About Network Connections

Network Connections provides connectivity between your computer and the Internet, a network, or another computer. With Network Connections, you can gain access to network resources and functionality, whether you are physically located at the location of the network or in a remote location. Connections are created, configured, stored, and monitored from within the Network Connections folder.

The New Connection Wizard helps you create Internet connections using your dial-up modem, ISDN, DSL or cable modem. You can also create incoming, direct, and virtual private networking (VPN) connections using the New Connection Wizard. Local area connections are created automatically when a network adapter is installed.

Each connection in the Network Connections folder contains a set of features that you can use to create a link between your computer and another computer or network. Outgoing connections contact a remote access server by using a configured access method (LAN, modem, ISDN line, DSL, cable modem, and so on) to establish a connection with the network. Conversely, an incoming connection enables a computer running XOX, XOX, or a stand-alone computer running Windows 2000 Server to be contacted by other computers. This means your computer can operate as a remote access server. Whether you are connected locally (LAN), remotely (dial-up, ISDN, and so on), or both, you can configure any connection so that it can perform any needed network function. For example, you can print to network printers, access network drives and files, browse other networks, or access the Internet.

Because all services and communication methods are configured within the connection, you do not need to use external management tools to configure connection settings. For example, the settings for a dial-up connection include features to be used before, during, and after connecting. These include the modem you use to dial, the type of password encryption you want to use upon connecting, and the network protocols you use after you connect. Connection status, which includes the duration and speed of a connection, is viewed from the connection itself; you do not need to use an external status tool. For information about configuring a connection, see To configure a connection.

Logon and domain security, support for security hosts, data encryption, authentication, and callback provide secure network access for network and dial-up connections. For more information about security features, see Security features of Network Connections.

Related Topics


Hardware requirements for network connections

Depending on your configuration, you may need some or all of the following hardware:

  • Network adapter with a Network Driver Interface Specification (NDIS) driver for LAN connectivity
  • One or more compatible modems and an available COM port
  • A 28.8k or 56k modem or ISDN adapter (if you are using an ISDN line)
  • DSL modem. If this is an external DSL modem it typically is connected to an Ethernet network adapter.
  • Cable Modem. If this is an external cable modem it typically is connected to an Ethernet network adapter.
  • X.25 card or PAD (if you are using X.25)
  • Analog telephone line
  • If your computer is set up for incoming connections, a multiport adapter may improve performance for multiple connections.

XOX

For information about configuring a connection, see To configure a connection.


Checklist: Configuring network connections

Step | Reference
Review key concepts. | About Network Connections
Connect to a local area network. | To make a local area connection
Connect to a network by using a phone line. | To make a dial-up connection by using a phone line
Connect to an Internet service provider (ISP). | To make an Internet connection
Connect to a private network through the Internet (virtual private network). | To make a virtual private network (VPN) connection
Create a direct connection to another computer. | To make a direct network connection
Let other computers connect to this computer. | To make an incoming network connection
Monitor a connection. | To monitor a connection


Renaming and creating network connections

The following list provides best practices for renaming network connections and creating multiple copies:

  • When using multiple network adapters, rename each local area connection.

    • Your operating system detects network adapters and automatically creates a local area connection in the Network Connections folder for each network adapter. If more than one network adapter is installed, you can eliminate possible confusion by immediately renaming each local area connection to reflect the network that it connects to. For example, you may have one network adapter that is connected to an external DSL or cable modem that provides your Internet connection. You may want to rename this connection to something simple so it is easily identified in Network Connections.

    You need to add or enable the network clients, services, and protocols that are required for each connection. When you do so, the client, service, or protocol is added or enabled in all other network and dial-up connections.

  • Create multiple dial-up or VPN connections by copying them in the Network Connections folder.

    • After you copy the connections, you can rename them and modify the connection settings. By doing so, you can easily create different connections to accommodate multiple modems, ISPs, dialing profiles, and so on.

    For more information, see To copy a network connection.


New ways to do familiar tasks

This table lists common tasks for Network Connections. The user interface for performing tasks is different in XOX than it was in Windows NT 4.0. This table does not include differences between Windows 2000 and XOX.

The interface for creating network connections in XOX is different than in Windows 2000. The New Connection Wizard replaces the Windows 2000 Network Connection Wizard and Internet Connection Wizard. The New Connection Wizard creates all types of network connections including Internet, incoming, dial-up, VPN, and direct connections. Using the table below, you can learn how to create each type of connection using the New Connection Wizard.

If you want to | In Windows NT 4.0 use | In XOX use
Connect to a network by using a modem or ISDN line | Dial-Up Networking in My Computer (click New) | Network Connections. For more information, see To make a dial-up connection by using a phone line.
Connect to a network by using a virtual private network (VPN) | Dial-Up Networking in My Computer (click New) | Network Connections. For more information, see To make a virtual private network (VPN) connection.
Configure a computer for incoming connections | Network in Control Panel | Network Connections. For more information, see To make an incoming network connection.
Configure the TCP/IP protocol | Network in Control Panel | Network Connections. For more information, see To configure TCP/IP settings.
Configure a connection | Dial-Up Networking in My Computer (click More) | Network Connections. For more information, see To configure a connection.
Add a client or service | Network in Control Panel | Network Connections. For more information, see To add a network component.
Add a protocol | Network in Control Panel | Network Connections. For more information, see To add a network component.
Add optional networking components | Network in Control Panel | Network Connections. For more information, see To add optional networking components.
Monitor incoming or outgoing connections | Dial-Up Monitor in Control Panel | Network Connections. For more information, see To monitor a connection.


Network connection types

There are five types of network and dial-up connections. The following table shows each connection type, the communication methods used to establish the connection type, and an example of the connection. XOX

Connection type | Communication method | Example
Dial-up connections | Modem, ISDN, X.25 | Connect to a corporate network or the Internet by using remote access
Local area connections | Ethernet, Token Ring, cable modem, DSL, FDDI, IP over ATM, IrDA, wireless, WAN technologies (T1, Frame Relay) | Typical corporate user. Cable modem and DSL connect to the Internet. You can use Ethernet, IrDA, wireless or home phoneline network adapters (HPNA) to set up your home or small office network
Virtual private network (VPN) connections | VPNs over PPTP or L2TP to corporate networks or the Internet | Connect securely to a corporate network over the Internet
Direct connections | Serial cabling, infrared link, DirectParallel cable | Synchronize information between a Windows CE Handheld PC and a desktop computer
Incoming connections | Dial-up, VPN, or direct connections | Call in to a remote access server at your home or small office network


Configuring a network connection

You can change a network or dial-up connection by modifying its settings. Dial-up settings, such as the phone number of the connection, the number of redial attempts, and so on, are defined for each connection. These pre and post connection settings do not modify or affect the settings of other connections. For example, you may have a dial-up connection that attempts to redial 10 times a server that is frequently busy. You may have a second dial-up connection that attempts to redial three times another server that is more readily available. The redial setting of the first connection never causes the second connection to redial more than its own established three times. There is no need to make changes to any settings outside of the settings of the dial-up connection.

Changes to some networking settings of a connection can affect other connections. For example, if you add the IPX/SPX protocol to the list of available network components for one connection, the IPX/SPX protocol is not enabled, but is available to other connections on the same computer.

You can modify connection settings when you are connected. You can also rename a connection when it is connected. However, the connection may need to be reconnected in order to save the changes. If this happens, the connection is disconnected, the changes are stored, and the connection is immediately reconnected.

Each connection is configured with general settings that are the minimum information needed to successfully connect. These options are found on the General tab. For example, a local area connection only needs to list its network adapter. For a dial-up connection, the General tab includes required information, such as the device used to dial, the area code, the phone number, and the country/region code to dial.

For outgoing connections, you can set additional configuration options on the Options, Security, Networking, and Sharing tabs. You can set additional configuration options for an incoming connection on the Users and Networking tabs.

You can configure advanced settings from Advanced Settings on the Advanced menu of the Network Connections folder. By modifying these settings, you can improve performance. For example, network providers and protocols are accessed in the order specified in Advanced Settings. If your LAN connection is enabled to access NetWare and Microsoft Windows networks that use TCP/IP and IPX, but your primary connection is to a Microsoft Windows network that uses TCP/IP, you can move Microsoft Windows Network to the top of the Network Providers list on the Provider Order tab, and move Internet Protocol (TCP/IP) to the top of the File and Printer Sharing for Microsoft Networks binding on the Adapters and Bindings tab. By changing your provider order, and by changing the order of protocols bound to those providers, you can improve performance.

XOX


Change the settings for a connection

Microsoft Windows graphic

To change the settings for a connection

  1. Open Network Connections.
  2. To change the settings for, or configure,a dial-up connection, click the connection that you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. Do one or more of the following:
    • To configure dialing devices that your computer uses to make a connection (a modem, for example), phone numbers, host addresses, country or region codes, or dialing rules, click the General tab.
    • To configure dialing and redialing options, or X.25 settings, click the Options tab.
    • To configure identity authentication, which is a way to help verify your computer’s identity when making a connection, data encryption (which codes the content so that it’s less likely to be readable by someone other than the intended recipient), or terminal window and scripting options, click the Security tab.
    • To configure the remote access server that you want to connect to and protocols (the format that your computer uses to communicate with other computers) used for this connection, click the Networking tab.
    • To turn Internet Connection Sharing on or off or configure your computer to establish a dial-up connection automatically, click the Advanced tab.

Notes

  • XOX
  • The options and tabs in the Properties dialog box can be different, depending on the type of connection that you are working with. If you don't see a specific item, it means that it doesn't apply to the connection that you are changing.
  • Windows Firewall is automatically turned on for all network and Internet connections. For more information, see Related Topics.


Copy a network connection

Microsoft Windows graphic

To copy a network connection

  1. Open Network Connections.
  2. Right-click your dial-up, VPN, or direct connection, and then click Create Copy.

Notes

  • XOX
  • You cannot copy local area and incoming connections.
  • You can create multiple dial-up, virtual private network, or direct connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple modems, ISPs, dialing profiles, and so on.


Repair a LAN or high-speed Internet connection

Microsoft Windows graphic

To repair a LAN or high-speed Internet connection

XOX

  1. Open Network Connections.
  2. Under LAN or High-Speed Internet, click the connection that you want to repair, and then, under Network Tasks, click Repair this connection.
  3. If your connection does not work after you click Repair this connection, try the following steps:
    • Check the status indicator lights on the DSL or cable modem to verify that the connection to your Internet service provider (ISP) is working.
    • Turn off the DSL or cable modem and then turn it on again.
    • If your Internet connection is not working after these steps, contact your ISP.

Notes

  • XOX
  • If you have more than one network adapter installed in your computer, it is recommended that you rename your Internet connection to easily identify it. For example, you could call your Internet connection "Internet connection" or use the name of your ISP.


Disconnect from the network

Microsoft Windows graphic

To disconnect from the network

  1. Open Network Connections.
  2. Right-click the connection you want to disconnect, and then do one of the following:
    • If it is a dial-up, VPN, or incoming connection, click Disconnect.
    • If it is a local area network connection, click Disable.

Notes

  • XOX
  • If you disconnect a local area connection, it disables the network adapter driver until the connection is reactivated.


Local area connections overview

When you create a home or small office network, computers running XOX, or XOX are connected to a local area network (LAN). When you install XOX, your network adapter is detected, and a local area connection is created. It appears, like all other connection types, in the Network Connections folder. By default, a local area connection is always activated. A local area connection is the only type of connection that is automatically created and activated.

If you disconnect your local area connection, the connection is no longer automatically activated. Because your hardware profile remembers this, it accommodates your location-based needs as a mobile user. For example, if you travel to a remote sales office and use a separate hardware profile for that location that does not enable your local area connection, you do not waste time waiting for your network adapter to time out. The adapter does not even try to connect.

If your computer has more than one network adapter, a local area connection icon for each adapter is displayed in the Network Connections folder.

You can create local area networks using Ethernet, wireless, home phoneline (HPNA), cable modems, DSL, and IrDA (Infrared), Token Ring, FDDI, IP over ATM, and ATM-emulated LANs. Emulated LANs are based on virtual adapter drivers such as the LAN Emulation Protocol.

If changes are made to your network, you can modify the settings of an existing local area connection to reflect those changes. For information about modifying a connection, see To configure a connection. With the Status menu option in Network Connections, you can view connection information such as connection duration, speed, amounts of data transmitted and received, and any diagnostic tools available for a particular connection. For information about using the Status menu option, see To view the status of a local area connection.

If you install a new network adapter in your computer, the next time you start your computer, a new local area connection icon appears in the Network Connections folder. Plug and Play functionality finds the network adapter and creates a local area connection for it. You can add a PC card while the computer is on, and you do not have to restart your computer. The local area connection icon is immediately added to the folder. You cannot manually add local area connections to the Network Connections folder.

You can configure multiple network adapters through the Advanced Settings menu option. You can modify the order of adapters that are used by a connection, and the associated clients, services, and protocols for the adapter. You can modify the provider order in which this connection gains access to information on the network, such as networks and printers.

You configure the device a connection uses, and all of the associated clients, services, and protocols for the connection, through the Properties menu option. Clients define the access of the connection to computers and files on your network. Services provide features such as file and printer sharing. Protocols, such as TCP/IP, define the language your computer uses to communicate with other computers.

Depending on the status of your local area connection, the icon changes appearance in the Network Connections folder, or a separate icon appears in the notification area. If a network adapter is not detected by your computer, a local area connection icon does not appear in the Network Connections folder. The following table describes the different local area connection icons.

