Understanding the VPN Connection Negotiation Process

When a client running Windows 7 tries to establish a connection with a remote VPN server, the tunneling protocol, authentication protocol, data encryption algorithm, and integritychecking algorithm used depend on several factors:

• The enabled authentication protocols and crypto algorithms on the client side
• The remote access policy on the server side
• The available network transports (IPv4 and/or IPv6)

By default, if Type Of VPN is set to Automatic on the client side, the client running Windows 7 attempts to establish a connection with the remote VPN server in the following order:

1. IKEv2
2. SSTP
3. PPTP
4. L2TP

The VPN client typically resolves the name of the VPN server using DNS. If the DNS lookup provides only an IPv4 or IPv6 address to the client, the connection attempts using the various tunneling protocols use only IPv4 or IPv6. If the DNS lookup provides the client with both the IPv4 and IPv6 addresses of the server, then IPv6 is preferred and the following tunnel connections are attempted, in this order:

1. IKEv2 over IPv6
2. SSTP over IPv6
3. PPTP over IPv4 (because PPTP doesn't support IPv6)
4. L2TP over IPv6

After a tunneling protocol has been selected for the connection, the authentication and crypto algorithms are then negotiated between the client and the server.

Note You can reduce connection time by explicitly specifying the tunneling protocol you want your client to use (provided that the remote server also supports this protocol) instead of selecting the Automatic type of VPN on the Networking tab of the connection's properties. Note that doing so means that if the connection attempt using the specified tunneling protocol fails then VPN connectivity cannot be established.