Configuring the Authentication Method Used

Under Authentication on the Security tab are two authentication methods that your connection can use:

• Use Extensible Authentication Protocol (EAP) Selecting this authentication method lets you choose from one of the following three protocols for authenticating the VPN connection:
  • Protected EAP (PEAP)
  • EAP-MSCHAPv2
  • Smart Card Or Other Certificate
  All three of these options ensure the security and data integrity of the EAP conversation by using encryption. The default setting here for a new connection is EAP-MSCHAPv2, which is also known as Secure Password.
  Additional authentication settings for EAP can be configured by clicking Properties. These additional settings depend on which EAP authentication method you have selected. Specifically:
• If PEAP is selected, clicking Properties lets you configure various authentication settings including client-side NAP settings. For more information on implementing NAP in enterprise environments, see the "Windows Server 2008 Networking and Network Access Protection (NAP)" volume in the "Windows Server 2008 Resource Kit" from Microsoft Press at http://www.microsoft.com/learning/en/us/books/11160.aspx.
• If EAP-MSCHAPv2 is selected, clicking Properties lets you configure the connection to automatically use your Windows logon credentials for authenticating the connection.
• If Smart Card Or Other Certificate is selected, clicking Properties lets you specify whether to use a smart card or other digital certificate for authenticating the connection. For example, if you are using certificates stored on the local computer rather than smart cards, you can select the Use A Certificate On This Computer option to enable certificates to be used for authenticating VPN connections. Selecting the Use Simple Certificate Selection (Recommended) option enables Windows Vista to determine which certificate on the computer should be used for VPN authentication. Selecting the Valid Server Certificate option forces the client computer to verify that the certificate of the remote VPN server is valid (this option is selected by default). You should also specify the trusted root authorities you want the client computer to trust, and you can optionally specify the IP address or FQDN of your CA in the Connect To These Servers text box.
• Allow These Protocols Selecting this authentication method lets you choose one or more of the following authentication protocols to be used by your connection:
  • PAP
  • CHAP
  • MS-CHAP v2
    In addition, you can choose whether to configure the connection to automatically use your Windows logon credentials. Note that the choice of using PAP, CHAP, or MSCHAPv2 applies only to PPTP, L2TP/IPsec, and SSTP tunnels; IKEv2 tunnels can only use EAP-MSCHAPv2 or certificates (see the next section for details).