	Use EAP: Smart Card or Other Certificate, or MD5-Challenge	Click Properties to select the certificate or smart card to use; use View Certificate to determine the expiration date and other settings. This dialog is not enabled unless you select it in place of Allow These Protocols.
Allow These Protocols	Microsoft CHAP; Microsoft CHAP Version 2	Unencrypted Password (PAP); Shiva PAP; CHAP; Allow Older MS-CHAP Version for W95 Servers; Automatically Use Windows Logon Name/Password/Domain	If you connect to a non-Windows VPN server, you probably need to change these defaults.

Click the IPSec Settings button if you need to provide a preshared key for authentication of your connection.

VPN ConnectionNetworking Tab

Use the Networking tab if you need to specify the type of VPN connection you are making or to adjust the clients, protocols, or drivers used by the connection.

The default VPN connection type, Automatic, is normally satisfactory for either PPTP or L2TP IPSec connections. Click Settings to adjust the following PPP options:

• Enable LCP Extensions (enabled)

• Enable Software Compression (enabled)

• Negotiate Multi-link for Single-link Connections (disabled)

The network clients, protocols, and drivers for the current connection are also listed. If you need to install a new client, protocol, or driver, click Install. To disable a particular client, protocol, or driver, clear the check box. Items with a grey check box are required for VPN and cannot be configured through the Properties button or disabled.

VPN ConnectionAdvanced Tab

The VPN connection Advanced tab is used to configure the Windows Firewall and Internet Connection Sharing.

Troubleshooting a VPN Connection

If you are unable to connect to a VPN server, check the following:

• Check basic settings such as username, password, and host name or IP address. These settings are easy to change, and a single digit or letter error is enough to prevent a successful connection.

• Compare the settings used by your VPN client to those expected by the VPN server. Adjust client settings to match those used by the server.

• If you use a router to connect your computer to the Internet, make sure the router is configured to provide IPSec and PPTP pass through. With a Linksys router, check the Filters dialog to check these settings. For other routers, check your documentation. If either or both pass through settings are disabled, you are not able to connect to a VPN server.

• If you use a router to connect your computer to the Internet and another user has a VPN connection running, but you can't connect at the same time, this is normal. Most low-cost routers for home and small office support IPSec and PPTP pass through for only one user at a time.

If you need support for multiple VPN connections, see the next section, "Selecting a Router with VPN Support."

For additional VPN troubleshooting suggestions, check with the help desk for the VPN server.

Tip

Microsoft offers the following Knowledge Base articles to help you with VPN client issues. To locate the article, search for the article number at http://support.microsoft.com:

Windows XP Professional

• "How to Configure a VPN Connection to Your Corporate Network in Windows XP Professional" (305550)

• "Basic L2TP/IPSec Troubleshooting in Windows XP" (314831)

Windows 2000 Professional

• "How to Configure Windows 2000 Professional to Windows 2000 Professional Virtual Private Network Connections" (257333)

• "How to Install and Configure a Virtual Private Network Server in Windows 2000" (308208). This article also contains a section on configuring a Windows 2000 client to connect to a VPN.

• "Basic L2TP/IPSec Troubleshooting in Windows 2000" (259335)