Icon | Description | Location
Active local area connection icon | The local area connection is active | Network Connections folder
Media disconnected local area connection folder icon | The media is disconnected | Network Connections folder
Media disconnected local area connection taskbar icon | The media is disconnected | Notification area
Driver disabled local area connection icon | The driver is disabled | Network Connections folder


Make a local area connection

Microsoft Windows graphic

To make a local area connection

  • If you have a network adapter installed, and have set up a home or small office network, you are connected to a local area network (LAN). You are also connected to a LAN if your XOX computer is part of a corporate network. When you start your computer, your network adapter is detected and the local area connection automatically starts. Unlike other types of connections, the local area connection is created automatically, and you do not have to click the local area connection in order to start it.

Notes

  • A local area connection is automatically created for each network adapter that is detected.
  • If more than one network adapter is installed, you can eliminate possible confusion by immediately renaming each local area connection to reflect the network that it connects to.
  • If your computer has one network adapter, but you need to connect to multiple LANs (for example, when traveling to a regional office), the network components for your local area connection need to be enabled or disabled each time you connect to a different LAN.
  • If more than one network adapter is installed, you need to add or enable the network clients, services, and protocols that are required for each local area connection. When you do so, the client, service, or protocol is added or enabled for all other network and dial-up connections.


Optional networking components

You can add or remove optional networking components. Optional networking components support network operations and are not automatically installed. Some of these components include the Route Listening Service, Simple TCP/IP Services, SNMP Services, and Print Services for UNIX.

For information about installing optional networking components, see To add optional networking components.


Add optional networking components

Microsoft Windows graphic

To add optional networking components

  1. Open Network Connections.
  2. On the Advanced menu, click Optional Networking Components.
  3. Do one of the following:
    • To install all optional networking components, select the Management and Monitoring Tools, Networking Services, and Other Network File and Print Services check boxes, and then click Next.
    • To install specific optional networking components, select the appropriate check box, and then click Details.

      In Subcomponents of component, select the check boxes next to the components you want to install, and then click OK.

Notes

  • XOX
  • Examples of optional networking components include Simple Network Management Protocol (SNMP), Simple TCP/IP Services, and Print Services for Unix.


Dial-up connections

A dial-up connection connects you to a network or the Internet by using a device that utilizes the telephone network. This device can be a modem that uses a standard phone line, an ISDN card with a high-speed ISDN line, or an X.25 network.

If you are a typical user, you may have one or two dial-up connections, perhaps to the Internet and to your corporate network. In a more complex server scenario, you can use multiple dial-up connections to implement advanced routing.

You can create multiple dial-up connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple modems, dialing profiles, and so on.


Dial-up credentials

Credentials, such as a user name and password, are required to successfully connect to the Internet using dial-up connections. Based in your user profile, you will be offered two or three choices about how your credentials are saved when you make a dial-up connection. Your user profile identifies you as having either administrator account privileges or user account privileges. If you have account profiles with both administrator and user privileges, only the privileges for the account that you are currently logged on with will apply.

If you log on with user account privileges, you can only make per user dial-up connections. Per user dial-up connections will be successful for you only and are not accessible to other user accounts. For per user dial-up connections, you can save your credentials for your use only or not save your credentials. If you select to save your credentials for your use only, the credentials will be automatically supplied to complete a dial-up connection only if you are logged on to the computer as the user who saved the credentials. If you do not save your credentials, you will be provided with a dialog box to enter your credentials before the connection will be completed.

If you log on with administrator account privileges, you can make either global or per user dial-up connections. Global connections can be seen by any user who logs on to the computer that is hosting the connection, but connection success is affected by how credentials were saved. For global connections, you can save your credentials for all users, for your use only, or not save your credentials at all. If you save your credentials for all users, your saved credentials will automatically be supplied for any user attempting to connect to the Internet using the dial-up connection icon or on-demand dialing. If you save your credentials for your use only, your saved credentials will be automatically supplied to complete a dial-up connection only if you are logged on to the computer. Other users will see a dialog box that prompts them for a user name and password, however, they will be unable to complete a connection to the Internet using this connection unless they can enter the correct credentials. If you do not save your credentials, a dialog box will appear and prompt you or any other user to enter your credentials before the connection to the Internet can be made.

The following provides a summary of the experience of a user logging on with a limited user account profile and a summary of a user logging on with an administrator account profile:

User account logon profile

Connection type made Credential save selections Local computer access
Per user only
  • User only
  • Not saved
 Only you can automatically complete the per user connection to the Internet. Because only administrators can access the Advanced tab to enable ICS or configure Windows Firewall, if you want to enable ICS or Windows Firewall, you should log on as an administrator when you create the dial-up connection. If you want to enable ICS or Windows Firewall on a dial-up connection that was created by a limited account user, you must promote the limited account user to an administrator account.
Client Internet access through per user shared Internet connections
Attempts to create a per user connection to the Internet, using the dial up icon or on-demand dialing, will only be successful for ICS client computers if:
  • You have actively logged on to the computer that hosts the shared Internet connection, and your credentials have been saved.
  • Your password credentials have not been saved, but a user is logged on at the ICS host computer who can supply your credentials when prompted by a dialog box.

Administrator account logon profile

Connection type made Credential save selections Local computer access
Per user
  • User only
  • Not saved
 Only you can automatically complete the per user connection to the Internet. Because only administrators can access the Advanced tab to enable ICS or configure Windows Firewall, if you want to enable ICS or Windows Firewall, you should log on as an administrator when you create the dial-up connection. If you want to enable ICS or Windows Firewall on a dial-up connection that was created by a limited account user, you must promote the limited account user to an administrator account.
Global
  • All users
  • User only
  • Not saved
 All users can see the Internet connection. If your credentials have been saved for all users, any user who has logged on to the computer can connect to the Internet. If your credentials have been saved as user only, the connection will only be completed automatically if you have logged on to the computer as the administrator or the user who saved the credentials. If your credentials have not been saved you will be required to supply your credentials when you attempt to connect to the Internet. As an administrator, you can use the Advanced tab to enable ICS.
Client Internet access through global shared Internet connections
Attempts to create a global shared Internet connection, using the dial-up icon or on-demand dialing, will only be successful for ICS client computers if:
  • Your credentials have been saved for all users (this will succeed whether a user is logged in or not at the ICS server).
  • You have actively logged on to the computer that hosts the shared Internet connection and your credentials have been saved as user only.
  • Your password credentials have not been saved, but a user is logged in at the ICS host computer. That user will be prompted with a dialog box to supply the credentials that are required to successfully connect your computer to your ISP.

On-demand dialing must be enabled for programs to automatically invoke dial-up connections to your ISP. For more information, see To enable on-demand dialing.

ICS must be enabled for computers on your network to use the shared Internet connection. For more information, see Internet Connection Sharing.

ICS Discovery and Control must be enabled for clients on your network to control the shared Internet connection. For more information, see Internet Connection Sharing with Internet Gateway Device Discovery and Control.

Notes

  • Dial-up connections created while you are a member of a workgroup in XOX or XOX will be available for all users.


Using phone lines and modems

The most common dial-up connection is made by using a standard analog telephone line and a modem. Standard analog phone lines are available worldwide and meet most requirements of a mobile user. Standard analog phone lines are also called PSTN (public switched telephone network) or POTS (plain old telephone service).

Hundreds of modems are compatible with XOX. Most modems that comply with industry standards should interoperate. However, many difficult-to-detect problems are the result of incompatible modems. XOX

Modems are automatically detected. This is especially useful for users who are not sure what modem is installed (for example, an internal modem). You can use shared modem pools for dial-up connections. Modem data compression and error control are available on most modems. However, built-in software compression offers enhanced performance over modem data compression.


Make a dial-up connection to your workplace by using a phone line

Microsoft Windows graphic

To make a dial-up connection to your workplace by using a phone line

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Connect to the network at my workplace, and then click Next.
  4. Click Dial-up connection, click Next, and then follow the instructions in the New Connection Wizard.

Note

  • XOX


Configure a modem for a dial-up connection

Microsoft Windows graphic

To configure a modem for a dial-up connection

  1. Open Network Connections.
  2. Click the dial-up connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the General tab, under Connect using, click the modem you want to configure, and then click Configure.
  4. Under Hardware Features, select the check box options you want to enable.
  5. If you want to enable the modem speaker, select the Enable modem speaker check box.

Notes

  • XOX

  • To ensure compatibility, you need to use the same kind of modem as the one connected to the remote access server, select the same initial speed, and enable the same features. If you do not select the same model, at least select a modem with the same ITU-T standard as the modem on the server.

  • Selecting a feature that is not supported by your modem has no effect on its performance.

  • Network Connections automatically configures connections according to the devices that are available. For example, you might use a laptop and docking station when you are in the office, with your connection configured to use the docking station modem. When you are on the road, and the docking station modem is not available, the connection is automatically configured to use the laptop's PCMCIA modem. When you return to the office and re-dock your laptop into its docking station, Network Connections detects that the docking station modem is available again, and automatically reconfigures the connection to use the docking station modem.


Start Remote Access Auto Connection Manager

Microsoft Windows graphic

To start Remote Access Auto Connection Manager

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Computer Management
    • Services and Applications
    • Services
  3. In the details pane, right-click Remote Access Auto Connection Manager, and then click Start.

    4. Under the Status column, Started appears.

Notes

  • XOX
  • Remote Access Auto Connection Manager is on by default in XOX computers that are not members of a domain and in XOX.


Configuring dial-up options

There are many dialing features that you can use to streamline the dial-up connection process. For instructions about configuring a dialing feature, click the feature in the following table.

Dialing feature | Function
To configure callback | Reduces phone charges by having the remote access server dial back to your location after you initially connect.
To configure phone number modifiers | Manually inserts characters to force dialing behaviors (pause, suspend dialing until input provided, and so on).
To configure redial options | Specifies the number of times your connection automatically redials when you fail to connect to your remote access server. You can also set this feature to reconnect automatically when an inactive link is dropped.
To assign multiple phone numbers to a connection | Assigns more than one destination phone number to your dial-up connection. This is useful if you have a pool of phone numbers to connect to.
To enable operator-assisted calls or manual dialing | Overrides automatic dial-up situations where intervention is required. For example, when you call through a manually operated switchboard.

Note

  • You can configure dial-up options that apply to all connections within a location (for example, dialing 9 for an outside line, disabling call waiting, using pulse dialing instead of tone dialing, and so on) in Phone and Modem Options.


Callback

The callback feature instructs your remote access server to disconnect, and then to call you back, after you dial in. Callback provides cost advantages to you and security advantages to your network. By immediately hanging up, and then dialing you back, callback reduces your phone charges. Required callback enhances network security by ensuring that only users from specific locations can access the server. By dropping the call, and then calling back a moment later to the preassigned callback number, most impersonators can be thwarted.

If callback has been required by your administrator, the following steps occur when your call reaches the remote access server:

  1. The server determines whether your user name and password are correct.
  2. If they are correct, the server disconnects and then returns the call.

If callback has been allowed by your network administrator and configured for your connection through the Dial-up Preferences menu option, the following steps occur when your call reaches the remote access server:

  1. The server determines whether your user name and password are correct.
  2. If they are correct, the Callback dialog box appears on your computer.
  3. You then type the current callback number in the dialog box and wait for the server to disconnect and return the call.

    Optionally, you can press ESC to cancel the callback process and remain connected.

For more information about configuring your callback options, see To configure callback.

Notes

  • Your callback privileges are determined by your system administrator. The administrator may deny the use of callback, allow user-defined callback, or require callback to a particular number. You can contact your system administrator to determine your callback options.
  • If your computer is configured to accept incoming connections, you can enforce callback options on that computer. For more information, see To configure callback for incoming connections.


Configure callback

Microsoft Windows graphic

To configure callback

  1. Open Network Connections.
  2. On the Advanced menu, click Dial-up Preferences.
  3. On the Callback tab, do one of the following:
    • If you do not want to use callback, click No callback.
    • If you want to decide whether to use callback at the time you connect, click Ask me during dialing when the server offers.
    • If you want to use callback consistently, click Always call me back at the number(s) below, and select the modem or device on which you want to be called back.
      • If Phone number is blank for the device you have selected, click Edit, and then type the number.
      • If you want to remove a modem or device from the list of possible callback devices, click the modem or device, and then click Delete.

Notes

  • XOX
  • Your callback privileges are determined by your system administrator and override any callback settings that you configure here. Through server settings, the administrator can deny the use of callback, allow you to set callback options, or require callback to a particular number. Contact your system administrator to determine your callback options.
  • To use callback, Link Control Protocol (LCP) extensions must be enabled.


Configuring multiple device dialing

The Network Connections feature performs PPP Multilink dialing over multiple ISDN, X.25, or modem lines. The feature combines multiple physical links into a logical bundle and the resulting aggregate link increases your connection bandwidth. To dial multiple devices, both your connection and your remote access server must have Multilink enabled.

Network Connections can dynamically control the use of multilinked lines. By allocating lines only as they are required, thereby eliminating excess bandwidth, you can realize a significant efficiency advantage. You can configure the conditions under which extra lines are dialed, and underused lines are hung up, through Network Connections settings.

Multilink is automatically enabled in XOX and XOX.

Note

  • If you use Multilink to dial a server that requires callback, then only one of your multilinked devices is called back. This is because you can only store one number in a user account. Therefore, only one device connects and all other devices fail to complete the connection, and your connection loses Multilink functionality.
    • You can avoid this problem:
    • If the multilinked phonebook entry uses an standard modem configuration, and the remote access server that your connection is calling uses more than one line for the same number.
    • If the multilinked phonebook entry is ISDN with two channels that have the same phone number.


