Tip

Windows 2000 and certificates

The two most common options for authenticating L2TP/IPSec/IKE are shared secrets and certificates. Certificates are generally regarded as more secure than shared secrets for a number of reasons, both theoretically and from the standpoint of practical implementation. However, in most endpoints, such as VPN appliances or routers and many hosts, managing certificates can be a real pain, not to mention expensive, if you subscribe to a 3rd party service for PKI. Shared secrets, on the other hand, are very simple; you just enter the same password into both devices.

But Microsoft's Windows 2000, both Professional and Server varieties, is just the opposite. Windows 2000 makes dealing with certificates fairly simple, and it is the default behavior. Microsoft also facilitates this with its Certificate Server product, which can satisfy a significant portion the PKI infrastructure requirements for your entire network. And it's free, if you have Windows 2000 server already.

The flip side is that using shared secrets with Windows 2000 is not simple at all. This is primarily because Microsoft strongly opposes the use of pre-shared keys, so they're difficult to configure in Microsoft products.

So if all your VPN endpoints are Windows 2000-based, using certificates for authentication is clearly a winning solution. However, if you have a mix of devices, there may exist some reason that would justify using pre-shared secrets instead of certificates. If this

    Requires Free Membership to View

is the case, or if you are considering deploying a mixed-vendor VPN solution, you should read this Microsoft Knowledgebase article.

While you won't often find people recommending a less-secure solution, organizations' security needs vary, and as a practical matter, the cost of implementing and managing a security solution should be compared to the cost of a denial of service, or having your data stolen, etc.


Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.

VPN management topics like this one will be discussed at the new Networking Decisions Conference held in Chicago on October 16 - 18. The conference is free for attendees. Go to www.netorkingdecisions.com to read more, and to sign up for a free registration.


This was first published in September 2002

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.