Title: Document Number: Version: OS Ver. this Paper Applies to: HW Platforms this Paper Applies to: udience (Internal or External): Purpose Overview

Transcription

1 Title: Windows 2000 Remote VPN to Netscreen using L2TP Document Number: VPN Version: 0.1 OS Ver. this Paper Applies to: 2.60 HW Platforms this Paper Applies to: All Audience (Internal or External): External Purpose The purpose of this paper is to assist a user in setting up a remote VPN tunnel using L2TP from a PC running Windows 2000 (WIN2K) Professional to a Netscreen VPN firewall device running ScreenOs 2.6. Overview To configure a VPN using L2TP you must create a native Microsoft VPN L2TP connection within WIN2k to the Netscreen firewall. This paper will provide a procedure in how to configure a VPN via L2TP with Windows Setting Up the Netscreen for L2TP First step is to create a L2TP user within the Netscreen through the WEBUI in the user section. You must only worry about selecting the L2TP entering the password and entering the username.

2 2. You must then go the VPN section and select IPPOOL, select New IPPOOL, enter the name of the IPPOOL and a range within the trusted subnet or you can define a totally different subnet. 3. Click on the L2TP Default Configuration. You must enter the primary and secondary DNS servers and the WINS server if you so desire.

3 4. Click on L2TP Default Configuration and enter the name of the L2TP tunnel.

4 5. Click on the policy section, click on the incoming section, select Dial-Up VPN for the Source Address, select Inside Any or the address that you prefer for Destination Address, select Any for the service, click on Tunnel for the Action, select L2TP tunnel name for the L2TP section, and you can select Logging or Counting if you so desire.

5 You must now edit your registry to make a connection for L2TP Important L2TP-related registry keys: 1. ProhibitIPSec registry key: Registry path: LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RasMan/Parameters/ProhibitIPSec 2.Once you reach this file double click on it 3. If its value is 0, or it doesn't exist, then W2K does L2TP/IPSec automatically. This should be turned off when your using L2TP only because WIN2K will try to do L2TP/IPSEC. It will sense that the IPSEC portion is not setup and will fail. If its value is 1, then W2K disables IPSec and does L2TP-only for you. It's not there by default. You'll have to create it later on to modify it to meet your need accordingly. To edit this portion you must be in the directory LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/RasMan/Parameters. You then must click on Edit, select DWORD value, you must rename the file you just created to ProhibitIPSec, then you must enter 1 in the Value data box, leave Hexadecimal selected, and then click OK. Once you have done all these modifications to the registry you must reboot you machine. 4. You must go to the PASSWORD registry key for L2TP tunnel authentication: Registry path HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Class/4D36E972-E325 /0002/ (On my W2K box, it s Should be the one containing minil2tpport)password/password (An easier way to locate it: find the registry containing key word "l2tp_miniport") If its value is empty, or it doesn't exist, then W2K doesn't do L2TP tunnel authentication. If its value is a non-empty string, then W2K does L2TP tunnel authentication. In this case, NS box must configure secret string in the corresponding L2TP configuration. The secret string and the string value of this registry key must match exactly. It's not there by default. You'll have to create, later on modify, it to meet your need accordingly. It must be a STRING registry key. 5. Configure Dial-Up Connection for L2TP: Windows menu-dialog path: Start=>Programs=>Accessories=>Communications=>Network and Dial-up Connections 6. Click on Make New Connection then click on next 7. Connect to a private network through the Internet and click on next 8. If the physical connection will be Ethernet connection, check Do not dial the initial connection. If the physical connection will be thru an ISP, check Automatically dial this initial connection and select the dial-up connection that connects you to your ISP click on next 9. In the Host name or IP address: enter the IP address of the Netscreen s Untrust interface then click next 10. You can select For all users or the other choice, depending on your own need then select next 11. Enter the desired Name then select finish. 12. Click on Properties

6 13. Click on Security then select Advanced settings then click on Settings 14. Under Data Encryption select Optional encryption. You then must select PAP and CHAP then click OK 15. Click on the Networking tab Under Type of VPN I am calling select L2TP then select OK Testing the Tunnel and Debugging At this point, you are done with the initial configuration. If all goes well, you should be able to ping across to the trusted network. Typically, you will find the first 5-8 pings fail, but afterwards, a reply will come back after the tunnel has been created. You must go back to the connection you created for the L2TP and enter the password to connect. You must have a connection to the internet or LAN to test this connection. To troubleshoot matters, on WIN2K to useful debugging commands are Debug L2TP 10 Debug flow basic