Configure phone number modifiers

Microsoft Windows graphic

To configure phone number modifiers

XOX

  1. Open Network Connections.
  2. Select the dial-up connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the General tab, modify the phone number by using one or more characters from the following list.
Character | Function
, (comma) | Pauses briefly (two seconds for most modems) before continuing.
P | Switches from touch-tone to pulse/rotary dialing.
T | Switches from pulse/rotary to touch-tone dialing.
$ | Waits for a calling card prompt tone.

For example, when you dial in from a hotel room, you may have to add 9 to the number you are calling to get an outside line. Your number may look similar to the following:

9,555-0100

The comma after the 9 gives a pause long enough to get an outside line before continuing to dial the full number.

Notes

  • XOX
  • By selecting the Use dialing rules check box, and then clicking Dialing Rules, you can create a location for which specific dialing rules automatically apply. For example, if you frequently connect from home and need to disable call waiting, you can create a location for use from home that automatically dials the code to disable call waiting before the connection call is placed.
  • If you see unfamiliar characters being dialed before your number, check to make sure the Use dialing rules check box is not selected. If it is selected, a location may be enforcing a dialing rule that you do not need. For example, a location may be selected that always dials 1 to accommodate long-distance dialing.


Configuring redial options

With redial options, you can determine the number of times your connection automatically redials when you fail to connect to a remote access server. You can also reconnect automatically when a link is dropped.

By default, a dial-up connection is set up to redial three times (at one minute intervals) if it cannot reach its remote access server. Also by default, a connection idles indefinitely and does not redial if the line is dropped.


Configure redial options

Microsoft Windows graphic

To configure redial options

  1. Open Network Connections.
  2. Click the dial-up connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the Options tab, in Redial attempts, specify the number of times the dial-up connection is redialed if the first attempt to connect fails.
  4. In Time between redial attempts, click the arrows to set the amount of time to pause between the end of one attempt and the beginning of another.
  5. In Idle time before hanging up, click the arrows to set the amount of idle time before a client hangs up a connection.
  6. If you want the connection to automatically redial if the line is dropped, select the Redial if line is dropped check box.

Notes

  • XOX
  • The Time between redial attempts pause lets the device reset itself before redialing. The default is one minute. If that is not enough time, increase this setting. You can also experiment with shorter times, but if you make the pause too short, the device does not have time to reset itself.
  • Keep in mind that the remote access server also has a disconnect timer. If Idle time before hanging up is set to a high time-out number, there is no guarantee that the connection will not disconnect before the time passes. This is because the server may choose to disconnect you before the time set here.
  • If you are using Internet Explorer, the browser's own settings for dial-up connections may conflict with these redial options.


Assign multiple phone numbers to a dial-up connection

Microsoft Windows graphic

To assign multiple phone numbers to a dial-up connection

  1. Open Network Connections.
  2. Click the connection to which you want to assign multiple phone numbers, and then, under Network Tasks, click Change settings of this connection.
  3. On the General tab, click Alternates and then do any of the following:
    • If you want the connection to attempt a different phone number if the first number in the list is not successful, select the If number fails, try next number check box.
    • If you want the connection to move the first successful phone number to the top of the list under Phone numbers and use it on the next connection attempt, click Move successful number to top of list.
    • To add a new phone number to the list, click Add, and in Phone number, type the phone number.
    • If you want to change the order of phone numbers under Phone numbers, click a phone number, and then click the Up button or Down button until the phone number is in the correct order.
    • If you want to remove a phone number under Phone numbers, click the phone number, and then click Delete.
  4. If you want the connection to use established area code and dialing rules, on the General tab, select the Use dialing rules check box.
  5. When you are finished adding the new phone number, click OK.

Notes

  • XOX
  • If you have alternate phone numbers defined for a connection, you can specify a particular phone number at the time you initiate your connection.


Enable operator-assisted calls or manual dialing

Microsoft Windows graphic

To enable operator-assisted calls or manual dialing

  1. Open Network Connections.
  2. On the Advanced menu, click Operator-Assisted Dialing.
  3. Double-click the connection you want to dial.
  4. Pick up the telephone handset, and then dial the number or ask the operator to dial it for you.

    5. The number assigned to the entry is displayed in the dialog box for easy reference.

  5. Immediately after you have finished dialing, click Dial.
  6. Hang up the handset only after the modem takes control of the line, which is typically signaled with a click followed by silence.

    7. It is always safe to replace the handset once Network Connections begins verifying your user name and password. The status message will remind you of this.

Notes

  • XOX
  • If operated-assisted dialing is enabled, a check mark appears next to Operator-Assisted Dialing on the Advanced menu.


Automating a network connection

You can automate the connection process for a network or dial-up connection by using the autodial feature. With autodial enabled, network addresses are mapped to connection destinations, which allows a destination connection to be automatically dialed when a remote resource is referenced.

You can also automate the connection process for any Microsoft client by using a simple batch file and the rasdial command or by using a custom, Windows NT and Windows 2000 application that recognizes remote access.


Autodial

Autodial maps and maintains network addresses to connection destinations, which allows the destinations to be automatically dialed when referenced, whether from an application or from the command prompt. A network address can be an Internet host name, an IP address, or a NetBIOS server name. The default Internet connection is automatically dialed unless another Internet connection has autodial configured on it.

The following example describes how autodial works:

  1. You are not connected to your ISP, and you click an Internet address that is embedded in a word processing document.
  2. If you have a connection that is marked as the default Internet connection, it is automatically dialed so you can reach the Internet address.
  3. If not, you are asked to select which connection to use to reach your ISP. The connection you select is dialed, and then you access the Internet address.
  4. The next time you are not connected to your ISP and click an Internet address in a word processing document, a similar process occurs. If you selected a specific connection in step three, that connection is automatically dialed. Otherwise, the default Internet connection is dialed.

Autodial maps the resources that are required to initially make a connection, but does not map resources once the connection is made.

There are two possibilities when autodial attempts to make a connection:

  • If you are not connected to a network, autodial attempts to create a connection whenever an application references a remote address.

  • If you are connected to a network, autodial attempts to create a connection only for those addresses that it has previously learned. Incorrectly typed server or Internet host names do not cause an autodial attempt.

For more information, see To configure autodial.


Configure autodial

Microsoft Windows graphic

To configure autodial

  1. Open Network Connections.
  2. On the Advanced menu, click Dial-up Preferences.
  3. On the Autodial tab, select the check box next to the location where you want to enable autodial, and then click OK.

Notes

  • XOX
  • Autodial is enabled by default on XOX. In support of this feature, the Remote Access Auto Connection Service is started by default. XOX
  • Autodial maps the resources that are required to initially make a connection, but does not map resources once the connection is made.


Rasdial

You can automate the connection process for any Microsoft client by using a simple batch file and the rasdial command. The rasdial command starts a network connection by using a specified entry.

Syntax

rasdial connectionname [username [password | *]] [/domain:domain] [/phone:phonenumber] [/callback:callbacknumber] [/phonebook:phonebookpath] [/prefixsuffix]

The rasdial command disconnects a network connection by using the following syntax:

rasdial [connectionname] /disconnect

Parameters

None
Used without options, rasdial displays the status of current connections.
connectionname
Specifies an entry in the current .pbk file, located in the systemroot\System32\Ras folder. If the connection name contains spaces or special characters, enclose the connection name in quotation marks (").

The Rasphone.pbk file is used unless the Personal Phonebook option is selected. If the Personal Phonebook option is selected, the file username.pbk is used. The name is shown on the Rasphone title bar when Personal Phonebook/p is selected. Numbers are appended if name conflicts occur.

username [password | *]
Specifies a user name and password with which to connect. If an asterisk is used, the user is prompted for the password, but does not display the characters typed.
/domain:domain
Specifies the domain the user account is located in.

If not present, the last value of the Domain field in the Connect To dialog box is used.

/phone:phonenumber
Substitutes the specified phone number for the entry's phone number in Rasphone.pbk.
/callback:callbacknumber
Substitutes the specified callback number for the entry's callback number in Rasphone.pbk.
/disconnect
Disconnects the specified entry.
/phonebook:phonebookpath
Specifies the path to the phonebook file. The default is systemroot\System32\Ras\username.pbk. You can specify a full path to the file.
/prefixsuffix
Applies the current TAPI location dialing settings to the phone number. These settings are configured in Telephony, which is located in Control Panel. This option is off by default.

Rasdial examples

To connect to the OFFICE entry in Rasphone.pbk, type:

rasdial office

To connect to the OFFICE 2 entry in Rasphone.pbk and specify a callback number, type:

rasdial "office 2" /callback:555-0100

To disconnect from the EAST OFFICE entry, type:

rasdial "EAST OFFICE" /d

Note

The following Rasphone.exe features are not supported with rasdial:

  • Entries that require Terminal mode user entry during the dial sequence.
  • Operator-assisted or manual dialing.


Using rasdial

You can create a simple batch file that connects to a dial-up network connection by using the rasdial command. You can also use rasdial to connect to or disconnect from a network connection from a command line. Unlike autodial, the rasdial command does not automatically detect your network connection status before dialing a connection and is not dependent on the Remote Access Auto Connection Manager service.

For example, you might want to automatically connect to a dial-up connection during off-peak hours in order to transfer large data files. You can create a batch file or a series of batch files to automate this process. You would use the rasdial command to start and end the dial-up connection. There are additional configurable parameters that are associated with Rasdial, such as what phone number to use, whether to use a callback number.

For more information about using the rasdial command, see Rasdial. For more information about batch files, see Batch files.


Internet connections overview

With Network Connections, connecting to the Internet is easy. For example, to create a dial-up connection, you can use the following components to gain access to the Internet:

  • The TCP/IP protocol that is enabled for your network connection.
  • A modem or other connection to an Internet service provider (ISP).
  • An account with an ISP.

Your Internet connection dials the ISP and logs you on to the system. The actual sequence for logging on varies based on the requirements of the ISP you are calling. PPP connections are often entirely automatic. SLIP connections may require you to log on by using Terminal Window, which may or may not permit you to automate the logon process with scripts in the Switch.inf file.

For more information, see:

  • TCP/IP overview
  • ISP access methods
  • Internet service providers
  • Using PPP for Internet connections
  • To make an Internet connection

Note

  • Before you create an Internet connection, check with your ISP to verify the required connection settings. A connection to your ISP may require one or more of the following settings:
    • An account with an ISP including setup information.
    • A phone number to call your ISP.
    • A specific IP address.
    • An IP address for the default gateway.
    • DNS addresses and domain names.


Internet service providers

An Internet service provider (ISP) is a company that provides Internet access. There are Internet service providers around the world. To connect to the Internet, you dial a phone number and log on to the remote system. Once connected, you have access to the Internet and any other services, such as e-mail, that are provided by the ISP. Fees usually apply for commercial ISPs.

There are several different ways to set up an Internet account with an ISP. These include:

  • Look in your telephone for book for listings of ISPs.
  • There may be a program(s) installed on your computer for well-known ISPs, such as MSN.
  • There may be one or more CD-ROMs included with the information that came with your computer. To connect to one of these ISPs, insert the CD into the drive and then follow the online instructions.
  • Use the XOX Referral Service to locate an ISP.

If you have an Internet account set up on another computer and want to have this computer connect to the Internet using the same settings, you can use one of the following methods:

  • Call your ISP to obtain the settings to connect to their service.
  • Visit your ISPs Web page to obtain the settings.
  • Run the Files and Settings Transfer Wizard. The wizard guides you through transferring your files from your old computer to your new one.

Note

  • XOX


ISP access methods

A connection to an Internet service provider (ISP) can be through a modem and telephone line, an ISDN adapter and ISDN line, a cable modem, a Digital Subscriber Line (DSL), or an X.25 network.

If you are using a modem, you will want the fastest possible speed to reduce downloading time while on the Internet. A modem of 28.8 Kbps or above is recommended. For more information about modems, see Modem overview.

Your dial-up Internet connection dials the ISP and logs you onto the system. The actual sequence for logging on varies based on the requirements of the ISP you are calling and are usually transparent.

If you connect to the Internet through a DSL or cable modem, your ISP may offer either an always on connection or require you to log on. An always on connection means you do not have to log on each time you want to access the Internet. If your DSL or cable modem provider requires you to log on, you need a user name and password.

For more information, see:

  • To make an Internet connection.
  • TCP/IP overview
  • Internet service providers
  • Using PPP for Internet connections

Note

  • Before you create an Internet connection, check with your ISP to verify the required connection settings. A connection to your ISP may require one or more of the following settings:
    • A specific IP address.
    • DNS addresses and domain names.


Make an Internet connection

Microsoft Windows graphic

To make an Internet connection

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Connect to the Internet, and then click Next.
  4. Choose one of the following:
    • If you already have an account with an Internet service provider (ISP), click Set up my connection manually and then click Next.
    • If you have a CD from an ISP, click Use the CD I got from an ISP and then click Next.
    • If you do not have an Internet account, click Choose from a list of Internet service providers (ISPs) and then click Next.
  5. From your choice above, click one of the following:

    6. Set up my connection manually

    • If you are connecting to your ISP using a standard 28.8 Kbps, 56 Kbps, or ISDN modem, click Connect using a dial-up modem, click Next, and follow the instructions in the wizard.
    • If your DSL or cable modem ISP connection requires a user name and password, click Connect using a broadband connection that requires a user name and password, click Next, and then follow the instructions in the wizard.
    • If your DSL or cable modem ISP connection is always on and does not require you to type a user name and password, click Connect using a broadband connection that is always on, click Next, and then click Finish.

