Re: L2TP Connection Issue
From: CG (cg_at_cg.com)
Date: 10/31/04
- Next message: Susan Bradley aka ebitz: "Re: SBS2003 / ISA 2000 - Is it possible to setup an IPSec VPN tunnel to an external Cisco IOS router?"
- Previous message: Janani V[MSFT]: "Re: VPN Port"
- Messages sorted by: [ date ] [ thread ]
Date: Sun, 31 Oct 2004 11:18:40 -0500
where should the Root Cert show up? Local computer or Personal? I can only
get mine to go to the Personal when I install it from the cert server's
webpage.
"Sharoon Shetty K [MSFT]" <sharoons@online.microsoft.com> wrote in message
news:%23EOTu0EsEHA.2764@TK2MSFTNGP11.phx.gbl...
> The client needs the root certificate that the server's certificate chains
> to. The server needs the root certificate that the client's certificate
> chains to. If you are using an enterprise CA, the root certificate should
be
> automatically propagated through group policy.
>
>
>
> Use certmgr.msc to check and make sure that the certificates exist
> appropriately before trying to set up the connection.
>
>
>
>
> Certificates are kept in the "certificate store" of the machine. ("Store"
as
> in "storage area.") You can view the certificates (and their properties)
on
> the machine by opening the Microsoft Management Console (Start, Run, type
> "mmc" and hit enter) and adding the certificates snap-in to the console.
>
>
>
> There are two certificate stores on a machine -- the Current User store
and
> the Local Computer store. You can add both stores to the snap-in so that
you
> can view them from the same console (and then you can save the console for
> later use). For more MMC info see
>
>
http://www.microsoft.com/windows2000/techinfo/planning/management/mmcsteps.asp
>
>
>
> Some tips:
>
> The server cert must be in the Local Computer cert store. Also, when you
> configure the cert templates, make sure the server cert has the server
> authentication purpose in Enhanced Key Usage extensions. Do not substitute
> the "All" purpose for the "Server Authentication" purpose or the cert is
> invalid.
>
>
>
> If possible, use the Web enrollment tool to enroll the cert on the server.
>
>
>
> If clients are domain members, you can autoenroll client computer
> certificates (but not user certs) using Group Policy. That is a little
> complicated to set up, but is much easier than manually installing certs
on
> all clients. Clients must have the Client Authentication purpose in EKU
> extensions, not the "All" purpose.
>
>
>
> Some resources that are recommended:
>
> Step-by-Step Guide to Setting up a Certification Authority
>
>
http://www.microsoft.com/windows2000/techinfo/planning/security/casetupsteps.asp
>
>
>
> Step-by-Step Guide to Advanced Certificate Management
>
>
http://www.microsoft.com/windows2000/techinfo/planning/security/advcertsteps.asp
>
>
>
> The following topic is from Windows Server 2003 Help, "Network access
> authentication and certificates" in Windows Server 2003 IAS or VPN Help,
or
> on the web at
>
>
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/sag_VPN_und15.asp
>
>
>
> Hope this helps!
>
>
> --
> Thanks,
> Sharoon
> ---------------------------------------------------------
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
> "John Ilgen" <anonymous@discussions.microsoft.com> wrote in message
> news:381601c4aaf5$6dbfeae0$a301280a@phx.gbl...
> >I tried the fix.
> >
> > Got error 789. The L2TP connection attempt failed because
> > the security layer encountered a processing error during
> > initial negotiations with the remote computer.
> >
> > For the certificate - I put the IPSEC certificate on both
> > the ISA server and the client. I assume that this is
> > correct.
> >
> > Thanks,
> >
> > John
> >
> >>-----Original Message-----
> >>Check the following KB article
> >>http://support.microsoft.com/default.aspx?scid=kb;EN-
> > US;247231
> >>
> >>--
> >>Thanks,
> >>Sharoon
> >>---------------------------------------------------------
> >>This posting is provided "AS IS" with no warranties, and
> > confers no rights.
> >>
> >>"John Ilgen" <anonymous@discussions.microsoft.com> wrote
> > in message
> >>news:3bce01c4aa76$17957470$a401280a@phx.gbl...
> >>> Can connect with PPTP but get Error 792. L2tp connection
> >>> attem failed because security timed out.
> >>>
> >>> Have followed procedures on Technet web site for L2TP
> > cert
> >>> install.
> >>>
> >>> Any suggestions?
> >>>
> >>> Thanks,
> >>>
> >>> John
> >>
> >>
> >>.
> >>
>
>
- Next message: Susan Bradley aka ebitz: "Re: SBS2003 / ISA 2000 - Is it possible to setup an IPSec VPN tunnel to an external Cisco IOS router?"
- Previous message: Janani V[MSFT]: "Re: VPN Port"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
