Network Connections

Network Connections provides connectivity between your computer and the Internet, a network, or another computer. With Network Connections, you can configure settings to reach local or remote network resources or functions.

Network Connections combines Microsoft® Windows NT® version 4.0 Dial-Up Networking with features that were formerly located in the Network Control Panel, such as network protocol and service configuration. Each connection in the Network Connections folder contains a set of features that creates a link between your computer and another computer or network. By using Network Connections, performing a task, such as modifying a network protocol, is as easy as right-clicking a connection and then clicking Properties.

  • Before using Network Connections, see Checklist: Configuring network connections.

  • Before setting up a home or small office network, see Checklist: Setting up a home or small office network.

  • To find features that have been moved, see New ways to do familiar tasks.

  • For tips about using Network Connections, see Best practices.

  • For help with specific tasks, see How to.

  • For general background information, see Concepts.

  • For problem-solving instructions, see Troubleshooting.


Checklist: Configuring network connections

Step | Reference
Review key concepts. | Network Connections overview
Connect to a local area network. | To make a local area connection
Connect to a network by using a phone line. | To make a dial-up connection by using a phone line; To connect to a remote network
Connect to an Internet service provider (ISP). | To make an Internet connection; To connect to a remote network
Connect to a private network through the Internet (virtual private network). | To make a virtual private network (VPN) connection; To connect to a remote network
Create a direct connection to another computer. | To make a direct network connection; To connect to a remote network
Let other computers connect to this computer. | To accept incoming network connections
Monitor a connection. | To monitor a connection


Checklist: Setting up a home or small office network

Step | Reference
Decide whether to use home and small office networking or Routing and Remote Access for your home or small office network. | Home and small office networking compared to Routing and Remote Access
If you decide to use home and small office networking, review home and small office networking concepts. | Home and small office networking; Using home and small office networking features
Decide how you want to save your Internet connection credentials (you will be prompted to select credential settings when you fist attempt to activate your Internet connection or when you run the New Connection Wizard). | Dial-up credentials
Familiarize yourself with the icons that indicate that Internet Connection Firewall (ICF), Network Bridge, or Internet Connection Sharing (ICS) have been enabled on a network connection. | Network connection icons
Enable ICF to protect your home or small office network. | To enable or disable ICF
Set up Network Bridge to connect network segments. | To set up Network Bridge
Enable ICS to provide a shared Internet connection. | To enable ICS

Note

  • XOX


New ways to do familiar tasks

This table lists common tasks for Network Connections. The user interface for performing these tasks is different in this version of Windows from the way it was in Windows NT version 4.0.

Note

  • XOX
If you want to | In Windows NT 4.0 use | In this version of Windows use
Connect to a dial-up server | Dial-Up Networking in My Computer | Network Connections. For more information, see To connect to a remote network.
Connect to a network by using a modem or ISDN line | Dial-Up Networking in My Computer (click New) | Network Connections. For more information, see To make a dial-up connection by using a phone line.
Connect to a network by using a virtual private network (VPN) | Dial-Up Networking in My Computer (click New) | Network Connections. For more information, see To make a virtual private network (VPN) connection.
Configure a computer for incoming connections | Network in Control Panel | Network Connections. For more information, see To accept incoming network connections.
Configure the TCP/IP protocol | Network in Control Panel | Network Connections. For more information, see To configure TCP/IP settings.
Configure a connection | Dial-Up Networking in My Computer (click More) | Network Connections. For more information, see To configure a connection to a remote network.
Add a client or service | Network in Control Panel | Network Connections. For more information, see To add a network component.
Add a protocol | Network in Control Panel | Network Connections. For more information, see To add a network component.
Add optional networking components | Network in Control Panel | Network Connections. For more information, see To add optional networking components.
Monitor incoming or outgoing connections | Dial-Up Monitor in Control Panel | Network Connections. For more information, see To monitor a connection.


Best practices

The following list provides best practices for implementing Network Connections:

  • When using multiple network adapters, rename each local area connection.

    • Your operating system detects network adapters and automatically creates a local area connection in the Network Connections folder for each network adapter. If more than one network adapter is installed, you can eliminate possible confusion by immediately renaming each local area connection to reflect the network that it connects to.

    You need to add or enable the network clients, services, and protocols that are required for each connection. When you do so, the client, service, or protocol is added or enabled in all other network and dial-up connections.

  • Verify required connection settings for your network adapter.

    • If your network administrator or Internet service provider (ISP) requires static settings, you may need one or more of the following:

    • A specific IP address.
    • DNS addresses.
    • DNS domain name.
    • Default gateway address.
    • WINS addresses.

    DHCP is enabled by default. This gets your IP address and other configuration information automatically. Automated IP settings are used for all connections, and they eliminate the need to configure settings such as DNS, WINS, and so on.

    For more information about enabling DHCP, see To configure TCP/IP settings.

  • Create dial-up, VPN, or direct connections by using the New Connection wizard.

    • After you create a connection, you can copy the connections, rename them and modify the connection settings. By doing so, you can easily create different connections to accommodate multiple modems, ISPs, dialing profiles, and so on.

    For more information, see To copy a network or dial-up connection.

  • Specify the order in which network providers and protocols are accessed.

    • By changing the order of protocols bound to those providers, you can improve performance. For example, if your LAN connection is enabled to access NetWare and Microsoft Windows networks, which use IPX and TCP/IP, but your primary connection is to a Microsoft Windows network that uses TCP/IP, you can move Microsoft Windows Network to the top of the Network providers list on the Provider Order tab, and move Internet Protocol (TCP/IP) to the top of the File and Printer Sharing for Microsoft Networks binding on the Adapters and Bindings tab.

    XOX

    For more information about modifying the order of network providers, see To modify the network provider order. For more information about modifying the order of protocol bindings, see To modify the protocol bindings order.

  • Only install and enable the network protocols that you need.

    • Limiting the number of protocols on your computer enhances its performance and reduces network traffic.

    If your computer encounters a problem with a network or dial-up connection, it attempts to establish connectivity by using every network protocol that is installed and enabled. By only installing and enabling the protocols that your system can use, the operating system does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.


How to...

  • Connect to a remote network
  • Disconnect from a remote network
  • Add optional networking components
  • Make network and dial-up connections
  • Configure network and dial-up connections
  • Monitor network connections
  • Set up and manage home and small office networking


Connect to a remote network

Microsoft Windows graphic

To connect to a remote network

  1. Open Network Connections.
  2. Double-click the connection you want to connect to the network.
  3. If you are prompted, in the Connect connection type dialog box, type your user name, password, and logon domain.

    If Logon domain does not appear in this dialog box, and you want to log on to a domain, type your user name and the domain name in one of two ways:

    • Your user principal name prefix (your user name) and your user principal name suffix (your domain name), joined by the "at" sign (@). For example, user@sales.westcoast.microsoft.com.
    • Your domain name and your user name, separated by the backslash (\) character. For example, sales\user.

      • Note that the suffix in the first example is a fully-qualified DNS domain name. Your administrator might have created an alternative suffix to simplify the logon process. For example, creating a user principal name suffix of "microsoft" allows the same user to log on by using the much simpler user@microsoft.com. For more information, see your system administrator.

    Instead of having to type your domain name, you can also enable Windows to include your logon domain to the Connect connection type dialog box.

    1. Click Properties if the button is enabled.
    2. On the Options tab, select the Include Windows logon domain check box.

    Once you are connected to the network, you can minimize your connection window and use e-mail, Windows Explorer, and so on.

Notes

  • XOX
  • To connect to a remote network you can also right-click the connection that you want to connect to the network and click Connect.
  • Authentication happens at two levels: logging on to the local computer domain and logging on as a valid user.
  • If you are on a local area network, your computer logs on to the local computer domain automatically even before you see the logon prompt. When you type your user credentials at the logon prompt, the computer checks your user credentials, opens a user context, and makes your personal data available to you. You are now logged on at both levels.
  • If you are not on a local area network, the attempt to log on to the local computer domain fails silently. In this case, user logon can proceed in two ways.
    • When you log on at the logon prompt, the computer checks your cached credentials from the last time you were actually online with the domain controller. If they match, a user context associated with your name is opened. You are now logged on to the computer as a valid user but you are not logged on to the network. To access your personal files you can now create a remote access connection by using your remote access credentials or by using your cached credentials if your computer is a member of the domain.
    • Select the Log on using dial-up networking check box if your computer is a member of the domain. In this case, the computer will attempt to make a remote access connection before processing your credentials. Once connected it uses the user logon credentials as though you were on a local area network.
  • The logon domain name you type should name the domain that the server is in. This is not the DNS domain name given by some PPP/SLIP providers.
  • If you are using IP connectivity on your local network connection and on your remote connection, you may not be able to see all computers on your local network. This is because after you connect, your remote connection becomes your default path for network routing. Consequently, you see computers on the remote network, and you see other computers on the same LAN segment to which your computer is connected. But you cannot communicate with computers on networks that were previously reached through a router on your local LAN.

Related Topics


Disconnect from a remote network

Microsoft Windows graphic

To disconnect from a remote network

  1. Open Network Connections.
  2. Right-click the connection you want to disconnect, and then click Disconnect.

Notes

  • XOX
  • If you disable a local area connection, it disables the network adapter driver until the connection is reactivated.

Related Topics


Add optional networking components

Microsoft Windows graphic

To add optional networking components

  1. Open Network Connections.
  2. On the Advanced menu, click Optional Networking Components.
  3. Do one of the following:
    • To install all optional networking components, select the Management and Monitoring Tools, Networking Services, and Other Network File and Print Services check boxes, and then click Next.
    • To install specific optional networking components, select its corresponding check box, and then click Details.

      In Subcomponents of component, select the check boxes next to the components you want to install, and then click OK.

Notes

  • XOX
  • Examples of optional networking components include Simple Network Management Protocol (SNMP), Simple TCP/IP Services, and Print Services for UNIX.

Related Topics


Make network and dial-up connections

  • Make a virtual private network (VPN) connection
  • Make a local area connection
  • Manage network connections
  • Set up ISDN connections
  • Set up dial-up connections
  • Configure dial-up options
  • Make Internet connections
  • Make direct network connections
  • Set up incoming connections


Make a virtual private network (VPN) connection

Microsoft Windows graphic

To make a virtual private network (VPN) connection

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. Click Connect to the network at my workplace, and then click Next.
  4. Click Virtual Private Network connection, and click Next.
  5. Type a name for this connection in Company Name, and click Next.
  6. If you have already established a dial-up connection
    7. , do one of the following:
    • If you need to establish a connection with your ISP or some other network before tunneling to your destination computer or network, click Automatically dial this initial connection, click a connection in the list, and then click Next.
    • If you do not want to automatically dial an initial connection, click Do not dial the initial connection, and then click Next.
  7. Type the host name or IP address of the VPN server to which you are connecting, and then click Next.
  8. Do one of the following:
    • If you want this connection to be made available to all users on this computer, click Anyone's use, and then click Next.
    • If you want to reserve the connection for your own use, click My use only, and then click Next.
  9. If you want to create a shortcut for this connection on your desktop, select the Add a shortcut to this connection to my desktop check box.
  10. Click Finish.

Notes

  • To make the connection available to all users, you must be logged on as Administrator or as a member of the Administrators group.
  • XOX
  • You can create multiple VPN connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple hosts, security options, and so on.

Related Topics


Make a local area connection

Microsoft Windows graphic

To make a local area connection

  • Typically, most computers running a member of the Windows Server 2003 family are connected to a local area network. When you start your computer, your network adapter is detected and the local area connection automatically starts. Unlike other types of connections, the local area connection is created automatically, and you do not have to click the local area connection in order to start it.

Once the local area connection is running, you can choose to disable it. To do so, do the following.

  1. Open Network Connections.
  2. Right-click the LAN or High Speed Internet connection that you want to disable.
  3. Click Disable.

If you need to enable a disabled LAN or High Speed Internet connection, do the following.

  1. Right-click the disabled LAN or High Speed Internet connection that you want to now enable.
  2. Click Enable.

Notes

  • XOX
  • A local area connection is automatically created for each network adapter that is detected.
  • If more than one network adapter is installed, you can eliminate possible confusion by immediately renaming each local area connection to reflect the network that it connects to.

Related Topics


Manage network connections

  • Copy a network or dial-up connection
  • Show a network connection icon in the notification area
  • Rename a network connection icon
  • Repair a LAN or high-speed Internet connection


Copy a network or dial-up connection

Microsoft Windows graphic

To copy a network or dial-up connection

  1. Open Network Connections.
  2. Right-click your dial-up, VPN, or direct connection, and then click Create Copy.

Notes

  • XOX
  • You cannot copy local area and incoming connections.
  • You can create multiple dial-up, virtual private network, or direct connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple modems, ISPs, dialing profiles, and so on.

Related Topics


Show a network connection icon in the notification area

Microsoft Windows graphic

To show a network connection icon in the notification area

  1. Open Network Connections.
  2. Right-click the icon for the network connection that you want to display in the notification area, and then click Properties.
  3. Select the Show icon in notification area when connected check box, and then click OK.

Notes

  • XOX
  • If a network connection icon is displayed in the notification area, you can access basic connection and statistical information by pointing to the icon.
  • If the Show icon in notification area when connected check box is selected for the shared Internet connection, an icon for the shared Internet connection appears in the notification area each time that connection is enabled. When the shared Internet connection is disabled, the icon disappears from the notification area.
  • It is a good practice to select this check box when you are using wireless connections.

Related Topics


Rename a network connection icon

Microsoft Windows graphic

To rename a network connection icon

  1. Open Network Connections.
  2. Right-click the icon for the network connection that you want to rename, and click Rename.
  3. Type a new name for the selected network connection icon.

Notes

  • You must be logged on as a member of the Administrators group to rename a network connection icon.
  • XOX
  • You should rename each network connection icon with a name that is easy to remember.

Related Topics


Repair a LAN or high-speed Internet connection

Microsoft Windows Graphic

To repair a LAN or high-speed Internet connection

  1. Open Network Connections.
  2. Before using the Repair option, try the following steps:
    • Check the status indicator lights on the DSL or cable modem to verify that the connection to your Internet service provider (ISP) is working.
    • Turn off the DSL or cable modem, and then turn it on again.
    • If your Internet connection is not working after these steps, contact your ISP.
  3. If media is connected properly, under LAN or High-Speed Internet, right-click the connection that you want to repair, and then click Repair.

Notes

  • You must be a member of the Administrators group, the Power Users group, or the Network Configuration Operators group to complete this procedure.
  • XOX
  • If you have more than one network adapter installed in your computer, it is recommended that you rename your Internet connection to easily identify it. For example, you could call your Internet connection "Internet connection" or use the name of your ISP.
  • The Repair option is not available for media disconnected connections.

Related Topics


Set up ISDN connections

  • Make a dial-up connection by using an ISDN line
  • Install an ISDN adapter
  • Configure ISDN settings


Make a dial-up connection by using an ISDN line

Microsoft Windows graphic

To make a dial-up connection by using an ISDN line

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. In Network Connection Type, do one of the following:
    • Click Connect to the Internet. In Internet Connection, click Connect using a dial-up modem, and then click Next.
    • Click Connect to the network at my workplace. In Network Connection, click Dial-up connection, and then click Next.
  4. Follow the instructions in the New Connection wizard.

Notes

  • XOX
  • To enable automatic dialing for all users, create a connection, save your user name and password for all users, and then enable Internet Connection Sharing for the new connection.

Related Topics


Install an ISDN adapter

Microsoft Windows graphic

To install an ISDN adapter

  1. Install an Integrated Services Digital Network (ISDN) adapter and start your computer. If you install more than one ISDN adapter, you must restart your computer after you have installed the ISDN drivers. Otherwise, all available ISDN ports may not show up when you configure your network connection for ISDN.
  2. You can use Device Manager to configure your system so that your ISDN adapter knows what type of telephone switch it is connected to. The switch type simply refers to the brand of equipment and software revision level that the telephone company uses to provide you with ISDN service. There are only a few types of switches in the world and usually just one in countries/regions other than the United States.

Notes

  • To use Device Manager, you must be logged on as an administrator or a member of the Administrators group.
  • XOX
  • If your ISDN adapter is internal to your computer, it appears in Network adapters. If the ISDN adapter is external to your computer, it appears in Modems.

Related Topics


Configure ISDN settings

Microsoft Windows graphic

To configure ISDN settings

  1. Open Network Connections.
  2. Right-click the dial-up connection that uses ISDN, and then click Properties.
  3. On the General tab, in Connect using, click the ISDN device, and then click Configure.
  4. In the ISDN Configure dialog box, do one or both of the following:
    • In Line type, click the line type you want to use. The line types are listed from highest to lowest quality.
    • If you want to start negotiation with the line type you selected, and then negotiate with a lower-quality line type depending on the line's condition, select the Negotiate line type check box.

Notes

  • XOX
  • Depending on the type of ISDN adapter that you are using, when you click Configure in step 3, you may be presented with Modem Configuration settings.

Related Topics


Set up dial-up connections

  • Make a dial-up connection by using a phone line
  • Configure a modem for a dial-up connection
  • Make a dial-up connection by using X.25
  • Start Remote Access Auto Connection Manager


Make a dial-up connection by using a phone line

Microsoft Windows graphic

To make a dial-up connection by using a phone line

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. In Network Connection Type, do one of the following:
    • Click Connect to the Internet. In Internet Connection, click Connect using a dial-up modem, and then click Next.
    • Click Connect to the network at my workplace. In Network Connection, click Dial-up connection, and then click Next.
  4. Follow the instructions in the New Connection wizard.

Notes

  • XOX
  • To enable automatic dialing for all users, create a connection, save your user name and password for all users, and then enable Internet Connection Sharing for the new connection.

Related Topics


Configure a modem for a dial-up connection

Microsoft Windows graphic

To configure a modem for a dial-up connection

  1. Open Network Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. On the General tab, under Connect using, click the modem you want to configure, and then click Configure.
  4. Under Hardware Features, select the check box options you want to enable.
  5. If you want to enable the modem speaker, select the Enable modem speaker check box.

Notes

  • XOX
  • To ensure compatibility, you need to use the same kind of modem as the one connected to the remote access server, select the same initial speed, and enable the same features. If you do not select the same model, at least select a modem with the same ITU-T standard as the modem on the server.
  • Selecting a feature that is not supported by your modem has no effect on its performance.
  • Network Connections automatically configures connections according to the devices that are available. For example, you might use a laptop and docking station when you are in the office, with your connection configured to use the docking station modem. When you are on the road, and the docking station modem is not available, the connection is automatically configured to use the laptop's PCMCIA modem. When you return to the office and re-dock your laptop into its docking station, Network Connections detects that the docking station modem is available again, and automatically reconfigures the connection to use the docking station modem.
  • Modem changes made as described in this procedure are unique to this connection. To make global changes, you will need to change each modem.

Related Topics


Make a dial-up connection by using X.25

Microsoft Windows graphic

To make a dial-up connection by using X.25

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. In Network Connection Type, click Connect to the Internet or Connect to the network at my workplace, and then click Next.
  4. In Network Connection, click Connect using a dial-up modem or Dial-up connection, and then click Next.
  5. Follow the instructions in the New Connection wizard.
  6. When the wizard is finished, right-click the new connection, and then click Properties.
  7. On the Options tab, click X.25.
  8. In Network, click your X.25 network provider.
  9. In X.121 address, type the X.121 address (the X.25 equivalent of a phone number) for the server you want to call.
  10. If required by the X.25 host computer, in User Data, type additional connection information.
  11. In Facilities, type any additional facility options you want to request from your X.25 provider. (For example, some providers support the /r option to specify reverse charging.)

Notes

  • XOX
  • To enable automatic dialing for all users, create a connection, save your user name and password for all users, and then enable Internet Connection Sharing for the new connection.
  • For details on facility options, consult your X.25 documentation or provider.

Related Topics


Start Remote Access Auto Connection Manager

Microsoft Windows graphic

To start Remote Access Auto Connection Manager

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Computer Management
    • Services and Applications
    • Services
  3. In the details pane, right-click Remote Access Auto Connection Manager, and then click Start.

    4. Under the Status column, Started appears.

Note

  • XOX

Related Topics


Configure dial-up options

  • Configure client callback options
  • Configure autodial
  • Enable logging
  • Enable multiple device dialing
  • Configure phone number modifiers
  • Configure redial options
  • Assign multiple phone numbers to a connection
  • Enable operator-assisted calls or manual dialing


Configure client callback options

Microsoft Windows graphic

To configure client callback options

  1. Open Network Connections.
  2. On the Advanced menu, click Remote Access Preferences.
  3. On the Callback tab, do one of the following:
    • If you do not want to use callback, click No callback.
    • If you want to decide whether to use callback at the time you connect, click Ask me during dialing when the server offers.
    • If you want to consistently use callback, click Always call me back at the number(s) below, and select the modem or device you want to be called back.
      • If Phone number is blank for the device you have selected, click Edit, and then type the number.
      • If you want to remove a modem or device from the list of possible callback devices, click the modem or device, and then click Delete.

Notes

  • XOX
  • Your system administrator can override any callback settings that you configure. Through server settings, the administrator can deny the use of callback, allow you to set callback options, or require callback to a particular number. Contact your system administrator to determine your callback options.
  • To use callback, Link Control Protocol (LCP) extensions must be enabled.

Related Topics


Configure autodial

Microsoft Windows graphic

To configure autodial

  1. Open Network Connections.
  2. On the Advanced menu, click Remote Access Preferences.
  3. On the Autodial tab, select the check box next to the location where you want to enable autodial, and then click OK.

Notes

  • XOX
  • Autodial is enabled by default in XOX. In support of this feature, the Remote Access Auto Connection Manager is also started by default.
  • Autodial maps the resources that are required to initially make a connection, but it does not map resources after the connection is made. For more information, see Related Topics.

Related Topics


Enable logging

Microsoft Windows graphic

To enable logging

  1. Open Network Connections.
  2. On the Advanced menu, click Remote Access Preferences.
  3. On the Diagnostics tab, do one or more of the following:
    • To enable logging for all remote access connections, select the Enable logging check box.
    • To clear logs created during a previous connection, click Clear Log.
    • To generate a report, click Generate Report.
  4. If you clicked Generate Report in the previous step, do one of the following:
    • To view the diagnostic report, click View report.
    • To save the report to a file, click Save report to this file, and specify the location and the name of the file you want to create. Specify the location by typing it or by clicking Browse and browsing to the location you want.
    • To send the report to an e-mail address, click Send report to this e-mail address, and type the e-mail address to which you want to send the report.
    • To quickly generate a more concise report, select the Generate summary report check box.

Notes

  • XOX
  • Creating a diagnostic report in HTML can take several minutes. If you need only configuration and installation information, you can create a summary report.

Related Topics


Enable multiple device dialing

Microsoft Windows graphic

To enable multiple device dialing

  1. Open Network Connections.
  2. Right-click the connection on which you want to enable the dialing of multiple devices, and then click Properties.
  3. On the Options tab, in Multiple devices, do one of the following:
    • If you want to dial only the first available device, click Dial only first available device.
    • If you want to use all of your devices, click Dial all devices.
    • If you want to dynamically dial and hang up devices as needed, click Dial devices only as needed, and then click Configure.

      In Automatic dialing, click the Activity at least percentage and Duration at least time you want to set. Another line is dialed when connection activity reaches this level for the amount of time that you specify.

      In Automatic hangup, click the Activity no more than percentage and Duration at least time you want to set. A device is disconnected when connection activity decreases to this level for at least the amount of time that you specify.

Notes

  • XOX
  • If you selected Dial devices only as needed, the last multilinked device ignores the Automatic hangup setting, and a twenty-minute time-out is used for the last device.
  • If you use multiple devices to dial a server that requires callback, then only one of your multilinked devices is called back. This is because only one number is stored in a user account. Therefore, only one device connects and all other devices fail to complete the connection, and your connection loses Multilink functionality.

    • You can avoid this problem if the multilinked phonebook entry is an ISDN with two channels that have the same phone number.

  • Multiple device dialing is available only if multiple adapters are available on the computer.
  • If you select Dial all devices, dropped links in the multilinked bundle are not automatically reinitialized. You can force links to reinitialize by selecting Dial devices only as needed, then Configure, and then setting easily achieved Automatic dialing conditions which cause another line to be dialed. For example, set Activity at least to 1% and Duration at least to 3 seconds.

Related Topics


Configure phone number modifiers

Microsoft Windows graphic

To configure phone number modifiers

  1. Open Network Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. On the General tab, modify the phone number by using one or more characters from the following list.
Character | Function
, (comma) | Pauses briefly (two seconds for most modems) before continuing.
P | Switches from touch-tone to pulse/rotary dialing.
T | Switches from pulse/rotary to touch-tone dialing.
$ | Waits for a calling card prompt tone.

For example, when you dial in from a hotel room, you may have to add 9 to the number you are calling to get an outside line. Your number may look similar to the following:

9,555-0100

The comma after the 9 gives a pause long enough to get an outside line before continuing to dial the full number.

Notes

  • To configure phone number modifiers, you must be logged on as a member of the Administrators group.
  • XOX
  • By selecting the Use dialing rules check box, and then clicking Dialing Rules, you can create a Location for which specific dialing rules automatically apply. For example, if you frequently connect from home and need to disable call waiting, you can create a location for use from home that automatically dials the code to disable call waiting before the connection call is placed.
  • If you see unfamiliar characters being dialed before your number, check to make sure the Use dialing rules check box is not selected. If it is selected, a location may be enforcing a dialing rule that you do not need. For example, a location may be selected that always dials 1 to accommodate long distance dialing.

Related Topics


Configure redial options

Microsoft Windows graphic

To configure redial options

  1. Open Network Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. On the Options tab, in Redialing options, click the arrows to set the number of times the dial-up connection is automatically redialed if the first attempt to connect fails.
  4. In Time between redial attempts, click the down arrow to set the amount of time to pause between the end of one attempt and the beginning of another.
  5. In Idle time before hanging up, click the down arrow to set the amount of idle time before a client hangs up a connection.
  6. If you want the connection to automatically redial if the line is dropped, select the Redial if line is dropped check box.

Notes

  • XOX
  • The Time between redial attempts pause lets the device reset itself before redialing. The default is one minute. If that is not enough time, increase this setting. You can also experiment with shorter times, but if you make the pause too short, the device does not have time to reset itself.
  • Keep in mind that the remote access server also has a disconnect timer. If Idle time before hanging up is set to a high time-out number, there is no guarantee that the connection will not disconnect before the time passes. This is because the server may choose to disconnect you before the time set here.
  • If you are using Internet Explorer, the browser's own settings for dial-up connections may conflict with these redial options.

Related Topics


Assign multiple phone numbers to a connection

Microsoft Windows graphic

To assign multiple phone numbers to a connection

  1. Open Network Connections.
  2. Right-click the dial-up connection to which you want to assign multiple phone numbers, and then click Properties.
  3. On the General tab, click Alternates.
  4. If you want the connection to attempt a different phone number if the first number in the list is not successful, select the If number fails, try next number check box.
  5. If you want the connection to move the first successful phone number to the top of the list under Phone numbers and use it on the next connection attempt, click Move successful number to top of list.
  6. To add a new phone number to the list, click Add, and in Phone number, type the phone number.
  7. If you want the connection to use established area code and dialing rules, select the Use dialing rules check box.
  8. When you are finished adding the new phone number, click OK.
  9. If you want to change the order of phone numbers under Phone numbers, click a phone number, and then click the Up button or Down button until the phone number is in the correct order.
  10. If you want to remove a phone number under Phone numbers, click the phone number, and then click Delete.

Notes

  • XOX
  • If you have alternate phone numbers defined for a connection, you can specify a particular phone number at the time you initiate your connection.

Related Topics


Enable operator-assisted calls or manual dialing

Microsoft Windows graphic

To enable operator-assisted calls or manual dialing

  1. Open Network Connections.
  2. On the Advanced menu, click Operator-Assisted Dialing.
  3. Double-click the connection you want to dial.
  4. Pick up the telephone handset, and then dial the number or ask the operator to dial it for you.

    5. The number assigned to the entry is displayed in the dialog box for easy reference.

  5. Immediately after you have finished dialing, click Dial.
  6. Hang up the handset only after the modem takes control of the line, which is typically signaled with a click followed by silence.

    7. It is always safe to replace the handset once Network Connections begins verifying your user name and password. The status message will remind you of this.

Notes

  • XOX
  • If operator-assisted dialing is enabled, a check mark appears next to Operator-Assisted Dialing on the Advanced menu.


Make Internet connections

  • Make an Internet connection
  • Make a broadband connection using Point-to-Point Protocol over Ethernet (PPPoE)


Make an Internet connection

Microsoft Windows graphic

To make an Internet connection

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. Click Connect to the Internet, and then click Next.
  4. Click Connect using a dial-up modem, and click Next.
  5. If prompted, select the check box for the modem you want to use for this connection, and click Next.
  6. Type the name of your ISP in ISP Name, and click Next.
  7. Type the phone number of your ISP, including the area code, in Phone number, and click Next.
  8. Make the connection available to any user or only to yourself by selecting Anyone’s use or My use only.
  9. In User name, type the account name your ISP assigned to you. In Password and Confirm password, type the password for your account name, and click Next.
  10. If you want to create a shortcut for this connection on your desktop, select the Add a shortcut to this connection to my desktop check box.
  11. Click Finish.

Notes

  • To make a connection available to any user, you must be logged on as a member of the Administrators group.
  • XOX
  • To enable automatic dialing for all users, create a connection, save your user name and password for all users, and then enable Internet Connection Sharing for the new connection.