    Use the CD I got from an ISP

    • Click Next, and then click Finish. Insert the CD provided by your ISP and follow the instructions.

    Choose from a list of Internet service providers (ISPs)

    • To create an Internet account using MSN Explorer, click Get online with MSN, and then click Finish. Follow the instructions in MSN Explorer.
    • To choose an ISP, click Select from a list of ISPs, click Finish, and then double-click Refer me to more Internet service providers. Follow the instructions in the wizard.

Notes

  • XOX
  • If your DSL or cable modem is always connected and your ISP does not require a user name and password, you do not need to run the New Connection Wizard. No additional configuration is required for your broadband connection.
  • Before you create an Internet connection, check with your Internet service provider (ISP) to verify the required connection settings. A connection to your ISP may require one or more of the following settings:
    • A specific IP address.
    • DNS addresses and domain names.
    • POP3 settings for incoming e-mail.
    • SMTP settings for outgoing e-mail.


Make a broadband connection using PPPoE

Microsoft Windows graphic

To make a broadband connection using Point-to-Point Protocol over Ethernet (PPPoE)

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Connect to the Internet, and then click Next.
  4. Click Setup my connection manually, and then click Next.
  5. Click Connect using a broadband connection that requires a user name and password.
  6. Follow the instructions in the New Connection Wizard providing the information from your ISP.

Note

  • XOX


Internet Connection Sharing overview

With Internet Connection Sharing (ICS), you can connect computers on your home or small office network to the Internet using just one connection. For example, you have one computer that connects to the Internet by using a dial-up connection. When ICS is enabled on this computer, called the ICS host, other computers on the network connect to the Internet through this dial-up connection.

When you are setting up a home or small office network, it is recommended that you use the Network Setup Wizard in XOX to enable Internet Connection Sharing. The Network Setup Wizard automatically provides all of the network settings you need to share one Internet connection with all the computers in your network.

Note

  • XOX

After ICS is enabled, and you make sure that all of your computers can communicate with each other and they have Internet access, you can use programs such as Internet Explorer and Outlook Express as if they were directly connected to the Internet service provider (ISP). When a request to the Internet is made, the ICS host computer connects to the ISP and creates the connection so that other computers can reach a specified Web address or download e-mail. To test your network and Internet connection, see if you can share files between computers and that each computer can get to a Web address.

Internet Connection Sharing is intended for use in a network where the ICS host computer directs network communication between computers and the Internet. It is assumed that in a home or small office network, the ICS host computer has the only Internet connection. While other computers on the network may have modems to access the Internet, their primary connection is through the ICS host computer.

You might need to configure the Internet Connection Sharing computer to work properly across the Internet. Services that you provide must be configured so that Internet users can access them. For example, if you are hosting a Web server on your home or small office network, and want Internet users to be able to connect to it, you must configure the Web server service on the ICS host computer. For more information, see Opening ports in Windows Firewall.

You must enable ICS on the public connection of your home or small office network. If you have more than one network adapter installed on your computer, you need to choose the local area connection that communicates with the rest of the computers on your home or small office network. This is also called the private network connection. If there are two or more local area connections, when you enable ICS, you must do one of the following:

  • Select one connection to connect to the rest of the computers on your network. For information about how to choose the private connection, see Public and private network connections.
  • If you have two or more local area connections, and all of them connect to the rest of the computers on your network, you need to bridge the local area connections before you can select the connection to your home or small office network. If you choose to create a network bridge that includes all of the local area connections to your network, the bridge is automatically selected when you enable ICS. If you create a network bridge that does not include all of the local area connections to your network, you can still select the bridge as your private connection. For information about how to enable ICS, see Enable Internet Connection Sharing on a network connection. For information about how to bridge connections, see Bridge connections.

For information about the protocols, services, interfaces, and routes that are configured by enabling Internet Connection Sharing, see Internet Connection Sharing settings

Important

  • You should not use this feature in an existing network with Windows 2000 Server domain controllers, DNS servers, gateways, DHCP servers, or systems configured for static IP addresses.
  • The ICS host computer needs two network connections. The local area network connection, automatically created by installing a network adapter, connects to the computers on the home or small office network. The other connection, using a 56k modem, ISDN, DSL, or cable modem, connects the home or small office network to the Internet. You need to ensure that ICS is enabled on the connection that has the Internet connection. By doing this, the shared connection can connect your home or small office network to the Internet, and users outside your network are not at risk of receiving inappropriate addresses from your network.
  • When you enable Internet Connection Sharing, the local area network connection to the home or small office network is given a new static IP address and configuration. Consequently, TCP/IP connections established between any home or small office computer and the ICS host computer at the time of enabling ICS are lost and need to be reestablished.

Note

  • If a VPN connection is created on the ICS host computer, and ICS is enabled on this connection, then all Internet traffic is routed to the corporate network and all of the computers in your home or small office network can access the corporate network. If ICS is not enabled on the VPN connection, other computers will not have access to the Internet or corporate network while a VPN connection is active on the ICS host computer. For more information about creating a virtual private network (VPN) connection, see To make a virtual private network (VPN) connection.


Internet Connection Sharing settings

When you run the Network Setup Wizard and enable Internet Connection Sharing, some protocols, services, interfaces, and routes are configured automatically. The following table describes these configured items.

Configured item | Action
IP address 192.168.0.1 | Configured with a subnet mask of 255.255.255.0 on the LAN adapter that is connected to the home or small office network.
Autodial feature | Enabled.
Static default IP route | Created when the dial-up connection is established.
Internet Connection Sharing service | Started.
DHCP allocator | Enabled with the default range of 192.168.0.1 and a subnet mask of 255.255.255.0. Unique addresses in the range 192.168.0.2 to 192.168.0.254 are allocated to private network clients.
DNS proxy | Enabled.

Playing Internet games on your network

To play Internet games using a computer on your network and a computer on the Internet, you must ensure that network communications for the Internet game are forwarded by the network devices between your network and the Internet. For example:

  • If the network device between your network and the Internet is a computer running XOX and Internet Connection Sharing, you must configure Internet Connection Sharing settings to pass network communications for the game. For more information about adding service definitions for Internet Connection Sharing, see Add a service definition for Internet Connection Sharing and Using Internet Gateway Device Discovery and Control. To enable Internet Gateway Device Discovery and Control, select the connection properties Advanced tab, and then select the Allow other network users to control or disable the shared Internet connection check box.
  • If the network device is a firewall or security gateway, you must configure the device to pass network communications for the game. In this case, contact your network administrator who will identify the specific type of communications used by the Internet game and will configure the firewall to forward them.
If you do not make these configurations, computers on your network will be unable to connect to Internet game servers on the Internet, and game players on the Internet will be unable to connect to Internet game servers on your network.

Notes

  • If you enable Internet Connection Sharing on a local area network (LAN) connection, TCP/IP for the LAN connection to the Internet must be configured with a default gateway. The TCP/IP addressing for this might be a static address or a dynamic address using DHCP.
  • XOX


Enable Internet Connection Sharing on a network connection

Microsoft Windows graphic

To enable Internet Connection Sharing on a network connection

XOX

  • To set up Internet Connection Sharing, run the Network Setup Wizard.

Important

  • Do not use Internet Connection Sharing (ICS) in a network with other domain controllers, DNS servers, gateways, DHCP servers, or systems configured for static IP.
  • When you enable ICS, the network adapter connected to your home or small office network gets a new static IP address configuration. Existing TCP/IP connections on the computer running ICS are lost and must be reestablished. For example, if Internet Explorer is connecting to a Web site when ICS is enabled, you must refresh the browser to reestablish the connection.
  • To use ICS, users on your home or small office network should configure TCP/IP on their local area connection to obtain an IP address automatically. Home or small office network users must also configure Internet options for ICS. For more information, see To configure Internet options for Internet Connection Sharing.

Notes

  • XOX
  • For information about the protocols, services, interfaces, and routes that are automatically configured, click Related Topics.
  • Internet Connection Sharing is only available when two or more network adapters are installed on the computer.


Configure Internet options for Internet Connection Sharing

Microsoft Windows graphic

To configure Internet options for Internet Connection Sharing

  1. Open Internet Explorer.
  2. On the Tools menu, click Internet Options.
  3. On the Connections tab, click Never dial a connection, and then click LAN Settings.
  4. In Automatic configuration, clear the Automatically detect settings and Use automatic configuration script check boxes.
  5. In Proxy Server, clear the Use a proxy server check box.

Notes

  • XOX
  • If an Internet connection has not been previously established, the New Connection Wizard starts. For more information about establishing an Internet connection, click Related Topics.


Using Internet Connection Sharing and Windows Firewall Plug-ins

Software vendors can supply a specific type of plug-in to fix connectivity problems that may occur when you use programs that operate across the Internet, and you have enabled Internet Connection Sharing (ICS), or Windows Firewall, or both ICS and Windows Firewall. This type of plug-in is called an Internet Connection Sharing and Windows Firewall Plug-in. An Internet Connection Sharing and Windows Firewall Plug-in is an executable file that is available to you in one of two formats:

  1. During the installation of a new program, you may be given the option to install the plug-in through a message that indicates that the program you are running will attempt to install an Internet Connection Sharing and Windows Firewall Plug-in.
  2. For a program that was previously installed, you may be able to locate a plug-in at the Web site of that program’s manufacturer. If a plug-in is available, you can download the plug-in from the Internet to install it.

When you install a new Internet Connection Sharing and Windows Firewall Plug-in, there is a possibility that previously installed Internet Connection Sharing and Windows Firewall Plug-ins will be altered and not work properly. You can remove the new plug-in to repair previously installed plug-ins. Removing the plug-in returns ICS, Windows Firewall, or both to their previous states. You can remove a plug-in by using Add or Remove Programs in Control Panel. For more information, see To change or remove a program.

Because Internet Connection Sharing and Windows Firewall Plug-ins can modify Windows Firewall and, in doing so, potentially expose your network to security risks, you should only install Internet Connection Sharing and Windows Firewall Plug-ins when they are from a trusted source.

Notes

  • XOX


View the status of a shared Internet connection

Microsoft Windows graphic

To view the status of a shared Internet connection

  1. Open Network Connections.
  2. Right-click the icon for the shared Internet connection, and then click Status.

Notes

  • XOX
  • If the Show icon in notification area when connected check box is selected for the shared Internet connection, you can click the icon for the shared Internet connection to open its status window.
  • If Windows Firewall is enabled, UPnP framework must be selected on the Exceptions tab in Windows Firewall for Internet Gateway Device Discovery and Control to work.


What is Windows Firewall?

A firewall helps to keep your computer more secure. It restricts information that comes to your computer from other computers, giving you more control over the data on your computer and providing a line of defense against people or programs (including viruses and worms) that try to connect to your computer without invitation.

You can think of a firewall as a barrier that checks information (often called traffic) coming from the Internet or a network and then either turns it away or allows it to pass through to your computer, depending on your firewall settings. See the following illustration:

Illustration of a firewall blocking some communications and allowing others

In XOX, Windows Firewall is turned on by default. (However, some computer manufacturers and network administrators might turn it off.) You do not have to use Windows Firewall—you can install and run any firewall that you choose. Evaluate the features of other firewalls and then decide which firewall best meets your needs. If you choose to install and run another firewall, turn off Windows Firewall.

How does it work?

When someone on the Internet or a network tries to connect to your computer, we call that attempt an "unsolicited request." When your computer gets an unsolicited request, Windows Firewall blocks the connection. If you run a program such as an instant messaging program or a multiplayer network game that needs to receive information from the Internet or a network, the firewall asks if you want to block or unblock (allow) the connection. If you choose to unblock the connection, Windows Firewall creates an exception so that the firewall won't bother you when that program needs to receive information in the future.

For example, if you are exchanging instant messages with someone who wants to send you a file (a photo, for example), Windows Firewall will ask you if you want to unblock the connection and allow the photo to reach your computer. Or, if you want to play a multiplayer network game with friends over the Internet, you can add the game as an exception so that the firewall will allow the game information to reach your computer.

Although you can turn off Windows Firewall for specific Internet and network connections, doing this increases the risk that the security of your computer might be compromised.

What Windows Firewall does and does not do

It does: | It does not:
Help block computer viruses and worms from reaching your computer. | Detect or disable computer viruses and worms if they are already on your computer. For that reason, you should also install antivirus software and keep it updated to help prevent viruses, worms, and other security threats from damaging your computer or using your computer to spread viruses to others.
Ask for your permission to block or unblock certain connection requests. | Stop you from opening e-mail with dangerous attachments. Don't open e-mail attachments from senders that you don't know. Even if you know and trust the source of the e-mail you should still be cautious. If someone you know sends you an e-mail attachment, look at the subject line carefully before opening it. If the subject line is gibberish or does not make any sense to you, check with the sender before opening it.
Create a record (a security log), if you want one, that records successful and unsuccessful attempts to connect to your computer. This can be useful as a troubleshooting tool. If you want Windows Firewall to create a security log, see Enable security logging options. | Block spam or unsolicited e-mail from appearing in your inbox. However, some e-mail programs can help you do this. Check the documentation for your e-mail program to learn more.


Why you should only use one firewall

If you have more than one firewall installed on your computer, you should not have both firewalls turned on at the same time. Two firewalls turned on at the same time can cause compatibility problems that result in some programs not working correctly.

To help protect your computer against viruses and other security threats, you should always have one firewall installed and turned on. Windows includes a firewall that is turned on by default. (However, some computer manufacturers and network administrators might turn it off.) If you want to install and run a second firewall, turn off Windows Firewall.

