VPN security settings in Windows XP

VPN security settings in Windows XP
Tom Lancaster

Once you've established a VPN connection in the Windows XP environment, you have access to a whole battery of advanced security settings and controls over that connection.

Here are the basic steps involved in accessing a VPN connection's security controls (this approach assumes you've got a VPN connection already set up. See VPN connections in Windows XP on how to set up such a connection):

1. Click Start, Connect To, then select whichever VPN connection for which you wish to access security settings.
2. This launches the Connect <connection-name> Window. Click the Properties button to see the connection properties window, and then click the Security tab.
3. The default is to select the Typical (recommended settings) button. This option is always selected when a new VPN connection is established for the first time. Note that identity can be validated using a smart card as well as by requiring a secured password (both elements show up by default in the Validate my identity as follows: pick list). Note also that you can use your Windows account name and password, plus domain information, to establish a VPN connection (but that this option is NOT selected by default). Finally note that data encryption is enabled by default. It's rare for Microsoft, but all these defaults represent intelligent, pessimistic security selections!
4. To explore other security options available for a VPN connection, click the radio button labeled Advanced (custom settings), then click the Settings button.
5. Exploring the Data Encryption pick list, you'll find the following options: No encryption allowed, Optional encryption, Require encryption, and Maximum strength encryption.
6. In the Logon Security pane, you'll see settings for any Extensible Authentication Protocols (EAPs) you may have installed on this machine. You'll also find a variety of protocol settings that may be used for the connection, including: PAP, SPAP, CHAP, MS-CHAP (selected by default, with support for an older version for Windows 95, if needed), MS-CHAPv2 (also selected by default) with the ability to associate Windows logon account and password with the VPN connection if desired (NOT selected by default).
7. The IPSec Settings button also gives you the ability to supply a pre-shared key for authentication, if such a key has been defined. (Hint: use cut and paste to drop the key into the textbox here to avoid possible errors.)
8. The Networking tab on the connection properties window also gives access to some key functionality, including the ability to specify the type of VPN connection to be used. Automatic is the default selection, but you can also limit the connection to either PPTP VPN or L2TP IPSec VPN, if you so choose. You can also access protocol and service properties through the This connection uses the following items: pane, including TCP/IP, Quality of Service (QoS), File and Printer Sharing for Microsoft Networks, and Client for Microsoft Networks (as with any other network connection in the Windows XP environment). Use these settings to control the behavior of your VPN connection--if you don't need Microsoft Client or File and Printer Sharing across the VPN connection, uncheck their checkboxes to turn off that functionality.
9. Finally, the Advanced tab on the connection properties window provides controls for the Internet Connection Firewall and Internet Connection Sharing properties associated with the VPN connection.

Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.