Related Topics


Make a broadband connection using Point-to-Point Protocol over Ethernet (PPPoE)

Microsoft Windows graphic

To make a broadband connection using Point-to-Point Protocol over Ethernet (PPPoE)

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. Click Connect to the Internet, and then click Next.
  4. To create a high-speed connection that requires you to sign in, click Connect using a broadband connection that requires a user name and password, and click Next.
  5. Type the name of your ISP in ISP Name, and click Next.
  6. Do one of the following:
    • If you want this connection to be made available to all users on your network, click Anyone's use, and then click Next.
    • If you want to reserve the connection for your own use, click My use only, and then click Next.
  7. In User name, type the account name your ISP assigned to you. In Password and Confirm password, type the password for your account name, and click Next.
  8. To create a shortcut for this connection on your desktop, select the Add a shortcut to this connection to my desktop check box.
  9. Click Finish.

Notes

  • To make a connection available to any user, you must be logged on as a member of the Administrators group.
  • XOX

Related Topics


Make direct network connections

  • Make a direct network connection
  • Make a direct network connection by using a DirectParallel cable


Make a direct network connection

Microsoft Windows graphic

To make a direct network connection

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. Click Set up an advanced connection, and then click Next.
  4. Click Connect directly to another computer, click Next, and then follow the instructions in the New Connection Wizard.

Notes

  • To create a direct network connection that acts as a host, you must be logged on as Administrator or be a member of the Administrators group. Guest direct network connections do not require administrator credentials.
  • XOX
  • If you specify your connection as a host when you create it, the connection appears as Incoming Connections in the Network Connections folder.
  • You can create multiple direct connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple ports, host computers, and so on.
  • Direct connections can bypass authentication requirements. This is useful for devices such as handheld PCs. You must configure this setting in the host incoming connection. For more information, see Related Topics.
  • If you create a direct connection by using a serial (RS-232C) cable, the port that you select in the New Connection Wizard is enabled for connections that use a null modem.
  • If you are logged on to your computer as Administrator or a member of the Administrators group when you create a direct connection, you are presented with a list of connection devices to choose from that includes all of the parallel ports for the computer, infrared ports that are installed and enabled, and COM ports. If you need to use a COM port for a direct connection, ask your system administrator to configure one of the COM ports on your computer with a null modem by using Phone and Modem Options in Control Panel.
  • Users do not need to use direct connections to allow access to shared resources, such as files and printers, over a local area network. In order to enable shared access to resources on the local computer, you must enable file and print sharing, share the resources, and then set up the appropriate permissions.

Related Topics


Make a direct network connection by using a DirectParallel cable

Microsoft Windows graphic

To make a direct network connection by using a DirectParallel cable

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. Click Set up an advanced connection, and then click Next.
  4. Click Connect directly to another computer, click Next, and then do one of the following:
    • If you want your computer to act as the host, click Host, and click Next. Click Direct Parallel (LPT1) in the Device for this connection, and click Next.
    • If you want your computer to act as the guest, click Guest, and click Next. Type the name of the other computer in Computer Name, and click Next.
  5. Follow the remaining instructions in the New Connection Wizard.

Notes

  • XOX
  • XOX
  • For information about contacting Parallel Technologies or their local dealers to order DirectParallel cables, see Related Topics.

Related Topics


Set up incoming connections

  • Accept incoming network connections
  • Grant incoming connection access rights to your computer
  • Configure an incoming connection to use TCP/IP
  • Configure callback for incoming connections


Accept incoming network connections

Microsoft Windows graphic

To accept incoming network connections

  1. Open Network Connections.
  2. Double-click New Connection Wizard, and then click Next.
  3. Click Set up an advanced connection, and then click Next.
  4. Click Accept incoming connections, click Next, and then follow the instructions in the New Connection Wizard.

Notes

  • To create an incoming network connection, you must be a member of the Administrators group.
  • XOX
  • If you make another incoming network connection, and you use the New Connection Wizard again, the existing incoming network connection is reconfigured.
  • For large numbers of incoming connections on a server that operates as part of a distributed network or as a domain controller, use Routing and Remote Access to create a remote access server.
  • If your incoming connection and Fax Service have problems working together (for example, you cannot receive incoming connection calls on a device enabled for Fax receive), the modem may not support adaptive answer. Check your modem documentation to verify that you need to disable Fax receive for that device to accept incoming connections.

Related Topics


Grant incoming connection access rights to your computer

Microsoft Windows graphic

To grant incoming connection access rights to your computer

  1. Open Network Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the General tab, do one or more of the following:
    • In Devices, click the check boxes next to the devices through which incoming connections can connect.
    • If you have more than one device selected, and you want to enable Multilink dialing, select the Enable multilink check box.
    • If you want to enable others to make private connections to your computer by tunneling through the Internet or other network, select the Allow others to make private connections to my computer by tunneling through the Internet or other network check box.
    • If you want to show icons on the taskbar when incoming connections are connected, select the Show icon in notification area when connected check box.
  4. On the Users tab, do one or more of the following:
    • If you want to allow a user to connect, select the check box next to the user's name.
    • If you want to revoke a user's right to connect, clear the check box next to a user's name.
    • To create a new user and grant them access to connect, click New.
    • To remove a user, click Delete.
    • To modify a user's name, password, and callback options, click Properties.
    • If you want directly connected devices to connect without providing a password, select the Always allow directly connected devices such as palmtop computers to connect without providing a password check box.
  5. On the Networking tab, do one or more of the following:
    • If you want to enable a network component, in Network components, select the check box next to the component name.
    • If you want to disable a network component, in Network components, clear the check box next to the component name.
    • To add a network component, click Install.
    • To remove a network component, click Uninstall.
    • To configure a network component, click Properties.

Notes

  • To modify an incoming connection, you must be logged on as a member of the Administrators group.
  • XOX
  • If you enable or disable TCP/IP for incoming connections, the settings affect only incoming connections. Other protocols, such as AppleTalk, are enabled or disabled for all connection types.
Related Topics


Configure an incoming connection to use TCP/IP

Microsoft Windows graphic

To configure an incoming connection to use TCP/IP

  1. Open Network Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the Networking tab, click Internet Protocol (TCP/IP), and then click Properties
    4. .
  4. If you want incoming users to be able to access the local area network on which the dial-up computer resides, select the Allow callers to access my local area network check box.
  5. Do one of the following:
    • If you want to automatically assign TCP/IP addresses, select the Assign TCP/IP addresses automatically using DHCP check box.
    • If you want to specify TCP/IP addresses, click Specify TCP/IP addresses, and do the following:
      • In From, type the starting IP address.
      • In To, type the ending IP address.

        • Based on the addresses you type in From and To, the number of addresses that are allocated is displayed in Total. The starting and ending IP addresses that you choose depend on the originating address space and the number of addresses needed. For more information on defining IP addresses for incoming connections, see Related Topics.

  6. If you want incoming connections to be able to use a specific TCP/IP address, select the Allow calling computer to specify its own IP address check box.

Notes

  • XOX
  • Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. The closest matching subnet is calculated for the range that you specified in From and To. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.
  • If you select Allow callers to access my local area network or Allow calling computer to specify its own IP address, these changes take effect immediately.
  • If you select Assign TCP/IP addresses automatically using DHCP, but there is no DHCP server available, random addresses from the range 169.254.0.1 to 169.254.255.254 are assigned.

Related Topics


Configure callback for incoming connections

Microsoft Windows graphic

To configure callback for incoming connections

  1. Open Network Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the Users tab, click the user for which you want to configure callback, and then click Properties.
  4. On the Callback tab, do one of the following:
    • If you do not want to use callback for incoming connections, click Do not allow callback.
    • If you want to give incoming connections the option of setting a specific callback number, click Allow the caller to set the callback number.
    • If you want to consistently use the same callback number, click Always use the following callback number, and type the number.

Note

  • XOX

Related Topics


Configure network and dial-up connections

  • Configure a connection to a remote network
  • Set up network components
  • Secure network or dial-up connections


Configure a connection to a remote network

Microsoft Windows graphic

To configure a connection to a remote network

  1. Open Network Connections.
  2. Right-click the dial-up connection that you want to configure, and then click Properties.
  3. Do one or more of the following:
    • To configure dialing devices, phone numbers, host address, country/region codes, or dialing rules, click the General tab.
    • To configure dialing and redialing options, multilink configuration, or X.25 parameters, click the Options tab.
    • To configure identity authentication, data encryption, or terminal window and scripting options, click the Security tab.
    • To configure the remote access server and protocols used for this connection, click the Networking tab.
    • To enable or disable Internet Connection Firewall, Internet Connection Sharing, and on-demand dialing, click the Advanced tab. For more information, see Related Topics.

Notes

  • XOX
  • XOX
  • Depending on the type of connection you are configuring, different options appear in the properties dialog box.
  • For more information about a specific item on a tab, right-click the item, and then click What's This?.

Related Topics


Set up network components

  • Configure TCP/IP settings
  • Add a network component
  • Remove a network component
  • Enable a network component
  • Disable a network component
  • Modify the protocol bindings order
  • Modify the network provider order
  • Configure Client for Microsoft Networks
  • Configure File and Printer Sharing for Microsoft Networks
  • PPP settings


Configure TCP/IP settings

Microsoft Windows graphic

To configure TCP/IP settings

  1. Open Network Connections.
  2. Right-click the connection you want to configure, and then click Properties.
  3. Do one of the following:
    • If the connection is a local area connection, on the General tab, in This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties.
    • If the connection is a dial-up or VPN connection, on the Networking tab, in This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties.
    • If the connection is an incoming connection, on the Networking tab, in Network components, click Internet Protocol (TCP/IP), and then click Properties.
  4. Do one of the following:
    • If you want IP settings to be assigned automatically, click Obtain an IP address automatically, and then click OK.
    • If you want to specify an IP address or a DNS server address, do the following:
      • Click Use the following IP address, and in IP address, type the IP address.
      • Click Use the following DNS server addresses, and in Preferred DNS server and Alternate DNS server, type the addresses of the primary and secondary DNS servers.
  5. To configure DNS, WINS, and IP settings, click Advanced.
  6. In a local area connection, selecting the Obtain an IP address automatically option enables the Alternate Configuration tab. Use this to enter alternate IP settings if your computer is used on more than one network. To configure DNS, WINS, and IP settings, click User configured on the Alternate Configuration tab.

Notes

  • XOX
  • You should use automated IP settings (DHCP) whenever possible for all connections because they eliminate the need to configure settings such as IP address, DNS server address, and WINS server address.
  • The Alternate Configuration settings specify a second set of IP settings that are used when a DHCP server is not available. This is very useful for laptop users who often switch between two different network environments such as DHCP and static IP network environments.

Related Topics


Add a network component

Microsoft Windows graphic

To add a network component

  1. Open Network Connections.
  2. Right-click the connection to which you want to add a network component, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, click Install.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, click Install.
  4. In the Select Network Component Type dialog box, click either Client, Service, or Protocol, and then click Add.
  5. Do one of the following:
    • If you do not have an installation disk for the component, click the appropriate client, service, or protocol, and then click OK.
    • If you have an installation disk for the component, click the appropriate client, service, or protocol, click Have Disk, insert the installation disk into the selected drive, and then click OK.

Notes

  • XOX
  • You should only install the network components that you need, for the following reasons:
    • Network performance is enhanced and network traffic is reduced when only the required protocols and clients are installed.
    • If a problem with a network or dial-up connection occurs, your computer attempts to establish connectivity by using every network protocol that is installed and enabled. By only installing and enabling the protocols that your system can use, the operating system does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.
    • Excessive services can hinder performance on your local computer.

Related Topics


Remove a network component

Microsoft Windows graphic

To remove a network component

  1. Open Network Connections.
  2. Right-click the connection on which you want to remove a network component, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, click the client, service, or protocol you want to remove, and then click Uninstall.
    • If this is a dial-up or VPN connection, on the Networking tab, in This connection uses the following items, click the client, service, or protocol you want to remove, and then click Uninstall.
    • If this is an incoming connection, on the Networking tab, in Network components, click the client, service, or protocol you want to remove, and then click Uninstall.
  4. In the Uninstall component name dialog box, click Yes.

Note

  • XOX

Related Topics


Enable a network component

Microsoft Windows graphic

To enable a network component

  1. Open Network Connections.
  2. Right-click a connection, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, select the check box next to the client, service, or protocol you want to enable.
    • If this is a dial-up or VPN connection, on the Networking tab, in This connection uses the following items, select the check box next to the client, service, or protocol you want to enable.
    • If this is an incoming connection, on the Networking tab, in Network components, select the check box next to the client, service, or protocol you want to enable.

Notes

  • XOX
  • You should only enable the network components that you need, for the following reasons:
    • Network performance is enhanced and network traffic is reduced when only the required protocols and clients are enabled.
    • If your computer encounters a problem with a network or dial-up connection, it attempts to establish connectivity by using every network protocol that is installed and enabled. By only enabling the protocols that your system can use, the operating system does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.
    • Excessive services can hinder performance on your local computer.

Related Topics


Disable a network component

Microsoft Windows graphic

To disable a network component

  1. Open Network Connections.
  2. Right-click the connection on which you want to disable a network component, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, clear the check box next to the client, service, or protocol you want to disable.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in Use these components with this connection, clear the check box next to the client, service, or protocol you want to disable.

Note

  • XOX

Related Topics


Modify the protocol bindings order

Microsoft Windows graphic

To modify the protocol bindings order

  1. Open Network Connections.
  2. On the Advanced menu, click Advanced Settings.
  3. In Connections, click the connection that you want to modify.
  4. Click the protocol that you want to move up or down in the list, and then click the up or down arrow button.

Notes

  • To modify the protocol bindings order, you must be logged on as a member of the Administrators group.
  • XOX

Related Topics


Modify the network provider order

Microsoft Windows graphic

To modify the network provider order

  1. Open Network Connections.
  2. Click the connection you want to modify, and on the Advanced menu, click Advanced Settings.
  3. On the Provider Order tab, in Network Providers, click the provider you want to move up or down in the list, and then click the Up or Down button.

Notes

  • To modify the network provider order, you must be logged on as a member of the Administrators group.
  • XOX
  • Network providers are accessed in the order they appear in this list.

Related Topics


Configure Client for Microsoft Networks

Microsoft Windows graphic

To configure Client for Microsoft Networks

  1. Open Network Connections.
  2. Right-click a connection, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, click Client for Microsoft Networks, and then click Properties.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in Use these components with this connection, click Client for Microsoft Networks, and then click Properties.
  4. In Name service provider, click an RPC name service provider.
  5. If you selected DCE Cell Directory Service, in Network address type the network address of your provider.

Notes

  • XOX
  • Windows Locator is the default name service provider.

Related Topics


Configure File and Printer Sharing for Microsoft Networks

Microsoft Windows graphic

To configure File and Printer Sharing for Microsoft Networks

  1. Open Network Connections.
  2. Right-click a connection, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, click File and Printer Sharing for Microsoft Networks, and then click Properties.
    • If the connection is a dial-up or VPN connection, on the Networking tab, in This connection uses the following items, click File and Printer Sharing for Microsoft Networks, and then click Properties.
    • If the connection is a incoming connection, on the Networking tab, in Network components, click File and Printer Sharing for Microsoft Networks, and then click Properties.
  4. Do one of the following:
    • To optimize the server for a small number of clients, click Minimize memory used.
    • To optimize the server for a mixed usage of file and printer sharing in addition to other services, such as serving as an interactive workstation, click Balance.
    • To dedicate as many resources as possible to file and print server services, click Maximize data throughput for file sharing.
    • To optimize server memory for distributed applications that perform their own memory caching, such as Microsoft SQL Server, click Maximize data throughput for network applications.
  5. To specify that LAN Manager 2.x clients on your network can browse for shared resources on this computer, select the Make browser broadcasts to LAN Manager 2.x clients check box.

Notes

  • XOX
  • You can only configure File and Printer Sharing for Microsoft Networks on a server.
  • To share local folders, you must enable File and Printer Sharing for Microsoft Networks. For more information, see Related Topics.
  • The File and Printer Sharing for Microsoft Networks component is the equivalent of the Server service in Windows NT 4.0.
  • XOX

Related Topics


PPP settings

  • Stop requesting LCP extensions in PPP
  • Start requesting LCP extensions in PPP
  • Turn off IP header compression in PPP
  • Disable software compression


Stop requesting LCP extensions in PPP

Microsoft Windows graphic

To stop requesting LCP extensions in PPP

  1. Disconnect from the remote server.
  2. Open Network Connections.
  3. Right-click the dial-up connection you want to configure, and then click Properties.
  4. On the Networking tab, click Settings.
  5. In the PPP Settings box, clear the Enable LCP extensions check box.

Note

  • XOX

Related Topics


Start requesting LCP extensions in PPP

Microsoft Windows graphic

To start requesting LCP extensions in PPP

  1. Disconnect from the remote server.
  2. Open Network Connections.
  3. Right-click the dial-up connection you want to configure, and then click Properties.
  4. On the Networking tab, click Settings, and then select the Enable LCP extensions check box.

Note

  • XOX

Related Topics


Turn off IP header compression in PPP

Microsoft Windows Graphic

To turn off IP header compression in PPP

  1. Disconnect from the remote server.
  2. Open Network Connections.
  3. Right-click the dial-up connection you want to configure, and then click Properties.
  4. On the Networking tab, click Internet Protocol (TCP/IP), and then click Properties.
  5. Click Advanced, and then clear the Use IP header compression check box.

Notes

  • To turn off IP header compression, you must be logged on as an administrator or a member of the Administrators group. Some connections do not display the IP header compression check box.
  • XOX

Related Topics


Disable software compression

Microsoft Windows graphic

To disable software compression

  1. Open Network Connections.
  2. Right-click the dial-up, VPN, or incoming connection you want to configure, and then click Properties.
  3. On the Networking tab, click Settings, and clear the Enable software compression check box.

Note

  • XOX

Related Topics


Secure network or dial-up connections

  • Configure identity authentication and data encryption settings
  • Enable smart card or other certificate authentication
  • Terminal and scripting options

For information on security considerations for routing, remote access and VPN, see Security information for routing, Security information for remote access and Security information for VPN.


Configure identity authentication and data encryption settings

Microsoft Windows graphic

To configure identity authentication and data encryption settings

  1. Open Network Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. On the Security tab, do one of the following:
    • To select preconfigured combinations of identity authentication methods and data encryption requirements, click Typical (recommended settings), and in Validate my identity as follows, click a method to use for validation.

      Depending on your Validate my identity as follows selection, you can select (enable) or clear (disable) the Automatically use my Windows logon name and password (and domain if any) or Require data encryption (disconnect if none) check boxes. The following table shows which selections are available.

      If Require data encryption (disconnect if none) is not enabled, encryption is optional. To prevent encryption, click Advanced (custom settings), and then click Settings. In Data encryption, click No encryption allowed (server will disconnect if it requires encryption).

      • For dial-up connections:

      Validate my identity as follows | Automatically use my Windows logon name and password (and domain if any) | Require data encryption (disconnect if none)
Allow unsecured password | Unavailable | Unavailable
Require secured password | Available | Available
Use smart card | Unavailable | Available

      For VPN connections:

      Validate my identity as follows | Automatically use my Windows logon name and password (and domain if any) | Require data encryption (disconnect if none)
Require secured password | Available | Available (enabled by default)
Use smart card | Unavailable | Available (enabled by default)

    • To individually enable, configure, and disable authentication methods and encryption requirements, click Advanced (custom settings), and then click Settings.

Important

  • Modifying Advanced (custom settings) requires a knowledge of security protocols.

Notes

  • XOX
  • Among the advanced custom settings is the Allow older MS-CHAP version for Windows 95 servers check box. You must select this check box to configure a connection to a server running Windows 95.

Related Topics


Enable smart card or other certificate authentication

Microsoft Windows graphic

To enable smart card or other certificate authentication

  1. Open Network Connections.
  2. Right-click the dial-up, VPN, or incoming connection on which you want to use smart card or other certificate authentication, and then click Properties.
  3. If you are using typical settings for your smart card, on the Security tab, click Typical (recommended settings), and in the Validate my identity as follows list, click Use smart card, and then click OK.
  4. If you are individually enabling, configuring, and disabling authentication methods and encryption requirements, on the Security tab, click Advanced (custom settings), and click Settings. In Logon security, click Use Extensible Authentication Protocol (EAP), click Smart card or other certificate (encryption enabled), click Properties, and then do the following:
    • If you want to use the certificate that resides on your smart card, click Use my smart card.
    • If you want to use the certificate that resides in the certificate store on your computer, click Use a certificate on this computer.
    • If you want to verify that the server certificate presented to your computer has not expired, has the correct signature, and has a trusted root certification authority, select the Validate server certificate check box.
    • If you only want to connect to servers within a particular domain, select the Connect only if server name ends with check box, and then type the name of the domain.
    • To specify that the root certification authority for your server certificate must be in a particular root certification authority, in Trusted root certification authority, click the appropriate certification authority.
    • To use a different user name when the user name in the smart card or certificate is not the same as the user name in the domain that you are logging on to, select the Use a different user name for the connection check box.

Notes

  • XOX
  • If, for example, you only want to connect to servers that reside in Microsoft.com, you type Microsoft.com in Connect only if server name ends in.
  • If, for example, you are working for a consulting company where you need to log on to the domain of the company to which you are assigned, but your smart card contains a user name specific to your home company, select the Use a different user name for the connection check box.
  • If you select the Use a different user name for the connection check box, your certificate is exported without private keys and submitted to your system administrator to be explicitly mapped to your domain user account. For more information, see Related Topics.
  • If you select the Connect only if server name ends with check box, and do not type a domain name, at the time you connect you are prompted to use the domain name in the server certificate.

Related Topics


Terminal and scripting options

  • Use the Terminal feature to log on to a remote computer
  • Activate a logon script
  • Log and view modem commands


Use the Terminal feature to log on to a remote computer

Microsoft Windows graphic

To use the Terminal feature to log on to a remote computer

  1. Open Network Connections.
  2. Right-click the dial-up connection on which you want to use Terminal, and then click Properties.
  3. On the Security tab, select the Show terminal window check box.

Notes

  • XOX
  • After you connect, the After Dial Terminal window appears and prompts you from the remote computer display. You then use this window to log on to the remote computer. After you have completed all interactions with the remote computer, click Done. At this point, authentication on the remote access server begins.
  • If the logon sequence does not vary, you can write a script that automatically passes information to the remote computer during the logon sequence, which enables completely automatic connections.

Related Topics


Activate a logon script

Microsoft Windows graphic

To activate a logon script

  1. Open Network Connections.
  2. Right-click the dial-up connection on which you want to run a script, and then click Properties.
  3. On the Security tab, select the Run script check box.
  4. To use an existing script file, click Browse.

    Or, to use Switch.inf, click Edit.

Notes

  • XOX
  • In addition to Switch.inf, the Windows 95 scripting language is supported for computers running the Windows Server 2003 family that connect to computers running operating systems other than Windows. You may find the Windows 95 scripting language easier to use than Switch.inf. For more information, see Related Topics.
  • If you click Edit and load Switch.inf into Notepad, immediately resave the file with a different name to preserve the default Switch.inf file.

Related Topics


Monitor network connections

  • Monitor a connection
  • View the status of a local area connection


Monitor a connection

Microsoft Windows graphic

To monitor a connection

  1. Open Network Connections.
  2. Do one of the following:
    • To monitor activity for the current session, right-click the connection you want to monitor, and then click Status.
    • To automatically enable the status monitor each time the connection is active, right-click the connection, click Properties, and then select the Show icon in taskbar when connected check box.

Notes

  • XOX
  • If your computer is set up to accept incoming connections, a connection with a user name assigned to it appears in the Network Connections folder as each user connects. You can view the progress of incoming connections by right-clicking a named connection, and then clicking Status.
  • You can also monitor a connection by clicking Status on the File menu or by clicking the status icon in the taskbar. You can also right-click the taskbar icon and click Status.
  • If you want to view the general status (Disconnected, Connected) of all of your connections, on the View menu, click Details.
  • You also can disconnect an active connection by clicking Disconnect in the Status dialog box.
  • By default, the status monitor is disabled for local area connections, but enabled for all other types of connections.

Related Topics


View the status of a local area connection

Microsoft Windows graphic

To view the status of a local area connection

  1. Open Network Connections.
  2. Do one of the following:
    • To monitor activity for the current session, right-click the local area connection, and then click Status.
    • To automatically enable the status monitor each time the connection is active, right-click the local area connection, click Properties, and then select the Show icon in taskbar when connected check box.

Notes

  • XOX
  • You can view and modify the network components of a local area connection, such as network protocol settings, by clicking Properties.
  • By default, the status monitor is disabled for local area connections, but enabled for all other types of connections.

Related Topics


Set up and manage home and small office networking

  • Set up and manage Internet Connection Firewall (ICF)
  • Set up and manage Network Bridge
  • Set up and manage Internet Connection Sharing (ICS)
  • Manage service definitions for ICF or ICS


Set up and manage Internet Connection Firewall (ICF)

  • Enable or disable ICF
  • Enable or disable Internet Control Message Protocol requests for ICF
  • Enable or disable ICF security log options
  • View the ICF security log
  • Change the file size of the ICF security log
  • Change the path and file name of the ICF security log
  • Restore the default settings to the ICF security log


Enable or disable ICF

Microsoft Windows graphic

To enable or disable ICF

  1. Open Network Connections.
  2. Under Dial-up or LAN or High-Speed Internet, right-click the connection that you want to protect, and then click Properties.
  3. On the Advanced tab, under Internet Connection Firewall, do one of the following:
    • To enable Internet Connection Firewall (ICF), select the Protect my computer and network by limiting or preventing access to this computer from the Internet check box.
    • To disable ICF, clear the Protect my computer and network by limiting or preventing access to this computer from the Internet check box.

Caution

  • If you clear the Protect my computer and network by limiting or preventing access to this computer from the Internet check box, the firewall on this connection is disabled. When the firewall is disabled, your computer is exposed to possible external attacks through the unprotected connection.

Notes

  • XOX
  • XOX
  • You need to enable ICF only on connections that connect to the Internet. You should not enable ICF on virtual private network (VPN) connections or on network client computers because ICF interferes with network activities such as file and printer sharing.
  • If ICF is enabled on two or more connections on a single computer, the ICF settings are global. If you select a setting or change a setting in Logging Options or Services on any one of the connections on which ICF is enabled, that setting is applied to all of the ICF firewalls on that computer.
  • ICF cannot be enabled on the private connections of the Internet Connection Sharing host computer, on Network Bridge, or on the adapters that are included in Network Bridge.
  • XOX

Related Topics


Enable or disable Internet Control Message Protocol requests for ICF

Microsoft Windows graphic

To enable or disable Internet Control Message Protocol requests for ICF

  1. Open Network Connections.
  2. Right-click the connection on which Internet Connection Firewall (ICF) has been enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the ICMP tab, do one of the following:
    • To enable Internet Control Message Protocol (ICMP) options, select the check box next to each type of request for information to which you would like your computer to respond.
    • To disable ICMP options, clear any or all of the ICMP check boxes.

Caution

  • All ICMP options are disabled by default. If you enable ICMP options on a computer running ICF, that computer may become visible to the Internet and vulnerable to attacks.

Notes

  • XOX
  • XOX
  • XOX

Related Topics


Enable or disable ICF security log options

Microsoft Windows graphic

To enable or disable ICF security log options

  1. Open Network Connections.
  2. Right-click the connection on which Internet Connection Firewall (ICF) has been enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the Security Logging tab, under Logging Options, select from the following:

    5. To enable ICF security log options:

    • To enable the logging of all dropped packets that originate from either the home or small office network or the Internet, select the Log dropped packets check box.
    • To enable the logging of all successful connections that originate from either the home or small office network or the Internet, select the Log successful connections check box.

    Or, to disable ICF security log options:

    • To disable the logging of all dropped packets that originate from either the home or small office network or the Internet, clear the Log dropped packets check box.
    • To disable the logging of all successful connections that originate from either the home or small office network or the Internet, clear the Log successful connections check box.

Notes

  • XOX
  • XOX
  • Security logging is not enabled by default when ICF is enabled.
  • ICF functions whether security logging is enabled or disabled.
  • If ICF is enabled on two or more connections on a single computer, the ICF settings are global. If you select a setting or change a setting in Logging Options or Services on any one of the connections on which ICF is enabled, that setting is applied to all of the ICF firewalls on that computer.
  • XOX

Related Topics


View the ICF security log

Microsoft Windows graphic

To view the ICF security log

  1. Open Network Connections.
  2. Right-click the connection on which Internet Connection Firewall (ICF) has been enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the Security Logging tab, under Log file options, in Name, click Browse.
  5. Scroll to the ICF security log, right-click the file, and then click Open.

Notes

  • XOX
  • The default name for the ICF security log is pfirewall.log, and the default location is in the Windows directory.
  • XOX

Related Topics


Change the file size of the ICF security log

Microsoft Windows graphic

To change the file size of the ICF security log

  1. Open Network Connections.
  2. Right-click the connection on which Internet Connection Firewall (ICF) has been enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the Security Logging tab, under Log file options, in Size limit, use the arrow buttons to adjust the size limit.

Caution

  • If the maximum allowable size for pfirewall.log is exceeded, the information that pfirewall.log contains is saved as pfirewall.log.old, and new information is saved as pfirewall.log. If the maximum allowable size for pfirewall.log is exceeded again, the information that pfirewall.log contains is saved as pfirewall.log.old, and the information that had been in pfirewall.log.old is overwritten. New information is always saved in pfirewall.log.