For instructions about turning off Windows Firewall, see Turn Windows Firewall on or off.


What are Windows Firewall settings used for?

Windows Firewall has three settings: On, On with no exceptions, and Off.

On: Windows Firewall is turned on by default, and normally you should leave it that way. When you choose this setting, Windows Firewall blocks all unsolicited requests to connect to your computer, except for requests to programs or services selected on the Exceptions tab.

On with no exceptions: When you select the Don’t allow exceptions check box, Windows Firewall blocks all unsolicited requests to connect to your computer, including requests to programs or services selected on the Exceptions tab. Use this setting when you need maximum protection for your computer, such as when you connect to a public network in a hotel or airport, or when a dangerous virus or worm is spreading over the Internet. There is no need to keep Don’t allow exceptions selected all the time, because when it is, some of your programs might not work correctly, and the following services are blocked from accepting unsolicited requests:

  • File and Printer Sharing
  • Remote Assistance and Remote Desktop
  • Discovery of network devices
  • Preconfigured programs and services on the exceptions list
  • Additional items that you have added to the exceptions list

When you select Don’t allow exceptions, you can still send and receive e-mail, use an instant messaging program, or view most Web pages.

Off: This setting turns Windows Firewall off. When you choose this setting, your computer is much more vulnerable to harm from unknown intruders or viruses from the Internet. This setting should only be used by advanced users for computer administration purposes, or if your computer is protected by another firewall.

Note

  • Settings that you create when your computer is joined to a domain are stored separately from those created when your computer is not joined to a domain. These separate groups of settings are called profiles.


Allowing a program to communicate through Windows Firewall

To help provide security for your computer, Windows Firewall blocks unsolicited requests to connect to your computer. Because the firewall restricts communication between your computer and the Internet, you might need to adjust settings for some programs that prefer an open connection to the Internet. You can make an exception for these programs, so that they can communicate through the firewall.

Risks of allowing exceptions

Each time that you allow an exception for a program to communicate through Windows Firewall, your computer is made more vulnerable. To allow an exception is like poking a hole through the firewall. If there are too many holes, there is not much wall left in your firewall. Unknown intruders often use software that scans the Internet looking for computers with unprotected connections. If you have many exceptions and open ports, your computer can become a victim of these intruders.

To help decrease your security risk if you allow exceptions:

  • Only allow an exception when you really need it.
  • Never allow an exception for a program that you don't recognize.
  • Remove an exception when you no longer need it.

Allowing exceptions despite the risk

Sometimes you might want someone to be able to connect to your computer, despite the risk—such as when you expect to receive a file sent through an instant messaging program, or when you play a multiplayer game over the Internet.

For example, if you are exchanging instant messages with someone who wants to send you a file (a photo, for example), Windows Firewall will ask you if you want to unblock the connection and allow the photo to reach your computer. Or, if you want to play a multiplayer network game with friends over the Internet, you can add the game as an exception so that the firewall will allow the game information to reach your computer.

To allow unsolicited requests to connect to a program on your computer, use the Exceptions tab in Windows Firewall. If the program or service that you want to allow an exception for is not listed on the Exceptions tab, you can add it by clicking Add Program. If you do not find the program on the list of programs to add, click Browse to search for it.

To add a program to the exceptions list

XOX

  1. Open Windows Firewall.
  2. On the Exceptions tab, under Programs and Services, select the check box for the program or service that you want to allow, and then click OK.

If the program (or service) that you want to allow is not listed:

  1. Click Add Program.
  2. In the Add a Program dialog box, click the program that you want to add, and then click OK. The program will appear, selected, on the Exceptions tab, under Programs and Services.
  3. Click OK.

If the program (or service) that you want to allow is not listed in the Add a Program dialog box:

  1. In the Add a Program dialog box, click Browse, locate the program that you want to add, and then double-click it. (Programs are usually stored in the Program Files folder on your computer.) The program will appear under Programs, in the Add a Program dialog box.
  2. Click OK. The program will appear, selected, on the Exceptions tab, under Programs and Services.
  3. Click OK.

If you still do not find the program, you can open a port instead. A port is like a small door in the firewall that allows communications to pass through. To specify which port to open, on the Exceptions tab, click Add Port. (When you open a port, remember to close it again when you are done using it.)

Adding an exception is preferable to opening a port because:

  • It is easier to do.
  • You do not need to know which port number to use.
  • Adding an exception helps provide security, because the firewall is only open while the program is waiting to receive the connection.

Advanced options

Advanced users can open ports for, and configure the scope of, individual connections to minimize opportunities for intruders to connect to a computer or network. To do this, open Windows Firewall, click the Advanced tab, and use the settings under Network Connection Settings.


Understanding when to block a program

When Windows Firewall is turned on and a program on your computer attempts to accept connections from the Internet or a network, the firewall blocks the program from doing this and displays a message giving you the option to unblock the program.

For example, suppose you've set up your computer to play a game with other players over the Internet. Because the firewall prevents the game from accepting connections from the Internet, the game will not be able to receive the information from other players that it needs to work correctly. A message will appear, asking what actions you'd like to take.

When you get this message, choose:

  • Keep Blocking to prevent the program from ever accepting connections without your permission.
  • Unblock only if you know why the program is asking to accept connections to your computer, or if you know that the program is trustworthy. (In the game example above, this is the option you would choose.)
  • Ask Me Later if you don't know whether to permanently block or unblock the program. This option keeps the program blocked (for greater security), and you will get this message again the next time that you start the program.

If you choose to unblock the program, Windows Firewall creates an exception for that program to allow it to communicate through the firewall. The firewall won't notify you when that program wants to receive connections in the future. When you close the program, the temporary opening in your firewall is also closed.

Notes

  • These choices apply to every user who logs on to this computer.
  • For some games (DirectX games), the message might be hidden behind the program. To see the message, minimize or close the program.
  • These messages can be disabled by using Windows Firewall, netsh.exe, or Group Policy. To disable these messages in Windows Firewall, on the Exceptions tab, clear the Display a notification when Windows Firewall blocks a program check box. However, we recommend that you keep these messages enabled to help monitor the security of your computer.
  • If Don't allow exceptions is selected on the General tab, you will not receive this message because the firewall will not allow any communications regardless of other settings you might have made.


Turn Windows Firewall on or off

Microsoft Windows graphic

To turn Windows Firewall on or off

XOX

  1. Open Windows Firewall.
  2. On the General tab, click one of the following:

    • On (recommended). This is the setting that you should normally use.

      You can also select the Don't allow exceptions check box. When this check box is selected, the firewall blocks all unsolicited requests to connect to your computer, including requests to programs or services selected on the Exceptions tab. Use this setting when you need maximum protection for your computer, such as when you connect to a public network in a hotel or airport, or when a dangerous virus or worm is spreading over the Internet.

    • Off (not recommended). Turning off Windows Firewall might make your computer (and your network, if you have one) more vulnerable to damage from viruses or unknown intruders.

Warning

  • If you use the Advanced tab to turn off Windows Firewall for one or more individual connections, the Windows Security Center will report that the firewall is off, even though the firewall is still turned on for other connections. Also, on the General tab, Windows Firewall will still be set to On.

Notes

  • XOX
  • Windows Firewall is turned on by default for all Internet and network connections. However, some computer manufacturers and network administrators might turn it off.
  • Windows Firewall is turned on by default, so you cannot use some features of some types of programs, unless the program is listed on the Exceptions tab in Windows Firewall. For example, you might not be able to send photos using an instant messaging program until you add the program to the exceptions list.


Turn Windows Firewall on with no exceptions

Microsoft Windows graphic

To turn Windows Firewall on with no exceptions

XOX

  1. Open Windows Firewall.
  2. On the General tab, click On.
  3. Select the Don't allow exceptions check box, and then click OK.

Notes

  • XOX
  • The Don't allow exceptions setting blocks all unsolicited requests to connect to your computer, including requests to programs or services selected on the Exceptions tab. Use this setting when you need maximum protection for your computer, such as when you connect to a public network in a hotel or airport, or when a dangerous virus or worm is spreading over the Internet.
  • When Don't allow exceptions is selected, the firewall also blocks unsolicited requests to share files or printers, and discovery of network devices.
  • When Don't allow exceptions is selected, you can still view most Web pages, send and receive e-mail, or use an instant messaging program.


Enable or disable file and printer sharing

Microsoft Windows graphic

To enable or disable file and printer sharing

XOX

  1. Open Windows Firewall.
  2. On the Exceptions tab, do one of the following:
    • To enable file and printer sharing, select the File and Printer Sharing check box.
    • To disable file and printer sharing, clear the File and Printer Sharing check box.

Note

  • XOX
  • Advanced users can edit the File and Printer Sharing service, and enable or disable individual ports or adjust scope as needed.


Enable or disable the UPnP framework

Microsoft Windows graphic

To enable or disable the UPnP framework

XOX

  1. Open Windows Firewall.
  2. Do one of the following:
    • To enable UPnP technology, on the Exceptions tab, select the UPnP framework check box.
    • To disable UPnP technology, on the Exceptions tab, clear the UPnP framework check box.

Notes

  • XOX
  • Advanced users can edit the service for the UPnP framework, enabling or disabling individual ports and adjusting scope as needed.


How does Windows Firewall affect printing and scanning?

Most printers will work the same way that they worked before you installed XOX. However, you might notice these differences:

  • Your computer will not receive notifications from your printer—such as "print job completed" or "printer out of paper."
  • If your print server (the computer that your printer is connected to) has Windows Firewall turned on and the file and printer sharing ports are not open, other computers on your network cannot use the printer.
  • Normally, status information about a printer—such as "Ready" or "Paused"— appears beside each printer icon in Printers and Faxes in Control Panel. If Windows Firewall is turned on, that information will take a few moments to appear.

If you just installed XOX and your shared printer no longer works, or a computer on your network other than your print server cannot use the printer, open Windows Firewall in Control Panel, and select the File and Printer Sharing check box on the Exceptions tab. This step will eliminate most printer sharing problems.

Network printers and scanners

If your print server has Windows Firewall turned on and your computers use Internet printing protocol (IPP) to print, you must open a specific port on your print server to share printers successfully. The port usually used for IPP-based print servers is port 80.

Scanning from a network-attached scanner might not be successful if Windows Firewall is turned on. Check with your scanner manufacturer for instructions if the scanner is not working correctly.

Note

  • XOX


How does Windows Firewall affect notifications?

Because Windows Firewall inspects all incoming communications, some programs, especially e-mail programs, might behave differently when Windows Firewall is turned on.

For example, Outlook Express sends you a notification when you have new e-mail. Windows Firewall does not affect the behavior of this program, because the new e-mail notification originates from your computer.

However, when Microsoft Office Outlook 2000, Outlook 2002, or Outlook 2003 sends an e-mail notification, the notification originates from a server (a computer that is on the Internet), so Windows Firewall blocks the notification from reaching your computer. With Office Outlook, you can send and receive e-mail, but you will not be notified about new messages.


Restore default settings for Windows Firewall

Microsoft Windows graphic

To restore default settings for Windows Firewall

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, click Restore Defaults.

Note

  • XOX


Opening ports in Windows Firewall

To help protect the security of your computer, you should keep Windows Firewall (or another firewall of your choice) turned on, so that unsolicited requests to connect to your computer are blocked. To allow this type of connection, you must allow an exception or open a port for the specific program or service.

A port is an opening into your computer through which information can flow. For example, if you are exchanging instant messages with someone who wants to send you a file, such as a photo, Windows Firewall will ask you if you want to unblock the request so that the photo can reach your computer. Or, if you want to play a multiplayer network game with friends over the Internet, you can open a port for the game so that the firewall can allow the game information to reach your computer.

Risks of opening ports

Each time that you allow an exception or open a port for a program to communicate through Windows Firewall, your computer is made more vulnerable. Opening a port is like poking a hole through the firewall. If there are too many holes, there is not much wall left in your firewall. Unknown intruders often use software that scans the Internet looking for computers with unprotected connections. If you have many open ports, your computer can become a victim of these intruders.

To help decrease your security risk if you open ports:

  • Only open a port when you really need it.
  • Never open a port for a program that you do not recognize.
  • Close a port when you no longer need it.

How ports work

Each port has a number, which is like an address. Many programs and services have a "permanent address"—that is, they have predefined port numbers. You can find the correct port number for a program or service in the manufacturer's documentation or on their Web site. For more information, see How to Open Ports in Windows Firewall on the Microsoft Web site (http://www.microsoft.com/).

Some programs (some games, for example) do not have predefined port numbers. These programs open ports automatically as needed. For a program like this to connect to your computer, Windows Firewall must allow the program to open the correct port. For these programs to work correctly, they must be listed on the Exceptions tab in Windows Firewall.

When you add or change settings for a service or program, such as a game, you must choose whether to open the port to any computer or only to computers on your network. If you choose Any computer, anyone from the Internet or your network can connect to your computer. If you choose My network only, only computers on your local network can connect. If you prefer, you can click Custom, and then type a custom list of IP addresses and subnets that should be allowed access.


Turn Windows Firewall on or off for individual connections

Microsoft Windows graphic

To turn Windows Firewall on or off for individual connections

XOX

  1. Open Windows Firewall.
  2. Do one of the following:
    • To turn Windows Firewall on for a connection, on the Advanced tab, under Network Connection Settings, select the check box for the connection.
    • To turn Windows Firewall off for a connection, on the Advanced tab, under Network Connection Settings, clear the check box for the connection.

Notes

  • XOX
  • If you turn off Windows Firewall on this computer, your computer (or network, if you have one) might be vulnerable to intrusions.
  • These settings apply only when the firewall is set to On (on the General tab).
  • If you select Don't allow exceptions on the General tab, communication will be blocked for all unsolicited connections, regardless of the check box state for individual connections.


