W2K vpn client to Cisco 3005 VPN concentrator

Yes, you can connect to a Cisco VPN concentrator using L2TP alone or L2TP/IPsec.

By default, W2K creates an IPsec policy for L2TP that relies on digital signature (digital certificate) authentication. So, if you want to configure either L2TP alone or L2TP/IPsec with pre-shared key authentication then you need to modify the registry.

Take a look at this article for more:

By creating the 'ProhibitIpSec' value, and setting the value to '1' (as discussed in the first part of the article), you actually disable the automatic creation of an IPsec policy (using digitial signature auth) for L2TP. So, if you don't want to use IPsec with L2TP, you can stop there, without following the instructions in the rest of the article (although you should consider the security implications!).

Hope that helps,

Mark

CCIE#6280 / CCSI#21051 / JNICS#121 / etc.

Author:

I've gotten l2tp working with the w2k client and cisco vpn 3005, but it looks like the same problem I was having with pptp.

Is there no way to connect with pptp or l2tp to a 3005 concentrator with encryption, when that concentrator is authenticating against an Active Directory server?

Can the same problem be solved under Windows XP and Windows 2003? Key 'ProhibitIpSec' does not work and I found no solution on MSDN site.

I will preface this by saying that it has been a couple of years since I did this, but I am reasonably positive that you can get PPTP with encryption working when the concentrator is authenticating against AD. Well, technically, we are authenticating against AD via RADIUS, using Windows' Internet Authentication Service (IAS).

If I recall correctly, the trick is making sure that you configure the concentrator to use MS-CHAP or higher, and to configure a Remote Access Policy on IAS that also supports MS-CHAP or higher for authentication. If you allow PAP or CHAP, encryption for PPTP cannot be negotiated.

Give that a try and see if it helps.