Notes

  • XOX
  • XOX
  • If ICF is enabled on two or more connections on a single computer, the ICF settings are global. If you select a setting or change a setting in Logging Options or Services on any one of the connections on which ICF is enabled, that setting is applied to all of the ICF firewalls on that computer.
  • The default size limit of the ICF security log is 4,096 kilobytes.
  • You must enable ICF before you can adjust the size limit of the ICF security log.
  • XOX

Related Topics


Change the path and file name of the ICF security log

Microsoft Windows graphic

To change the path and file name of the ICF security log

  1. Open Network Connections.
  2. Right-click the connection on which Internet Connection Firewall (ICF) has been enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the Security Logging tab, under Log file options, click Browse, and then do the following:
    • To change the path of the ICF security log, navigate to the location where you want the ICF security log to be saved. (If you do not want to change the path, do not navigate to a new location.)
    • To change the file name of the ICF security log, in File name, type a new name, and then click Open. (If you do not want to change the default file name, in File name, type pfirewall, and then click Open.)

Notes

  • XOX
  • XOX
  • The default name for the ICF security log is pfirewall.log, and the default location is in the Windows directory.
  • XOX

Related Topics


Restore the default settings to the ICF security log

Microsoft Windows graphic

To restore the default settings to the ICF security log

  1. Open Network Connections.
  2. Right-click the connection on which Internet Connection Firewall (ICF) has been enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the Security Logging tab, click Restore Defaults.

Notes

  • XOX
  • XOX
  • The default size limit of the log is 4,096 kilobytes.
  • The default name for the ICF security log is pfirewall.log, and the default location is in the Windows directory.
  • XOX

Related Topics


Set up and manage Network Bridge

  • Set up Network Bridge
  • Add a connection to or remove a connection from Network Bridge
  • Enable or disable Network Bridge
  • Remove Network Bridge


Set up Network Bridge

Microsoft Windows graphic

To set up Network Bridge

  1. Open Network Connections.
  2. Under LAN or High-Speed Internet, hold down the CTRL key, and then click each of the adapters that you want to include in the bridge.
  3. Right-click one of the connections that you have selected, and then click Bridge Connections.

Caution

  • If Internet Connection Firewall (ICF) or Internet Connection Sharing (ICS) are not enabled on your network, do not set up Network Bridge between the public Internet connection and the private network connection. Setting up Network Bridge between the public Internet connection and the private network connection creates an unprotected link between your network and the Internet, leaving your network vulnerable to external attacks. When ICF or ICS are enabled, this risk is mitigated.

Notes

  • XOX
  • XOX
  • Connections that run ICF or adapters that provide shared Internet connections cannot be a part of the Network Bridge and do not appear under LAN or High-Speed Internet. Similarly, the Bridge Connections menu command is available only for adapters that you can add as connections to Network Bridge.
  • You must select at least two private network connections in order for Bridge Connections to create a bridge.
  • You can create only one Network Bridge on a computer, but the bridge can accommodate numerous network connections.
  • Network adapters that previously appeared under LAN or High-Speed Internet, appear under Network Bridge when you add them as connections to the bridge. Network adapters that provide Internet connectivity, such as DSL and cable modems, cannot be bridged and always appear under LAN or High-Speed Internet.
  • Only Ethernet, IEEE-1394 adapters, or Ethernet-compatible adapters, such as wireless and Home Phoneline Network adapters, can be a part of Network Bridge.
  • Network Bridge with a wireless or IEEE-1394 connection supports traffic using Internet Protocol version 4 (IPv4) only.
  • You cannot create Network Bridge on a computer running Windows 2000 or earlier versions of Windows.
  • XOX

Related Topics


Add a connection to or remove a connection from Network Bridge

Microsoft Windows Graphic

To add a connection to or remove a connection from Network Bridge

  1. Open Network Connections
  2. Under Network Bridge, right-click Network Bridge, and then click Properties.
  3. On the General tab, under Adapters, do one of the following.
    • To add a connection to Network Bridge, select the check box next to each adapter you want to add to the bridge, and then click OK.
    • To remove a connection from Network Bridge, clear the check box next to each adapter you want to remove from the bridge, and then click OK.

Caution

  • If Internet Connection Firewall (ICF) or Internet Connection Sharing (ICS) are not enabled on your network, do not set up Network Bridge between the public Internet connection and the private network connection. Setting up Network Bridge between the public Internet connection and the private network connection creates an unprotected link between your network and the Internet, leaving your network vulnerable to external attacks. When ICF or ICS are enabled, this risk is mitigated.

Notes

  • XOX
  • XOX
  • If you remove network adapters from Network Bridge and less than two adapters remain, Network Bridge does not perform its intended function but continues to use system resources.
  • You must set up Network Bridge before you can add connections to it. For more information, see Related Topics.
  • Connections that run ICF or adapters that provide shared Internet connections cannot be a part of Network Bridge and do not appear under Adapters. Similarly, the Add to Bridge menu command is available only for adapters that you can add as connections to Network Bridge.
  • Network adapters that previously appeared under LAN or High-Speed Internet, appear under Network Bridge when you add them as connections to the bridge. Network adapters that provide Internet connectivity, such as DSL and cable modems, cannot be bridged and always appear under LAN or High-Speed Internet.
  • Only Ethernet, IEEE-1394 adapters, or Ethernet-compatible adapters, such as wireless and Home Phoneline Network adapters, can be a part of Network Bridge.
  • Network Bridge with a wireless or IEEE-1394 connection supports traffic using Internet Protocol version 4 (IPv4) only.
  • You can also add a connection to or remove a connection from Network Bridge by opening Network Connections, right-clicking the adapter that you want to add, and then clicking Add to Bridge.
  • XOX

Related Topics


Enable or disable Network Bridge

Microsoft Windows Graphic

To enable or disable Network Bridge

  1. Open Network Connections.
  2. Under Network Bridge, right-click Network Bridge, and do one of the following:
    • To enable Network Bridge, click Enable.
    • To disable Network Bridge, click Disable.

Notes

  • XOX
  • XOX
  • If you remove or disable Network Bridge, computers on your network are unable to communicate with computers that are on different network segments. Some of the computers on your network may lose Internet connectivity.
  • You must set up Network Bridge before you can enable or disable it. For more information, see Related Topics.
  • XOX

Related Topics


Remove Network Bridge

Microsoft Windows Graphic

To remove Network Bridge

  1. Open Network Connections.
  2. Under Network Bridge, right-click Network Bridge, and then click Delete.

Notes

  • XOX
  • XOX
  • If you remove or disable Network Bridge, computers on your network are unable to communicate with computers that are on different network segments. Some of the computers on your network may lose Internet connectivity.
  • XOX

Related Topics


Set up and manage Internet Connection Sharing (ICS)

  • Enable ICS
  • Enable ICS on-demand dialing
  • Configure client computers for ICS


Enable ICS

Microsoft Windows graphic

To enable ICS

  1. Open Network Connections.
  2. Under Dial-up or LAN or High-Speed Internet, right-click the connection on which you want to enable (ICS), and then click Properties.
  3. On the Advanced tab, under Internet Connection Sharing, select the Allow other network users to connect through this computer's Internet connection check box.
  4. If present, under Home networking connection, in the Select a private network connection drop-down box, select the connection that connects directly to your network. For more information, see Notes.

Important

  • You can enable ICS only when two or more network adapters are installed.
  • If your computer has multiple private connections that connect to private LAN segments, you should bridge the private connections before you enable ICS. For information about how to set up Network Bridge, see Related Topics.
  • When ICS is enabled, it automatically provides an IP address for the private connection of the ICS host.

Notes

  • XOX
  • XOX
  • Home networking connection and the Select a private network connection drop-down box are present only when two or more adapters that can connect to the private network are installed.
  • For information about the protocols, services, interfaces, and routes that are automatically configured by ICS when you connect to the Internet in a home or small office network, see Related Topics.
  • If you are having difficulty connecting the ICS host to the Internet, you can use Repair to obtain refreshed IP address configurations from your Internet service provider (ISP).
  • If a computer on your network is unable to communicate with other network computers, you can use Repair to force the connection to refresh its IP address configuration from the ICS host.
  • Before using Repair, ensure that the client computers are plugged into the network and that the ICS host is running, configured, and connected to the network and the Internet.
  • For information about how to configure client computers for ICS, see Related Topics.
  • XOX

Related Topics


Enable ICS on-demand dialing

Microsoft Windows Graphic

To enable ICS on-demand dialing

  1. Open Network Connections.
  2. Right-click the dial-up connection on which you want to enable ICS on-demand dialing, and then click Properties.
  3. On the Advanced tab, under Internet Connection Sharing, do one of the following:
    • To enable ICS on-demand dialing, select the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box.
    • To disable ICS on-demand dialing, clear the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box.

Notes

  • XOX
  • XOX
  • In order for ICS on-demand dialing to work correctly, the shared Internet connection must be available for all ICS clients, and the dial-up credentials must be saved for all users. For more information, see Related Topics.
  • Establish a dial-up connection whenever a computer on my network attempts to access the Internet is selected by default. Unless you clear the check box, clients can activate the shared Internet connection from their computers by starting their Internet browsers or mail programs.
  • XOX

Related Topics


Configure client computers for ICS

Microsoft Windows Graphic

To configure client computers for ICS

  1. Insert the XOX or XOX CD into the CD-ROM drive of your computer running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition.
  2. When the Welcome screen appears, click Perform additional tasks, and then click Browse this CD.
  3. Double-click Support, and then double-click Netsetup.
  4. Follow the instructions that appear on your screen.

Notes

  • XOX
  • Enable Internet Connection Sharing (ICS) on your ICS host computer before you attempt to configure client computers for your home or small office network. For more information, see Related Topics.
  • You can run Netsetup.exe only on computers running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition.
  • XOX

Related Topics


Manage service definitions for ICF or ICS

Microsoft Windows graphic

To manage service definitions for ICF or ICS

  1. Open Network Connections.
  2. Right-click the shared Internet connection or the Internet connection on which Internet Connection Firewall (ICF) or Internet Connection Sharing (ICS) is enabled, and then click Properties.
  3. On the Advanced tab, click Settings.
  4. On the Services tab, do one of the following:
    • If you want to enable a service, under Services select the check box next to service that you want to enable, and then enter the required information.
    • If you want to add a service definition, click Add, and then enter the required information.
    • If you want to edit a service definition, click the service that you want to edit, click Edit, and then change the appropriate information.
    • If you want to delete a service definition, click the service that you want to delete, and then click Delete.

Caution

  • This feature is intended for advanced users. When you add or edit a service definition, you create a port mapping that can expose your network to the Internet. For more information about service definitions, see Related Topics.

Notes

  • XOX
  • XOX
  • Before you can add, edit, or delete service definitions, you must enable ICF, ICS, or both.
  • You can obtain the correct configuration values for the TCP or UDP port number from the service's documentation or Web site.
  • No two service definitions can use the same port numbers simultaneously.
  • For service definitions that are preconfigured, you can edit only the field that is labeled Name or IP address of the computer hosting this service on your network.
  • For service definitions that you have added, you can edit only the fields that are labeled Name or IP address of the computer hosting this service on your network, External Port number for this service, and Internal Port number for this service.
  • You can delete only the service definitions that you have added. You cannot delete service definitions that are preconfigured.
  • XOX

Related Topics


Concepts

This section provides general background information about Network Connections:

  • Network Connections overview
  • Understanding Network Connections
  • Using Network Connections
  • Administering Network Connections


Network Connections overview

This section covers:

  • About Network Connections
  • Hardware requirements for network and dial-up connections
  • Network connection types
  • Dial-up connections
  • Network connection icons
  • Protocols and access methods
  • Home and small office networking overview


About Network Connections

Network Connections provides connectivity between your computer and the Internet, a network, or another computer. With Network Connections, you can gain access to network resources and functionality, whether you are physically located at the location of the network or in a remote location. Connections are created, configured, stored, and monitored from within the Network Connections folder. For information about creating connections, see Make network and dial-up connections. For a list of network connection icons, see Network connection icons.

Each connection in the Network Connections folder contains a set of features that you can use to create a link between your computer and another computer or network. Outgoing connections contact a remote access server by using a configured access method (LAN, modem, ISDN line, cable modem, DSL line, X.25 line, and so on) to establish a connection with a remote network. Conversely, an incoming connection enables a computer running XOX or a stand-alone computer running a member of the Windows Server 2003 family to be contacted by other computers. This means your computer can operate as a remote access server. Whether you are connected locally (LAN), remotely (dial-up, VPN, and so on), or both, you can configure any connection so that it can perform any needed network function. For example, you can print to network printers, access network drives and files, browse other networks, or access the Internet.

Because all services and communication methods are configured within the connection, you do not need to use external management tools to configure connection settings. For example, the settings for a dial-up connection include features to be used before, during, and after connecting. These include the modem you use to dial, the type of password encryption you want to use upon connecting, and the network protocols you use after you connect. Connection status, which includes the duration and speed of a connection, is viewed from the connection itself; you do not need to use an external status tool. For information about configuring a connection, see To configure a connection to a remote network.

Logon and domain security, support for security hosts, data encryption, authentication, and callback provide secure network access for network and dial-up connections. For more information about security features, see Security features of Network Connections.


Hardware requirements for network and dial-up connections

Depending on your configuration, you may need some or all of the following hardware:

  • One or more network adapters with a Network Driver Interface Specification (NDIS) driver for LAN connectivity
  • One or more compatible modems and an available COM port
  • ISDN adapter (if you are using an ISDN line)
  • DSL adapter
  • X.25 adapter or PAD (if you are using X.25)
  • Analog telephone line, ISDN line, X.25 line, or DSL line
  • Smart card reader
  • Wireless adapter

To verify the compatibility of all hardware, see the compatibility information at Support resources.

For information about configuring a connection, see To configure a connection to a remote network. For a list of network connection icons, see Network connection icons.


Network connection types

You can use Network Connections to create several types of connections between computers. The following table shows each type of connection you can create, the communication methods you can use to create each type of connection, and an example of each connection type. For more information, click the appropriate connection type in the table.

Connection type | Communication method | Example
Dial-up connections | Modem, ISDN, X.25 | Connect to a private network or the Internet by using remote access
Virtual private network (VPN) connections | VPN connections to organization networks over the Internet using PPTP or L2TP | Connect securely to a private network over the Internet
Connection Manager connections | See dial-up or VPN connections | Connect to a private network using a collection of dial-up or VPN settings provided by your network administrator in a self-installing profile
LAN or High-Speed Internet | Ethernet, token ring, cable modem, DSL, FDDI, IP over ATM, IrDA, wireless, WAN technologies (T1, Frame Relay), PPPoE | Connect directly to a local area network, to your cable modem, or to your DSL modem through an Ethernet adapter or a similar device
Direct connections | Serial cabling, infrared link, DirectParallel cable | Connect a handheld computer running Microsoft® Windows® CE to a desktop computer so you can synchronize information
Incoming connections | See dial-up, VPN, or direct connections | Accept dial-up, VPN, or direct connections from other computers

For a list of icons that appear in the Network Connections folder, see Network connection icons.


Dial-up connections

A dial-up connection connects you to a network or the Internet by using a device that utilizes the telephone network. This device can be a modem that uses a standard phone line, an ISDN adapter with a high-speed ISDN line, DSL, broadband, a cable modem, or an X.25 network.

If you are a typical user, you may have one or two dial-up connections, perhaps to the Internet and to your corporate network.

You can create multiple dial-up connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple modems, dialing profiles, and different destinations.

For more information about creating dial-up connections, see Set up dial-up connections.


Network connection icons

The following table displays the different icons that appear in the Network Connections folder.

Icon | Description | Location
Active local area connection icon | The local area connection is active | Network Connections folder
Active local area connection icon | The local area connection is disabled | Network Connections folder
Default remote access connection icon | The default remote access connection | Network Connections folder
Incoming connection icon | An incoming connection | Network Connections folder
Media disconnected local area connection folder icon | The media is disconnected | Network Connections folder
Media disconnected local area connection taskbar icon | The media is disconnected | Taskbar
Driver disabled local area connection icon | The driver is disabled | Network Connections folder
Adapter with invalid IP address icon | The adapter in this connection has an invalid IP address | Network Connections folder
Adapter with invalid IP address icon in the taskbar | The adapter in this connection has an invalid IP address | Taskbar
Shared connection icon | A connection on which Internet Connection Sharing (ICS) has been enabled | Network Connections folder
Firewalled connection icon | A connection on which Internet Connection Firewall (ICF) has been enabled | Network Connections folder
Bridged network connections icon | A connection on which Network Bridge has been enabled | Network Connections folder


Protocols and access methods

This section covers:

  • Network communications
  • TCP/IP
  • IPX
  • AppleTalk
  • ISDN access
  • Serial (RS-232) cable access
  • DirectParallel cable access
  • SLIP
  • Point-to-Point Protocol (PPP)

Note

  • The IPX/SPX protocol is not available on XOX 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family.


Network communications

Network protocols, access methods, and server protocols help create a communications link between your computer and a network.

Whether information is transported from your computer to a server by using a direct serial cable, or across a secure VPN from your Internet service provider (ISP) to the corporate network, different combinations of access methods and protocols are used to send information. These access methods and protocols are listed as follows:

Network protocols

  • TCP/IP
  • IPX
  • AppleTalk

Access methods

  • Using phone lines and modems
  • ISDN access
  • Serial (RS-232) cable access
  • DirectParallel cable access

Server protocols

  • Point-to-Point Protocol (PPP)
  • SLIP
  • Layer Two Tunneling Protocol (L2TP)
  • Point-to-Point Tunneling Protocol (PPTP)

The IPX/SPX protocol is not available on XOX 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family.


TCP/IP

Transmission Control Protocol/Internet Protocol (TCP/IP) is the most popular protocol, and the basis for the Internet. Its routing capabilities provide maximum flexibility in an enterprise-wide network.

On a TCP/IP network, you must provide IP addresses to clients. Clients may also require a naming service or a method for name resolution. This section explains IP addressing and name resolution for Network Connections on TCP/IP networks. It also describes the FTP and Telnet tools that are provided by the Microsoft® Windows® Server 2003 family.

Assigning IP addresses to remote access connections

Each remote computer that connects to a remote access server on a Windows TCP/IP network is provided an IP address by the server. This IP address is either automatically provided through the server by DHCP on the target network or selected from the static range that is assigned to the remote access server. For more information see Incoming connections and IP addresses.

If you use a specific IP address, the remote access server must be configured to permit users to request a specific address.

Name resolution for network and dial-up connections

In addition to requiring an IP address, network and dial-up connections for a NetBT gateway on a TCP/IP network may require a mechanism to resolve computer names to IP addresses. You can use any one of the following mechanisms for name resolution: DNS, WINS, broadcast name resolution, and the Hosts and Lmhosts files.

Incoming connections clients are assigned the same WINS and DNS servers that are assigned to the incoming connections computer. The TCP/IP settings of a network or dial-up connection can override these automatic assignments.

Incoming connections that do not have a DNS or WINS server rely completely on broadcast name resolution, which occurs by using broadcasts to locate network resources that match a computer name.

Internet tools

The Windows Server 2003 family provides File Transfer Protocol (FTP) and Telnet. FTP is a character-based utility that permits you to connect to FTP servers and transfer files. Telnet is a command-line application that lets you log on to remote computers and issue commands as if you were at the keyboard of the remote computer. Multiple variations of FTP, Telnet, and other services based on earlier Internet standards are also available on the Internet or commercially.

For information about configuring a connection, see To configure a connection to a remote network. For information about configuring TCP/IP, see To configure TCP/IP settings.

Note

  • FTP and Telnet tools run on top of TCP/IP networks.


IPX

Internetwork Packet Exchange (IPX) is the protocol that is used on many Novell NetWare networks. This section explains how to integrate Network Connections into an IPX network.

Support for NetWare and IPX

Network Connections supports NetWare and IPX networks by including:

  • NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, also known as NWLink, which is the Microsoft® Windows® Server 2003 family implementation of the IPX protocol.
  • Client Service for NetWare client component, which provides access to NetWare shared file and printer resources.
  • Point-to-Point Protocol (PPP) IPX Configuration Protocol (IPXCP), which supports IPX over PPP for dial-up, virtual private network (VPN), and incoming connections. PPP connections use IPXCP, as defined in RFC 1552, "The PPP Internetwork Packet Exchange Control Protocol (IPXCP)," to configure PPP connections for IPX.

For information about configuring a connection, see To configure a connection to a remote network. For information about configuring NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, see To configure NWLink.

Notes

  • XOX
  • IPX routing is not supported in the Windows Server 2003 family.
  • IPX cannot be configured for incoming or dial-up connections in the Windows Server 2003 family.


AppleTalk

Networking on an Apple Macintosh computer is implemented through the AppleTalk protocol. Applications and processes can communicate across a single AppleTalk network or an AppleTalk internet, which is a number of interconnected AppleTalk networks. By using AppleTalk, applications and processes can transfer and exchange data and share resources, such as printers and file servers. AppleTalk remote access is supported by the AppleTalk Control Protocol (ATCP).

With ATCP, Macintosh clients can run the AppleTalk network protocol over the Point-to-Point Protocol (PPP). With ATCP support, a remote user can access a Web server over TCP/IP, print a document to an AppleTalk printer, and connect to a Macintosh file server (over TCP/IP or AppleTalk), all with the same dial-up connection over PPP.

For more information, see AppleTalk over PPP.

For information about configuring a connection, see To configure a connection to a remote network.


ISDN access

To enhance your network connection speed, you can use an Integrated Services Digital Network (ISDN) line. Whereas standard phone lines typically transmit at up to 56 kilobits per second (Kbps), ISDN lines can transmit at speeds of 64 or 128 Kbps.

An ISDN line must be installed by the phone company at both the server and at the remote site. ISDN also requires that you install an ISDN adapter on the server and your computer. Costs for ISDN equipment and lines may be higher than standard modems and phone lines. However, the speed of communication reduces the duration of the connection, possibly saving toll charges.

An ISDN line comes with two B channels that transmit data at 64 Kbps, and one D channel for signaling that transmits data at 16 Kbps. You can configure each B channel to operate as a port. With some ISDN drivers, you can aggregate the channels. This means you can statically assign a higher bandwidth by configuring both B channels to act as a single port. With this configuration, line speed increases to 128 Kbps. For information about configuring a connection to use ISDN, see To make a dial-up connection by using an ISDN line or To configure ISDN settings.

The Multilink feature performs channel aggregation for ISDN. Multilink combines multiple physical links into a logical bundle. This aggregate link increases the bandwidth of a connection. In addition, you can allocate multiple links dynamically, which means ISDN lines are used only as they are required. This eliminates excess bandwidth, representing a significant efficiency advantage to users. You can configure the conditions under which extra lines are dialed, and underused lines are disconnected, through Network Connections settings. For more information, see Configuring multiple device dialing.


Serial (RS-232) cable access

Suppose you have two networks in the same location that are not physically connected. To use resources on both networks from one computer, you can use RS-232 cables and COM ports to create null modems. You connect an RS-232 cable from a COM port to a COM port on each remote access server. To the servers, the COM ports then appear to be modems. You can use server remote access, a part of the integrated Routing and Remote Access service, to create network access.

For information about creating a direct connection by using serial access, see To make a direct network connection.


DirectParallel cable access

The DirectParallel feature supports computer-to-computer connections by using standard and enhanced (ECP) parallel ports, which use Parallel Technologies' Basic or Fast parallel cables. For information about configuring a direct network connection to use a DirectParallel cable, see To make a direct network connection by using a DirectParallel cable. Direct cable connection cables are available from several sources. You can obtain DirectParallel cables from Parallel Technologies or from their local dealers. For more information, see To contact Parallel Technologies.


SLIP

Serial Line Internet Protocol (SLIP) is an older remote access standard typically used by UNIX remote access servers. Network Connections supports SLIP for dial-up connections.

When you connect to a SLIP server, a Windows Terminal dialog box appears for an interactive logon session with the UNIX SLIP server. The UNIX logon overrides and prevents the remote access logon session from appearing. After a connection is established, remote network access becomes transparent to the user.

The RFCs supported in remote access are:

  • RFC 1055, "A Nonstandard for Transmission of IP Datagrams Over Serial Lines: SLIP"

  • RFC 1144, "Compressing TCP/IP Headers for Low-Speed Serial Links"

For information about configuring a network or dial-up connection, see To configure a connection to a remote network.

Notes

  • XOX does not support SLIP for incoming connections.
  • You must use the TCP/IP protocol and a serial COM port to connect to a SLIP server.


Point-to-Point Protocol (PPP)

The Point-to-Point Protocol (PPP) is a set of standard protocols that allow remote access software from different vendors to interoperate. A PPP-enabled connection can dial into remote networks through any industry-standard PPP server. PPP also permits a remote access server to receive calls from, and provide network access to, other vendors' remote access software that complies with the PPP standards.

The PPP standards also permit advanced features that are not available with older standards such as SLIP. PPP supports several authentication methods, as well as data compression and encryption. With most PPP implementations, you can automate the entire logon sequence.

PPP also supports multiple LAN protocols. You can use TCP/IP or IPX as your network protocol. The IPX/SPX protocol is not available on XOX 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family.

PPP is the basis for the PPTP and L2TP protocols, which are used in secure virtual private network (VPN) connections.

PPP is the primary standard for most remote access computing.

This section covers:

  • PPP operation and protocols
  • Point-to-Point Protocol over Ethernet (PPPoE) Protocols


PPP operation and protocols

Connections made using Point-to-Point Protocol (PPP) must adhere to standards established in PPP RFCs. For information on PPP RFCs, see "Introduction to TCP/IP" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/) This topic gives an overview of PPP operations and the protocols used in a PPP connection. For information about how to configure PPP settings, see PPP settings.

PPP connection process

After a physical or logical connection is made to a PPP-based remote access server, the following negotiations establish a PPP connection:

  1. Negotiate the use of the link

    2. PPP uses Link Control Protocol (LCP) to negotiate link parameters such as the maximum PPP frame size, the use of Multilink, and the use of a specific PPP authentication protocol.

  2. Authenticate the remote access computer

    3. The remote access client and the remote access server exchange messages according to the negotiated authentication protocol. If EAP is being used, the client and the server negotiate a specific EAP method, known as an EAP type, and then exchange the messages of that EAP type.

  3. Use callback

    4. If callback for the dial-up connection is configured, the physical connection is terminated, and the remote access server calls the remote access client back.

  4. Negotiate the use of network protocols

    5. This process involves using a series of network control protocols (NCPs) to configure the network protocols the remote access client uses. For example, the NCP for TCP/IP is Internet Protocol Control Protocol (IPCP). If the remote access client is configured to use TCP/IP, IPCP is used to assign an IP address to the client and to configure the client with the IP addresses of DNS and WINS servers.

The resulting connection remains active until the line is disconnected for any of the following reasons:

  • The user or the administrator explicitly hangs up the line.
  • The line is disconnected due to idle time-out.
  • An unrecoverable link error occurs.

Link Control Protocols

Link Control Protocol (LCP) establishes and configures PPP framing. PPP framing defines how data is encapsulated before it is transmitted on the wide area network. The PPP standard framing format ensures that remote access software from any vendor can communicate and recognize data packets from any remote access software that adheres to the PPP standards.

PPP and the Microsoft® Windows® Server 2003 family use variants of High-level Data Link Control (HDLC) framing for serial or ISDN connections.

Authentication protocols

Authentication protocols are negotiated immediately after link quality is determined and before the network layer is negotiated. For more information about available authentication protocols, see Authentication protocols and methods.

Network control protocols

Network control protocols establish and configure different network protocol settings for TCP/IP, IPX, and AppleTalk. The following table describes network control protocols used with a PPP connection.

The IPX/SPX protocol is not available on Microsoft XOX or the 64-bit versions of the Windows Server 2003 family.

Network control protocol | Description
Internet Protocol Control Protocol (IPCP) | IPCP is used to configure TCP/IP on the remote access client. Configuration parameters include an IP address and the IP addresses of DNS and WINS servers.
Internetwork Packet Exchange Control Protocol (IPXCP) | IPXCP is used to configure IPX on the remote access client. IPXCP is widely implemented by PPP vendors. Configuration parameters include the IPX network and node numbers.
AppleTalk Control Protocol (ATCP) | ATCP is used to configure AppleTalk on the remote access client. Configuration parameters include an AppleTalk address.

Note

  • The PPP settings dialog box includes the option Negotiate multi-link for single-link connections. This option enables separation of high and low-priority channels over a single link connection. If your remote access server supports this feature, you might notice improved audio quality. However, because this feature is incompatible with many remote access servers, you should leave it disabled unless instructed otherwise. For more information on PPP settings, see PPP settings.


Point-to-Point Protocol over Ethernet (PPPoE) Protocols

Using Point-to-Point Protocol over Ethernet (PPPoE) and a broadband modem, LAN clients can gain individual authenticated access to high-speed data networks. By combining Ethernet and Point-to-Point Protocol (PPP), PPPoE provides an efficient way to create a separate connection to a remote server for each user. Access, billing, and choice of service are managed on a per-user basis, rather than a per-site basis. Clients can create both dial-up and dial-on-demand connections using PPPoE.

PPPoE RFCs

Requests for Comments (RFCs) are an evolving series of technical reports, proposals for protocols, and protocol standards used by the Internet community. PPPoE is defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups. The following is an example of a PPPoE RFC:

RFC number - 2516A

Title - Method for Transmitting PPP Over Ethernet (PPPoE)

Obtaining RFCs

You can obtain RFCs from the RFC Editor Web site. This Web site is currently maintained by members of the Information Sciences Institute (ISI) who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standards, proposed Internet standards (circulated in draft form for review), Internet best practices, or For Your Information (FYI) documents.

Notes

  • XOX
  • PPPoE is supported on clients running XOX. All members of the Windows Server 2003 family can connect to and route PPPoE traffic. However, they cannot accept an incoming PPPoE connection.

For more information, see To make a broadband connection using Point-to-Point Protocol over Ethernet (PPPoE).


Home and small office networking overview

With home and small office networking, even if you do not have the resources, time, or experience of a network administrator, you can build a small network in your home or small office. Home and small office networking is a group of features that limits hardware requirements and automates configurations for routing and private IP addressing. This reduces the work that is typically required to connect and configure a network. It also reduces the associated costs.