Open or close ports

Microsoft Windows graphic

To open or close ports

XOX

  1. Open Windows Firewall.
  2. On the Exceptions tab, choose one of the following options:
    • To open a port for a program or service, select the check box for the program or service.
    • To close a port for a program or service, clear the check box for the program or service.

Notes

  • XOX
  • Preconfigured programs and services on the Exceptions tab cannot be deleted.
  • Advanced users can open ports on a per-connection basis using Network Connection Settings on the Advanced tab.


Add a port

Microsoft Windows graphic

To add a port

XOX

  1. Open Windows Firewall.
  2. On the Exceptions tab, click Add Port.
  3. In Port number, type the port number that you want to add.
  4. Select either TCP or UDP.
  5. In Name, type a short name for the port to help you remember what it is used for.
  6. To specify which computers can use the port, click Change Scope.
  7. Do one of the following:
    • To allow connections from any computer, including those on the Internet, select Any computer (including those on the Internet), and then click OK.
    • To allow connections from your local subnet only, select My network (subnet) only, and then click OK.
    • To define a custom list, select Custom list, and then type a list of IP addresses, subnets, or both, separated by commas.

Notes

  • XOX
  • If you are not sure what port number to use or whether to choose TCP or UDP, check the documentation or the Web site for the program or service that you're adding a port for.


Change port or program settings

Microsoft Windows graphic

To change port or program settings

XOX

  1. Open Windows Firewall.
  2. On the Exceptions tab, click the program or service that you want to change port settings for, and then click Edit.
  3. In the Edit a Port or Edit a Program dialog box, select the settings that you want to change.

Notes

  • XOX
  • For more information, refer to the documentation or Web site for the program or service for which you are editing a port.


Delete a port or program

Microsoft Windows graphic

To delete a port or program

XOX

  1. Open Windows Firewall.
  2. On the Exceptions tab, select the port or program that you want to delete, and then click Delete.

Notes

  • XOX
  • Preconfigured programs and services on the Exceptions tab cannot be deleted.


Add a service definition for an individual connection

Microsoft Windows graphic

To add a service definition for an individual connection

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under Network Connection Settings, select the connection that you want to change, and then click Settings.
  3. On the Services tab, click Add, and then type the following information:
    • In Description of service, type a name that you can easily recognize.
    • In Name or IP address of the computer hosting this service on your network, type the name or IP address of this computer.
    • In External Port number for this service, type the port number that external computers use to contact this service.
    • In Internal Port number for this service, type the port number that the service uses. (This is usually the same number that you typed in the previous step.)
    • Click either TCP or UDP.

Notes

  • XOX
  • You can get the correct TCP or UDP port number from the service's documentation or Web site.


Edit a service definition for an individual connection

Microsoft Windows graphic

To edit a service definition for an individual connection

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under Network Connection Settings, select the connection that you want to edit, and then click Settings.
  3. On the Services tab, click the service you want to change, click Edit, and then change any of the following:
    • In Name or IP address of the computer hosting this service on your network, type the name or IP address of this computer.
    • In External Port number for this service, type the port number that external computers use to contact this service.
    • In Internal Port number for this service, type the port number that the service uses. (This is usually the same number that you typed in the previous step.)
    • Click either TCP or UDP.

Notes

  • XOX
  • For service definitions that are preconfigured, you can only edit the field that is labeled Name or IP address of the computer hosting this service on your network.
  • You can get the correct TCP or UDP port number from the service's documentation or Web site.
  • No two service definitions can simultaneously use the same internal port numbers.


Delete a service definition for an individual connection

Microsoft Windows graphic

To delete a service definition for an individual connection

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under Network Connection Settings, select the connection that you want to delete, and then click Settings.
  3. On the Services tab, click the service to be deleted, and then click Delete.

Notes

  • XOX
  • You can only delete services that you have added. You cannot delete service definitions that are preconfigured.
  • Deleting a service for one connection deletes it for all connections.


Windows Firewall security logging

If Windows Firewall is turned on, it can keep a security log (or record) of successful connections that go through the firewall and connections that are blocked (dropped packets).

When you choose to log dropped packets, information is collected about each attempt to cross the firewall that is detected and blocked by Windows Firewall. For example, if your Internet Control Message Protocol (ICMP) settings are not set to allow incoming echo requests, such as those sent out by the Ping and Tracert commands, and an echo request from outside your network is received, the echo request is dropped, and an entry is made in the log.

When you choose to log successful connections, information is collected about each successful connection that travels across the firewall. For example, when your computer successfully connects to a Web site using a Web browser, that connection is recorded in the log.

For information about how to view a Windows Firewall security log, see View the security log file. To save the firewall log to a specific location and with the name that you want, see Change the path and file name of the security log file.

The security log has two sections:

  • The header displays information about the version of the security log and the fields that are available for data entry, which you can add information to.
  • The body is the complete report of all of the information gathered and recorded about the traffic, or attempts to cross the firewall. The body of the security log is a dynamic list, which displays new data entries at the bottom of the log. For information about how to set up security logging, see Enable security logging options.

The following tables explain the information that is recorded in the security log:

Header information

Item

Description

Example
#Version: Displays which version of the Windows Firewall security log is installed. 1.5
#Software: Displays the name of the security log. Microsoft Windows Firewall
#Time: Indicates that all of the timestamps in the log are in local time. Local
#Fields: Displays a static list of fields that are available for security log entries, if data is available. These fields are listed in the Body table below. src-ip

Body data

Fields

Description

Example
Date Displays the year, month, and day that the recorded transaction occurred. Dates are recorded in the format:
YYYY-MM-DD
where YYYY is the year, MM is the month, and DD is the day. 		2001-01-27
Time Displays the hour, minute, and seconds at which the recorded transaction occurred. Times are recorded in the format:
HH:MM:SS
where HH is the hour in 24-hour format, MM is the number of minutes, and SS is the number of seconds. 		21:36:59
Action | Displays which operation was observed by the firewall. The options available to the firewall are OPEN, CLOSE, DROP, and INFO-EVENTS-LOST. An INFO-EVENTS-LOST action indicates the number of events that happened but that were not recorded in the log. | OPEN
Protocol | Displays which protocol was used for the communication. A protocol entry can also be a number for packets that are not TCP, UDP, or ICMP. | TCP
src-ip | Displays the source IP address (the IP address of the computer attempting to establish communications). | 192.168.0.1
dst-ip | Displays the destination IP address of a communication attempt. | 192.168.0.1
src-port | Displays the source port number of the sending computer. Only TCP and UDP display a valid src-port entry. All other protocols display a src-port entry of -. | 4039
dst-port | Displays the port number of the destination computer. Only TCP and UDP display a valid dst-port entry. All other protocols display a dst-port entry of -. | 53
size | Displays the packet size in bytes. | 60
tcpflags Displays the TCP control flags found in the TCP header of an IP packet:
  • Ack Acknowledgment field significant
  • Fin No more data from sender
  • Psh Push function
  • Rst Reset the connection
  • Syn Synchronize sequence numbers
  • Urg Urgent Pointer field significant
Flags are written as uppercase letters. 		FAP
tcpsyn | Displays the TCP sequence number in the packet. | 1315819770
tcpack | Displays the TCP acknowledgement number in the packet. | 2515999782
tcpwin | Displays the TCP window size in bytes in the packet. | 64240
icmptype | Displays a number that represents the Type field of the ICMP message. | 8
icmpcode | Displays a number that represents the Code field of the ICMP message. | 0
info | Displays an information entry that depends on the type of action that occurred. For example, an INFO-EVENTS-LOST action will result in an entry of the number of events that happened but were not recorded in the log from the time of the last occurrence of this event type. | 23

Notes

  • Windows Firewall security logging is turned off by default. To turn on security logging, see Enable security logging options.
  • Logging is only available for connections for which Windows Firewall is turned on.


View the security log file

Microsoft Windows graphic

To view the security log file

  1. Open Windows Firewall.
  2. On the Advanced tab, under Security Logging, click Settings.
  3. Click Browse.
  4. Right-click pfirewall.log, and then click Open.

Notes

  • XOX
  • The default name for the firewall log is pfirewall.log, and it is located in the Windows folder.
  • Either the Log dropped packets or the Log unsuccessful connections check box must be selected before the pfirewall.log file will appear in the Windows folder.
  • If the maximum allowable size for pfirewall.log (4096 kilobytes) is exceeded, the original information that the log file contains is transferred to a new file and saved with the file name, pfirewall.log.old. The new information is saved in the first file created, named pfirewall.log.


Enable security logging options

Microsoft Windows graphic

To enable security logging options

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under Security Logging, click Settings.
  3. Choose one of the following options:
    • To enable logging of unsuccessful inbound connection attempts, select the Log dropped packets check box.
    • To enable logging of successful outbound connections, select the Log successful connections check box.

Notes

  • XOX
  • Security logging is not enabled by default when Windows Firewall is turned on, but the firewall works normally whether security logging is enabled or disabled.
  • Logging is only available for connections for which Windows Firewall is enabled.
  • For information about opening and reading the security log file, click Related Topics.


Disable security logging options

Microsoft Windows graphic

To disable security logging options

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under Security Logging, click Settings.
  3. Do one or both of the following:
    • To disable logging unsuccessful inbound connection attempts, clear the Log dropped packets check box.
    • To disable logging successful outbound connections, clear the Log successful connections check box.

Notes

  • XOX
  • Windows Firewall works normally whether security logging is enabled or disabled.


Change the security log file size

Microsoft Windows graphic

To change the security log file size

XOX Also, Windows Firewall must be turned on.

  1. Open Windows Firewall.
  2. On the Advanced tab, under Security logging, click Settings
  3. In Size limit, type the new file size limit, or use the arrow keys to adjust the size.

Notes

  • XOX
  • The default maximum size limit of the security logs is 4,096 kilobytes (KB). The maximum log file size is 32,767 KB.
  • If the maximum allowable size for pfirewall.log is exceeded, the information that the log file contains is written to a new file and saved as pfirewall.log.old. The new information is saved in pfirewall.log.


Change the path and file name of the security log file

Microsoft Windows graphic

To change the path and file name of the security log file

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under Security Logging, click Settings.
  3. Click Save As, and navigate to the location where you want to save the log file.
  4. In File name, type the new log file name (or leave it blank to accept the default name of pfirewall.log) and then click Save.

Notes

  • XOX
  • If the maximum allowable size for pfirewall.log is exceeded, the information that pfirewall.log contains is saved as pfirewall.log.old and the new information is saved as pfirewall.log.


Advanced options in Windows Firewall

Advanced users can set Windows Firewall settings for individual connections. To do this, open Windows Firewall, click the Advanced tab, and then, under Network Connection Settings, click Settings.

Administrators can use Remote Desktop to troubleshoot Windows Firewall on client computers. However, if the Windows Firewall service does not start, an administrator will not be able to troubleshoot remotely because all ports will be closed, including the port used by Remote Desktop.

You can use Internet Control Message Protocol (ICMP) to choose various firewall options, such as Allow incoming echo request, Allow incoming timestamp request, Allow incoming router request, and Allow redirect. To set these options and to see brief descriptions of them, click the Advanced tab, and then, under ICMP, click Settings. For information about ICMP, see Internet Control Message Protocol (ICMP).

Administrators can use the netsh command line tool to configure Windows Firewall. For more information, see Configuring Windows Firewall from the command line.


Understanding which Windows Firewall settings are in effect

The combination of settings on the Exceptions tab plus any additional settings under Network Connection Settings on the Advanced tab is called the "resultant set" of Windows Firewall settings.

The resultant set can be different for each connection. Per-connection settings that open a port take precedence over global settings that might not open it. The following table shows some examples:

Global Setting | Per Connection Setting | Resultant Set
Disabled | Disabled | Disabled
Enabled (Subnet) | Disabled | Enabled (Subnet)
Enabled (Global) | Disabled | Enabled (Global)
Disabled | Enabled | Enabled
Enabled (Subnet) | Enabled | Enabled (Global)
Enabled (Global) | Enabled | Enabled (Global)

If you mix global and individual settings, the resultant set will be complex.


Group policy settings for Windows Firewall

Microsoft Windows graphic

Group Policy for Windows Firewall

With Windows Firewall, administrators can help protect the public connection of a small network or single computer that is connected to the Internet. For more information about Windows Firewall, see Windows Firewall overview. Group Policy settings list the components of the user's system that a system administrator needs to manage. For more information about Group Policy, see Group Policy overview.

These Group Policy settings are available in XOX:

  • Windows Firewall: Allow authenticated IPSec bypass
  • Windows Firewall: Allow file and printer sharing exception
  • Windows Firewall: Allow ICMP exceptions
  • Windows Firewall: Allow local port exceptions
  • Windows Firewall: Allow local program exceptions
  • Windows Firewall: Allow logging
  • Windows Firewall: Allow remote administration exception
  • Windows Firewall: Allow Remote Desktop exception
  • Windows Firewall: Allow UPnP framework exception
  • Windows Firewall: Define program exceptions
  • Windows Firewall: Define port exceptions
  • Windows Firewall: Do not allow exceptions
  • Windows Firewall: Protect all network connections
  • Windows Firewall: Prohibit notifications
  • Windows Firewall: Prohibit unicast response to multicast or broadcast requests

For more information about these settings, see the Windows XP SP2 documentation for IT professionals (http://www.microsoft.com/technet/winxpsp2/).


