Setting Up
the Windows 98SE PPTP and L2TP/IPSec Client
Windows 98
VPN clients can connect to the ISA Server firewall/VPN server using either PPTP
or L2TP/IPSec. If you have a Windows 98 computer that meets the following
specifications:
·
Installed
with the default installation settings
·
Completely
updated with all updates on the Windows Update site
Then you need to carry out the following procedures to
connect to the ISA Server firewall/VPN server:
- Install Dial-Up Networking
version 1.4 (DUN 1.4)
- Install the Microsoft
L2TP/IPSec VPN client
- Obtain a user certificate
- Create the PPTP Dial-up
Networking Entry
- Create the L2TP/IPSec Dial-up
Network Entry
You will be
able to establish both PPTP and L2TP/IPSec VPN connections to the ISA Server
firewall/VPN server after completing these steps.
Installing Dial-up Networking
Version 1.4 (DUN 1.4)
Perform the
following steps to install DUN 1.4 on the Windows 98SE Computer:
1.
Go to http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q285/1/89.ASP&NoWebContent=1
and follow the link to the Windows 98
Second Edition DUN 1.4 download. Click the link and download the Dun14-se.exe file to the desktop.
Microsoft DUN 1.4 must be installed before you can
install the Microsoft L2TP/IPSec VPN client.
2.
Double click on the dun14-se.exe on the desktop. Click Yes on the dialog
box
3.
Click Yes in the dialog box indicating
that you accept all terms of the License Agreement. DUN 1.4 file will now be
installed.
4.
You will be asked for the Windows 98
CD-ROM (Figure 1). Click OK on the Insert Disk dialog box. Type a path to
the Setup folder in the Copying Files
dialog box and click OK.
Figure 1
(Fig1)
5.
If you encounter Version Conflict dialog boxes (figure
2), click Yes on each of them to
keep the new file.
Figure 2
(Fig2)
6.
Click Yes in the System Settings
Change dialog box. This will restart your computer.
Installing the Microsoft L2TP/IPSec
VPN Client Software
Now you can
download and install the Microsoft
L2TP/IPSec VPN Client software and install it on the Windows 98SE computer:
1.
Open Internet Explorer and go to http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/l2tpclient.asp
to download the Microsoft L2TP/IPSec VPN
Client. Note that there is an administrators guide for the Microsoft
L2TP/IPSec VPN client on this page. You should review the administrators guide
either before or after installing the Microsoft L2TP/IPSec VPN client software.
Click the msl2tp.exe link and
download the file to your desktop.
2.
Double click on the msl2tp.exe file on the desktop. Click Yes on the Microsoft L2TP/IPSec VPN Client Setup v1.0 dialog box.
3.
Click Yes in the dialog box to indicate that you accept all the terms of
the licensing agreement. The MS
L2TP/IPSec VPN Client software installs (figure 3).
Figure 3
(Fig3)
4.
Click Yes in the dialog box asking if you want to restart the computer.
The computer restarts.
5.
You may be presented with a Location Information dialog box after
restarting the Windows 98SE computer (Figure 4). If so, enter your Area Code
and click Close. Log in to the
Windows 98SE computer.
Figure 4
(Fig4)
Obtain a User Certificate to Allow
L2TP/IPSec Connections
Dial-up
Networking 1.4 (DUN 1.4) and the Microsoft L2TP/IPSec VPN Client are now installed
on the Windows 98SE computer. The next step is to obtain a user certificate
that the Microsoft L2TP/IPSec VPN Client can use to create L2TP/IPSec
connections with the ISA Server Firewall/VPN Server.
Note:
The Microsoft L2TP/IPSec VPN Client is not required if you wish to create only
PPTP connections to the ISA Server firewall/VPN server.
There are
many methods available to obtain user certificates from a Microsoft Certificate
Server. The most common scenario is when there is a standalone or enterprise
Microsoft Certificate Server located on the internal network and the Web
enrollment site is installed on the standalone Certificate Server. We will go
through the steps of obtaining a user certificate from the Web enrollment site
of a standalone Microsoft Certificate Server running on a Windows Server 2003
machine.
Note:
You can get more
Perform the
following steps on the Windows 98SE computer to obtain the user certificate:
1.
On the Windows 98SE computer, open Internet Explorer and type in the URL http://<ip_address>/certsrv
or http://fqdn/certsrv.
Where <ip_address>
and <fqdn>
represent the IP address and Fully Qualified Domain Name of the standalone
Microsoft Certificate Server. The IP address or FQDN can be an internal address
or FQDN or an external IP address or FQDN. External addresses are used when the
Certificate Server is published to the Internet.
Note:
For more
2.
On the Microsoft Certificate Services Welcome
page (figure 5), click the Request a
certificate link.
Figure 5
(Fig5)
3.
On the Request a Certificate page (figure 6), click the Web Browser Certificate link.
Figure 6
(Fig6)
4.
Click Yes on the Security Warning
dialog box (figure 7) that asks if you want to install and run the Microsoft Certificate Enrollment Control.
Click Yes again if you see the
dialog box a second time.
Figure 7
(Fig7)
5.
Type in your user
Figure 8
(Fig8)
6.
Click Yes on the Potential
Scripting Violation dialog box that
7.
The Certificate Pending page appears and
Figure 9
(Fig9)
8.
Click the Home link on the Certificate
Pending page (figure 9). This takes you back to the Welcome page (figure 10). On the Welcome page, click the View
the status of a pending certificate request link.
Figure 10
(Fig10)
9.