Home and small office networking provides many of the benefits of traditional networks and offers benefits that are uniquely suited for a home or small office network. With home and small office networking you can:

  • Share one Internet connection with all of the computers on your network.
  • Provide local private network services, such as name resolution and addressing, automatically.
  • Share printers or other hardware devices, such as cameras and scanners, from any computer on your network.
  • Share folders and files with other computers on your network.
  • Use one computer to secure your entire network and protect your Internet connection.
  • Easily establish network connections across two or more types of network media, such as IEEE 1394, Ethernet, wireless, and Home Phoneline Network adapters.

This section covers:

  • Home and small office networking features
  • Home and small office networking compared to Routing and Remote Access


Home and small office networking features

Home and small office networking uses the following features to simplify the implementation and administration of small networks.

Internet Connection Firewall (ICF)

Home and small office networking offers computers that are directly connected to the Internet the added security of firewall protection. The firewall checks all communications that cross the connection between your network and the Internet and is selective about which responses from the Internet it allows. ICF protects only the computer on which it is enabled. However, if ICF is enabled on the Internet Connection Sharing (ICS) host computer, ICS clients that use the shared Internet connection for Internet connectivity are protected because they cannot be seen from outside your network. For this reason, you should always enable ICF on the ICS host computer. In addition, if there are clients on your network with direct Internet connections, or if you have a stand-alone computer that is connected to the Internet, then it is recommended that you enable the ICF on those Internet connections as well.

When ICF has been enabled on a network connection, the following network connection icon appears in Network Connections: firewalled connection.

For more information about ICF, see Internet Connection Firewall.

Network Bridge

Network Bridge removes the need for routing and bridging hardware in a home or small office network that consists of multiple LAN segments. With Network Bridge, multiple LAN segments become a single IP subnet, even if the LAN segments are of mixed network media types. Network Bridge automates the configuration and management of the address allocation, routing, and name resolution that is typically required in a network that consists of multiple LAN segments.

When Network Bridge has been enabled on a network connection, the following network connection icon appears in Network Connections: Bridged network connections icon.

For more information see Network Bridge.

Internet Connection Sharing (ICS)

ICS allows you to provide Internet access for a home or small office network by using one common connection as the Internet gateway. The ICS host is the only computer that is directly attached to the Internet. Multiple ICS clients simultaneously use the common Internet connection and benefit from Internet services as if the clients were directly connected to the Internet service provider (ISP) (for more information, see Dial-up credentials). Security is enhanced when ICS is enabled because only the ICS host computer is visible to the Internet. The addresses of ICS clients are hidden from the Internet rendering ICS clients invisible to the Internet. In addition, ICS simplifies the configuration of small networks by providing local private network services, such as name resolution and addressing.

When ICS has been enabled on a network connection, the following network connection icon appears in Network Connections: shared Internet connection.

For more information about ICS, see Connecting to the Internet in a home or small office network.

Note

  • Internet Connection Sharing, Internet Connection Firewall, and Network Bridge are included only with XOX and the 32-bit version of XOX. These features are not included with XOX; the 32-bit version of XOX; or the 64-bit versions of the Windows Server 2003 family.


Home and small office networking compared to Routing and Remote Access

Home and small office networking and the Routing and Remote Access service are both included in XOX and the Windows Server 2003 family to provide the following networking capabilities:

  • Network address translation (NAT)
  • Packet filtering
  • Dial-up access
  • Virtual private network (VPN) access
  • Automated IP addressing for network clients
  • Name resolution
  • Internet connections
Because home and small office networking features and Routing and Remote Access share common drivers, they cannot coexist, and you need to decide which to implement in order to meet the needs of your networking environment.

Home and small office networking

You can use home and small office networking features—Internet Connection Firewall (ICF), Network Bridge, and Internet Connection Sharing (ICS)—to simplify the configuration of your home or small office network. These features are intended for networks that consist of two to 10 computers when you want to:

  • Protect computers that are connected to the Internet using an easily configured firewall. For more information, see Internet Connection Firewall.
  • Connect LAN segments simply, by using the Bridge Connections menu command. For more information, see Network Bridge.
  • Provide simultaneous Internet access for up to 10 computers using a single dial-up or high-speed Internet connection. For more information, see Connecting to the Internet in a home or small office network.
  • Support up to 10 simultaneous dial-up or VPN connections to provide remote computers with access to network resources. For more information, see Incoming connections.

Routing and Remote Access

You can use Routing and Remote Access in combination with Internet Security and Acceleration (ISA) Server to meet the needs of your small business with high security needs, your medium-sized private business, or your enterprise network that spans multiple subnets and supports up to 1,000 computers running XOX or up to 5,000 computers running XOX. Internet connectivity for branch offices is routed through the corporate routing and firewall infrastructure. Use Routing and Remote Access when you want to:

  • Provide local and branch office computers with high-security Internet access.
  • Connect branch offices with corporate intranets, and share resources as if all computers are connected to the same LAN.
  • Protect network interfaces with static packet filters or dynamic packet filters.
  • Support up to 1,000 simultaneous dial-up or VPN connections to provide remote computers with access to corporate network resources.

Comparisons

The following table summarizes the differences between the way that home and small office networking features (and incoming connections) and Routing and Remote Access (with ISA Server) implement basic networking services.

Service | Description | Home and small office networking features (and incoming connections) | Routing and Remote Access (with ISA Server)
NAT | Hides internally managed IP addresses from external networks by translating private internal addresses to public external addresses. This reduces IP address registration costs by letting you use unregistered IP addresses internally, with translation to a small number of registered IP addresses externally. It also hides the internal network structure, reducing the risk of attacks against internal systems. | ICS | Routing and Remote Access NAT
Dynamic packet filtering | Provides protection from unsolicited traffic for the private network. Permits only traffic that is sent in response to an internal request. | ICF | Basic Firewall
VPN and dial-up access | Allows clients on a remote computer to connect to a private network and to access network resources as if the computer was physically attached to the network. | Incoming connections | Routing and Remote Access
Address assignment | Automates the assignment of client IP addresses on the private network in order to configure clients to allow client-access to network resources. | ICS DHCP allocator | Routing and Remote Access NAT, with a DHCP allocator or a DHCP server
DNS name resolution | Converts the names of computers and other network devices, such as printers, to IP addresses. | ICS DNS Proxy | NAT, with a DNS proxy or a DNS server
Internet connections | Provides a high-speed or dial-up connection for the computer that is connected to the Internet to use to publish its services to the private network. | Configured through Network Connections | Configured through Routing and Remote Access

The following table summarizes which components, features, and connection types are best suited to provide networking services in a given networking scenario.

Service | Scenario
 | Small office, non-domain network | Small office, domain network | Medium office network with NAT traversal | Medium office network without NAT traversal | Enterprise network | Branch office network
NAT | ICS | ICS | Routing and Remote Access | Routing and Remote Access | Routing and Remote Access | Routing and Remote Access with ISA (on the corporate network)
Packet filtering | ICF | ICF | Basic Firewall or ISA | Basic Firewall or ISA | ISA | ISA (on the corporate network)
VPN/remote access | Incoming connections | Incoming connections | Routing and Remote Access | Routing and Remote Access | Routing and Remote Access | Routing and Remote Access with ISA (on the corporate network)
Address assignment | ICS DHCP allocator | DHCP server | DHCP server | DHCP server | DHCP server | DHCP server
Internet connection | Dial-up, ISDN, broadband, DSL, or LAN | Dial-up, ISDN, broadband, DSL, or LAN (with ISA) | Any combination of T1 or T3, dial-up, ISDN, broadband, DSL, and LAN | Any combination of dial on demand (DoD) routing, T1 or T3, dial-up, ISDN, broadband, DSL, or LAN | Any combination of dial on demand (DoD) routing, T1 or T3, dial-up, ISDN, broadband, DSL, or LAN | Any combination of dial on demand (DoD) routing, T1 or T3, dial-up, ISDN, broadband, DSL, or LAN
NAT traversal | Not available | Not available | ISA | Does not apply | ISA | ISA (on the corporate network)
DNS | DNS proxy | DNS server | DNS server | DNS server | DNS server | DNS server

Notes

  • In the case of ICS with a DNS or DHCP server, ICS discovers the DHCP service or DNS service and, if present, disables the DNS proxy, DHCP allocator, or both.
  • Because ICS and ICF are not compatible with Routing and Remote Access, you cannot enable ICF or ICF if Routing and Remote Access is configured. Likewise, if ICS or ICF are enabled, they must first be disabled in order to configure Routing and Remote Access.
  • XOX


Understanding Network Connections

This section covers:

  • Security for network connections
  • Tunneling protocols
  • Home and small office networking


Security for network connections

This section covers:

  • Security features of Network Connections
  • Intermediary devices


Security features of Network Connections

You can configure your dial-up, virtual private network (VPN), broadband, and direct connections to enforce various levels of password authentication and data encryption. Authentication methods range from unencrypted to custom, using Extensible Authentication Protocol (EAP). EAP provides an infrastructure to support a wide range of authentication methods, including smart cards, certificates, one-time passwords, and public keys. You can also specify the type of data encryption, depending on the level of password authentication (MS-CHAP, MS-CHAP v2, or EAP-TLS) that you select. Finally, you can configure callback options to increase dial-up security.

User accounts and domains provide security with encrypted authentication and encrypted data. For more information about security, see Security.

This section covers:

  • Callback
  • How security works at connection
  • Group Policy for Network Connections
  • Group Policy settings that prohibit home and small office networking on your domain
  • Dial-up credentials
  • Data encryption and encryption methods
  • Authentication


Callback

The callback feature instructs the remote access server to disconnect after authentication and then to call you back. Callback provides cost advantages to you and security advantages to your network. By immediately hanging up and then dialing you back, callback reduces phone charges. Required callback enhances network security by ensuring that only users from specific locations can access the server. By dropping the call, and then calling back a moment later to the preassigned callback number, most impersonators can be thwarted.

If callback has been required by your administrator, the following steps occur when your call reaches the remote access server:

  1. The server determines whether your user name and password are correct.
  2. If they are correct, the server disconnects and then returns the call.

If your administrator has configured callback for your connection through the Remote Access Preferences menu option, the following steps occur when your call reaches the remote access server:

  1. The server determines whether your user name and password are correct.
  2. If they are correct, the Callback dialog box appears on your computer.
  3. You then type the current callback number in the dialog box and wait for the server to disconnect and return the call.

    Optionally, you can press ESC to cancel the callback process and remain connected.

For more information about configuring your callback options, see To configure client callback options.

Notes

  • Your callback options are determined by your system administrator. The administrator may deny the use of callback, allow user-defined callback, or require callback to a particular number. You can contact your system administrator to determine your callback options.
  • If your computer is configured to accept incoming connections, you can enforce callback options on that computer. For more information, see To configure callback for incoming connections.


How security works at connection

The following steps describe what happens during a call to a remote access server:

  1. The remote access client computer calls a remote access server.
  2. Depending on the authentication methods that have been negotiated, one of the following happens:
    • If you are using PAP or SPAP:
      • The client sends its user name and password to the server.
      • The server checks the account credentials against the user database.
    • If you are using CHAP or MS-CHAP:
      • The server sends a challenge to the client.
      • The client sends an encrypted response to the server.
      • The server checks the response against the user database.
    • If you are using MS-CHAP v2:
      • The server sends a challenge to the client.
      • The client sends an encrypted response and a challenge to the server.
      • The server checks the encrypted response of the client against the user database and sends the client its own encrypted response.
      • The client verifies the encrypted response of the server.
    • If you are using certificate-based authentication:
      • The server sends its computer certificate to the client.
      • If the client is configured for certificate-based authentication, the client validates the server certificate.
      • The client sends its user certificate to the server.
      • The server verifies that the user certificate is valid and has not been revoked.
  3. If the connection attempt is both authenticated (the user credentials are valid, the user account is enabled and not locked out, and the connection is occurring within the allowed logon hours) and authorized (for incoming connections, the user account has remote access permission), the server accepts the remote access connection.

    4. If callback is enabled, the server calls your computer back and repeats steps 2 through 3.

Notes

  • For the Routing and Remote Access service, authorization of the connection is determined by the dial-in properties of the user account and remote access policies. Remote access policies are a set of conditions and connection settings that give network administrators more flexibility in granting remote access permissions and usage. If the settings of the connection do not match at least one of the remote access policies that apply to your connection, the connection attempt is rejected, regardless of the dial-in properties of the user account.
  • Network Connections authentication methods control access to your network, not to resources on the network. Once you are connected to a network, resource access control is managed through access control lists (ACLs) in various ways: Local Users and Groups, Active Directory, Group Policy, file and printer sharing, and so on.
  • Authentication methods are designed for remote computing environments where the computer that is dialing in does not have access to the network until credentials, such as user name and password, are validated.
  • For information about configuring security options for your connections, such as identity authentication protocols and data encryption settings, see Secure network or dial-up connections.


Group Policy for Network Connections

By using the Group Policy snap-in, an administrator can configure the desktop settings of many computers at once. Some Group Policy settings apply specifically to Network Connections, such as user access to connections and the ability to change the properties of connections. These settings can be found in the Administrative Templates of the Group Policy snap-in.

Where?

  • Group_Policy_object_name
  • Computer Configuration (or User Configuration)
  • Administrative Templates
  • Network
  • Network Connections

Notes

  • XOX
  • If you do not have write access to a Group Policy object, you cannot see the settings contained in that object.
For an overview of Group Policy, Group Policy objects, and administrative templates, see Group Policy overview. For more information on how to use Group Policy to define policy settings that are applied to computers or users, see Group Policy.


Group Policy settings that prohibit home and small office networking on your domain

Group Policy settings define the various components of the user's environment that a system administrator can manage. The following Group Policy settings are available to prohibit home and small office networking on your domain:

  • Prohibit use of Internet Connection Sharing on your DNS domain network determines whether computer users with administrator accounts can enable and configure Internet Connection Sharing (ICS) on network connections on your domain.
  • Prohibit use of Internet Connection Firewall on your DNS domain network determines whether computer users with administrator accounts can enable and configure Internet Connection Firewall (ICF) on network connections on your domain.
  • Prohibit installation and configuration of Network Bridge on your DNS domain network determines whether computer users with administrator accounts can enable Network Bridge on your domain.

Group Policy for ICS

ICS allows a user with an administrator account to provide Internet access for a home or small office network, using one common connection as the Internet gateway, and to provide local private network services, such as name resolution and addressing. The ICS host is the only computer that is directly connected to the Internet. Multiple ICS clients simultaneously use the common (shared) Internet connection. ICS is available only on computers that have two or more network connections. Users with administrator accounts enable ICS by accessing the Advanced tab on network connections. For more information about ICS, see Connecting to the Internet in a home or small office network.

If you do not want users on your domain to be able to enable or configure ICS, apply the Prohibit use of Internet Connection Sharing on your DNS domain network Group Policy setting. When you apply the Prohibit use of Internet Connection Sharing on your DNS domain network Group Policy setting, users with administrator accounts cannot enable or configure ICS because the Advanced tab on network connections becomes unavailable, and the related wizard options on computers running XOX are blocked.

Computer users with user rights are prohibited from configuring ICS, regardless of this Group Policy setting.

Group Policy for ICF

ICF allows a user with an administrator account to activate a firewall to protect the public connection of a small network or a single computer that is connected to the Internet. ICF is enabled by default only on dial-up connections. Users with administrator accounts can enable ICF on other types of connections, such as LAN and wireless connections, by accessing the Advanced tab on network connections. For more information about ICF, see Internet Connection Firewall.

If you do not want users to be able to enable or configure ICF, apply the Prohibit use of Internet Connection Firewall on your DNS domain network Group Policy setting. When you apply the Prohibit use of Internet Connection Firewall on your DNS domain network Group Policy setting, users with administrator accounts cannot enable or configure ICF because the Advanced tab becomes unavailable, and the related wizard options on computers running XOX are blocked.

Computer users with user rights are prohibited from configuring ICF, regardless of this Group Policy setting.

Group Policy for Network Bridge

Network Bridge automates the configuration that is required to route traffic between multi-segment networks comprised of a single type of media or mixed media. With Network Bridge, no configuration is required, and you do not need purchase additional hardware such as routers or bridges. The Network Bridge menu command Bridge Connections is available only when two or more network adapters are present. By default, Network Bridge is disabled, but users with administrator accounts can use Bridge Connections to enable Network Bridge. For more information about Network Bridge, see Network Bridge.

If you do not want users on your domain to be able to enable or configure Network Bridge, apply the Prohibit installation and configuration of Network Bridge on your DNS domain network Group Policy setting. When you apply the Prohibit installation and configuration of Network Bridge on your DNS domain network Group Policy setting, users with administrator accounts cannot enable or configure Network Bridge because the Bridge Connections command is removed from the menu on network connection icons, and the related wizard options on computers running XOX are blocked.

Computer users with user rights are prohibited from configuring Network Bridge, regardless of this Group Policy setting.

Important

The Group Policy settings for ICS and ICF are location-aware. A location-aware Group Policy setting applies only when a computer is connected to the domain that it was connected to when the setting was last refreshed. If a computer, such as a laptop computer, is connected to your domain, but the setting on the computer was last refreshed on another domain, then the Group Policy setting on your network do not apply to that computer.

For example, if ICS is enabled on a computer that is on your network, and then you apply the Group Policy setting for ICS, ICS continues to run as normal until you restart the computer or log off of the network and then log on again. The same is true if the Group Policy setting for ICS is set on your network, and then a computer on which ICS is enabled joins your network. In this case also, ICS continues to run as normal until you restart the new computer or log off of the network and then log on again. This example applies to ICF as well.

The Group Policy setting for Network Bridge works somewhat differently. If Network Bridge is enabled on a computer that is on your network, and then you apply the Group Policy setting for Network Bridge, or if the Group Policy setting for Network Bridge is set on your network, and then a computer on which Network Bridge is enabled joins your network, Network Bridge continues to exist in the Network Connections folder and to use system resources, but the functionality of Network Bridge changes. In these cases, Network Bridge continues to receive and send data over the network connections that are included in the bridge but, for security reasons, no longer forwards traffic from one network connection to another. This change is immediate; it does not require that you restart the computer or log off of the network and then log on again.

For an overview of Group Policy, see Group Policy.

Note

  • XOX


Dial-up credentials

Credentials are required to successfully connect to the Internet using dial-up connections. Your credentials are the combination of your ISP account name and password. Your computer user profile identifies your account as either an administrator account or a user account. If you log on using user credentials, you will have two options for how your credentials are saved when you create a dial-up connection. If you log on with administrative credentials, you will have three options for how your credentials are saved when you create a dial-up connection. If you have account profiles with both administrator and user credentials, only the credentials for the account that you have logged on with will apply.

If you log on with user account credentials, you can create only dial-up connections for My use only. These connections will be successful only when you are logged on to the computer, and they will not be accessible to any other users. When creating user account dial-up connections, you can either save your credentials as Me only (for your use only) or not save your credentials. If you save your credentials as Me only, and you are logged on to the computer using the account you used when you created the connection, your credentials will be automatically supplied when using the connection. If you do not save your credentials, a dialog box will be provided for you to enter your credentials each time you are logged on to the computer using the account you used when creating the connection and you attempt to connect to the Internet.

If you log on with administrative credentials, you can create connections for either Anyone's use or My use only. If you create a connection for My use only, the connection options are the same as those created by anyone with a user account. Connections created for Anyone's use can be seen by any user who logs on to that computer, but connection success to the Internet is affected by how credentials were saved. When creating a connection for Anyone's use, you can save your credentials so that they will be supplied automatically for Anyone who logs on to this computer or Me only. You can also choose not to save your credentials.

If you save your credentials for Anyone who logs on to this computer, your saved credentials will automatically be supplied for any user who has logged on to the computer and attempts to connect to the Internet using that connection or on-demand dialing. If you save your credentials but do not make them available for Anyone who logs on to this computer, then your saved credentials will be automatically supplied only if you are logged on to the computer. Other users will see a dialog box that prompts them for your user name and password; they will be unable to connect to the Internet using this connection unless they can provide your credentials. If you do not save your credentials, a dialog box will appear and prompt you or any other user to enter your credentials before the connection to the Internet can be completed.

The following summarizes the experience of a user logging on with user credentials and experience of a user logging on with administrative credentials:

Logging on with user credentials

Connection type created Credential save options Local computer access
  • My use only
  • Me only
  • Not saved
 This connection will work only when you are logged on with the account that you used when you created the connection. If you did not save your credentials, you will be prompted to supply them every time you use the connection. You cannot configure Internet Connection Sharing (ICS) or Internet Connection Firewall (ICF) on this connection. If you want to enable ICS or configure ICF, you should log on with administrative credentials before you create the dial-up connection because only administrators can access the Advanced tab. If you want to enable ICS or ICF on a dial-up connection that was created with user credentials, the user who created the connection must be promoted to an administrator.
ICS client Internet access through My use only ICS connections
Users of ICS client computers can connect to the Internet through connections on the ICS host computer that are saved for My use only if:
  • The user who created the connection saved credentials and is logged on to the ICS host computer.
  • The user who created the connection did not save credentials but that user or another user can supply those credentials when prompted by the ICS host computer to do so.

Logging on with administrative credentials

Connection type created Credential save options Local computer access
  • My use only
  • Me only
  • Not saved
 This connection will work only when you are logged on with the account that you used when you created the connection. If you did not save your credentials, you will be prompted to supply them every time you use the connection. You cannot configure Internet Connection Sharing (ICS) or Internet Connection Firewall (ICF) on this connection. If you want to enable ICS or configure ICF, you should log on with administrative credentials before you create the dial-up connection because only administrators can access the Advanced tab. If you want to enable ICS or ICF on a dial-up connection that was created with user credentials, the user who created the connection must be promoted to an administrator.
  • Anyone's use
  • Anyone who uses this computer
  • Me only
  • Not saved
 All users can see the Internet connection. If you saved your credentials for all users, any user who is logged on to the computer can connect to the Internet. If you saved your credentials as Me only, the connection is automatically completed only if you log on to the computer as the administrator who saved the credentials when you created the connection. If you did not save your credentials, when you or another user attempts to connect to the Internet, your credentials must be supplied when prompted in order to complete the connection. You can access the Advanced tab to enable ICS or configure ICF because you logged on as an administrator when you created the dial-up connection.
ICS client Internet access through Anyone's use connections
Users of ICS client computers can connect to the Internet through connections on the ICS host computer that are saved for Anyone's use only if:
  • The administrator who created the connection saved credentials for use by anyone who uses the computer. (This attempt will succeed whether a user is logged on to the ICS host computer or the ICS client computer.)
  • The administrator who created the connection saved credentials as User only and is now logged on to the ICS host computer with the same credentials.
  • The administrator who created the connection did not save credentials, but a user can supply those credentials when prompted by the ICS host computer.

You must enable on-demand dialing in order for programs to automatically initiate dial-up connections to your Internet service provider. For more information, see To enable ICS on-demand dialing.

You must enable ICS in order for computers on your network to share a common Internet connection. For more information, see Connecting to the Internet in a home or small office network.

Note

  • As a security measure, you should log on using user credentials rather than administrative credentials.


Data encryption and encryption methods

This section covers:

  • Data encryption
  • Microsoft Point-to-Point Encryption (MPPE)
  • Internet Protocol security (IPSec)


Data encryption

You can think of encryption as locking something valuable into a strong box with a key. Sensitive data is encrypted by using an encryption algorithm and a key, which renders it unreadable without the knowledge of the key. Data encryption keys are determined at connect time between the connecting computers. The use of data encryption can be initiated by your computer or by the server you are connecting to.

Network Connections supports two types of encryption:

  • Microsoft MPPE, which uses RSA RC4 encryption.
  • An implementation of Internet Protocol security (IPSec) that uses Data Encryption Standard (DES) encryption.

Both MPPE and IPSec support multiple levels of encryption, as shown in the following table.

Encryption type | Level of encryption supported
MPPE Standard | 40-bit, 56-bit
MPPE Strong | 128-bit
IPSec DES | 56-bit
IPSec Triple DES | 3DES

For more information, see the following:

  • Microsoft Point-to-Point Encryption (MPPE)
  • Internet Protocol security (IPSec)

Notes

  • Server controls are flexible and can be set to deny the use of encryption, require a specific encryption strength, or allow your computer to select an encryption strength. By default, most servers allow encryption and allow clients to select their encryption methods. This works for most computers. A system administrator sets encryption requirements. To determine your options, contact your system administrator.
  • To enable MPPE-based data encryption for dial-up or virtual private network (VPN) connections, you must select the MS-CHAP, MS-CHAP v2, or EAP-TLS authentication methods. These authentication methods generate the keys used in the encryption process.
  • Virtual Private Networks (VPNs) use encryption depending on the type of server they are connecting to. If the VPN connection is configured to connect to a PPTP server, then MPPE encryption is used. If the VPN is configured to connect to an L2TP server, then IPSec encryption methods are used. If the VPN is configured for an Automatic server type, which is the default selection, then L2TP, and its associated IPSec encryption, will be attempted first, then PPTP, and its associated MPPE encryption.


Microsoft Point-to-Point Encryption (MPPE)

Microsoft Point-to-Point Encryption (MPPE) encrypts data in Point-to-Point Protocol (PPP)-based dial-up connections or Point-to-Point Tunneling Protocol (PPTP) virtual private network (VPN) connections. 128-bit key (strong), 56-bit key, and 40-bit key (standard) MPPE encryption schemes are supported. MPPE provides data security for the PPTP connection that is between the VPN client and the VPN server.

For more information about configuring connections, see To configure a connection to a remote network.

Note

  • MPPE requires encryption keys as generated by Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2), or Extensible Authentication Protocol-Transport Level Security (EAP-TLS) authentication process.


Internet Protocol security (IPSec)

The long-term direction for secure networking, IPSec is a suite of cryptography-based protection services and security protocols. Because it requires no changes to applications or protocols, you can easily deploy IPSec for existing networks.

IPSec provides computer-level authentication, as well as data encryption, for VPN connections that use the L2TP protocol. IPSec is negotiated between your computer and an L2TP-based VPN server before an L2TP connection is established. This negotiation secures both passwords and data.

L2TP uses standard PPP-based authentication protocols, such as EAP, MS-CHAP, MS-CHAP v2, CHAP, SPAP, and PAP with IPSec.

Encryption is determined by the IPSec Security Association, or SA. A security association is a combination of a destination address, a security protocol, and a unique identification value, called a Security Parameters Index (SPI). The available encryptions include:

  • Data Encryption Standard (DES), which uses a 56-bit key.
  • Triple DES (3DES), which uses three 56-bit keys and is designed for high-security environments.

For more information about IPSec, see Internet Protocol security (IPSec).

For more information about configuring connections, see To configure a connection to a remote network.


Authentication

This section covers:

  • Authentication process
  • Authentication protocols and methods


Authentication process

Authentication in the Windows Server 2003 family consists of two parts: an interactive logon process and a network authentication process. Successful user authentication depends on both of these processes.

Interactive logon process

The interactive logon process confirms the user's identification to either a domain account or a local computer. Depending on the type of user account, the interactive logon process is different:

  • With a domain account, a user logs on to the network with a password or smart card by using single sign-on credentials stored in Active Directory. By logging on with a domain account, an authorized user can access resources in the domain and any trusting domains. Kerberos V5 is used for authentication if a password is used to log on to a domain account. Kerberos V5 authentication with certificates is used if a smart card is used instead.
  • With a local computer account, a user logs on to a local computer by using credentials stored in the Security Accounts Manager (SAM), which is the local security account database. Any workstation or member server can store local user accounts.

Network authentication process

Network authentication confirms the user's identification to any network service that the user is attempting to access. To provide this type of authentication, many mechanisms are supported, including Kerberos V5, Secure Socket Layer/Transport Layer Security (SSL/TLS), and, for compatibility with Windows NT 4.0, LAN Manager.

Users who use a domain account do not see network authentication. Users who use a local computer account must provide credentials (such as a user name and password) every time they access a network resource. By using the domain account, the user has credentials that are automatically used for single sign-on.

For information about authentication methods and protocols used by Network Connections, see Authentication protocols and methods.


Authentication protocols and methods

With Network Connections, you can use the following authentication protocols and methods:

  • Password Authentication Protocol (PAP)
  • Challenge Handshake Authentication Protocol (CHAP)
  • Shiva Password Authentication Protocol (SPAP)
  • Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
  • Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2)
  • Extensible Authentication Protocol (EAP)
  • Smart card and other certificate authentication


Password Authentication Protocol (PAP)

Password Authentication Protocol (PAP) is a simple authentication protocol in which the user name and password is sent to the remote access server in a plaintext (unencrypted) form. Using PAP is strongly discouraged because your passwords are easily readable from the Point-to-Point Protocol (PPP) packets exchanged during the authentication process. PAP is typically used only when connecting to older UNIX-based remote access servers that do not support more secure authentication protocols.

To configure a connection for PAP, see To configure identity authentication and data encryption settings.

Notes

  • You cannot use Microsoft Point-to-Point Encryption (MPPE) if PAP is used to authenticate the connection.
  • If the connection is configured to require a secured password and you attempt to connect to a server that is configured only for PAP, the XOX remote access client terminates the connection.


Challenge Handshake Authentication Protocol (CHAP)

Challenge Handshake Authentication Protocol (CHAP) is a widely supported authentication method in which a representation of the user's password, rather than the password itself, is sent during the authentication process. With CHAP, the remote access server sends a challenge to the remote access client. The remote access client uses a hash algorithm (also known as a hash function) to compute a Message Digest-5 (MD5) hash result based on the challenge and a hash result computed from the user's password. The remote access client sends the MD5 hash result to the remote access server. The remote access server, which also has access to the hash result of the user's password, performs the same calculation using the hash algorithm and compares the result to the one sent by the client. If the results match, the credentials of the remote access client are considered authentic. A hash algorithm provides one-way encryption, which means that calculating the hash result for a data block is easy, but determining the original data block from the hash result is mathematically infeasible.