Configuring Windows Firewall from the command line

Advanced users can use the command line to configure Windows Firewall. You can use the netsh command line tool for this purpose.

The netsh commands in the following table are available for XOX. Typing the command plus " /?" displays the Help for that command.

Group | Command | Description
Add | netsh firewall add allowedprogram | Add allowed program configuration to Windows Firewall
 | netsh firewall add portopening | Add port configuration to Windows Firewall
Delete | netsh firewall delete allowedprogram | Delete allowed program configuration from Windows Firewall
 | netsh firewall delete portopening | Delete port configuration from Windows Firewall
Reset | netsh firewall reset | Reset Windows Firewall configuration to default
Set | netsh firewall set allowedprogram | Edit allowed program configuration in Windows Firewall
 | netsh firewall set icmpsettings | Edit ICMP configuration in Windows Firewall
 | netsh firewall set logging | Edit logging configuration in Windows Firewall
 | netsh firewall set notifications | Edit notification configuration in Windows Firewall
 | netsh firewall set opmode | Edit operational configuration in Windows Firewall
 | netsh firewall set portopening | Edit port configuration in Windows Firewall
 | netsh firewall set service | Edit service configuration in Windows Firewall
Show | netsh firewall show allowedprogram | Show allowed program configuration in Windows Firewall
 | netsh firewall show config | Show Windows Firewall configuration
 | netsh firewall show currentprofile | Show current profile of Windows Firewall
 | netsh firewall show icmpsettings | Show ICMP configuration in Windows Firewall
 | netsh firewall show logging | Show logging configuration in Windows Firewall
 | netsh firewall show notifications | Show notification configuration in Windows Firewall
 | netsh firewall show opmode | Show operational configuration in Windows Firewall
 | netsh firewall show portopening | Show port configuration in Windows Firewall
 | netsh firewall show service | Show service configuration in Windows Firewall
 | netsh firewall show state | Show current state of Windows Firewall

Notes

  • The Set machine, Set online, Set offline, and Dump commands are not supported in Windows Firewall. These commands do not do anything.
  • The Show commands usually only display locally configured settings. Group policy settings are not displayed except in Show state.


Enable Internet Control Message Protocol

Microsoft Windows graphic

To enable Internet Control Message Protocol

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under ICMP, click Settings.
  3. On the ICMP dialog box, select the check box beside each type of Internet Control Message Protocol (ICMP) message that you want to enable.

Notes

  • XOX
  • All ICMP options are disabled by default. If you enable ICMP options, your computer can become visible to anyone on your network or on the Internet.
  • When you select an option in the list, a description appears in the box below.


Disable Internet Control Message Protocol

Microsoft Windows graphic

To disable Internet Control Message Protocol

XOX

  1. Open Windows Firewall.
  2. On the Advanced tab, under ICMP, click Settings.
  3. On the ICMP dialog box, clear the check box beside each type of Internet Control Message Protocol (ICMP) message that you want to disable.

Notes

  • XOX
  • All ICMP options are disabled by default.


Using Internet Connection Sharing with Internet Gateway Device Discovery and Control

By default, the Internet Connection Sharing (ICS) public Internet connection can be controlled using Internet Gateway Device Discovery and Control.

With Internet Gateway Device Discovery and Control, users of ICS computers on your network can:

  • View statistics about the shared Internet connection.
  • Monitor the status of the shared Internet connection.
  • Remotely connect or disconnect the shared Internet connection.
  • Use an icon, displayed in the notification area on the taskbar, to monitor and control the shared Internet connection.
  • Configure service mappings.

For more information about Internet Gateway Device Discovery and Control, see Using Internet Gateway Device Discovery and Control.

The administrator of the computer that connects directly to the Internet can disable the options listed above for users of the other computers on the home or small office network. For more information, see Set permission for shared Internet connection control and Control the shared Internet connection.

Notes

  • To enable Internet Connection Sharing (ICS) with Internet Gateway Device Discovery and Control on computers running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition, run the Network Setup Wizard from the CD or floppy disk on those computers. For more information about the Network Setup Wizard, click Related Topics.
  • For ICS with Internet Gateway Device Discovery and Control to work on computers running Windows 98, Windows 98 Second Edition, and Windows Millennium Edition, Internet Explorer version 5.01 or later must be installed.
  • For ICS Internet Gateway Device Discovery and Control to work, you must select UPnP framework on the Exceptions tab in Windows Firewall.


Using Internet Gateway Device Discovery and Control

If your home network has an Internet gateway device, you can use Internet Gateway Device Discovery and Control (IGDDC) to monitor and configure the device’s Internet connection from any computer connected to your home network and running Windows.

IGDDC works with residential gateways, Wi-Fi wireless base stations, and computers configured for Internet Connection Sharing (ICS).

The Internet gateway device icon

If your home network has an Internet gateway device, IGDDC adds an Internet gateway device icon to the Network Connections folder or the Communications program group, depending on which version of Windows your computer is running. The icon displays the name and status of the Internet connection on your device, and controls to configure the device.

When an Internet gateway device is discovered, the icon automatically appears on your computer. In XOX, the icon appears in the Network Connections folder, under Internet Gateway. On computers running Windows 98 and Windows Millennium Edition, an icon appears in the Communications program group and in the taskbar.

If the icon does not appear on your computer, make sure that:

  • Your computer is physically connected to the network.
  • You have a good wireless signal (to view signal strength, right-click the wireless networking icon in the taskbar).
  • Your Internet gateway device or the computer that connects directly to the Internet (the ICS host computer) is configured correctly and is connected to the network.
  • If Windows Firewall is enabled, the UPnP framework ports are open. For more information, see Enable UPnP network functionality.

If you tried the steps above and the icon still does not appear, you can try repairing your computer’s network connection. Repairing the connection forces it to create the icon on your computer. For more information, see Force a network adapter to acquire an IP address.

If the shared Internet connection is disconnected, double-clicking the Internet gateway device icon dials the Internet connection. If the shared Internet connection is connected, double-clicking the icon opens the status window, where you can view connection status and statistics or disable the shared Internet connection. You can also right-click the shared Internet connection icon of an active connection to view the Properties page, where you can select the Show icon in the notification area when connected check box or open the status window. If the connection is disabled, you can view the Properties page or enable the shared Internet connection by right-clicking the shared Internet connection icon. Enabling or disabling the shared Internet connection from any single computer, enables or disables the connection for the entire network.

The following table lists the types of information that are available in the status window on computers using IGDDC.

Status window title | Displays the name of the shared Internet connection. When the Internet gateway device is a computer running XOX and using ICS, this appears as the name of the shared dial-up or high-speed connection and the name of the ICS host computer, in the following form: connection name connection on host name status. For example, if your ICS host computer is named Main, and your shared Internet connection is named ICS, the title of the status window appears as: ICS connection on Main status.
Status Displays the connectivity status of the connection between the Internet gateway device and the Internet service provider (ISP). This status is updated in real time to provide accurate information about the shared Internet connection. The status that is displayed is always one of the following:
  • Connected or Enabled, when the Internet gateway device is connected to the ISP.
  • Disconnected or Disabled, when the Internet gateway device is not connected to the ISP.
Status only appears in the status window once the shared Internet connection is either completely connected or completely disconnected. When the shared Internet connection is a dial-up connection, a dialog box appears on the ICS host computer while the connection is being made, whether the connection was initiated from a network client or from the ICS host computer.
Duration | Displays the duration of the current connection between the ICS host computer and the ISP. The duration shows days, hours, minutes, and seconds that have elapsed since the connection was last activated. It is updated in real time.
Speed | Displays the speed in megabits per second (Mbps) at which the Internet gateway device’s Internet connection is capable of operating. This is the speed that the Internet gateway device is capable of, not the speed at which data is actually sent to and from the Internet. Downloads, streaming media, and other types of data transfer might not actually be transferred at the speed indicated.
Shared connection statistics | Displays the total number of bytes or packets that are sent and received between the Internet gateway device and the ISP. Whether the information is displayed in bytes or packets depends on which type is supported by your Internet gateway device.
My Computer | Displays the total number of bytes or packets sent from or received by the client. If the client is connected to the Internet, the number of bytes or packets sent and received between the Internet gateway device and your computer is displayed. If your computer is communicating with other computers on your private network, the number of bytes or packets sent and received between your computer and the other network computers is displayed.
Disconnect button | Allows users to immediately disconnect a shared dial-up connection or to disable the public adapter on the Internet gateway device. This button displays Disconnect if your shared Internet connection is a dial-up connection, and Disable if your shared Internet connection is a high-speed connection, such as DSL or cable modem.

When you view the Properties tab of the icon for the shared Internet connection, you can configure service definitions. The contents of the tab provide information only, with the exception of the option to display the shared Internet connection icon in the notification area on the taskbar. For more information, see Display network connection icons on the taskbar.

Display the shared Internet connection icon in the notification area

You can display the icon for the shared Internet connection in the notification area on the taskbar. For more information, see Display network connection icons on the taskbar.

With IGDDC, you can pause your mouse pointer over the icon to see the name of the shared Internet connection and the speed that the Internet gateway device is capable of.

If you click the icon in the notification area on the taskbar, a status window opens. This window provides statistics and the option to disconnect the shared Internet connection from the Internet. You can also right-click the icon to see a menu that provides an alternative way to disconnect the shared Internet connection from the Internet.

For more information about using the shared Internet connection icon, see Control the shared Internet connection , Using Internet Connection Sharing with Internet Gateway Device Discovery and Control, and Set permission for shared Internet connection control.

Notes

  • XOX
  • To use IGDDC on computers running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition, run the Network Setup Wizard from the CD or floppy disk on those computers. For more information about the Network Setup Wizard, click Related Topics.
  • For IGDDC to work on computers running Windows 98, Windows 98 Second Edition, or Windows Millennium Edition, Internet Explorer version 5.01 or later must be installed.
  • If Windows Firewall is enabled, UPnP framework must be selected on the Exceptions tab in Windows Firewall for IGDDC to work.
  • If UPnP architecture is not supported by your home router, IGDDC will not work.


Set permission for shared Internet connection control

Microsoft Windows graphic

To set permission for shared Internet connection control

  1. Open Network Connections.
  2. Click the network connection on which Internet Connection Sharing (ICS) is enabled, and then, under Network Tasks, click Change settings of this connection.
  3. On the Advanced tab, under Internet Connection Sharing, do one of the following:
    • To give network clients permission to control the shared Internet connection, select the Allow other network users to control or disable the shared Internet connection check box.
    • To revoke the permission of network clients to control of the shared Internet connection, clear the Allow other network users to control or disable the shared Internet connection check box.

Notes

  • XOX
  • Allow other network users to control or disable the shared Internet connection is enabled by default. Unless you clear the check box, control of the shared Internet connection is available to client computers. Other users on your network can disable or enable the current Internet connection for the entire network.
  • The Allow other network users to control or disable the shared Internet connection check box is independent of the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box.
  • If the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box is selected, when the ICS host detects a client's outbound Internet traffic, it connects to the Internet using the shared Internet connection. However, unless the Allow other network users to control or disable the shared Internet connection check box is selected, the client is unable to control when the connection connects or disconnects.
  • To enable Internet Connection Sharing (ICS) Discovery and Control on Windows 98, Windows 98 Second Edition, and Windows Millennium Edition computers, run the Network Setup Wizard from the CD or floppy disk on these computers. For more information about the Network Setup Wizard, click Related Topics.
  • For ICS Discovery and Control to work on Windows 98, Windows 98 Second Edition, and Windows Millennium Edition computers, Internet Explorer version 5.01 or later must be installed.


Force a network adapter to acquire an IP address

Microsoft Windows graphic

To force a network adapter to acquire an IP address

  1. Open Network Connections.
  2. Click the icon for the adapter that connects this computer to the Internet or to other network computers.
  3. Under Network Tasks, click Repair this connection.

Notes

  • XOX
  • If you are having difficulty connecting the Internet Connection Sharing (ICS) host to the Internet, you can use Repair to obtain refreshed IP address configurations from your Internet service provider (ISP).
  • If a computer on your network is unable to communicate with other network computers, you can use Repair to force the connection to refresh its IP address configuration from the ICS host.
  • If the icon for the shared Internet connection does not automatically appear on a client computer (and the Allow other network users to control or disable the shared Internet connection check box has not been disabled), it may be because ICS has not assigned an IP address to your network adapter. An IP address is required in order for a client computer to use ICS Discovery and Control features, connect with to the Internet, or to communicate with other computers on the network.
  • When ICS is enabled, it automatically provides an IP address for the ICS host's private connection. The ISP assigns an IP address to the shared Internet connection.
  • Before using the Repair menu command on the ICS host computer, ensure that you have plugged in the adapter that is used for the Internet connection.
  • Before using the Repair menu command, ensure that the client computer is plugged into the network and that the ICS host is running, configured, and connected to the network.


Control the shared Internet connection

Microsoft Windows graphic

To control the shared Internet connection

  1. Open Network Connections.
  2. Right-click the icon for the shared Internet connection, and do one of the following:
    • To connect to the Internet using the shared Internet connection, click Connect or Enable.
    • To disconnect the shared Internet connection from the Internet, click Disconnect or Disable.

