Encryption Considerations

By Author: Shirley Green
Total Articles: 129
Comment this article

Encryption protocols are selected when the VPN is configured. L2TP/IPSec VPNs will use MCSA Certification for encryption. PPTP uses MPPE. Encryption strength is determined by the client and server configuration. Servers must be configured to provide an encryption strength the client is capable of. Encryption strength is rated by the size of the key used. In general, the larger the encryption key, the stronger the protection. Choices include the following:
No encryption. This selection provides no protection for remote access connections of any kind and is not recommended.
Basic. PPTP connections will use a 40-bit key. L2TP/IPSec connections will use 56-bit DBS.
Strong. PPTP connections will use a 56-bit key. L2TP/IPSec connections will use56-bit DES.
Strongest. PPTP connections will use a 128-bit key. L2TP/IP Sec connections will use 128-bit Triple DES (3DES).

EAP-MD5 can be used only with L2TP/IPSec VPNs and dial-up access, not with PPTP or -wireless VPNs. It is less secure than EAP-TLS because it uses pass-words, not certificates. It weakens password ...
... security as well. A reversibly encrypted password must be stored in the microsoft exams account database, as with CHAP.
EAP/MS-CHAPv2 is password based and provides mutual authentication. The client must prove its knowledge of the user password to the server, and the server must prove its knowledge of the user password to the client. Encryp?tion keys are generated for use with MPPE based on the user's password.

The /Account/Lockout subkey is added to the registry when the Routing and Remote Access or Internet Authentication Service is installed on the Windows Server 2003 computer. The subkey is located at:
To enable account lockout, set the MaxDen/a/s value to the number of failed attempts that are allowed before lockout will occur. The number of failed attempts is reset according to the ResetTime value. Setting MaxDenials to MCITP Enterprise Administrator zero disables remote account lockout