To configure a connection for CHAP, see To configure identity authentication and data encryption settings.

Notes

  • You cannot use Microsoft Point-to-Point Encryption (MPPE) if CHAP is used to authenticate the connection.
  • If you are using CHAP to authenticate a connection to a remote access server running Windows 2000 and Routing and Remote Access, the user account of the connecting client must be configured to allow the storage of the password in a reversibly encrypted form. For more information on configuring user accounts for storing a reversibly encrypted form of a password, see To enable reversibly encrypted passwords in a domain.


Shiva Password Authentication Protocol (SPAP)

Shiva Password Authentication Protocol (SPAP) is a simple encrypted password authentication protocol supported by Shiva remote access servers. With SPAP, the remote access client sends an encrypted password to the remote access server. SPAP uses a two-way encryption algorithm. The remote access server decrypts the password and uses the plaintext form to authenticate the remote access client.

To configure a connection for SPAP, see To configure identity authentication and data encryption settings.

Note

  • You cannot use Microsoft Point-to-Point Encryption (MPPE) if SPAP is used to authenticate the connection.


Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

Microsoft created MS-CHAP to authenticate remote Windows-based workstations, integrating the functionality to which LAN-based users are accustomed with the hashing algorithms used on Windows networks. Like CHAP, MS-CHAP uses a challenge-response mechanism to authenticate connections without sending any passwords.

MS-CHAP uses the Message Digest 4 (MD4) hashing algorithm and the Data Encryption Standard (DES) encryption algorithm to generate the challenge and the response. MS-CHAP also provides mechanisms for reporting connection errors and for changing the user's password. The response packet is in a format designed to work with networking products in Windows 95, Windows 98, Windows Millennium Edition, Windows NT, Windows 2000, XOX, and the Windows Server 2003 family.

To configure a connection for MS-CHAP, see To configure identity authentication and data encryption settings.

Notes

  • If you are configuring a connection to a server running Windows 95, you must use a specific version of MS-CHAP. To enable this older version of MS-CHAP, see To configure identity authentication and data encryption settings.
  • Unlike CHAP, MS-CHAP does not require that the user's password be stored in a reversibly encrypted form.
  • During the MS-CHAP authentication process, shared secret encryption keys for Microsoft Point-to-Point Encryption (MPPE) are generated.


Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2)

The Windows Server 2003 family supports MS-CHAP v2, which provides mutual authentication, the generation of stronger initial data encryption keys for Microsoft Point-to-Point Encryption (MPPE), and different encryption keys for sent and received data. To minimize the risk of password compromise during a password change, support for older methods of the MS-CHAP password change are not supported.

Because MS-CHAP v2 is more secure than MS-CHAP, it is offered before MS-CHAP (if enabled) for all connections.

MS-CHAP v2 is supported by computers running XOX, Windows 2000, Windows 98, Windows Millennium Edition, and Windows NT version 4.0. Computers running Windows 95 support MS-CHAP v2 only for VPN connections, not for dial-up connections.

To configure a connection for MS-CHAP v2, see To configure identity authentication and data encryption settings.

Note

  • MS-CHAP v2 is a mutual authentication protocol, which means that both the client and the server prove that they have knowledge of the user's password. First, the remote access server asks the remote access client for proof by sending a challenge to the client. Then the remote access client asks the remote access server for proof by sending a challenge back to the server. If the server cannot prove that it has knowledge of the user's password by correctly answering the challenge from the client, the client terminates the connection. Without mutual authentication, a remote access client cannot establish a connection to an unauthorized remote access server.


Extensible Authentication Protocol (EAP)

Extensible Authentication Protocol (EAP) extends Point-to-Point Protocol (PPP) by allowing arbitrary authentication methods that use credential and information exchanges of arbitrary lengths. EAP was developed in response to an increasing demand for authentication methods that use security devices, such as smart cards, token cards, and crypto calculators. EAP provides an industry-standard architecture for supporting additional authentication methods within PPP.

By using EAP, you can support additional authentication schemes, known as EAP types. These schemes include token cards, one-time passwords, public key authentication using smart cards, and certificates. EAP, in conjunction with strong EAP types, is a critical technology component for secure virtual private network (VPN) connections. Strong EAP types, such as those based on certificates, offer better security against brute-force or dictionary attacks and password guessing than password-based authentication protocols, such as CHAP or MS-CHAP.

To find out if an EAP type is being used in your organization, contact your network administrator.

To configure a connection for EAP, see To configure identity authentication and data encryption settings.

The Windows Server 2003 family supports two EAP types:

  • EAP-MD5 CHAP (equivalent to the CHAP authentication protocol)
  • EAP-TLS (used for user certificate-based authentication).

EAP-TLS is a mutual authentication method, which means that both the client and the server prove their identities to each other. During the authentication process, the remote access client sends its user certificate and the remote access server sends its computer certificate. If either certificate is not sent or is invalid, the connection is terminated.

Note

  • During the EAP-TLS authentication process, shared secret encryption keys for Microsoft Point-to-Point Encryption (MPPE) are generated.


Smart card and other certificate authentication

If a user certificate is installed, either in the certificate store on your computer or on a smart card, Extensible Authentication Protocol (EAP) is enabled, and Smart Card or other Certificate EAP type (EAP-TLS) is selected, you can use certificate-based authentication in a single network logon process, which provides tamper-resistant storage of authentication information.

A certificate is an encrypted set of authentication credentials. A certificate includes a digital signature from the certification authority that issued the certificate. In the EAP-TLS certificate authentication process, your computer presents its user certificate to the remote access server, and the remote access server presents its computer certificate to your computer, providing mutual authentication. Certificates are authenticated by using a public key to verify the included digital signature. The digital signature is contained in a trusted root certification authority certificate that is stored on your computer. These trusted root certificates are the basis for certificate verification. The Windows Server 2003 family provides many trusted root certificates. You should add or remove trusted root certificates only if your system administrator advises.

Certificates can reside either in the certificate store on your computer or on a smart card. A smart card is a credit-card-sized device that is inserted into a smart card reader, which is either installed internally in your computer or connected externally to your computer.

If you configure the advanced security settings for a connection, you can choose to use a smart card or other certificate, and you can specify particular certificate requirements. For example, you can specify that the computer certificate for the server must be validated, that the server name must end in a particular value, and that the computer certificate must be issued by a specific trusted root certification authority for the server.

When you double-click New Connection Wizard in the Network Connections folder and a smart card reader is installed, Windows detects it and prompts you to use it as the authentication method for the connection. If you decide not to use the smart card at the time you create a connection, you can modify the connection to use the smart card or other certificate at a later time. For more information, see To enable smart card or other certificate authentication.

If you are a member of an Active Directory domain, and need to request a certificate, see To request a certificate. If you are not a member of an Active Directory domain, or you need to request a certificate from the Internet, see To submit a user certificate request via the Web. For information about mobile users and certificates, see Mobile users and certificates.


Intermediary devices

This section covers:

  • Using an intermediary device
  • Security hosts
  • Writing scripts for intermediary devices


Using an intermediary device

Network Connections supports various kinds of intermediary devices (security hosts and switches) between the remote access client and the remote access server. These devices include:

  • Modem-pool switches
  • Security hosts
  • X.25 networks

Before you connect to the remote access server, you can have one of two possible dialog boxes (user input and computer response screens) with each intermediary device:

  • Static (a dialog box that never changes and requires no input from you)
  • Interactive (a dialog box that always changes and requires input from you)

You must configure your connection to work with each intermediary device.

If you require both static and interactive dialog boxes, you must take the following steps:

  • Write a script for the static dialog box. For more information, see Writing scripts for intermediary devices.
  • Activate Terminal mode for the interactive dialog boxes. For more information, see To use the Terminal feature to log on to a remote computer.

If you require only one kind of dialog box, take only one of the preceding steps. For example:

  • If your clients connect through only one intermediary device with a static dialog box (such as an X.25 network), skip step 2.
  • If your clients connect through a security host with an interactive dialog box, skip step 1.


Security hosts

A security host is an authentication device that verifies whether a connection is authorized to connect to a remote access server. This verification supplements security already supplied by Network Connections and by the Windows Server 2003 family. There are two kinds of security hosts:

  • Those which perform authentication checks during a modem call

    This type of security host sits between you and the remote access server and performs an authentication check before remote access server authentication. This type of security host generally provides an extra layer of security by requiring a hardware key of some sort in order to provide authentication. Verification that you are in physical possession of the key takes place before access to the remote access server is granted. With this open architecture, your system administrator can select from a variety of security hosts to augment the security in Network Connections, but the authentication check is restricted to modem calls.

    For example, one such security system consists of two hardware devices: the security host and the security card. The security host is installed between the remote access server and its modem. The security card is a small unit the size of a credit card that resembles a pocket calculator without keys. The security card displays a different access number every minute. This number is synchronized with a similar number calculated in the security host every minute. When connecting, you send a PIN number and the number on the security card to the host. If these match the number calculated on the host, the security host connects you with the remote access server.

    Another security host of the same type prompts you to type in a user name (which may or may not be the same as the remote access user name) and a password (which differs from the remote access password). The security host must be configured to allow the remote access server to initialize the modem before the security functions take effect. The remote access server must also be able to directly initialize the modem connected to the security host without security checks from the security host.

  • Those which are called during the authentication process of the connection

    This type of security host provides custom authentication during the remote access authentication process. This authentication may augment or replace the standard verification of your network credentials by Routing and Remote Access in the Windows Server 2003 family. RADIUS servers are examples of this type of security host in that they perform user authentication on behalf of Routing and Remote Access. With the introduction of the Extensible Authentication Protocol (EAP), other vendors can create interfaces between remote access authentication and their own proprietary servers. Servers of this type are used to verify smart cards and other forms of extended authentication.

Note

  • To make other security devices work with your connection, you must activate Terminal mode to interact with the security host. For more information, see To use the Terminal feature to log on to a remote computer.


Writing scripts for intermediary devices

Each script for a static dialog box is a section of the Switch.inf file. You add a script for each intermediary device to the Switch.inf file. For an example of X.25 network scripts, see the Pad.inf file, located in the systemroot\System32\Ras folder.

When you connect by using modem pools or security hosts, you must have a dialog with that device. The dialog occurs either before dialing or after dialing. Although preconnect and postconnect dialogs can be either static or interactive, the preconnect dialog box is normally static and the postconnect is normally interactive.

The included Switch.inf file provides a generic script that will probably work with little or no modification when you are connecting to PPP servers. You should try to connect by using the generic Switch.inf script. If that does not work, you can copy—and then modify—the generic script to match the logon sequence of the remote computer to which you want to connect.

For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts. For information about configuring a connection to use a Switch.inf script, see To activate a logon script.


Tunneling protocols

This section covers:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer Two Tunneling Protocol (L2TP)


Point-to-Point Tunneling Protocol (PPTP)

You can access a private network through the Internet or other public network by using a virtual private network (VPN) connection with the Point-to-Point Tunneling Protocol (PPTP).

PPTP enables the secure transfer of data from a remote computer to a private server by creating a VPN connection across IP-based data networks. PPTP supports on-demand, multiprotocol, virtual private networking over public networks, such as the Internet.

Developed as an extension of the Point-to-Point Protocol (PPP), PPTP adds a new level of enhanced security and multiprotocol communications over the Internet. By using the new Extensible Authentication Protocol (EAP) with strong authentication methods such as certificates, data transfer through a PPTP-enabled VPN connection is as secure as within a single LAN at a corporate site. For more information on EAP, see Extensible Authentication Protocol (EAP).

PPTP encapsulates IP or IPX protocols inside of PPP datagrams. This means that you can remotely run applications that are dependent upon particular network protocols. The tunnel server performs all security checks and validations, and enables data encryption, which makes it much safer to send information over nonsecure networks. You can also use PPTP in private LAN-to-LAN networking.

XOX

PPTP tunnel

PPTP requires IP connectivity between your computer and the server. If you are directly attached to an IP LAN and can reach a server, then you can establish a PPTP tunnel across the LAN. If you are creating a tunnel over the Internet, and your normal Internet access is a dial-up connection to an ISP, you must dial up your Internet connection before you can establish the tunnel.

For more information about VPNs, see Virtual private network (VPN) connections. For information about creating a VPN, see To make a virtual private network (VPN) connection.


Layer Two Tunneling Protocol (L2TP)

You can access a private network through the Internet or other public network by using a virtual private network (VPN) connection with the Layer Two Tunneling Protocol (L2TP). L2TP is an industry-standard Internet tunneling protocol with roughly the same functionality as the Point-to-Point Tunneling Protocol (PPTP). The Windows Server 2003 family implementation of L2TP is designed to run natively over IP networks. This implementation of L2TP does not support native tunneling over X.25 or Frame Relay networks.

Based on the Layer Two Forwarding (L2F) and Point-to-Point Tunneling Protocol (PPTP) specifications, you can use L2TP to set up tunnels across intervening networks. Like PPTP, L2TP encapsulates Point-to-Point Protocol (PPP) frames, which in turn encapsulate IP or IPX protocols, thereby allowing users to remotely run applications that are dependent upon specific network protocols.

XOX

L2TP tunnel

With L2TP, the computer running a member of the Windows Server 2003 family that you are logging on to performs all security checks and validations, and enables data encryption, which makes it much safer to send information over nonsecure networks. By using Internet Protocol security (IPSec) authentication and encryption, data transfer through an L2TP-enabled VPN is as secure as within a single LAN at a corporate site. For more information about IPSec, see Internet Protocol security (IPSec).

For more information about VPNs, see Virtual private network (VPN) connections. For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


Home and small office networking

This section covers:

  • Internet Connection Firewall
  • Internet Connection Firewall security log
  • Network Bridge
  • Service definitions for Internet Connection Firewall and Internet Connection Sharing


Internet Connection Firewall

A firewall is a security system that acts as a protective boundary between a network and the outside world. Internet Connection Firewall (ICF) is firewall software that is used to set restrictions on what traffic is allowed to enter your network from the Internet. ICF protects your network against external threats by allowing safe network traffic to pass through the firewall into your network, while denying the entrance of unsafe traffic.

If your network uses Internet Connection Sharing (ICS) to provide shared Internet access to multiple computers, ICF should be enabled on the shared Internet connection.

Shared Internet connection protected by ICF
Additionally, you should enable ICF on the Internet connection of any computer that is connected directly to the Internet. ICF can provide protection to a single computer connected to the Internet with a cable modem, a DSL adapter or modem, or a dial-up modem. You should not enable ICF on VPN connections because it will interfere with the operation of file sharing and other VPN functions.

When ICF has been enabled on a network connection, the following network connection icon appears in Network Connections: firewalled connection. To check to see whether ICF is enabled, or to enable ICF, see To enable or disable ICF. For information about using ICF, see Protecting your home or small office network using Internet Connection Firewall.

How ICF works

ICF is considered a "stateful" firewall. A stateful firewall is one that monitors all aspects of the communications that cross its path and inspects the source and destination address of each message that it handles. To prevent unsolicited traffic from the public side of the connection from entering the private side, ICF keeps a table of all communications that have originated from the ICF computer. When used in conjunction with ICS, ICF tracks all traffic that has originated from the ICF/ICS computer and all traffic that has originated from private network computers. All inbound traffic from the Internet is compared against entries in the table. Inbound Internet traffic is allowed to reach the computers in your network only when there is a matching entry in the table that shows that the communication exchange originated from your computer or private network.

To thwart common hacking attempts, such as port scanning, communications that originate from the Internet are dropped by the firewall. Rather than sending you notifications about firewall activity, ICF silently discards unsolicited communications, because such notifications could be sent frequently enough to become a distraction. Instead, ICF creates a security log to track this activity. For more information, see Internet Connection Firewall security log.

Services can be configured to allow unsolicited traffic from the Internet to be forwarded by the ICF computer to the private network. For example, if you are hosting an HTTP Web server service, and the HTTP service is enabled on your ICF computer, unsolicited HTTP traffic will be forwarded by the ICF computer. A set of operational information, known as a service definition, is required by ICF to allow the unsolicited Internet traffic to be forwarded to the Web server on your private network. Service definitions for ICF work on a per connection basis. If your network has multiple firewall connections, you should configure service definitions on all firewall connections. For information about service definitions, see Service definitions for Internet Connection Firewall and Internet Connection Sharing. For information about adding and editing service definitions, see To manage service definitions for ICF or ICS.

Note

  • XOX


Internet Connection Firewall security log

The Internet Connection Firewall (ICF) security log allows advanced users to choose which information to log. With ICF security logging you can:

  • Log dropped packets. Log all dropped packets that originate from either the home or small office network or the Internet.
  • Log successful connections. Log all successful connections that originate from either the home or small office network or the Internet.

When you select the Log dropped packets check box, information is collected each time ICF detects and denies traffic attempts. For example, if your Internet Control Message Protocol (ICMP) settings are not set to allow incoming echo requests, such as those sent by the ping and tracert commands, and an echo request from outside your network is received, the echo request is dropped, and an entry is made in the log.

When you select the Log successful connections check box, information is collected each time ICF detects and permits traffic attempts. For example, when a computer on your network successfully connects to a Web site, an entry is produced in the log.

The ICF security log is produced using the W3C Extended Log File Format, a format similar to the format that is used in common log analysis tools. For information about how to view an ICF security log, see To view the ICF security log. To save the ICF security log using your choice of name and location, see To change the path and file name of the ICF security log.

ICF security logging is considered an advanced option and is not enabled by default. In order for the ICF security log to accept new data, you must select one or both of the logging options. For more information, see To enable or disable ICF security log options.

The ICF security log has two sections:

  • The header provides information about the version of the ICF security log and the fields that are available for data entry. The header information is presented as a static list.
  • The body contains compiled data that is entered as a result of traffic attempting to cross the firewall. The fields in the body of the ICF security log are entered from left to right across the page. The body of the ICF security log is a dynamic list—new data entries are entered at the bottom of the log.

The following tables define the information that the ICF security log contains:

Header items

Item

Description

Example
#Version | Displays which edition of the ICF security log is installed. | 1.0
#Software | Provides the name of the ICF security log. | Microsoft Internet Connection Firewall
#Time | Indicates that all of the timestamps in the log are in local time. | Local
#Fields | Displays a static list of the fields that are available for ICF security log entries, if data is available. Fields include: date, time, action, protocol, src-ip, dst-ip, src-port, dst-port, size, tcpflags, tcpsyn, tcpack, tcpwin, icmptype, icmpcode, and info. | Src-port, dst-port, size

Body data

Field

Description

Example

Date Specifies the year, month, and day on which the recorded transactions occurred. Dates are recorded in the format:
YY-MM-DD
where YY is the year, MM is the month, and DD is the day. 		2001-01-27
Time Specifies the hour, minute, and seconds at which the recorded transaction occurred. Times are recorded in the format:
HH:MM:SS
where HH is the hour in 24 hour format, MM is minutes, and SS is seconds. 		21:36:59
Action | Specifies which operation was observed by the firewall. The options available to the firewall are OPEN, CLOSE, DROP, and INFO-EVENTS-LOST. An INFO-EVENTS-LOST action indicates the number of events that happened but were not recorded in the log. | DROP
Protocol | Specifies which protocol was used for the communication. A protocol entry can be TCP, UDP, ICMP, or, if the protocol that was used was not TCP, UDP, or ICMP, a number. | ICMP
Src-ip Specifies the source IP address (the IP address of the computer attempting to establish communications). The source IP is recorded in the dotted decimal format:
(number).(number).(number).(number)
192.168.0.0
Dst-ip Specifies the destination IP address (the IP address of the destination for a communication attempt). The destination IP is recorded in the dotted decimal format:
(number).(number).(number).(number)
 192.168.0.1
Src-port | Specifies the port number of the source (sending) computer. A src-port entry is recorded as a whole number, ranging from 1 to 65,535. Only TCP and UDP return a valid src-port entry. All other protocols are invalid for src-port and result in an entry of -. | 4039
Dst-port | Specifies the port number of the destination computer. A dst-port entry is recorded as a whole number, ranging from 1 to 65,535. Only TCP and UDP return a valid dst-port entry. All other protocols are invalid for dst-port and result in an entry of -. | 53
Size | Specifies the packet size in bytes. | 60
Tcpflags Specifies the TCP control flags found in the TCP header of an IP packet:
  • Ack-Acknowledgment field significant
  • Fin-No more data from sender
  • Psh-Push function
  • Rst-Reset the connection
  • Syn-Synchronize sequence numbers
  • Urg-Urgent pointer field significant
Flags are written as uppercase letters. The entry information for tcpflags is provided for users with an in-depth knowledge of Transmission Control Protocol (TCP). Additional information about TCP can be found in RFC 793. 		AFP
Tcpsyn | Specifies the TCP sequence number in the packet. The entry information for tcpsyn is provided for users with an in-depth knowledge of TCP. | 1315819770
Tcpack | Specifies the TCP acknowledgement number in the packet. The entry information for tcpack is provided for users with an in-depth knowledge of TCP. | 0
Tcpwin | Specifies the TCP window size in the packet. The size is specified in bytes. The entry information for tcpack is provided for users with an in-depth knowledge of TCP. | 64240
Icmptype | Specifies a number that represents the type field of the ICMP message. | 8
Icmpcode | Specifies a number that represents the code field of the ICMP message. | 0
Info | Specifies an information entry that depends on the type of action that occurred. For example, an INFO-EVENTS-LOST action displays the number of events that occurred but were not placed in the log since the last occurrence of this event type. | 23

The character (-) is entered when no information is available for a field.

If ICF is enabled on two or more connections on a single computer, the ICF settings are global. If you select a setting or change a setting in Logging Options or Services on any one of the connections on which ICF is enabled, that setting is applied to all of the ICF firewalls on that computer.

Notes

  • If the maximum allowable size for pfirewall.log is exceeded, the information that pfirewall.log contains is saved as pfirewall.log.old, and new information is saved as pfirewall.log. If the maximum allowable size for pfirewall.log is exceeded again, the information that pfirewall.log contains is saved as pfirewall.log.old, and the information that had been in pfirewall.log.old is overwritten. New information is always saved in pfirewall.log.
  • You can obtain RFCs from the RFC Editor Web site. This Web site is currently maintained by members of the Information Sciences Institute (ISI) who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standards, proposed Internet standards (circulated in draft form for review), Internet best practices, or For Your Information (FYI) documents.
  • XOX
  • XOX


Network Bridge

Network Bridge makes it inexpensive and easy to connect LAN segments. A LAN segment is a section of network media that connects computers. Frequently, a network has more than one LAN segment. Prior to XOX; XOX; and XOX, if you wanted to have a network with more than one LAN segment, then you had two options: IP routing and hardware bridging. IP routing required you to buy hardware routers or configure computers to act like routers, configure IP addressing for each computer on each network segment, and configure each network segment as a separate subnet. Hardware bridging did not require difficult configurations, but it did require you to purchase hardware bridges. Additionally, if you were using different types of network media, you needed to create a separate subnet for each type of media.

In contrast, the Network Bridge feature that is available with XOX; XOX; and XOX allows you to connect LAN segments simply by clicking the Bridge Connections menu command. No configuration is required, and you do not need to purchase additional hardware, such as routers or bridges. Network Bridge automates the configuration that is required to route traffic between multi-segment networks that consist of a single type of media or mixed media.

Combined Ethernet and Wireless network with Network Bridge, Internet Connection Sharing and Internet Connection Firewall enabled

Network Bridge example

Suppose you have a small office network with four computers (PC1, PC2, PC3, and PC4) and one Ethernet hub. The four computers are running XOX; XOX; or XOX and have the following hardware installed:

  • PC1 has an adapter connecting it to the Internet, an Ethernet network adapter, an HPNA network adapter, and a wireless adapter.
  • PC2 has an Ethernet network adapter.
  • PC3 has an HPNA network adapter.
  • PC4 has a wireless network adapter.
The Ethernet adapters on PC1 and PC2 are connected to a common Ethernet hub to form the first LAN segment. PC1 is connected to PC3 with the HPNA adapter to form a second LAN segment, and PC1 is connected to PC4 with the wireless adapter to form a third LAN segment.

You can use Network Bridge to connect the Ethernet network adapter, the HPNA network adapter, and the wireless network adapter on PC1. Network Bridge can forward traffic from one LAN segment to another and enable all of your computers to communicate with each other.

Bridged network connections

Without Network Bridge (or additional routing configurations or bridging hardware), only PC1 can communicate with each of the other computers because PC1 is the only computer that has connections to all three LAN segments. Because PC2, PC3, and PC4 use different types of network media, they are on different LAN segments, and they are unable to communicate with any computer other than PC1 (without Network Bridge or additional routing configurations or bridging hardware).

Network Bridge considerations

Only one bridge can exist on a computer, but it can be used to bridge as many different network connections as the computer can physically accommodate. For information about creating Network Bridge, see To set up Network Bridge.

In order to include the ICS private connection as part of a Network Bridge, you must temporarily disable ICS. Be careful not to include the ICS public connection as part of a Network Bridge. To do so creates an unprotected link between your network and the Internet, leaving your network vulnerable to intrusions, and prevents you from enabling ICF or ICS. For more information about using ICS, see Connecting to the Internet in a home or small office network.

Only Ethernet, IEEE-1394 adapters, or Ethernet-compatible adapters, such as wireless and Home Phoneline Network adapters, can be a part of Network Bridge. Network Bridge with a wireless or IEEE-1394 connection supports traffic using Internet Protocol version 4 (IPv4) only.

Spanning tree algorithm

Network Bridge uses the IEEE spanning tree algorithm (STA) to establish a loop-free forwarding topology. When there are multiple paths in a bridged network, loops can form, and the simple forwarding rules of a bridge can cause forwarding storms—a condition in which the same frame is relayed endlessly from one network segment, across the bridge, to another segment. STA provides an automated mechanism to selectively disable bridge forwarding on individual ports as is necessary, in order to ensure that the network topology is loop-free. There is no configuration needed to configure Network Bridge for STA.

Note

  • XOX


Service definitions for Internet Connection Firewall and Internet Connection Sharing

Services run transparently to support other programs. An example of a service is an HTTP Web server that supports hosting Web pages from your home or small office network. If the HTTP Web server service is enabled for your network, you can use that service to supply your own Web pages to the Internet. In addition to having a Web server on your network, you can have an FTP service that permits users to upload or download files through the Internet, an Internet mail server for storing and forwarding mail, and a variety of other services.

In order to permit traffic to flow from the Internet to the computer hosting the service, you must use a preconfigured service or add the service to the Services list by entering information about the operational settings of the services on the Services tab of the Internet Connection Firewall (ICF) or Internet Connection Sharing (ICS) host computer. The operational settings are known as a "service definition," because they define the environment that the service requires in order to operate. Service definitions for ICF and ICS provide the port mappings that are required in order for ICF to allow unsolicited traffic to travel from the Internet to the network.

Some service definitions are preconfigured for ICF and ICS. FTP Server, Internet Mail Server, Secure Web Server, Telnet Server, and Web Server are examples of preconfigured (built-in) services. These services can run on ICS client computers or on your ICF or ICS host computer. You can add a new service to your network by installing the service software on one of your network computers and then adding the service definition so that ICF and ICS, if one or both are enabled, will allow the service to be accessed from the Internet.

Services for ICF and ICS can run on an ICS client computer or an ICS host computer. When you add a service definition to an ICS host computer, it is made available to ICS clients. For information about how to add or edit a service definition, see To manage service definitions for ICF or ICS.

Note

  • XOX


Using Network Connections

Network Connections is automatically installed. This section covers:

  • Monitoring network and dial-up connections
  • Making network connections
  • Using home and small office networking features


Monitoring network and dial-up connections

You can obtain information about an active connection by using the Status menu command on the File menu.

By using Status, you can view:
  • The duration of a connection.
  • The speed at which you initially connected.

    For a single-link connection and for individual links in a multilink connection, this speed is negotiated (and fixed) at the time the connection or link is established. For multilink connections, this speed is equal to the sum of the speeds of the individual links. For multilink connections, this speed varies as links are added or deleted.

  • For local area connections, the number of bytes transmitted and received during a connection. For other types of connections, the number of bytes transmitted and received during a connection, and the associated compression and error statistics.
  • The diagnostic tools that you can use for a connection, if any. For example, the Windows Network Troubleshooter, TCP/IP, Autoping, and TCP/IP Windows IP Configuration. These tools are explicitly registered in the Windows Server 2003 family by their providers, whether the provider is Microsoft or another organization.

You can also generate diagnostic reports for remote access connections. For more information on remote access preferences and generating diagnostic reports, see Logging remote access connections and To enable logging.

For more information on monitoring connections, see To monitor a connection.

Note

  • If your computer is set up to accept incoming connections, a connection icon with a user name assigned to it appears in the Network Connections folder as each user connects. You can view the progress of incoming connections by right-clicking a named connection, and then clicking Status.


Making network connections

This section covers:

  • Using local area connections
  • Using direct connections
  • Using remote access methods
  • Using incoming connections
  • Using Internet connections
  • Virtual private network (VPN) connections


Using local area connections

Typically, computers running Windows are connected to a local area network (LAN). When you install Windows, your network adapter is detected, and a local area connection is created. It appears, like all other connection types, in the Network Connections folder. By default, a local area connection is always activated. A local area connection is the only type of connection that is automatically created and activated.

If you disable your local area connection, the connection is no longer automatically activated. Because your hardware profile remembers this, it accommodates your location-based needs as a mobile user. For example, if you travel to a remote sales office and use a separate hardware profile for that location that does not enable your local area connection, you do not waste time waiting for your network adapter to time out. The adapter does not even try to connect.