On the View the Status of a Pending Certificate Request page (figure 11),
click the Web Browser Certificate
(Date/Time) link. In this example the link says Web Browser Certificate (Thursday
Figure 11
(Fig11)
10. On the Certificate Issued page (figure 12), click the Install this certificate link. Click Yes in the Potential
Scripting Violation dialog box that warns that you need to trust the Web
enrollment site.
Figure 12
(Fig12)
11. Click Yes on the Root Certificate
Store dialog box (figure 13). This dialog box tells you the certificate
authority’s self-signed (Self Issued)
certificate will be added to the Trusted Root Authorities certificate store.
Figure 13
(Fig13)
12. Close Internet Explorer after you
see the Certificate Installed page.
Creating the PPTP VPN Dial-up
Networking Entry
The Windows
98SE VPN client now has DUN 1.4, the Microsoft L2TP/IPSec VPN client, and a
user certificate installed. Now we can create the VPN connectoids that we use
to connect to the ISA Server firewall/VPN server. Let’s start with creating a
PPTP VPN connectoid.
Note:
A VPN connectoid is a Dial-up Networking entry represented by an icon in the
Dial-up Networking Window.
Perform the
following steps to create the PPTP VPN Dial-up Networking connection:
1.
Click Start and point to Programs.
Point to Accessories and then point
to Communications. Click on Dial-up Networking.
2.
If this is the first time you’ve run
Dial-up networking on this machine, you should click Next on the Welcome to
Dial-Up Networking dialog box (figure 14). If you have run the Dial-up
networking application on the Windows 98SE computer at some time in the past,
then the Dial-up Networking windows will appear. Double click on the Make New Connection icon in the Dial-Up Networking window.
Figure 14
(Fig14)
3.
In the Make New Connection dialog box (figure 15), type in a name for the
PPTP VPN connectoid in the Type a name
for the computer you are dialing text box. In this example, we’ll call it PPTP VPN. Click the down arrow for the Select a device drop down list box.
Select the Microsoft VPN Adapter
entry. Click Next.
Figure 15
(Fig15)
4.
On the Make New Connection page (figure 16), type in an IP address or FQDN
for the ISA Server firewall/VPN server. In this example we’ll use an IP
address. If you choose to use a FQDN, make sure the FQDN resolves to the primary
IP address on the external interface of the ISA Server firewall/VPN server. The
primary IP address is the top listed IP address seen in the Advanced TCP/IP Properties dialog box
(on the Windows 2000/Windows Server 2003 Server machine). Click Next.
Figure 16
(Fig16)
5.
Click Finish on the Make New
Connection dialog box (figure 17). The PPTP VPN connection will be placed
in the Dial-up Networking folder.
Figure 17
(Fig17)
6.
Return to the Dial-Up Networking folder and right click on the PPTP VPN connectoid. Click the Properties command (figure 18).
Figure 18
(Fig18)
7.
Click the Server Types tab in the PPTP
VPN dialog box (figure 19). Place checkmarks in the Require encrypted password and Require
data encryption checkboxes. Remove the checkmarks from the NetBEUI and TCP/IP checkboxes. Click OK.
Figure 19
(Fig19)
8.
Double click on the PPTP VPN connectoid. Type in a User name and Password of a user that has Remote Access permission to connect to
the VPN server (figure 20).
Figure 20
(Fig20)
9.
You will see the You are connected to PPTP VPN dialog
box (figure 21) when the connection succeeds. If you right click on the Dial-up
networking connection icon in the system tray and click the Status command, you’ll see the Connected to PPTP VPN dialog box. Click
the Details button. This dialog box gives you
Figure 21
(Fig21)
Creating the L2TP/IPSec Dial-up
Networking Connection
Perform the
following steps to create an L2TP/IPSec VPN Dial-up Networking connection
between the Windows 98SE computer and your ISA Server firewall/VPN server:
1.
Click Start and point to Programs.
Point to Accessories and then point
to Communications. Click on Dial-up Networking.
2.
Double click on the Make New Connection icon in the Dial-Up Networking window.
3.
In the Make New Connection dialog box (figure 22), type in a name for the
connectoid in the Type a name for the
computer you are dialing text box. Click the down-arrow in the Select a device drop down list box and
select the Microsoft L2TP/IPSec VPN
Adapter 1 option. Click Next.
Figure 22
(Fig22)
4.
In the Make New Connection dialog box (figure 23), type in the FQDN or IP
address of the ISA Server firewall VPN server in the Host name or IP Address text box. Click Next.
Figure 23
(Fig23)
5.
Click Finish in the Make New
Connection dialog box. The L2TP/IPSec VPN connectoid will be saved in the Dial-Up Networking folder.
6.
Return to the Dial-Up Networking folder and right click on the L2TP-IPSec connectoid. Click the Properties command.
7.
Click the Server Types tab in the L2TP-IPSec
dialog box. Place checkmarks in the Require
encrypted password and Require data
encryption checkboxes. Remove the checkmarks from the NetBEUI and TCP/IP
checkboxes. Click OK.
8.
Double click on the L2TP/IPSec
connectoid in the Dial-Up Networking
folder and enter your credentials. The L2TP/IPsec VPN connection is
established.
At this
point the Windows 98 computer will be able to make L2TP/IPSec connections to
the ISA Server firewall/VPN server. In addition, the Windows 98 computer will
be able to make outbound L2TP/IPSec connections through a NAT device such as a
NAT router or NAT-based firewall such as ISA Server. Please refer to ISA Server
VPN Deployment Kit Documents Configuring the ISA Server
Firewall/VPN Server to Support L2TP/IPSec NAT Traversal Client Connections
and Configuring the ISA Firewall/VPN Server to Support
Outbound L2TP/IPSec NAT-T Connections for more