asked on

VPN Client Windows - set priority / order of VPN connection type to try, when left on 'Automatic' (e.g. 1st L2TP, 2nd SSTP)

I'm running RRAS on two servers inside my network, currently able to offer L2TP (via shared key), SSTP and PPTP connections. All three VPN types are working and accessible (as an aside, I'll be ditching PPTP shortly, owing to its lacking security).

I would like to know if there is an easy way to setup on the server side (most ideal) or client side a priority of which connection type to try first, when iniating a VPN connection from client to server. I'd like L2TP to be used as a priority, and if it doesn't work for some reason (like protocol 50 is being block outbound on the remote client side) it switches across to attempting SSTP connection as a secondary choice.

At present, when left on 'automatic' on the Windows VPN client settings, the client just connects up to the PPTP VPN by default (despite having the L2TP shared key in place), utlising the weakest of the VPN technologies we're offering.

Many thanks!

ASKER CERTIFIED SOLUTION

bbao

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Qlemo

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Member_2_3517100

ASKER

Thanks, Bing - I guessed so much but was hopeful I was wrong.... :-( L2TP then SSTP if that fails is actually what I want, along with getting rid of the PPTP, so I might play around with that, and see how it performs (i.e. how quickly it gives up trying to make a PPTP connection and then tries L2TP). That said, from a security stand point, it probably makes sense to remove PPTP from the table altogether.

Qlemo - this is how we're configured at present. I wanted to try and create a seamless solution for my colleagues, as one user in particular is a menace, and an automated failover would have been great. Also we have two separate BB connections and therefore VPN routes into the firm, so it's going to mean creating 4 separate VPN connections on client systems. Not the end of the world as we're a small business. I find the interface for the VPN connections in Windows 10 is a bit of a mess as well, split between the old UI and the modern UI (and with glitches). Hopeful MS will improve soon.

Thanks a lot to you both for your input. I'll issue points shortly :-)

Qlemo

Some kind of automation is available by providing a PBK file with the generic connection info, and using it with rasphone (interactive) or rasdial (batch). The latter allows for checking the status and switch over to a different connection.

Member_2_3517100

ASKER

Hi Qlemo - thanks for that last comment. I did have a look into it, but it marginally went over my head, and I'm not sure it helps too much in this specific incidence (or it may be a admin heavy solution), but could be my ignorance too :-)

Bing - thanks for your original commend - I finally fully read that article, and interestingly I note the author states:

"Once the connection is successfully made with one kind of tunnel then this tunnel type is remembered and next time when the connection is attempted that tunnel is tried first. If it fails with this tunnel then again the other tunnel types are tried." - From the perspective of your concern over a lengthy login, from this I'd assume this only happened first time or occasionally when the VPN topology remembered had been unavailable.

After consideration, I've decided to ditch the idea of the SSTP, as I find it just silently cuts out way too much (I've read that HTTPS is very critical of the quality of the connection) and L2TP is doing the job for us great. Thanks to both of you for your help, and I'll award points now. Cheers!

Member_2_3517100

ASKER

Now have a clear perspective on how this works, many thanks :-)