Protocols and Features of VPN Reconnect

VPN Reconnect works by using the following protocols:

• IPsec tunnel mode using Encapsulating Security Payload (ESP) for secure transmission
• IKEv2 for key negotiation and MOBIKE for switching the tunnel endpoints when interfaces change

On the server side, VPN Reconnect is implemented within the Routing and Remote Access service (RRAS) mainly by the addition of two new features:

• A new Kernel Mode miniport driver for creating IKEv2 tunnels
• A new VPN IKE Protocol Engine that plugs into the Remote Access Connection Manager service (Rasman)

On the client side, Rasman loads the VPN IKE Protocol Engine, which controls IKEv2 protocol negotiation and provides interfaces for IPsec for authentication and IP parameter configuration. A new Network Driver Interface Specification (NDIS) miniport driver called the VPN Reconnect driver then performs the necessary encapsulation for IKEv2-based tunnels.

In addition, a feature called Mobility Manager is involved in making VPN Reconnect possible. Mobility Manager provides support for the switching of mobility-enabled VPN connections when the underlying interface fails. Mobility Manager is implemented as a scheduled task having LocalService privileges. This task gets triggered when the first mobilityenabled IKEv2 tunnel is established, and it continues running until there is no longer any mobility-enabled IKEv2 tunnels present on the system.

IKEv2 tunnels support two types of client-side authentication:

• Using EAP to enable authentication based on the user's credentials
• Using a machine certificate that has been installed on the VPN server

For more information on how IKEv2 tunnels are authenticated, see the sidebar titled "Direct from the Source: IKEv2 Authentication" later in this tutorial.