How VPN Reconnect Works

VPN Reconnect (IKEv2) is available only on Windows 7 and Windows Server 2008 R2. This means that mobile computers must be running Windows 7 and the VPN server at the corporate network must be running Windows Server 2008 R2 to use VPN Reconnect.

A typical example of how VPN Reconnect works is as follows:

1. A user's Windows 7 mobile computer at remote location A establishes Internet connectivity using a wireless access point at the location. This Internet connectivity provides the user's computer with a reachable IP address.
2. The user initiates a VPN connection to a VPN server running Windows Server 2008 R2 on the corporate network. The user's VPN connection has been configured to attempt IKEv2 first as a tunneling protocol for the connection.
3. The VPN client exchanges IKEv2 messages with the VPN server and uses EAP to negotiate an authentication protocol.
4. The VPN server uses Remote Authentication Dial-in User Service (RADIUS) to authenticate and authorize the remote client.
5. An SA is negotiated for tunnel mode ESP.
6. The VPN client obtains an internal IP address for the duration of the session.
7. Data is now exchanged between the VPN client and server. This data is encapsulated in an IP packet that uses the internal address, which is then encapsulated by ESP, which is finally encapsulated in an IP packet that uses the reachable address.
8. Then, at some point, the user's computer is moved away from location A so that Internet connectivity is lost.
9. VPN Reconnect ensures that the SA remains valid, keeping the VPN session alive even though the VPN connection is temporarily broken.
10. The user's computer is now moved to a new location B, where Internet connectivity is reestablished using a different wireless access point.
11. The user's computer acquires a new reachable IP address that is different from the one used previously.
12. The VPN client exchanges MOBIKE messages with the VPN server to update the existing VPN tunnel and SA with the newly acquired reachable address.
13. The VPN connection is now automatically restored with no action required on the part of the user.

For information on how to configure VPN Reconnect on the client and server side, see the section titled "Configuring Mobility for IKEv2 Connections" later in this tutorial.

Note Unlike other VPN tunneling protocols such as PP TP, L2TP/IPsec, and SSTP, VPN Reconnect (IKEv2) does not run a Point-to-Point Protocol (PPP )-based handshake on top of the tunnel.