Using Security Knowledge to Resolve Connectivity Issues
I often have the pleasure of introducing consultants to the mysteries of PKI. It’s a subject I like talking about 70-291, and it’s also great to be able to solve a problem in five minutes that the communications consultant has been working on for hours or perhaps days. Sometimes I am contracted to solve the problem, and sometimes I answer an inquiry from a reader. The latter was the case in this example. In this example, the problem concerned VPN connections between three sites of the same company. The problem is similar to one you will have to solve when dealing with communications between multiple organizations.
I was told that all three sites used exactly the same hardware and software and were configured in exactly the same manner by local administrators using a centrally prepared instruction sheet. All three sites were part of the same company, but one site had been acquired six months previously. The purpose of the con?nection was to create a site-to-site demand-dial VPN between all three sites using L2TP/IPSec as the communications protocol. The reader told me that the site-to-site demand-dial VPN between Sites A and B was working just fine, but neither A nor B were able to establish demand-dial connectivity with Site C. This information, plus the requirement for free MCSE PDF questions, was my first indication that the problem was trust related. I told the reader to switch to PPTP and see whether the VPN could be connected. He did, and it was. Here’s how I explained why the solution worked.
When L2TP/IPSec is used to secure VPN traffic, both peers (computers on either side of a communication) must be able to present a certificate that the other peer can validate. Each computer sends to its peer a list of the root CAs that it has machine certificates from. If the peer trusts one of the CAs listed, it should be able to validate the certificate presented by its peer. If it trusts none of them, the con?nection cannot be negotiated. When the reader questioned the administrator at Site 3, he found that the site had its own CA hierarchy. He then examined the trusted root CA certificates in the certificate stores of Routerl and Router2 and found, not surprisingly, neither router had a copy of the Site 3 root CA. By sub?stituting PPTP for the VPN protocol, the need for certificates was removed.
Processing your request, Please wait....