If your computer has more than one network adapter, a local area connection icon for each adapter is displayed in the Network Connections folder.

Examples of LAN connections include Ethernet, token ring, cable modems, DSL, FDDI, IP over ATM, IrDA (Infrared), wireless, and ATM-emulated LANs. Emulated LANs are based on virtual adapter drivers such as the LAN Emulation Protocol.

If changes are made to your network, you can modify the settings of an existing local area connection to reflect those changes. The General tab of the Local Area Connection Status dialog box allows you to view connection information such as connection status, duration, speed, signal strength, amounts of data transmitted and received, and any diagnostic tools available for a particular connection. The Support tab contains information on:

  • The address type which indicates how the address was assigned. For example the TCP/IP address is assigned by DHCP.
  • The IP address currently assigned for the session.
  • The IP subnet mask for the IP address currently assigned for the session.
  • The default gateway address of the IP device that allows access to other protocols.
The Support tab also has a Details button that displays detailed information about the properties of the network connection. This includes the addresses of dependent external devices. For information about using the Status menu option, see To view the status of a local area connection.

If you install a new LAN adapter in your computer, the next time you start your computer, a new local area connection icon appears in the Network Connections folder. Plug and Play functionality finds the network adapter and creates a local area connection for it. If you are using a laptop computer, you can add a PC card while the computer is on. Plug and Play will identify the new card without you having to restart your laptop computer. The local area connection icon is immediately added to the folder. You cannot manually add local area connections to the Network Connections folder.

You can configure multiple LAN adapters through the Advanced Settings menu option. You can modify the order of adapters that are used by a connection, and the associated clients, services, and protocols for the adapter. You can modify the provider order in which this connection gains access to information on the network, such as networks and printers.

You configure the device a connection uses, and all of the associated clients, services, and protocols for the connection, through the Properties menu option. Clients define the access of the connection to computers and files on your network. Services provide features such as file and printer sharing. Protocols, such as TCP/IP, define the language your computer uses to communicate with other computers.

Depending on the status of your local area connection, the icon changes appearance in the Network Connections folder, or a separate icon appears in the taskbar. If a LAN adapter is not detected by your computer, a local area connection icon does not appear in the Network Connections folder. For a list of connection icons, see Network connection icons.


Using direct connections

With Network Connections, you can create a physical connection to another computer by using a serial cable, a DirectParallel cable, a modem, infrared devices or other methods. For example, you might want to connect a handheld PC running Windows CE to your network. Or, you may have two or more networks in the same location that are not physically connected. If you want to use resources on both networks from one computer, you can use a serial cable connection with an RS-232C null modem cable. You connect an RS-232C cable from a COM port on the computer to a COM port on your remote access server, which is used to create network access. You can also use an RS-232C null modem as a substitute for a network adapter if your computer is located physically near (less than 50 feet of cable) a remote access server.

The DirectParallel driver supports computer-to-computer connections by using standard and enhanced (ECP) parallel ports, which use Parallel Technologies' Basic or Fast parallel cables. For more information about using a DirectParallel cable for a direct connection, see DirectParallel cable access.

Remote access authentication methods control access to your network, not resources on the network. Having a Windows CE device directly attached to a computer on your network is analogous to having a computer attached to your network, but not logged on. In that instance, you attached and accessed the network without using authentication of any kind.

Once you are present on a network, resource control is managed in various ways: Local Users and Groups, Active Directory, Group Policy, file and printer sharing, and so on.

Therefore, if you have set up a direct network connection using, for example, a Windows CE device, you need to ensure that resource control is in place that enforces access to restricted folders, printers, and so on.

Authentication methods are designed for remote computing, where the computer dialing in does not have access to the network until credentials such as user name and password are exchanged.

For information about creating a direct network connection, see To make a direct network connection.

Note

  • To create or modify a direct network connection, you must be a member of the Administrators group.


Using remote access methods

This section covers:

  • Using phone lines and modems
  • Using ISDN lines
  • Using X.25


Using phone lines and modems

The most common dial-up connection is made by using DSL, a cable modem, or a standard analog telephone line and a modem. Standard analog phone lines are available worldwide and meet most requirements of a mobile user. Standard analog phone lines are also called PSTN (public switched telephone network) or POTS (plain old telephone service).

Hundreds of modems are compatible with XOX and all members of the Windows Server 2003 family. Most modems that comply with industry standards should interoperate. However, many difficult-to-detect problems are the result of incompatible modems. To verify the compatibility of a modem, see the compatibility information at Support resources.

Modems are automatically detected. This is especially useful for users who are not sure what modem is installed (for example, an internal modem). You can use shared modem pools for dial-up connections. Modem data compression and error control are available on most modems. However, built-in software compression offers enhanced performance over modem data compression.

For information about connecting to a network by using a phone line, see To make a dial-up connection by using a phone line.


Using ISDN lines

To enhance connection speeds, you can use an Integrated Services Digital Network (ISDN) line. Whereas standard phone lines typically transmit from 28.8 to 56 kilobits per second (Kbps), typical ISDN devices are capable of 64 or 128 Kbps. This is slower than local area networks supported by high-speed data communications technology, but faster than analog telephone lines. ISDN provides end-to-end digital connectivity between your computer and a remote computer or network by using a local telephone line for network connection.

An ISDN line must be installed by the phone company at your site and at the remote access server. Also, an ISDN adapter must be installed in place of a modem in both your computer and the remote access server. For information about installing an ISDN adapter, see To install an ISDN adapter. Costs for ISDN equipment and lines may be higher than standard modems and phone lines. However, the speed of communication reduces the duration of the connection time, thereby possibly saving toll charges.

An ISDN line comes with two B channels that transmit data at 64 Kbps, and one D channel for signaling that transmits data at 16 Kbps. You can configure each B channel to operate as a port. With this configuration, line speed increases to 128 Kbps. Channel aggregation schemes are specific to each driver, so you must use the same driver and equipment on the client and server.

Multilink dialing over ISDN combines multiple physical links into a logical bundle. This aggregate link increases your bandwidth. To use Multilink, both your connection and the remote access server must have Multilink enabled. For more information about the Multilink feature, see Configuring multiple device dialing.

For information about creating an ISDN network connection, see To make a dial-up connection by using an ISDN line. For information about configuring ISDN network connection settings, see To configure ISDN settings.


Using X.25

An X.25 network transmits data with a packet-switching protocol, bypassing noisy telephone lines. This protocol relies on an elaborate worldwide network of packet-forwarding nodes that can participate in delivering an X.25 packet to its designated address.

Network Connections supports X.25 by using packet assemblers/disassemblers (PADs) and X.25 cards. You can also use a modem and special dial-up X.25 carriers in place of a PAD or X.25 smart card on your computer.

Remote access clients running XOX or a member of the Windows Server 2003 family can either use an X.25 card or dial in to an X.25 PAD to create connections. To accept incoming connections on a computer using X.25 running XOX or a member of the Windows Server 2003 family, you must use an X.25 card.

For information about creating an X.25 connection, see To make a dial-up connection by using X.25.


Using incoming connections

This section covers:

  • Incoming connections
  • Incoming connections and IP addresses
  • Incoming connection clients


Incoming connections

With the Windows Server 2003 family, you can create incoming connections and allow even computers that are members of a domain to run incoming connections.

You can configure an incoming connection to accept the following connection types: dial-up (modem, ISDN, X.25), virtual private network (VPN) (PPTP, L2TP), or direct (serial, infrared, DirectParallel). On a computer running Windows 2000 Professional or XOX, an incoming connection can accept up to three incoming calls, up to one of each of these types. On a computer running Windows 2000 Server, the number of inbound calls is only limited by the computer and its hardware configuration. For information about Windows NT Server (and other operating systems) that can accept an incoming connection, see Incoming connection clients.

You can use the Multilink feature to configure multiple modems or ISDN adapters for use with incoming dial-up connections. For more information on Multilink, see Configuring multiple device dialing.

When you create a connection, the users that can connect to your incoming connection and their network protocols are selected. Each user that connects to an incoming connection must have established a local user account. For more information about user settings such as name, password, and callback rights, see To grant incoming connection access rights to your computer. For more information about configuring your connection for the TCP/IP network protocol, see To configure an incoming connection to use TCP/IP.

For information about creating an incoming connection, see To accept incoming network connections.

Notes

  • For large numbers of incoming connections on a computer that is running Windows 2000 Server or a member of the Windows Server 2003 family and that operates as part of a distributed network or as a domain controller, you can use Routing and Remote Access to create a remote access server.
  • To create an incoming connection, you must be a member of the Administrators group.
  • Users do not need to use incoming connections to allow access to shared resources, such as files and printers, over a local area network. In order to enable shared access to resources on the local computer, you must enable file and print sharing, share the resources, and then set the appropriate permissions. For information about sharing a folder, see To share a folder or drive.
  • The Guest account is disabled by default for both incoming connections and in the Computer Management snap-in. Guests can connect only after you enable the Guest account in the Computer Management snap-in and in the Users tab of the properties dialog box of the connection.


Incoming connections and IP addresses

The incoming connections computer will assign IP addresses to the remote computers that connect to it. These addresses can be allocated in one of two ways:

  • They are automatically allocated by DHCP.
  • They are assigned based on a range of addresses that is defined in the TCP/IP properties for the incoming connection.

If you want to specify a range of IP addresses, you must provide a starting IP address and an ending IP address for the range. Network Connections calculates the number of addresses that can be used within the starting and ending addresses of the range. For more information about specifying the range, and the effects of a subnet on the address range, see To configure an incoming connection to use TCP/IP.

If the incoming connections computer is attached to another network, and the specified address range consists of a subset of IP addresses for the network to which the computer is attached, you must ensure that the addresses in the range are not already assigned to other TCP/IP nodes within the attached network. This is recommended because using a subset of the larger network's addresses requires less manual configuration of the intranet nodes.

If you must use a range of addresses that is not a subset of the network to which the incoming connections computer is attached, then steps must be taken to ensure that computers on the network attached to the incoming connections computer can reach the incoming connection clients. To do this, on each of the computers on the network you can create a route to the incoming client computers with the IP address of the incoming connections computer as the associated gateway.

For more information, see To configure a default gateway.

Note

  • If Internet Connection Sharing (ICS) is already enabled on the dial-up, virtual private network (VPN), or local area connection of an incoming connections computer, you do not need to configure the default gateway setting. ICS automatically makes the ICS host computer the default gateway for all of the computers on the intranet.


Incoming connection clients

The Windows Server 2003 family supports incoming connections from clients running XOX, Windows 2000, and the following operating systems:

  • Windows NT version 4.0 clients

    • Windows NT version 4.0 clients can take full advantage of all incoming connection features except dynamic allocation of multilinked lines, Extensible Authentication Protocol (EAP), IPSec client to server data security, and L2TP for tunneling across intervening networks.

  • Windows NT version 3.1, 3.5, and 3.51 clients

    • Windows NT version 3.5x clients can take full advantage of incoming connection features, except for Multilink functionality. Windows NT 3.5x clients negotiate the logon process and authentication with the incoming connection. You can also configure these clients to use scripts that completely automate the logon process.

    Windows NT version 3.1 clients do not support the implementation of Point-to-Point Protocol (PPP) that was introduced in Windows NT 3.5. Only Windows NT 3.5x or other PPP clients provide the support necessary to run TCP/IP or IPX applications on clients that directly communicate with servers on the LAN by using TCP/IP or IPX.

  • Windows 98 clients

    • Windows 98 clients can take full advantage of incoming connection features, except dynamic allocation of multilinked lines and the Extensible Authentication Protocol. Windows 98 clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Windows 95 clients

    • Windows 95 clients can take full advantage of incoming connection features, except the use of Multilink, dynamic allocation of multilinked lines, and Extensible Authentication Protocol. Windows 95 clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Macintosh clients

    • Macintosh users can connect to a computer running Services for Macintosh and access Macintosh file volumes and AppleTalk printers by using the AppleTalk Control Protocol (ATCP).

  • PPP clients

    • PPP clients that other companies offer and that use TCP/IP can access an incoming connection. The incoming connection automatically negotiates authentication with PPP clients; special configuration for these PPP clients is not required.

    For more information about your PPP client, see the software documentation for your PPP client.

For information about creating and configuring incoming connections, see Set up incoming connections.

Notes

  • XOX
  • IPX cannot be configured for incoming or dial-up connections in the Windows Server 2003 family.


Using Internet connections

With Network Connections, connecting to the Internet is easy. You can use the following components to gain access to the Internet:

  • The TCP/IP protocol that is enabled for your network connection.
  • If you are part of a corporate domain, a user account with remote access permissions.
  • A modem or other connection to an Internet service provider (ISP).
  • An account with an ISP.

This section covers:

  • ISP access methods
  • Internet service providers


ISP access methods

You can create a connection to an Internet service provider (ISP) through a modem and telephone line, a Point-to-Point Protocol over Ethernet (PPPoE) broadband connection, an ISDN adapter and ISDN line, or an X.25 network.

If you are using a modem, you will want the fastest possible speed to reduce downloading time while on the Internet. A modem of 28.8 Kbps or above is recommended. For more information about modems, see Modems.

Your Internet connection dials the ISP and logs you on. The logon sequence varies based on the requirements of the ISP that you are calling. Point-to-Point Protocol (PPP) connections are often entirely automatic. Serial Line Internet Protocol (SLIP) connections may require that you log on using the terminal window, which may or may not permit you to automate the logon process with Switch.inf file scripts. You can set the terminal window to appear during the logon process by selecting Show terminal window on the Security tab of the Dial-up Connection Properties dialog box.

For more information, see:

  • TCP/IP
  • Internet service providers
  • To make an Internet connection

Note

  • Before you create an Internet connection, check with your ISP to verify the required connection settings. A connection to your ISP may require one or more of the following settings:
    • A specific IP address.
    • IP header compression (for PPP).
    • DNS addresses and domain names.
    • Optional settings, such as Internet Protocol security (IPSec).

For information about creating an Internet connection, see To make an Internet connection.


Internet service providers

There are Internet service providers (ISPs) around the world. Similar to other online services or bulletin boards, you dial the service number and log on to the remote system. Once connected, you have access to the Internet and any other services, such as electronic mail, that are provided by the ISP. Fees usually apply for commercial ISPs.

For information about creating an Internet connection, see To make an Internet connection.


Virtual private network (VPN) connections

A virtual private network (VPN) extends the capabilities of a private network to encompass links across shared or public networks such as the Internet. With a VPN, you can send data between two computers across a shared or public network in a manner that emulates a point-to-point link on a private network. Virtual private networking is the act of creating and using a virtual private network.

To emulate a point-to-point link, data is encapsulated, or wrapped, with a header that provides routing information, which allows the data to traverse the shared or public network to reach its endpoint. To emulate a private link, the data is encrypted for confidentiality. Packets that are intercepted on the shared or public network cannot be read without the encryption keys. The link in which the private data is encapsulated and encrypted is a VPN connection.

The following table describes the advantages of using VPN connections. For more information, click an advantage.

Advantage | Example
Cost advantages | The Internet is used as a connection instead of a long-distance telephone number or 1-800 service. Because an Internet service provider (ISP) maintains communications hardware, such as modems and ISDN adapters, to access the Internet, your network requires less hardware to purchase and manage.
Outsourcing dial-up networks | You can make a local call to the telephone company or ISP, which then connects you to a remote access server and your corporate network. The telephone company or ISP manages the modems and telephone lines required for dial-up access. Because the ISP supports complex configurations of communication hardware, a network administrator is free to centrally manage user accounts at the remote access server.
Enhanced security through VPN | The connection over the Internet is encrypted and secure. Authentication and encryption are enforced by the VPN server. Sensitive data is hidden from unauthorized users, but it is accessible to users authorized through the connection.
Network protocol support | You can remotely run any application that depends on the most common network protocols, including TCP/IP and IPX. XOX
IP address security | Because information sent over a VPN is encrypted, the addresses you specify are protected, and the Internet sees only the external IP address. For organizations with private addresses, this advantage is substantial, because no administrative costs are incurred from having to change IP addresses for remote access over the Internet.

You can create a VPN connection by dialing an ISP or by connecting directly to the Internet, as shown in the following examples.

Example 1

In the first example, the VPN user makes a call to an ISP. After a connection is established with the ISP, the ISP server then makes a call to the remote access server that establishes the Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) tunnel. These protocols are automatically installed on your computer. After the VPN connection is made, you can access the corporate network, as shown in the following illustration.

VPN connection by using an ISP

Example 2

In the second example, a user who is already connected to the Internet uses a VPN connection to connect to the VPN server. Examples of this type of user include a person whose computer is connected to a local area network, a cable modem user, or a subscriber of a service such as ADSL, where IP connectivity is established immediately after the user's computer is turned on. The VPN client makes a tunnel through the Internet and connects to the PPTP-enabled or L2TP-enabled VPN server. After the VPN connection is made, the user can access the corporate network, achieving the same functionality as the user in the preceding example.

VPN connection by using an existing Internet connection

For information about creating a VPN connection, see To make a virtual private network (VPN) connection. For information about the ways Active Directory can tighten security measures for VPNs, see VPN administration.

Note

  • Connecting directly to the Internet means direct IP access without going through an ISP. (For example, some hotels allow you to use an Ethernet cable to connect to the Internet.)


Cost advantages

By using virtual private networks (VPNs), mobile professionals and telecommuters can access their corporate local area network (LAN) over the Internet for a fraction of the cost of traditional remote access solutions. Just as it is more cost effective to make use of the phone company's massive switching system, rather than to string up your own telephone lines and invest in your own switch, a connection to the IP address or DNS name of your Point-to-Point Tunneling Protocol (PPTP)-enabled VPN server makes use of the physical base of routers that are available on the Internet, asynchronous transfer mode (ATM) switches, and digital and analog lines, without sacrificing security.

You can use a network adapter to dial in to a virtual private network, as you would dial a modem to connect to a traditional remote server. VPNs offer corporations a release from the cost and maintenance obligations of components such as modem banks and dedicated analog (1-800) phone lines. The modems and their associated infrastructure remain centralized at the Internet service provider's locations, without sacrificing security or the ability to control remote connections. At the same time, the benefits of secure access to private data are ensured by additional VPN-required authenticated access, encryption, and user data compression.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


Outsourcing dial-up networks

The communications hardware that is available for supporting dial-up needs can be complicated and not well-integrated. For a large organization, putting together a remote access server requires modems, serial controllers, and many cables. Furthermore, many solutions do not provide a single integrated way to efficiently support V.34 and ISDN dial-up lines.

Many corporations like to outsource dial-up access to their corporate backbone networks in a manner that is cost-effective, hassle-free, protocol-independent, secure, and that requires no changes to the existing network addressing. Virtual WAN support by using virtual private network (VPN) connections is one way an Internet service provider (ISP) can meet the needs of corporations. In this way, the outsourcing company maintains and manages remote access modems and lines, leaving a system administrator free to manage users and their authentication needs.

This type of solution takes advantage of proven PPP authentication, encryption, and compression technologies. For information about creating a VPN connection, see To make a virtual private network (VPN) connection.

The following illustration shows an example of outsourcing.

Outsourced dial-up network

The connection does not need to have a PPTP driver; the client simply makes a PPP connection to the modem pool or communications server. The communication server or modem pool must implement PPTP for communication with the remote access server.


Enhanced security through VPN

Virtual private network (VPN) connections that are enabled with Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) are authenticated by using Point-to-Point Protocol (PPP) user-level authentication methods. For PPTP connections, you can use only the Microsoft Challenge Authentication Protocol (MS-CHAP), MS-CHAP version 2 (MS-CHAP v2) or Extensible Authentication Protocol-Transport Level Security (EAP-TLS). For L2TP connections, you can use any PPP authentication protocol because the PPP authentication message exchange is encrypted with Internet Protocol Security (IPSec); however, MS-CHAP, MS-CHAP v2, or EAP-TLS is recommended.

For the most secure PPTP VPN connections, do the following:

  • Use EAP-TLS with user certificates or smart cards.
  • Require the use of the strongest possible encryption.
  • Use a remote access policy to define who can make a PPTP connection based on group membership (if you are using the Routing and Remote Access service).
  • Configure PPTP packet filters on your firewall interfaces and VPN server interfaces.

For security reasons, you should use PPTP with either MSCHAPv2 or EAP-TLS with PPTP connections. If using EAP-TLS is not feasible, use MSCHAP v2 for secure connections.

For the most secure L2TP VPN connections, do the following:

  • Use EAP-TLS with user certificates or smart cards.
  • Require the use of the strongest possible encryption.
  • Use a remote access policy to define who can make a L2TP connection based on group membership (if you are using the Routing and Remote Access service).
  • Configure IPSec or L2TP packet filters on your firewall interfaces and VPN server interfaces.

In some environments, data is so sensitive that it needs to be hidden from the majority of corporate users. Finance data or human resources data are examples of this type of data. Corporations can store extremely sensitive data servers on a separate network segment that is connected to the corporate network by a VPN server. Authorized users use a VPN connection to connect to the VPN server, and then they can access the protected resources. All communication across the VPN connection is encrypted in order to ensure data confidentiality. Users who do not have authorization to establish a VPN connection with the VPN server cannot see the hidden server or its resources.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


Network protocol support

Because virtual private networks (VPNs) support the most common network protocols, it is easy for clients on Ethernet and TCP/IP networks to use VPNs. Any network protocol supported by remote access is inherently supported in a VPN. This means that you can remotely run applications that are dependent upon particular network protocols. In turn, this translates to reduced costs in setting up and maintaining VPN connections.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.

Notes

  • XOX
  • IPX cannot be configured for incoming or dial-up connections in the Windows Server 2003 family.
  • IPX cannot be configured on a computer running a member of the Windows Server 2003 family that is being used as a VPN server.


IP address security

If you are using a private IP address range (for example, 10.0.0.0-8, 172.16.0.0-12, 192.168.0.0-16), you can find a path through the Internet by providing valid, public IP addresses for the virtual private network (VPN) client and the VPN server. The original IP packets, those with the private addresses of your source and destination, are encapsulated using Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) during data transfer over non-secure networks. Because the IP packets are also encrypted, the private addresses are protected. Internet users see only the public IP addresses of the VPN client and the VPN server. In this case, and whenever you use private IP addresses, there are no administrative costs associated with changing IP addresses for remote access.

Note

  • It is possible to use a nonregistered IP address range (a range of private IP addresses that overlaps with the valid, public IP addresses that are used on the Internet), but it is not recommended.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


VPN administration

By using access policies in the remote access server infrastructure, your system administrator can configure virtual private network (VPN) user settings that significantly tighten security measures, such as required levels of data and password encryption and authentication. These requirements can be applied to individual users, or to a group (or profile) of similar users. For example, a system administrator can configure remote access dial-in settings to define a group profile such that all users who are assigned to that profile are required to authenticate by using the Extensible Authentication Protocol (EAP) and encrypt their data by using strong (128-bit) data encryption. By assigning a user to the group profile, these security measures are automatically required when anyone in that group profile connects to the remote access server.

You should configure your VPN connection to match the policies that your network administrator established. For information about configuring connections, see To configure a connection to a remote network.


Using home and small office networking features

This section covers:

  • Protecting your home or small office network using Internet Connection Firewall
  • Connecting to the Internet in a home or small office network


Protecting your home or small office network using Internet Connection Firewall

Home and small office networking offers computers that are directly connected to the Internet the added security of firewall protection. Internet Connection Firewall (ICF) checks all communications that cross the connection between your network and the Internet and is selective about which responses from the Internet it allows.

Recommended topologies

You can enable Internet Connection Sharing (ICS) on only one Internet connection on your network, and you should protect this connection by enabling ICF. ICF can check only the communications that cross the Internet connection on which it is enabled. These types of network topologies are safe and the most recommended.

Shared Internet connection protected by ICF
ICS with bridged private connections protected by ICF

Topologies that are not recommended

You should avoid topologies with multiple Internet connections. If you must have multiple direct Internet connections on your network, you should ensure that ICF is enabled on each direct Internet connection in order to protect your network, as shown in the following illustration. However, because ICF works on a per-connection basis, this topology is still not a recommended topology because there is no central point of administration through which you can ensure the continuous protection of all Internet connections.

ICF protected network with two Internet connections

Likewise, providing Internet connectivity to your network by connecting your network hub directly to the Internet causes similar vulnerabilities and is not a recommended topology.

Unprotected network

Enabling ICF on this type of network topology disrupts some network communications and provides protection only for the computer on which it is enabled. The other computers have direct connections to the Internet through the hub and are not protected.

Connection icons

When ICF has been enabled on a network connection, the following network connection icon appears in Network Connections: firewalled connection. To check to see if ICF is enabled, or to enable ICF, see To enable or disable ICF. When ICS is enabled on a network connection, it appears in Network Connections as the shared Internet connection shared Internet connection icon. To check to see if ICS is enabled, or to enable ICS, see To enable ICS.

Recommendations for using ICF

You should enable ICF on every Internet connection. You should not enable ICF on virtual private network (VPN) connections or on network client computers because ICF interferes with some types of network activities such as file and printer sharing. For a similar reason, ICS prohibits you from enabling ICF on the ICS host computer's private connection, the connection that connects the ICS host to the ICS client computers. A firewall on this location would completely obstruct network communications. You should not enable ICF on any connection that does not directly connect to the Internet. ICF is not needed if an Internet connection already has a firewall or proxy server running.

ICF and notification messages

Because ICF inspects all incoming communications, some programs, especially e-mail programs, may behave differently when ICF is enabled. Some e-mail programs periodically poll their e-mail server for new mail, and some e-mail programs wait for notification from their e-mail server. Outlook Express, for example, automatically checks for new e-mail when its timer tells it to do so. When new e-mail is present, Outlook Express prompts the user with a notification about the new e-mail. ICF does not affect the behavior of this program, because the request for new e-mail notification originates from inside the firewall. The firewall makes an entry in a table noting the outbound communication to the mail server. When the mail server returns the response for new e-mail, the firewall finds an associated entry in the table and allows the communication to pass, then the user receives notification that a new e-mail has arrived.

Outlook 2000, however, is connected to a Microsoft Exchange Server that uses a remote procedure call (RPC) to send new e-mail notifications to client computers. Outlook 2000 does not automatically check for new e-mail when it is connected to an Exchange Server. The Exchange Server notifies Outlook 2000 when new e-mail arrives. Because the RPC notification is initiated from the Exchange Server that is outside the firewall, and not by Outlook 2000, which is inside the firewall, ICF cannot find the corresponding entry in the table, and the RPC messages are not allowed to cross from the Internet into the home or small office network. The RPC notification message is dropped. Users can send and receive e-mail but need to manually check the inbox for new e-mail.

Advanced ICF settings

The ICF security logging feature provides a way to create a security log of firewall activity. ICF is capable of logging both traffic that is permitted and traffic that is rejected. For example, incoming echo requests from the Internet, by default, are not allowed by the firewall. If the Internet Control Message Protocol (ICMP) Allow incoming echo request is not enabled, then the inbound request fails, and a log entry that records the failed inbound attempt is generated.

ICMP allows you to modify the behavior of the firewall by enabling various ICMP options, such as Allow incoming echo request, Allow incoming timestamp request, Allow incoming router request and Allow redirect. Brief descriptions of these options are provided on the ICMP tab. For information about ICMP, see Internet Control Message Protocol (ICMP).

If ICF is enabled on two or more connections on a single computer, the settings for the ICMP options are per connection. If you make a setting or change a setting in the ICMP options on any connection on which ICF is enabled, that setting is not applied to the other ICF firewalls on that computer. For more information, see To enable or disable Internet Control Message Protocol requests for ICF.

You can set the allowable size of the ICF security log to prevent the potential overflow that could be caused by denial-of-service attacks. Event logging is generated in the Extended Log File Format as established by the World Wide Web Consortium (W3C). For more information about ICF security logging, see Internet Connection Firewall security log.

If ICF is enabled on two or more connections on a single computer, the ICF settings are global. If you select a setting or change a setting in Logging Options or Services on any one of the connections on which ICF is enabled, that setting is applied to all of the ICF firewalls on that computer. For more information, see Internet Connection Firewall security log.

Note

  • XOX


Connecting to the Internet in a home or small office network

With the Internet Connection Sharing (ICS) feature of Network Connections, you can connect your home or small office network to the Internet. For example, you might have a home network that connects to the Internet by using a dial-up connection. By enabling ICS on the computer that uses the dial-up connection, you provide network address translation (NAT), addressing (DHCP Allocator), and name resolution (DNS Proxy) services for all of the computers on your network.

When ICS has been enabled on a network connection, the following network connection icon appears in Network Connections: shared Internet connection. For more information, see To enable ICS, Internet Connection Sharing and network address translation, and Incoming connections.

After ICS is enabled, and users verify that they are all joined to the same networking workgroup as the ICS host, home or small office network users can use programs such as Internet Explorer and Outlook Express as if they were directly connected to the Internet service provider (ISP). The ICS host computer connects to the ISP and creates the connection so that the user can reach the specified Web address or resource.

ICS is intended for use in a home or small office where network configuration and the Internet connection are managed by the computer where the shared connection resides. It is assumed that this computer is the only Internet connection on the network, the only gateway to the Internet, and that ICS sets up all internal network addresses.

You might need to configure services on the ICS host computer to work properly across the Internet. The Web services that you provide must be configured so that Internet users can access them. For example, if you are hosting a Web server on your home network, and you want Internet users to be able to connect to it, you must configure the ICS host computer to permit traffic from the Web on to your network. For information, see To manage service definitions for ICF or ICS.

ICS requires two connections in order to work: one public and one private. The private connection, typically a LAN adapter, connects the ICS host computer to the computers on your home or small office network. The public connection, typically a DSL, cable, or dial-up modem, connects your network to the Internet.

