Windows 7 / Networking

---

Supported Tunneling Protocols

Windows 7 supports four different tunneling protocols for creating secure VPN connections to remote corporate networks:

• Internet Key Exchange version 2 New in Windows 7, IKEv2 is an updated version of the IKE protocol that uses the IPsec tunnel mode over UDP port 500. IKEv2 enables VPN connections to be maintained when the VPN client moves between wireless hotspots or switches from a wireless to a wired connection. Using IKEv2 and IPsec together enables support for strong authentication and encryption methods. IKEv2 is documented in RFC 4306.
• Secure Socket Tunneling Protocol Supported in Windows Vista Service Pack 1 (SP1) and later versions, SSTP encapsulates PPP frames over HTTPS (HTTP over Secure Sockets Layer [SSL]) to facilitate VPN connectivity when a client is behind a firewall, NAT, or Web proxy that allows outgoing TCP connection over port 443. The SSL layer provides data integrity and encryption while PPP provides user authentication. SSTP was introduced in Windows Vista SP1 and Windows Server 2008. SSTP was developed by Microsoft and the SSTP protocol specification can be found on MSDN at http://msdn.microsoft.com/en-us/library/cc247338.aspx.
• Layer Two Tunneling Protocol An industry-standard Internet tunneling protocol designed to run natively over IP networks and which encapsulates PPP frames like PPTP does. Security for L2TP VPN connections is provided by IPsec, which provides the authentication, data integrity, and encryption needed to ensure that L2TP tunnels are protected. The combination of L2TP with IPsec for tunneling purposes is usually referred to as L2TP over IPsec or L2TP/IPsec. L2TP/IPsec is documented in RFC 3193, while L2TP is documented in RFC 2661.
• Point-to-Point Tunneling Protocol An open industry standard developed by Microsoft and others, PPTP provides tunneling over PPP frames (which themselves encapsulate other network protocols such as IP) and uses PPP authentication, compression, and encryption schemes. PPTP was first introduced in Microsoft Windows NT 4.0 and is simpler to set up than L2TP, but it does not provide the same level of security as L2TP. PPTP is documented in RFC 2637.