Guidelines For Selecting A Vpn Protocol For A Specific Communication Task

By Author: Shirley Green
Total Articles: 129
Comment this article

Follow these guidelines for selecting a VPN microsoft exams for a specific communication task:In general, if a public key infrastructure is not available, select PPTP.If the highest level of security is required, select L2TP/IPSec. L2TP/IPSec provides not only mutual authentication of users, but also the computer and VPN endpoint.
L2TP/IPSec also provides stronger end-to-end encryption than PPTP does. Use IPSec tunnel mode only when interoperability issues require you to.
If DBS or 3DES is required by the organization's security policy for encryption, use L2TP/IPSec.
Because of the CPU overhead incurred by using IPSec on VPN servers, consider either installing IPSec offload hardware or using PPTP instead.
Use PPTP when testing VPN connectivity. It is easier to use and configure. If the VPN works with PPTP but does not work with L2TP/IPSec, the problem is related to the protocol or protocol configuration—there will be fewer things to trouble-shoot. Because PPTP does not require certificates for computer authentication and NAT is less likely to cause a problem with a 70-620 ...
... VPN, using PPTP to test your VPN will allow you to verify or troubleshoot VPN network connectivity. You can then test the IPSec protocol.

Many VPN client and server configuration selections must match before secure com-munications can take place. The following components can be configured to provide security for VPN connections. You must consider all these components as you design client and server VPN configuration.
Authentication, Authorization, and Accounting Selection Considerations
Two selections are possible for controlling authentication, authorization, and account?ing: Windows or RADIUS. You can select one to control all three, and you can choose one for authentication and authorization and the other for accounting. When Windows authentication is selected, the local Security Accounts Manager (SAM) database of the VPN server will be used if the VPN server is a stand-alone computer and the Active Directory directory services database will be used if the VPN server is a domain mem?ber. When RADIUS is used, the Active Directory database can also be used regardless of whether the VPN server is a domain member. When RADIUS is used, a RADIUS cli?ent (such as a Windows Server 2003 computer) passes credentials to the RADIUS server, which forwards them to Active Directory for validation. RADIUS is implemented in Windows Server 70-640 as a server, the Internet Authentication Service (IAS).