Enable ICS on the public connection of your home or small office network, and before doing so, ensure that the network connection that ICS will use as the private connection connects only to your home or small office network. If you have only one connection to your network, that connection is automatically selected as the private side of your shared Internet connection when you enable ICS. If you have two or more connections to your network, you must do one of the following in order to enable ICS:

  • Select one connection to be the private side of your shared Internet connection. For information about how to select the private connection, see To enable ICS.
  • Set up Network Bridge to include all of the private connections to your network, so that Network Bridge serves as the private side of your shared Internet connection. If you set up Network Bridge to include all of the connections to your network, Network Bridge is automatically selected as your private connection when you enable ICS. If you do not set up Network Bridge to include all of the connections to your network, you can still select Network Bridge as your private connection.
    ICS with bridged private connections protected by ICF
    When Network Bridge has been enabled on a network connection, the following network connection icon appears in Network Connections: Bridged network connections icon. For information about how to select the private connection, see To enable ICS. For more information about how to bridge connections, see To set up Network Bridge.

Adding ICS client computers to a home or small office network

When ICS is enabled on the Internet connection of a computer running XOX; XOX; or XOX, you can add a client running Windows 98; Windows 98 Second Edition; Windows Millennium Edition; XOX; XOX; or XOX to your home or small office network in the following ways:

  • Add a computer running XOX or XOX to your home or small office network by adding it to the home or small office network workgroup. For more information, see To join a workgroup.
  • Add a computer running XOX to your home or small office network by running the XOX Network Setup Wizard on it.
  • Add a computer running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition to your home or small office network by running a XOX or XOX installation CD on it, and then running the setup program Netsetup.exe. For more information, see To configure client computers for ICS.
You can also add a computer running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition to your home or small office network if you have a XOX installation CD. Run Network Setup Wizard on the computer running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition. The wizard provides an opportunity to create a setup disk that can be run on computers running Windows 98, Windows 98 Second Edition,or Windows Millennium Edition.

Network Setup Wizard cannot be run on computers running Windows 2000. You can provide ICS addressing and name resolution services to a computer running Windows 2000 by adding it to your home and small office network workgroup.

Notes

  • When you enable ICS, the adapter connected to the home or small office network is given a new static IP address configuration. Consequently, when you enable ICS, TCP/IP connections that are established between any small office or home office computer and the ICS host computer are lost and need to be reestablished.
  • If your home or small office users need to access a corporate network that is connected to the Internet by a tunnel server from a home or small office network on which ICS is enabled, they need to create a virtual private network (VPN) connection to tunnel from the computer on the home or small office network on which ICS is enabled to the corporate tunnel server on the Internet. The VPN connection is authenticated and secure, and creating the tunneled connection allocates proper IP addresses, DNS server addresses, and WINS server addresses for the corporate network. For more information about creating a VPN connection, see To make a virtual private network (VPN) connection.

Items configured by ICS

When you enable ICS, certain protocols, services, interfaces, and routes are configured automatically. One important configuration is that the ICS host computer automatically becomes a Dynamic Host Configuration Protocol (DHCP) allocator for the home or small office network. DHCP distributes IP addresses to users when they start up.

Caution

  • If you enable ICS on any of your private network adapters, the home or small office network DHCP allocator might grant IP addresses to users outside of your network, causing problems on their networks. Additionally, if you enable ICS on a private network adapter on a computer that is directly attached to the Internet, you might expose your network to computers outside your network, potentially allowing external attacks.
  • Transmissions may be disrupted if you enable ICS on an existing network with other domain controllers running XOX, DNS servers, gateways, DHCP servers, or systems configured for static IP addresses. If you are running XOX and one or more of these components exist, you must use NAT to achieve the same results and to protect your network against data loss. For more information, see Deploying network address translation.

The following table describes each of the protocols, services, interfaces, and routes are configured automatically when you enable ICS.

Configured item | Action
IP address 192.168.0.1 | Configured with a subnet mask of 255.255.255.0 on the LAN adapter that is connected to the home or small office network
Autodial feature | Enabled
Static default IP route | Created when the dial-up connection is established
ICS service | Started
DHCP allocator | Enabled with the default range of 192.168.0.0 and a subnet mask of 255.255.255.0. Unique addresses in the range of 192.168.0.2 to 192.168.0.254 are allocated to private network clients
DNS proxy | Enabled

Notes

  • You cannot modify the default configuration of ICS. This means you cannot configure items such as disabling the DHCP allocator or modifying the range of private IP addresses that are distributed, disabling the DNS proxy, configuring a range of public IP addresses, or configuring inbound mappings. If you want to modify any of these items, you must use NAT.
  • For information about how to enable ICS, see To enable ICS.
  • XOX


Administering Network Connections

This section covers:

  • Managing network connections from the command line
  • Logging remote access connections
  • Configuring network and dial-up connections


Managing network connections from the command line

You can display or change settings for the Server service or the Workstation service while the service is running with Net config. Net config allows you to display the configurable services that are running, or to display and change settings for a service. Additional Net services commands are available.

Netsh overview allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. Netsh can also save a configuration script in a text file for archival purposes or to help you configure other servers.

For information about other command-line utilities, see Command-line reference A-Z. For more information about manageability, see Management strategies and tools.


Logging remote access connections

You can enable logging to automatically record configuration and activity details of remote access connections. If you enable logging, you can review connection errors and pertinent connection information in a log file. This option is especially helpful when you need to determine why a remote access connection failed. If a connection fails, you can generate a diagnostic report based on the log file and send the report to a support engineer.

If you enable logging, you can view a diagnostic report, save the report to a file, or send the report to an e-mail address that you specify. You can also clear previous logs so that the report contains details of the most recent connection only. If you do not need detailed connection information but want to run the report more quickly, you can generate a summary report that contains configuration and installation information only. You can use this information to troubleshoot configurations.

If you do not enable logging and a connection fails, you are prompted to enable logging. After you enable logging, you can dial the remote access connection again to log errors for the failed connection.

For more information, see To enable logging.


Configuring network and dial-up connections

This section covers:

  • Configuring a network or dial-up connection
  • Optional networking components
  • Client for Microsoft Networks
  • File and Printer Sharing for Microsoft Networks
  • Mobile users and certificates
  • Configuring dial-up connections
  • Using Terminal and scripting
  • Configuring authentication and data encryption
  • Automating a network or dial-up connection


Configuring a network or dial-up connection

You can change a network or dial-up connection by modifying its settings. Dial-up settings, such as the phone number of the connection, the number of redial attempts, and so on, are defined for each connection. These pre-connection and post-connection settings do not modify or affect the settings of other connections. For example, you may have a dial-up connection that makes 10 attempts to redial a server that is frequently busy. You may have a second dial-up connection that makes 3 attempts to redial another server that is more readily available. The redial setting of the first connection never causes the second connection to redial more than its own established attempts of 3. There is no need to make changes to any settings outside of the settings of the dial-up connection.

Changes to some networking settings of a connection can affect other connections. For example, if you add the IPX protocol to the list of available network components for one connection, the IPX protocol also is available to other connections on the same computer.

You can modify connection settings when you are connected. You can also rename a connection when it is connected. However, the connection may need to be reconnected in order to save the changes. In a dial-up connection, modifying settings displays the message Since this connection is currently active, some settings will not take affect until the next time you dial it. In a local area connection, changed settings are stored automatically.

Each connection is configured with general settings that represent the basic information needed to connect successfully. These options are found on the General tab. For example, a local area connection only needs to list its network adapter. For a dial-up connection, the General tab includes required information, such as the device used to dial, the area code, the phone number, and the country/region code to dial.

For outgoing connections, you can set additional configuration options on the Options, Security, Networking, and Advanced tabs. You can set additional configuration options for an incoming connection on the Users and Networking tabs. Local area connections have additional configuration options in the Authentication and Advanced tabs.

You can configure advanced settings from Advanced Settings on the Advanced menu of the Network Connections folder. By modifying these settings, you can improve performance. For example, network providers and protocols are accessed in the order specified in Advanced Settings. If your LAN connection is enabled to access NetWare and Microsoft Windows networks that use TCP/IP and IPX, but your primary connection is to a Microsoft Windows network that uses TCP/IP, you can move Microsoft Windows Network to the top of the Network Providers list on the Provider Order tab, and move Internet Protocol (TCP/IP) to the top of the File and Printer Sharing for Microsoft Networks binding on the Adapters and Bindings tab. By changing your provider order, and by changing the order of protocols bound to those providers, you can improve performance. For more information about modifying the order of network providers, see To modify the network provider order. For more information about modifying the protocol binding order, see To modify the protocol bindings order.

XOX

For more information about configuring connections, see To configure a connection to a remote network.


Optional networking components

You can add or remove optional networking components. Optional networking components support network operations and are not automatically installed. Some of these components include the Route Listening Service, Simple TCP/IP Services, SNMP Services, and Print Services for UNIX.

For information about installing optional networking components, see To add optional networking components.


Client for Microsoft Networks

The Client for Microsoft Networks component allows a computer to access resources on a Microsoft network.

This component is installed and enabled by default for all VPN connections. However, this component needs to be enabled for PPPoE connections. You should not need to configure the component unless you are running software from The Open Group, such as Distributed Computing Environment (DCE) server or client kits. If you are, contact your system administrator for the correct DCE Cell Directory Service network address.

The Client for Microsoft Networks component is the equivalent of the Workstation service in Windows NT 4.0.

For information about configuring the Client for Microsoft Networks component, see To configure Client for Microsoft Networks.


File and Printer Sharing for Microsoft Networks

The File and Printer Sharing for Microsoft Networks component allows other computers on a network to access resources on your computer by using a Microsoft network.

This component is installed and enabled by default for all VPN connections. However, this component needs to be enabled for PPPoE and dial-up connections. It is enabled per connection and is necessary to share local folders.

The File and Printer Sharing for Microsoft Networks component is the equivalent of the Server service in Windows NT 4.0.

For information about configuring the File and Printer Sharing for Microsoft Networks component, see To configure File and Printer Sharing for Microsoft Networks. For information about sharing folders, see To share a folder or drive.

Note

  • XOX


Mobile users and certificates

If you are a mobile user, you need to enable the use of certificates on your computer. Unless your system administrator preconfigures your computer with machine and user certificates before you receive it, you must connect to your corporate network by using conventional, password-based authentication methods to get your machine and user certificates. At the time you connect, you join your computer to the corporate domain, obtain certificates, and set certificates policy. The next time you connect to the corporate network, you can use certificate-based authentication methods such as EAP.

To enable the use of certificates on a computer, do the following:

  • Connect to the corporate network by using a dial-up or PPTP network connection, and authentication protocols such as MS-CHAP, or MS-CHAP v2. When you connect, your computer name joins the corporate domain and receives machine certificates.
  • Request a user certificate. For more information about requesting certificates, see To request a certificate, To submit a user certificate request via the Web, and Requesting certificates.
  • Create another connection that uses certificate-based authentication, and then connect again by using certificate-based authentication methods such as EAP or IPSec. For more information about enabling a connection to use a smart card or other certificate, see To enable smart card or other certificate authentication.

You can avoid these steps by having your system administrator load machine and user certificates before you take your laptop out onto the road.

Note

  • For machine certificates to be received automatically, you must implement public key policies (by using Group Policy) that autoenroll computers to receive certificates. If the machine certificate process is not automated, you must log on to your computer with administrative credentials, install Certificate Services, and request a computer certificate. For more information, see To manage certificates for a computer and To manage certificates for your user account.


Configuring dial-up connections

This section covers:

  • Configuring dial-up options
  • Configuring redial options
  • Configuring multiple device dialing


Configuring dial-up options

There are many dialing features that you can use to streamline the dial-up connection process. For instructions about configuring a dialing feature, click the feature in the following table.

Dialing feature | Function
To configure client callback options | Reduces phone charges by having the remote access server dial back to your location after you initially connect.
To configure autodial | Remembers network addresses to connection destinations, which allows them to be automatically dialed when referenced from an application or from the command prompt.
To enable multiple device dialing | Combines multiple physical links, which increases the aggregate bandwidth of your connection, and dynamically dials and drops multilinked lines as needed.
To configure phone number modifiers | Manually inserts characters to force dialing behaviors (pause, suspend dialing until input provided, and so on).
To configure redial options | Specifies the number of times your connection automatically redials when you fail to connect to your remote access server. You can also set this feature to reconnect automatically when an inactive link is dropped.
To assign multiple phone numbers to a connection | Assigns more than one destination phone number to your dial-up connection. This is useful if you have a pool of phone numbers to connect to.
To enable operator-assisted calls or manual dialing | Overrides automatic dial-up situations where intervention is required. For example, when you call through a manually operated switchboard.

Note

  • You can configure dial-up options that apply to all connections within a location (for example, dialing 9 for an outside line, disabling call waiting, using pulse dialing instead of tone dialing, and so on) in Phone and Modem Options. For more information, see To create a new location .


Configuring redial options

With redial options, you can determine the number of times your connection automatically redials when you fail to connect to a remote access server. You can also reconnect automatically when a link is dropped.

By default, a dial-up connection is set up to redial 3 times (at 1 minute intervals) if it cannot reach its remote access server. Also, by default the Idle time before hanging up is set to Never.

For information about configuring redial options, see To configure redial options.


Configuring multiple device dialing

The Multilink Control Protocol allows dialing over multiple ISDN, X.25, or modem lines. The feature combines multiple physical links into a logical bundle and the resulting aggregate link increases your connection bandwidth. To dial multiple devices, both your connection and your remote access server must have Multilink enabled.

Network Connections can dynamically control the use of multilinked lines. By allocating lines only as they are required, thereby eliminating excess bandwidth, you can realize a significant efficiency advantage. You can configure the conditions under which extra lines are dialed, and underused lines are disconnected, through Network Connections settings.

For more information, see To configure multiple device dialing.

Note

  • If you use Multilink to dial a server that requires callback, then only one of your multilinked devices is called back. This is because you can only store one number in a user account. Therefore, only one device connects and all other devices fail to complete the connection, and your connection loses Multilink functionality.
    • You can avoid this problem:
    • If the multilinked phonebook entry uses a standard modem configuration, and the remote access server that your connection is calling uses more than one line for the same number.
    • If the multilinked phonebook entry is ISDN with two channels that have the same phone number.


Using Terminal and scripting

If you are connecting to a remote access server that is not running Windows, you may need to provide logon information in a separate logon Terminal window. Your connection must be configured to accommodate this requirement.

You can use one of two possible scripting methods to automate the remote Terminal logon process: Switch.inf scripts or Windows scripting. Switch.inf is an older scripting method that was developed for earlier versions of Windows NT. You may find the Windows 95 scripting language easier to use than Switch.inf.

This section covers:

  • Using the Terminal feature for the remote logon process
  • Automating the dial-up logon process by using Switch.inf scripts

For information on automating the dial-up logon process by using Windows scripting, see "Using Windows Scripting with Network Connections" at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)


Using the Terminal feature for the remote logon process

For a PPP or SLIP server, if the remote computer you connect to requires that you log on with a terminal-emulation screen, you must configure the script settings for that network connection to use a Terminal logon window. With this logon process, after your connection connects to the remote system, a character-based window displays the logon sequence from the remote computer. You can use this window for logging on to the remote computer. For more information, see To use the Terminal feature to log on to a remote computer. Alternatively, you can automate this manual logon process as described in Automating the dial-up logon process by using Switch.inf scripts.

Some commercial networks present a large menu of available services before you log on. On SLIP servers, typically running on UNIX, you may go through an extensive sequence of commands that updates files, collects data about you, or configures your SLIP connection during your logon process. On a newer PPP server, you may be prompted for only your user name and password before you are given a connection.

Note

  • If the remote computer is a remote access server running Windows, you do not need to use a Terminal logon window. Instead, the logon process is completely automated for you.


Automating the dial-up logon process by using Switch.inf scripts

To automate the logon process, you can use the Switch.inf file (or Pad.inf on X.25 networks) instead of the manual Terminal window described in Using the Terminal feature for the remote logon process.

Automated scripts are especially useful when a constant connection to a remote computer is needed. If your network connection is configured to use a script, and a remote connection fails, your connection automatically redials the number and reestablishes the connection. Scripts also save time if you frequently log on to a remote system and do not want to manually log on each time.

The Switch.inf file provides a generic script that you can use with little or no modification. You can try Switch.inf without modification and if it does not work, then copy and modify the generic script to match the logon sequence of the remote computer to which you want to connect.

The script language is also designed to communicate with other devices, including modems. If you are unfamiliar with modem scripts, scripting can be difficult to understand. You may find it easier to copy, then modify, one of the generic sample scripts.

This section covers:
  • Using device command (.inf) files
  • Creating Switch.inf scripts for network and dial-up connections
  • Stepping through an example Switch.inf script
  • Getting through two-second gaps and large blocks of text in Switch.inf
  • Using commands and carriage returns in Switch.inf
  • Troubleshooting logon scripts


Using device command (.inf) files

Network Connections uses the Switch.inf and Pad.inf files to automate the interactive logon process with servers and to initialize X.25 packet assemblers/disassemblers (PADs). These device command (.inf) files, located in the systemroot\System32\Ras folder, use the same commands and syntax to communicate with devices or computers automatically.

Switch.inf

You can use the commands in this file when you connect to the network through a security host or a remote server that requires you to log on interactively (for example, a UNIX server). You can create a script by typing the name of the device in brackets and then adding one or more commands following the device name. After you create the script, activate the script (on the Security tab) for each connection that will use the script. You can use the scripts before you dial (for example, modem pools) or after you dial (for example, using security hosts or actually logging on to a remote server). For more information, see Automating the dial-up logon process by using Switch.inf scripts.

Pad.inf

You can use the commands in this file when you connect to the network through an X.25 PAD. Most supported PADs have scripts that are provided in Pad.inf. If necessary, you can create a script by typing the name of the device within brackets and then adding one or more commands following the device name. After you create the script, activate the script (on the Security tab) for each connection that will use the script.

Caution

  • You should not edit Switch.inf or Pad.inf without a basic understanding of system configuration files.


Creating Switch.inf scripts for network and dial-up connections

The Switch.inf file, located in the systemroot\System32\Ras folder, is like a set of small batch files (scripts) contained in one file. The Switch.inf file contains a different script for each intermediary device or online service that a connection calls.

A Switch.inf script has six elements:

  • Section headers
  • Comment lines
  • Commands
  • Responses
  • Response keywords
  • Macros


Section headers

Section headers divide the Switch.inf file into individual scripts. A section header marks the beginning of a script for a particular remote computer and must not exceed 31 characters. The text of a section header appears in Network Connections when you activate the script. The section header is enclosed in square brackets. For example:

[Route 66 Logon Process]

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Comment lines

Comment lines must have a semicolon (;) in column one and can appear anywhere in the file. Comment lines contain information for people who maintain the Switch.inf file. For example:

; This script was created by Martha on September 29, 1996.

For more information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Commands

Each line in a script is a command from your local computer to a remote computer or a response from a remote computer to your local computer. Each command or response is a stream of data or text. For example, the following command sends a user name (Martha) and a carriage return (the macro <cr>) to the remote computer:

COMMAND=Martha<cr>

The commands and responses must be in the exact order the remote computer expects them. Branching statements, such as GOTO or IF, are not supported.

The required sequence of commands and responses for a specific remote device should be in the documentation for that device or, if you are connecting to a commercial service, from the support staff of that service. If the exact sequence is not available, you can activate the generic script provided with Network Connections and modify it to match the logon sequence of the remote computer as described in Troubleshooting logon scripts.

You can use the COMMAND= statement in two additional ways:

  • COMMAND= NoResponse

    This is the default behavior and causes an approximate two-second delay. This is useful when an intermediate device requires a delay.

  • COMMAND= string

    In this case, string is not followed by a carriage return (<cr>). This is useful when a device requires slow input. Instead of receiving the whole command string, the device requires characters to be sent one-by-one.

The following example shows a script for an intermediary device that is so slow, it is able to receive and process only one character of the command PPP at a time:

COMMAND=P
NoResponse

COMMAND=P
NoResponse

COMMAND=P
NoResponse

Note

  • To activate a script.inf file, see To activate a logon script.


Responses

A response is sent from the remote device or computer. To write an automatic script, you must know the responses you will receive from the remote device. If a gap of two or more seconds occurs between characters, the received text is sent as a response. This gap is the only cue that a response is over. For more information, see Getting through two-second gaps and large blocks of text.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Response keywords

The keyword in a response line specifies what to do with the responses you receive from the remote computer, as follows:

  • OK=remote computer response<macro>

    The script continues to the next line if the response or macro is encountered.

  • LOOP=remote computer response<macro>

    The script returns to the previous line if the response or macro is encountered.

  • CONNECT=remote computer response<macro>

    Used at the end of a successful modem script. Not generally useful with the Switch.inf file.

  • ERROR=remote computer response<macro>

    Causes Network Connections to display a generic error message if the response is encountered. Useful for notifying you when the remote computer reports a specific error.

  • ERROR_DIAGNOSTICS=remote computer response<diagnostics>

    Causes Network Connections to display the specific cause for an error returned by the device. Not all devices report specific errors. Use ERROR= if your device does not return specific errors that can be identified with Network Connections diagnostics.

  • NoResponse

    Used when no response comes from the remote device.

A connection always expects a response from the remote device and waits until a response is received unless a NoResponse statement follows the COMMAND= line. If there is no statement for a response following a COMMAND= line, the COMMAND= line executes and stops the script at that point.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Macros

Macros are enclosed in angle brackets (<>) and perform a variety of special functions, as follows:

  • <cr>

    Inserts a carriage return.

  • <lf>

    Inserts a line feed.

  • <match> "string"

    Reports a match if the string enclosed in quotation marks is found in the device response. Each character in the string is matched according to upper and lower case. For example, <match> "Smith" matches Denise Smith and Jeff Smith, but not SMITH.

  • <?>

    Inserts a wildcard character, for example, CO<?><?>2 matches COOL2 or COAT2, but not COOL3.

  • <hXX>

    (XX are hexadecimal digits)

    Allows any hexadecimal character to appear in a string—including the zero byte, <h00>.

  • <ignore>

    Ignores the rest of a response from the macro on.

  • <diagnostics>

    Passes specific error information from a device to remote access, which displays the specific error to you. Otherwise, a nonspecific error message appears.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Stepping through an example Switch.inf script

This section describes each part of the generic script provided in the Switch.inf file.

Every script must start with a command to the remote computer, followed by one or more response lines. This initial command might be simply to wait for the remote computer to initialize and send its logon banner. The default initial command is to wait two seconds for the logon banner. It appears as follows in the Switch.inf file:

COMMAND=

If the response (the logon banner from the remote computer) is the following:

Welcome to A. Datum Corporation. Please enter your login:

then the corresponding response line in the Switch.inf file should be:

OK=<match>"Please enter your login:"

If the remote computer sends the "Please enter your login:" string, then this indicates that everything is correct. You respond by sending a command with the characters in your user name and the carriage return, as follows:

COMMAND=Martha<cr>

If the response from the remote computer is the following:

Please enter your password:

then the corresponding response line in the Switch.inf file should be:

OK=<match>"Please enter your password:"

To send your password, you send the following command:

COMMAND=mUs3naB<cr>

On many PPP computers, this script automatically logs you on.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Getting through two-second gaps and large blocks of text in Switch.inf

If the computer you are connecting to has a two-second gap in the data stream response to your computer, the remote access server assumes that the gap is the end of the response. These gaps can occur anywhere, even between words, and are detected by using modem diagnostics. For more information, see To log and view modem commands.

If you write a script that fails for no apparent reason, you can use modem diagnostics, and then consult systemroot\ModemLog_model.txt to see if a response ends in the middle of a word. Model is the name of the modem as it appears in the list of installed modems in Modem Properties. If a response ends in the middle of a word, your script must account for the two-second gap. A simple way to do this is to include the following command:

COMMAND=<cr>

You can skip to the end of large blocks of text that contain multiple gaps by using the LOOP= keyword and by matching text at the end of a block. For example:

COMMAND=<cr>

OK=<match>"Enter the service to start:"

LOOP=<ignore>

In this example, the network connection sends a null command (waits two seconds). The network connection then waits for the "Enter the service to start:" message. If this is a long block of text, the connection does not find the string. The connection then moves to the LOOP command. The LOOP command causes Network Connections to return to the line above, and the connection waits for the words "Enter the service to start:" in the second response. In this manner, you can loop though long blocks of text until you reach the text of the desired prompt.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Using commands and carriage returns in Switch.inf

In Switch.inf scripts, you usually must include <cr>, which indicates a carriage return, at the end of a command. The carriage return causes the remote computer to process the command immediately. If you do not include <cr>, the remote computer may not recognize the command.

In other situations, you cannot use <cr> because the remote computer accepts a command without a carriage return and requires time to process the command. This situation mainly applies when you are sending a series of commands without expecting a response.

For more information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the dial-up logon process by using Switch.inf scripts.


Troubleshooting logon scripts

You can log all information passed between your network connection, the modem, and the remote device, including errors reported by the remote device.

You can view modem commands by enabling logging. After you enable logging, commands sent to the modem are captured in the file systemroot\ModemLog_model.txt. Model is the name of the modem as it appears in the list of installed modems. For instructions about logging modem commands, see To log and view modem commands.


Configuring authentication and data encryption

This section covers:

  • Dial-up connection authentication and data encryption
  • VPN connection authentication and data encryption


Dial-up connection authentication and data encryption

The Typical (recommended settings) security options that you select on the Security tab result in a predefined set of authentication methods and encryption requirements that are negotiated with the server during a PPP exchange.

The following table shows the authentication and data encryption methods that you can use with each combination of Validate my identity as follows and Require data encryption (disconnect if none) selections. You can also view these settings by making your identity validation and data encryption requirement selections in Typical (recommended) settings, and then clicking Settings in Advanced (custom) settings.

You may individually enable, configure, and disable these combinations of security settings by using Advanced (custom settings), but this requires a knowledge of security protocols.

For more information about a specific authentication or data encryption method, click the method in the table. For information about configuring a connection, see To configure a connection to a remote network.

Validate my identity as follows | Require data encryption | Authentication methods negotiated | Encryption enforcement
Allow unsecured password | No | PAP, CHAP, SPAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP-TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP-TLS | Require encryption (disconnect if server declines)

Notes

  • Data is only encrypted if MS-CHAP, MS-CHAP v2, or EAP-TLS authentication is negotiated. These are the only authentication protocols that generate their own initial encryption keys, which are required for encryption.
  • Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPP-based dial-up connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported.
  • MS-CHAP v2 and EAP are mutual authentication protocols, which means that both the client and the server prove their identities. If your connection is configured to use either MS-CHAP v2 or EAP as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authentication and simply accept the call. This change ensures that you can configure a connection to connect to the expected server.


VPN connection authentication and data encryption

The Typical (recommended settings) security options that you select on the Security tab result in a predefined set of authentication methods and encryption requirements that are negotiated with the server during a PPP exchange.

The following tables show the authentication and data encryption methods that you can use with each combination of Validate my identity as follows and Require data encryption (disconnect if none) selections. You can also view these settings by making your identity validation and data encryption requirement selections in Typical (recommended settings), and then clicking Settings in Advanced (custom settings).

You may individually enable, configure, and disable these combinations of security settings, by using Advanced (details for all possible settings), but this requires a knowledge of security protocols.

For more information about a specific authentication or data encryption method, click the method in the table. For information about configuring a connection, see To configure a connection to a remote network.

Point-to-Point Tunneling Protocol (PPTP) remote access server

Validate my identity as follows | Require data encryption | Authentication methods negotiated | Encryption enforcement
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP-TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP-TLS | Require encryption (disconnect if server declines)

Layer Two Tunneling Protocol (L2TP) remote access server

Validate my identity as follows | Require data encryption | Authentication methods negotiated | Encryption enforcement
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | CHAP, MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP-TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP-TLS | Require encryption (disconnect if server declines)

Notes

  • In L2TP VPN connections, data is encrypted by using Internet Protocol security (IPSec).
  • Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPTP VPN connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported.
  • Data is only encrypted by MPPE if MS-CHAP, MS-CHAP v2, or EAP-TLS authentication is negotiated. These are the only authentication protocols that generate their own initial encryption keys. MPPE requires common client and server keys as generated by these types of authentication.
  • MS-CHAP v2 and EAP-TLS are mutual authentication protocols, which means that both the client and the server prove their identities. If your connection is configured to use either MS-CHAP v2 or EAP-TLS as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authenticating themselves to clients and simply accept the call. This change ensures that you can configure a connection to connect to the expected server.


Automating a network or dial-up connection

You can automate the connection process for a network or dial-up connection by using the autodial feature. With autodial enabled, network addresses are mapped to connection destinations, which allows a destination connection to be automatically dialed when a remote resource is referenced.

You can also automate the connection process for any Microsoft client by using a simple batch file and the rasdial command or by using a custom application that recognizes remote access.

This section covers:

  • Autodial
  • Using rasdial


Autodial

Autodial maps and maintains network addresses to connection destinations, which allows the destinations to be automatically dialed when referenced, whether from an application or from the command prompt. A network address can be an Internet host name, an IP address, or a NetBIOS server name. When a more specific mapping is not available in the database, autodial dials the default Internet connection.

The following example describes how autodial works:

  1. You are not connected to your ISP, and you click an Internet address that is embedded in a word processing document.
  2. If you have a connection that is set as the default Internet connection, autodial dials this connection, and then you can access the Internet address that you are trying to reach.
  3. If you do not have a connection that is set as the default Internet connection, you are prompted to select a connection to use to reach your ISP. Autodial dials with this connection, and then you can access the Internet address that you are trying to reach.
  4. The next time that you are not connected to your ISP and click the Internet address in a word processing document, a similar process occurs. If you selected a specific connection, that connection is automatically dialed. Otherwise, the default connection is dialed.

Autodial maps the resources that are required to initially make a connection but does not map resources once the connection is made.

There are two possibilities when autodial attempts to make a connection:

  • If you are not connected to a network, autodial attempts to create a connection whenever an application references a remote address.

  • If you are connected to a network, autodial attempts to create a connection only for those addresses that it has previously learned. Incorrectly typed server or Internet host names do not cause an autodial attempt.

For more information, see To configure autodial.

Note

  • Autodial is disabled by default in all members of the Windows Server 2003 family. To enable autodial, the Remote Access Auto Connection Manager service needs to be started. For more information, see To start Remote Access Auto Connection Manager.


Using rasdial

You can create a simple batch file that connects to a dial-up network connection by using the rasdial command. You can also use rasdial to connect to or disconnect from a network connection from a command line. Unlike autodial, the rasdial command does not automatically detect your network connection status before dialing a connection and is not dependent on the Remote Access Auto Connection Manager service.

For example, you might want to automatically connect to a dial-up connection during off-peak hours in order to transfer large data files. You can create a batch file or a series of batch files to automate this process. You would use the rasdial command to start and end the dial-up connection. There are additional configurable parameters that are associated with Rasdial, such as what phone number to use, the callback number, the phone book file, prefix and suffix.

For more information about using the rasdial command, see Rasdial. For more information about batch files, see Using batch files.


Troubleshooting

This section covers:

  • Troubleshooting network and dial-up connections
  • Error messages


Troubleshooting network and dial-up connections

What problem are you having?

The modem does not work.

Cause: The modem is incompatible.

Solution: If you have access to another computer with an Internet connection, check the list of compatible modems at Support resources.

Cause: The modem is not connected properly or is turned off.

Solution: Verify that the modem is connected properly to the correct port on your computer. If the modem is external, verify that the power is on.

See Also: Troubleshooting.

Unable to connect to a remote access server.

Cause: The remote access server is not running.

Solution: Ask your system administrator to verify that the remote access server is running. If the server is down, the administrator needs to check the error and audit logs to see why the service stopped. After the problem is fixed, restart the service. If the service is running, the administrator needs to check whether other remote access clients can connect properly. If other clients can connect, the problem may be specific to your workstation.

Cause: You do not have a valid user account, or you do not have remote access permission.

Solution: Verify with your system administrator that your user account has been created, and that you have remote access permission.

Cause: You dialed the wrong number, or you dialed the correct number but forgot to dial an external line-access number, such as 9.

Solution: Verify that the dialed number is correct.

Cause: Your modem cannot negotiate with the modem of the server.

Solution: Try using the same type of modem as the server.

Cause: The modem cabling is faulty.

Solution: Do not use the 9-to-25-pin converters that are included with most mouse hardware because some of them do not carry modem signals. To be safe, you should use a converter made especially for this purpose.

Cause: The telephone line (for example, in your hotel room) does not accommodate your modem speed.

Solution: Select a lower bits-per-second (bps) rate (or call the hotel manager to request a direct line).

See also: To change the maximum modem port speed.

Cause: The line you are trying to use is digital.

Solution: Most modems work only with analog phone lines. Verify that you have analog phone lines installed or, if you have digital phone lines installed, verify that the servers and clients have digital modems.

Cause: Your modem settings need to be changed because of a remote access server change.

Solution: Verify the modem settings with your system administrator.

When trying to connect, a message is received that says the remote access server is not responding.

Cause:

  • At higher bits-per-second (bps) rates, your modem is incompatible with the modem of the server.
  • There is a lot of static on the phone line, which prevents a modem from connecting at a higher bps rate.
  • Switch equipment between the client and server that prevents the two modems from negotiating at a higher bps rate.

Solution: Adjust the speed of your modem to a lower bit-per-seconds (bps) rate.

See also: To change the maximum modem port speed.

Cause: The remote access server is not running.

Solution: Ask your system administrator to verify that the server is running.

The modem always connects at a lower bits-per-second (bps) rate than specified.

Cause: The modem and telephone line are not operating correctly. Excessive static on the telephone line causes sessions to be dropped.

Solution: You can use modem diagnostics to confirm correct modem operation.

See also: To log and view modem commands.

Cause: The remote access server is not functioning properly.

Solution: Ask your system administrator to verify that the destination server is running properly. Try connecting to the same server from another workstation. If other workstations are having the same problem, there may be problems with server applications or hardware. If not, the problem is specific to your workstation.

Cause: The quality of your line is insufficient.

Solution: Contact your telephone company to verify the quality of your line.

Cause: The line you are dialing is affecting the speed.

Solution: If you can connect to your remote access server by using more than one number, try another number and see if the speed improves.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

The sessions with a remote access server on the network keep getting dropped.

Cause: Call waiting is disrupting your connection.

Solution: Verify that the phone has call waiting. If so, disable call waiting and try calling again.

See also: To change dialing properties for a location.

Cause: The remote access server disconnected you because of inactivity.

Solution: Reattempt dial-up connection again.

Cause: Someone picked up the phone. Picking up the phone automatically disconnects you.

Solution: Reattempt dial-up connection again.

Cause: Your modem cable is loose.

Solution: Verify that the modem cable is connected properly.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

Connections are disconnecting abnormally.

Cause: The remote access server is not performing optimally.

Solution: Ask your system administrator to verify that the remote access server is running properly.

Cause:

  • Your modem is unable to negotiate correctly with the modem of the remote access server.
  • The serial port of the computer cannot keep up with the speed you have selected.

Solution: Try to connect at a lower initial port speed.

See also: To change the maximum modem port speed.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

When trying to connect, a hardware error is received.

Cause: The modem is turned off.

Solution: Verify that the modem is turned on. If the modem is turned off, turn it on and redial.

Cause: Your modem is not functioning properly.

Solution: Enable modem logging to test the modem.

See also: To log and view modem commands.

Cause: Your cable is incompatible.

Solution: If your modem does not communicate through Network Connections, the cable that attaches your modem to the computer is probably incompatible. You need to install a compatible cable.

Conflicts between serial ports are causing connection problems.

Cause: The serial ports are conflicting.

Solution: Com1 and Com3 share interrupt request (IRQ) 4. Com2 and Com4 share IRQ 3. As a result, for serial communications, you cannot use COM1 and COM3 simultaneously, or COM2 and COM4 simultaneously. For example, you cannot use Network Connections on COM1 and Terminal on COM3.

This rule applies if you are using the mouse in addition to other serial communications programs such as Network Connections or the Terminal program. The rule does not apply if you are using an intelligent serial adapter.

See Also: To configure a connection to a remote network; To change the COM port for a modem.

When trying to connect by using ISDN, a "No Answer" message is received.

Cause: The remote access server did not answer because it is turned off or the modem is not connected.

Solution: Contact your system administrator.

Cause: The line is busy.

Solution: Try calling later, or contact your system administrator.

Cause: There is a problem with the ISDN hardware.

Solution: Verify that the ISDN adapters are installed and configured correctly.

Cause: Your phone number is not configured correctly.

Solution: In some cases, each B channel on an ISDN line has its own number, while in other cases both B channels share a single number. Your telephone company can tell you how many numbers your ISDN line has.

Cause: If you are located in the United States or Canada, your Service Profile Identifier (SPID) is configured incorrectly. The SPID normally consists of the phone number with additional digits added to the beginning, the end, or both. The SPID helps the switch understand what type of equipment is attached to the line and routes calls to appropriate devices on the line. If an ISDN channel requires a SPID, but it is not entered correctly, then the device cannot place or accept calls.

Solution: Verify that the SPID is entered correctly.

Cause: A poor line condition (for example, too much static) interrupted your connection.

Solution: Wait a few minutes and try dialing again.

Cause: You did not enable line-type negotiation, or a connection cannot be made with the line type you selected.

Solution: Enable line-type negotiation.

Cause: Your ISDN switching facility is busy.

Solution: Try again later.

Cause: Your DigiBoard card is too old.

Solution: If you do not have the latest PCIMAC-ISA DigiBoard card, serial number A14308 or greater, contact DigiBoard for a replacement.

Connections made by using X.25 fail.

Cause: The dial-up PAD is configured with the wrong X.3 parameters or serial settings.

Solution: If the remote access server is running and you cannot connect to it directly through an X.25 smart card or an external PAD, modify the dial-up PAD X.3 parameters or serial settings. Ask your system administrator for the correct settings.

See also: To configure a connection to a remote network.

Cause: New Pad.inf entries are incorrect.

Solution: You can check other Pad.inf entries for direct connections and external PADs, and view the comments that go with them. You may need a line analyzer or a terminal program to see the response for the PAD. For dial-up PAD entries, you can use an entry in Pad.inf as an example, paying attention to the comments that go with the example.

Cause: Your modem is incompatible.

Solution: If the modem that connects to a dial-up PAD connects at a lower speed than it should, replace the modem with a compatible one.

See also: The modem does not work with Network Connections.

Cause: The line for the remote access server is congested. If a connection has been established, but the network drives are disconnecting, and you are dropping sessions or getting network errors, the cause may be congestion on the leased line for the remote access server.

For example, four clients connecting at 9600 bps (through dial-up PADs) require a 38,400-bps (four times 9600) leased line on the server end. If the leased line does not have adequate bandwidth, it can cause time-outs and degrade performance for connected clients. This example assumes that Routing and Remote Access is using all the bandwidth. If Routing and Remote Access is sharing the bandwidth, fewer connections can be made.

Solution: Your system administrator needs to verify that the speed of the leased line can support all the COM ports at all speeds clients use to dial in.

Connections through PPTP fail.

Cause: TCP/IP connectivity problems are keeping you from connecting to the PPTP server.

Solution: You or your system administrator can use the ipconfig and ping commands to verify a connection to your server.

Cause: A Winsock Proxy client is active.

Solution: A VPN connection cannot operate with an active Winsock Proxy client. Winsock Proxy immediately redirects packets to the proxy server before they can be processed by a virtual network connection for encapsulation. To fix this, you need to disable the Winsock Proxy client.

Cause: You do not have the appropriate remote access permissions and domain rights on the remote access server.

Solution: Contact your system administrator.

Cause: If you are using the TCP/IP protocol, you do not have a unique TCP/IP address.

Solution: Contact your system administrator.

Cause: Name resolution problems are keeping you from resolving names to IP addresses.

Solution: Specify a valid IP address for your connection.

See Also: To configure TCP/IP settings.

Connections configured by using PPP or TCP/IP are failing.

Cause: The server does not support LCP extensions.

Solution: If you cannot connect to a server by using PPP, or the remote computer terminates your connection, the server may not support LCP extensions. In Network Connections, clear the Enable LCP extensions check box.

Cause: IP header compression is keeping TCP/IP from running. If you successfully connect to a remote server by using PPP, but TCP/IP does not work, the problem may be IP header compression.

Solution: Try to reconnect after turning off IP header compression.

See Also: To stop requesting LCP extensions in PPP; To turn off IP header compression in PPP.

Connections made by using Internet Connection Sharing (ICS) are failing.

Cause: The wrong LAN network adapter is shared.

Solution: A computer with ICS needs two connections. One connection, typically a LAN adapter, connects to the computers on the home or small office network and the other connection connects the home or small office network to the Internet. You need to ensure that ICS is enabled on the connection that connects your home or small office network to the Internet.

Cause: TCP/IP is not installed on home network computers.

Solution: By default, the TCP/IP protocol is installed on computers running Windows NT version 4.0, Windows 98, Windows 2000, XOX, and Windows Server 2003 operating systems. If users on your home or small office network are running operating systems other than these, verify that TCP/IP is installed on their computers.

Cause: If users on your home or small office network cannot reach the Internet, TCP/IP is incorrectly configured on their home or small office network computers.

Solution: Verify that the following TCP/IP settings are established on home or small office network local area connections:

  • IP Address: Obtain an IP address automatically (through DHCP)
  • DNS server: Obtain DNS server address automatically
  • Default gateways: None specified

For computers running Windows 9x or Windows NT version 4.0, you can find the TCP/IP settings in Network in Control Panel.

Cause: The Internet Connection Sharing (ICS) service is not started.

Solution: Use Event Viewer to verify that the ICS service is started.

See also: Event Viewer.

Cause: The Internet Connection Sharing (ICS) host computer is not properly configured for name resolution.

Solution: You may need to configure the WINS or DNS name resolution services on the computer. If computers on the home or small office network cannot resolve names to IP addresses, you can check the name resolution configuration of the ICS host computer by using the ipconfig command. There are two ways that your ISP can configure name resolution:

  • Statically assigned name servers

    • You must manually configure the TCP/IP protocol with the IP address (or addresses) of the name servers provided by the ISP. If you have statically assigned name servers, you can use the ipconfig command at any time to get the IP addresses of your configured name servers.

  • Dynamically assigned name servers

    • Manual configuration is not required. The IP addresses of the name servers provided by the ISP are dynamically assigned whenever you dial the ISP. If you have dynamically assigned name servers, you must run the ipconfig command after a connection to the ISP has been made.

Cause: If you cannot play a game across the Internet, the protocol used by the application is not translatable.

Solution: Try running the application from the Internet Connection Sharing host computer. If the application works there but not at a workstation on the home or small office network, then the application may not be translatable.

Cause: If you cannot play a game across the Internet, the application is not configured on the Internet Connection Sharing host computer.

Solution: Verify that the application, including port numbers, is configured correctly.

See also: To manage service definitions for ICF or ICS.

Cause: If Internet users cannot see services on your home or small office network, such as a Web server, the service is not configured correctly.

Solution: Verify that the service, including port numbers and TCP/IP addresses, is configured correctly.

Cause: If users on your home or small office network cannot reach Internet sites by using friendly names, there is a DNS resolution problem.

Solution: Have users on your home or small office network use fully qualified domain names or IP addresses when accessing Internet resources.

See Also: To manage service definitions for ICF or ICS; Connecting to the Internet in a home or small office network; To configure TCP/IP to use WINS; To configure TCP/IP to use DNS; To test a TCP/IP configuration by using the ping command.

XOX

When using a local area network connection, there is no response.

Cause: There may be problems with your network adapter.

Solution: Try the following:

  • Check the appearance of the local area connection icon. Depending on the status of the local area connection, the icon appears in different ways in the Network Connections folder. Also, if the local area connection media is disconnected (for example, the cable is unplugged), a status icon is displayed in the taskbar.
  • Use Device Manager to verify that your network adapter is working correctly.

See also: Local area connections

Cause: The LAN cable may not be plugged into the network adapter.

Solution: Check to make sure the LAN cable is inserted into the network adapter.

When using a laptop to connect to an ISP, some or all of the applications do not run properly.

Cause: The WinSock Proxy Client may be preventing your applications from running properly when you use the ISP connection.

Solution: If you are a mobile user and use your laptop in your corporate environment, you may need to disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) when you use the same computer to dial to an ISP or other network. For example, if you use a laptop in your office and use the same computer to connect to an ISP or other network from your home, you may have problems running all of your applications when you use the ISP connection. (For example, your applications may not be able to find the resources or servers they need.) If this is the case, you should disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) to run the applications that you typically run when you use your laptop in the corporate office.

Incoming connection clients cannot see resources beyond the incoming connection computer.

Cause: If the addresses that are being allocated to incoming clients are not a subset of the network to which the incoming connection computer is attached, you must create a route to the incoming client computers on the intranet computers.

Solution: Reconfigure your range of IP addresses that are being allocated to incoming clients so that it is a subset of the network to which the incoming connections computer is attached. If you cannot do this, then configure your intranet hosts with the IP address of the incoming connections computer as a default gateway.

  • If your intranet hosts are configured to obtain an IP address automatically and a Dynamic Host Configuration Protocol (DHCP) server is present, you can configure your DHCP server to assign the default gateway.
  • If your intranet hosts are configured to obtain an IP address automatically and a DHCP server is not present (you are using the Automatic Private IP Addressing feature), then you must manually configure all of your intranet hosts with an IP address, subnet mask, and default gateway.

See Also: To configure a default gateway, Incoming connections and IP addresses.

Cause: The calculated range of addresses allocated to connecting clients is larger than the range that you configured.

Solution: Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. The closest matching subnet is calculated for the range that you specified in From and To. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.

See Also: To configure an incoming connection to use TCP/IP.

The smart card reader does not work.

Cause: The smart card reader is not installed.

Solution: Install the smart card reader and make sure that it is properly attached to the port.

Cause: The smart card reader is not installed properly.

Solution: Try the following:

  • Make sure that the smart card reader appears in Device Manager.
  • Ensure that you have the latest drivers installed for your smart card reader. To do so, right-click the smart card reader in Device Manager and click Update driver. If this does not work, check Windows Update to verify whether you are using the most recent drivers.
  • If the drivers for your smart card reader are not loaded correctly or have become corrupted, you can reinstall them. To do this, right-click the smart card reader in Device Manager, and click Uninstall. Right-click any device and then click Scan for hardware changes.
  • If the solutions given above do not work, uninstall the smart card reader drivers using Device Manager and then unplug the smart card reader from its port. Next, plug the smart card reader back into its appropriate port. Windows will automatically reinstall the drivers for the newly detected hardware.
  • If Windows Update does not offer drivers for your smart card reader, contact the supplier for your smart card reader to verify whether you have the appropriate drivers.
  • Try a different smart card reader.

Notes

  • The above-mentioned causes can generate the following errors:
    • 0x80090022: Provider could not perform the action since the context was acquired as silent.
    • Error 0x80090019: The keyset is not defined.
    • Error 764: No smart card reader is installed.
    • An internal error has been detected, but the source is unknown.
    • Error 0x8010002e: Cannot find a smart card reader. For customized troubleshooting information for this connection, click Help.
  • If you are using cryptographic service provider (CSP) software from a supplier other than Microsoft, the software might not be installed properly or might be corrupted. If this happens, you may see the following error messages:
    • 0x80090022: Provider could not perform the action since the context was acquired as silent.
    • Error 0x80090019: The keyset is not defined.
    • An internal error has been detected, but the source is unknown.

Cause: The smart card reader might be physically damaged.

Solution: Try the following:

  • Check whether the smart card reader has an LED or a display that tells you whether the device is functioning properly. Verify using the manual supplied by your vendor.
  • Try a different smart card reader.

The smart card does not work.

Cause: The smart card might be inserted incorrectly.

Solution: Try the following:

  • The smart card might be inserted upside down in the smart card reader. Make sure you insert it with the correct side up.
  • If this does not work, see the solutions for "The smart card reader does not work."

Cause: The smart card might be physically damaged.

Solution: Try the following:

  • See the solutions for "The smart card reader does not work."
  • If the smart card reader is working properly and the smart card is inserted correctly, then the smart card itself could be damaged. Try a different smart card.
  • Contact your system administrator for additional support.

When you try to establish a remote access connection using a smart card, you receive an error.

Cause: Multiple users might be logged on to the same computer.

Solution: Try the following:

  • Log off any additional users that are logged on at the same time using Fast User Switching.
  • If more than one user is logged on with administrative credentials, the following error message appears: "Local Security Authority cannot be contacted." Log off additional users that have logged on with administrative credentials.
  • If more than one user is logged on using local user credentials, the following error message appears: "Cannot find a smart card reader (Error 0x8010002e). For customized troubleshooting information for this connection, click Help." Log off additional users that have logged on using local user credentials.


Error messages

You may receive one or more of the following errors when you use Network Connections. To see more information about an error, click the error.

600 An operation is pending.

601 An invalid port handle was detected.

602 The specified port is already open.

603 The caller's buffer is too small.

604 Incorrect information was specified.

605 The port information cannot be set.

606 The specified port is not connected.

607 An invalid event was detected.

608 A device was specified that does not exist.

609 The device type was specified that does not exist.

610 An invalid buffer was specified.

611 A route was specified that is not available.

612 A route was specified that is not allocated.

613 An invalid compression was specified.

614 There were insufficient buffers available.

615 The specified port was not found.

616 An asynchronous request is pending.

617 The modem (or other connecting device) is already disconnecting.

618 The specified port is not open.

619 A connection to the remote computer could not be established, so the port used for this connection was closed.

620 No endpoints could be determined.

621 The system could not open the phone book file.

622 The system could not load the phone book file.

623 The system could not find the phone book entry for this connection.

624 The system could not update the phone book file.

625 The system found invalid information in the phone book file.

626 A string could not be loaded.

627 A key could not be found.

628 The connection was terminated by the remote computer before it could be completed.

629 The connection was closed by the remote computer.

630 The modem (or other connecting device) was disconnected due to hardware failure.

631 The user disconnected the modem (or other connecting device).

632 An incorrect structure size was detected.

633 The modem (or other connecting device) is already in use or is not configured properly.

634 Your computer could not be registered on the remote network.

635 There was an unknown error.

636 The device attached to the port is not the one expected.

637 A string was detected that could not be converted.

638 The request has timed out.

639 No asynchronous net is available.

640 A error has occurred involving NetBIOS.

641 The server cannot allocate NetBIOS resources needed to support the client.

642 One of your computer's NetBIOS names is already registered on the remote network.

643 A network adapter at the server failed.

644 You will not receive network message popups.

645 There was an internal authentication error.

646 The account is not permitted to log on at this time of day.

647 The account is disabled.

648 The password for this account has expired.

649 The account does not have permission to dial in.

650 The remote access server is not responding.

651 The modem (or other connecting device) has reported an error.

652 There was an unrecognized response from the modem (or other connecting device).

653 A macro required by the modem (or other connecting device) was not found in the device .INF file.

654 A command or response in the device .INF file section refers to an undefined macro.

655 The <MESSAGE> macro was not found in the device .INF file section.

656 The <DEFAULTOFF> macro in the device .INF file section contains an undefined macro.

657 The device .INF file could not be opened.

658 The device name in the device .INF or media .INI file is too long.

659 The media .INI file refers to an unknown device name.

660 The device .INF file contains no responses for the command.

661 The device .INF file is missing a command.

662 There was an attempt to set a macro not listed in the device .INF file section.

663 The media .INI file refers to an unknown device type.

664 The system has run out of memory.

665 The modem (or other connecting device) is not properly configured.

666 The modem (or other connecting device) is not functioning.

667 The system was unable to read the media .INI file.

668 The connection was terminated.

669 The usage parameter in the media .INI file is invalid.

670 The system was unable to read the section name from the media .INI file.

671 The system was unable to read the device type from the media .INI file.

672 The system was unable to read the device name from the media .INI file.

673 The system was unable to read the usage from the media .INI file.

674 The system was unable to read the maximum connection BPS rate from the media .INI file.

675 The system was unable to read the maximum carrier connection speed from the media .INI file.

676 The phone line is busy.

677 A person answered instead of a modem (or other connecting device).

678 The remote computer did not respond.

679 The system could not detect the carrier.

680 There was no dial tone.

681 The modem (or other connecting device) reported a general error.

691 Access was denied because the user name and/or password was invalid on the domain.

692 There was a hardware failure in the modem (or other connecting device).

695 The state machines are not started.

696 The state machines are already started.

697 The response looping did not complete.

699 The modem response caused a buffer overflow.

700 The expanded command in the device .INF file is too long.

701 The modem moved to a connection speed not supported by the COM driver.

703 The connection needs information from you, but the application does not allow user interaction.

704 The callback number is invalid.

705 The authorization state is invalid.

707 There was an error related to the X.25 protocol.

708 The account has expired.

709 There was an error changing the password on the domain. The password might have been too short or might have matched a previously used password.

710 Serial overrun errors were detected while communicating with the modem.

711 A configuration error on this computer is preventing this connection.

712 The two-way port is initializing. Wait a few seconds and redial.

713 No active ISDN lines are available.

714 No ISDN channels are available to make the call.

715 Too many errors occurred because of poor phone line quality.

716 The remote access service IP configuration is unusable.

717 No IP addresses are available in the static pool of remote access service IP addresses.

718 The connection was terminated because the remote computer did not respond in a timely manner.

719 The connection was terminated by the remote computer.

720 A connection to the remote computer could not be established. You might need to change the network settings for this connection.

721 The remote computer did not respond.

722 Invalid data was received from the remote computer. This data was ignored.

723 The phone number, including prefix and suffix, is too long.

726 The IPX protocol cannot be used for dial-out on more than one modem (or other connecting device) at a time.

728 The system cannot find an IP adapter.

729 SLIP cannot be used unless the IP protocol is installed.

731 The protocol is not configured.

732 Your computer and the remote computer could not agree on PPP control protocols.

733 A connection to the remote computer could not be completed. You might need to adjust the protocols on this computer.

734 The PPP link control protocol was terminated.

735 The requested address was rejected by the server.

736 The remote computer terminated the control protocol.

737 Loopback detected.

738 The server did not assign an address.

739 The authentication protocol required by the remote server cannot use the stored password. Redial, entering the password explicitly.

740 An invalid dialing rule was detected.

741 The local computer does not support the required data encryption type.

742 The remote computer does not support the required data encryption type.

743 The remote server requires data encryption.

751 The callback number contains an invalid character. Only the following characters are allowed: 0 to 9, T, P, W, (,), -, @, and space.

752 A syntax error was encountered while processing a script.

753 The connection could not be disconnected because it was created by the multi-protocol router.

754 The system could not find the multi-link bundle.

755 The system cannot perform automated dial because this entry has a custom dialer specified.

756 This connection is already being dialed.

757 Remote access services could not be started automatically. Additional information is provided in the event log.

758 Internet Connection Sharing is already enabled on the connection.

760 An error occurred while routing capabilities were being enabled.

761 An error occurred while Internet Connection Sharing was being enabled for the connection.

763 Internet Connection Sharing cannot be enabled. There are two or more LAN connections in addition to the connection to be shared.

764 No smart card reader is installed.

765 Internet Connection Sharing cannot be enabled. A LAN connection is already configured with the IP address required for automatic IP addressing.

766 A certificate could not be found. Connections that use the L2TP protocol over IPSec require the installation of a machine certificate, also known as a computer certificate.

767 Internet Connection Sharing (ICS) cannot be enabled. The LAN connection selected on the private network has more than one IP address configured. Reconfigure the LAN connection with a single IP address before enabling ICS.

768 The connection attempt failed because of failure to encrypt data.

769 The specified destination is not reachable.

770 The remote computer rejected the connection attempt.

771 The connection attempt failed because the network is busy.

772 The remote computer's network hardware is incompatible with the type of call requested.

773 The connection attempt failed because the destination number has changed.

774 The connection attempt failed because of a temporary failure. Try connecting again.

775 The call was blocked by the remote computer.

776 The call could not be connected because the destination has invoked the Do Not Disturb feature.

777 The connection attempt failed because the modem (or other connecting device) on the remote computer is out of order.

778 It was not possible to verify the identity of the server.

779 To dial out using this connection you must use a smart card.

780 An attempted function is not valid for this connection.

781 The encryption attempt failed because no valid certificate was found.

782 Network address translation (NAT) is currently installed as a routing protocol and must be removed before enabling Internet Connection Sharing.

783 Internet Connection Sharing (ICS) cannot be enabled. The LAN connection selected as the private network is either not present, or it is disconnected from the network. Please ensure that the LAN adapter is connected before enabling ICS.

784 You cannot dial using this connection at logon time, because it is configured to use a user name different than the one on the smart card. If you want to use it at logon time, you must configure it to use the user name on the smart card.

785 You cannot dial using this connection at logon time, because it is not configured to use a smart card. If you want to use it at logon time, you must edit the properties of this connection so that it uses a smart card.

786 The L2TP connection attempt failed because there is no valid machine certificate on your computer for security authentication.

787 The L2TP connection attempt failed because the security layer could not authenticate the remote computer.

788 The L2TP connection attempt failed because the security layer could not negotiate compatible parameters with the remote computer.

789 The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer.

790 The L2TP connection attempt failed because certificate validation on the remote computer failed.

791 The L2TP connection attempt failed because security policy for the connection was not found.

792 The L2TP connection attempt failed because security negotiation timed out.

793 The L2TP connection attempt failed because an error occurred while negotiating security.

794 The Framed Protocol RADIUS attribute for this user is not PPP.

795 The Tunnel Type RADIUS attribute for this user is not correct.

796 The Service Type RADIUS attribute for this user is neither Framed nor Callback Framed.

797 A connection to the remote computer could not be established because the modem was not found or was busy.

798 A certificate could not be found that can be used with this Extensible Authentication Protocol.

799 Internet Connection Sharing (ICS) cannot be enabled due to an IP address conflict on the network. ICS requires that the host be configured to use 192.168.0.1. Ensure that no other client on the network is configured to use 192.168.0.1.

800 Unable to establish the VPN connection. The VPN server may be unreachable, or security parameters may not be configured properly for this connection.

801 This connection is configured to validate the identity of the access server, but Windows cannot verify the digital certificate sent by the server.

802 The card supplied was not recognized. Please check that the card is inserted correctly, and fits tightly.


The modem does not work with Network Connections

If you have access to another computer with an Internet connection, check the compatibility information at Support resources.

If Network Connections supports the modem, verify that the modem is connected properly to the correct port on your computer. If the modem is external, verify that the power is on.

For additional modem troubleshooting information, see Troubleshooting.


Contact Parallel Technologies

Microsoft Windows graphic

To contact Parallel Technologies

  • Do any of the following:
    • Phone

      Within the United States and Canada: (800) 789-4784

      Outside of the United States and Canada: (425) 869-1119

    • Internet

      Parallel Technologies Web site

    • E-mail

      sales@lpt.com

      Compuserve e-mail 71612,3466

Note

  • XOX


Configure a default gateway

Microsoft Windows graphic

To configure a default gateway

  1. Open Network Connections.
  2. Right-click Local Area Connection, and then click Properties.
  3. Click Internet Protocol (TCP/IP), and then click Properties
    4. .
  4. In Default gateway, type the IP address of the intranet interface for the incoming connection.

Notes

  • XOX
  • If you currently have TCP/IP configured to obtain an IP address automatically, you must manually configure a TCP/IP address and subnet mask in order to configure a default gateway.

Related Topics