Notes

  • XOX
  • If your network uses a dial-up Internet connection, Connect connects you to the Internet using the shared Internet connection. If your network uses a high-speed Internet connection, Enable provides the same service.
  • If your network uses a dial-up Internet connection, Disconnect disconnects your shared Internet connection from the Internet. If your network uses a high-speed Internet connection, Disable provides the same service.
  • If the Allow other network users to control or disable the shared Internet connection check box has been selected on the Internet Connection Sharing (ICS) host computer, you can activate the shared Internet connection from a client computer by double-clicking the shared Internet connection icon, which is located in the Network Connections folder under Internet Gateway.
  • If the Allow other network users to control or disable the shared Internet connection check box is selected on the ICS host computer, and the Show icon in the notification area when connected check box is selected for the shared Internet connection on the client computer, you can disconnect the shared Internet connection by right-clicking the taskbar icon and selecting Disconnect.
  • If the Allow other network users to control or disable the shared Internet connection check box is not selected, client computers on your network are unable to control the shared Internet connection.
  • When you disconnect an active shared Internet connection, all of the active Internet sessions on your network terminate, and the icon for the shared Internet connection disappears from the notification area on the taskbar until the connection has been reactivated by any of your network computers.
  • To enable Internet Connection Sharing (ICS) Discovery and Control on Windows 98, Windows 98 Second Edition, and Windows Millennium Edition computers, run the Network Setup Wizard from the CD or floppy disk on these computers. For more information about the Network Setup Wizard, click Related Topics.
  • For ICS Discovery and Control to work on Windows 98, Windows 98 Second Edition, and Windows Millennium Edition computers, Internet Explorer version 5.01 or later must be installed.


Enable Internet Connection Sharing on-demand dialing

Microsoft Windows graphic

To enable Internet Connection Sharing on-demand dialing

XOX

  1. Open Network Connections.
  2. Click the network connection on which Internet Connection Sharing (ICS) is enabled, and then, under Network Tasks, click Change settings of this connection.
  3. On the Advanced tab, under Internet Connection Sharing, do one of the following:
    • To enable ICS on-demand dialing, select the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box.
    • To disable ICS on-demand dialing, clear the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box.

Notes

  • XOX
  • Establish a dial-up connection whenever a computer on my network attempts to access the Internet is enabled by default. Unless you clear the check box, clients can activate the shared Internet connection from their computers by starting their Internet browsers or mail programs.
  • For ICS on-demand dialing to work correctly for ICS clients, the connection must be an all user connection, with the credentials saved for all users.
  • The Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box is independent of the Allow other network users to control or disable the shared Internet connection check box.
  • If the Establish a dial-up connection whenever a computer on my network attempts to access the Internet check box is selected, when the ICS host computer detects a client's outbound Internet traffic, it connects to the Internet using the shared Internet connection. However, unless the Allow other network users to control or disable the shared Internet connection check box is selected, the client is unable to control when the connection connects or disconnects.


Add or remove the Internet Gateway Device Discovery and Control Client

Microsoft Windows graphic

To add or remove the Internet Gateway Device Discovery and Control Client

XOX

  1. Open Network Connections.
  2. On the Advanced menu, click Optional Networking Components, and then do one of the following:
    • To add the Internet Gateway Device Discovery and Control Client, select the Internet Gateway Device Discovery and Control Client check box.
    • To remove the Internet Gateway Device Discovery and Control Client, clear the Internet Gateway Device Discovery and Control Client check box.
  3. Click Next.
  4. Open Windows Firewall.
  5. On the Exceptions tab, select the UPnP framework check box.

Notes

  • XOX
  • XOX
  • The Internet Gateway Device Discovery and Control Client is an optional networking component that is installed by default on XOX.
  • Internet Gateway Device Discovery and Control is also called Internet Connection Sharing Discovery and Control.


Direct connections overview

With Network Connections, you can create a physical connection to another computer by using a serial cable, a DirectParallel cable, a modem, an ISDN device, or other method. For example, you may have a Windows CE Handheld PC that you want to connect to your network. Or, you may have two or more networks in the same location that are not physically connected. If you want to use resources on both networks from one computer, you can use a serial cable connection with an RS-232C null modem cable. You connect an RS-232C cable from a COM port on the computer to a COM port on your remote access server, which is used to create network access. You can also use an RS-232C null modem as a substitute for a network adapter if your computer is located physically near (less than 50 feet of cable) a remote access server.

The DirectParallel driver supports computer-to-computer connections by using standard and enhanced (ECP) parallel ports, which use Parallel Technologies' Basic or Fast parallel cables. For more information about using a DirectParallel cable for a direct connection, see DirectParallel access.

Remote access authentication methods control access to your network, not resources on the network. Having a Windows CE device directly attached to a computer on your network is analogous to having a computer attached to your network, but not logged on. In that instance, you attached and accessed the network without using authentication of any kind.

Once you are present on a network, resource control is managed in various ways: Local Users and Groups, Active Directory, Group Policy, file and printer sharing, and so on.

Therefore, if you have set up a direct network connection using, for example, a Windows CE device, you need to ensure that resource control is in place that enforces access to privileged folders, printers, and so on.

Authentication methods are designed for remote computing, where the computer dialing in does not have access to the network until credentials such as user name and password are exchanged.

For information about creating a direct network connection, see To make a direct network connection.

Note

  • XOX


Make a direct network connection

Microsoft Windows graphic

To make a direct network connection

To create a direct network connection that acts as a host, you must be logged on as Administrator or be a member of the Administrators group. Guest direct network connections do not require administrator-level rights.

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Set up an advanced connection, and then click Next.
  4. Click Connect directly to another computer, click Next, and then follow the instructions in the New Connection Wizard.

Notes

  • XOX
  • If you specify your connection as a host when you create it, the connection appears as Incoming Connections in the Network Connections folder.
  • You can create multiple direct connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple ports, host computers, and so on.
  • Direct connections can bypass authentication requirements. This is useful for devices such as palmtop computers. You must configure this setting in the host incoming connection. XOX
  • If you create a direct connection by using a serial (RS-232C) cable, the port that you select in the New Connection Wizard is enabled for connections that use a null modem.
  • If you are logged on to your computer as Administrator or a member of the Administrators group when you create a direct connection, you are presented with a list of connection devices to choose from that includes all of the parallel ports for the computer, infrared ports that are installed and enabled, and COM ports. If you are logged on as a user who is not a member of the Administrators group, and create a direct connection, the list of devices includes the parallel ports for the computer, infrared ports that are installed and enabled, and only the COM ports that are configured with null modems. If you need to use a COM port for a direct connection, ask your system administrator to configure one of the COM ports on your computer with a null modem by using Phone and Modem Options in Control Panel.
  • Users do not need to use direct connections to allow access to shared resources, such as files and printers, over a local area network. In order to enable shared access to resources on the local computer, you must enable file and print sharing, share the resources, and then set up the appropriate permissions.


Make a direct network connection by using a DirectParallel cable

Microsoft Windows graphic

To make a direct network connection by using a DirectParallel cable

XOX

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Set up an advanced connection, and then click Next.
  4. Click Connect directly to another computer, click Next, and then do one of the following:
    • If you want your computer to act as the host (your computer contains the information you need to access), click Host.
    • If you want your computer to act as the guest (your computer accesses information on another computer), click Guest, and then click Next.
  5. In Device for this connection, click Direct Parallel (LPT1) and then click Next.
  6. Follow the remaining instructions in the Network Connection Wizard.

Notes

  • XOX
  • A direct network connection that uses a DirectParallel cable requires a stand-alone computer running Windows 2000 or XOX.
  • For information about contacting Parallel Technologies or their local dealers to order DirectParallel cables, click Related Topics.


ISDN overview

To enhance connection speeds, you can use an Integrated Services Digital Network (ISDN) line. Whereas standard phone lines typically transmit from 28.8 to 56 kilobits per second (Kbps), typical ISDN devices are capable of 64 or 128 Kbps. This is slower than local area networks supported by high-speed data communications technology, but faster than analog telephone lines. ISDN provides end-to-end digital connectivity between your computer and a remote computer or network by using a local telephone line for network connection.

An ISDN line must be installed by the phone company at your site and at the remote access server. Also, an ISDN adapter must be installed in place of a modem in both your computer and the remote access server. Costs for ISDN equipment and lines may be higher than standard modems and phone lines. However, the speed of communication reduces the duration of the connection time, thereby possibly saving toll charges.

An ISDN line comes with two B channels that transmit data at 64 Kbps, and one D channel for signaling that transmits data at 16 Kbps. You can configure each B channel to operate as a port. With this configuration, line speed increases to 128 Kbps. Channel aggregation schemes are specific to each driver, so you must use the same driver and equipment on the client and server.

Multilink dialing over ISDN combines multiple physical links into a logical bundle. This aggregate link increases your bandwidth. To use Multilink, both your connection and the remote access server must have Multilink enabled. Multilink is automatically enabled in XOX and XOX.


Make a dial-up connection by using an ISDN line

Microsoft Windows graphic

To make a dial-up connection by using an ISDN line

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Connect to the Internet, and then click Next.
  4. Click Set up my connection manually, and then click Next.
  5. Click Connect using a dial-up modem, click Next, and then follow the instructions in the New Connection Wizard.

Note

  • XOX


Install an ISDN adapter

Microsoft Windows graphic

To install an ISDN adapter

XOX

  1. Install an Integrated Services Digital Network (ISDN) adapter and start your computer. If you install more than one ISDN adapter, you must restart your computer after you have installed the ISDN drivers. Otherwise, all available ISDN ports may not show up when you configure your network connection for ISDN.
  2. You can use Device Manager to configure your system so that your ISDN adapter knows what type of telephone switch it is connected to. The switch type simply refers to the brand of equipment and software revision level that the telephone company uses to provide you with ISDN service. There are only a few types of switches in the world and usually just one in countries/regions other than the United States. Some examples of switch types include ATT (AT&T), NI-1 (National ISDN-1), and NTI (Northern Telecom).

Notes

  • XOX
  • The ISDN manufacturer can install the adapter as either an ISDN device or as a modem. If the adapter is installed as a device, it appears in device manager. If it is installed as a modem, it appears in the Modems control panel. Whether the adapter is installed as a device or a modem, it's connection type is dial-up.


Configure ISDN settings

Microsoft Windows graphic

To configure ISDN settings

  1. Open Network Connections.
  2. Select the dial-up connection that uses ISDN, and then, under Network Tasks, click Change settings of this connection.
  3. On the General tab, in Connect using, click the ISDN device, and then click Configure.
  4. In the ISDN Configure dialog box, do one or both of the following:
    • In Line type, click the line type you want to use. The line types are listed from highest to lowest quality.
    • If you want to start negotiation with the line type you selected, and then negotiate with a lower-quality line type depending on the line's condition, select the Negotiate line type check box.

Notes

  • XOX
  • Depending on the type of ISDN adapter that you are using, when you click Configure in step 3, you may be presented with Modem Configuration settings.


X.25 overview

Microsoft Windows graphic

Using X.25

An X.25 network transmits data with a packet-switching protocol, bypassing noisy telephone lines. This protocol relies on an elaborate worldwide network of packet-forwarding nodes that can participate in delivering an X.25 packet to its designated address.

Network Connections supports X.25 by using packet assemblers/disassemblers (PADs) and X.25 cards. You can also use a modem and special dial-up X.25 carriers (such as Sprintnet and Infonet) in place of a PAD or X.25 smart card on your computer.

Remote access clients running XOX or Windows 2000 Server or later can use either an X.25 card or dial in to an X.25 PAD to create connections. To accept incoming connections on a computer using X.25 running XOX or Windows 2000 Server or later, you must use an X.25 card.

For more information about installing an X.25 card, see To install X.25.

For information about creating an X.25 connection, see To make a dial-up connection by using X.25.


Make a dial-up connection by using X.25

Microsoft Windows graphic

To make a dial-up connection by using X.25

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Connect to the network at my workplace, and then click Next.
  4. Click Dial-up connection, click Next, and then follow the instructions in the New Connection Wizard.
  5. When the wizard is finished, right-click the new connection, and then click Properties.
  6. On the Options tab, click X.25.
  7. In Network, click your X.25 network provider.
  8. In X.121 address, type the X.121 address (the X.25 equivalent of a phone number) for the server you want to call.
  9. If required by the X.25 host computer, in User Data, type additional connection information.
  10. In Facilities, type any additional facility options you want to request from your X.25 provider. (For example, some providers support the /r option to specify reverse charging.)

Notes

  • XOX
  • For details on facility options, consult your X.25 documentation or provider.


Install X.25

Microsoft Windows graphic

To install X.25

  • Install the X.25 card or PAD card and start your computer.

    For instructions on installing the card, see your X.25 manufacturer's documentation.


Incoming connections overview

Microsoft Windows graphic

Incoming connections

By creating an incoming connection, a computer can act as a remote access server if it is running Windows 2000 Professional, XOX, or XOX, or if it is a stand-alone computer running Windows 2000 Server. You can configure an incoming connection to accept the following connection types: dial-up (modem, ISDN, X.25), virtual private network (VPN) (PPTP, L2TP), or direct (serial, infrared). On a computer running Windows 2000 Professional, XOX, or XOX, an incoming connection can accept up to three incoming calls, up to one of each of these types.

The Multilink feature automatically configures multiple modems or ISDN adapters for use with incoming dial-up connections. For more information on Multilink, see Configuring multiple device dialing.

When you create a connection, the users that can connect to your incoming connection and their network protocols are selected. Each user that connects to an incoming connection must have established a local user account. For more information about user settings such as name, password, and callback rights, see To grant incoming connection access rights to your computer. For more information about configuring your connection for the TCP/IP network protocol, see To configure an incoming connection to use TCP/IP. For more information about configuring your connection for the IPX network protocol, see To configure an incoming connection to use IPX. XOX

For information about creating an incoming connection, see To make an incoming network connection.

Notes

  • XOX can accept three incoming connections at a time, provided they are different types. For example, there can be three simultaneous connections, one each, from dial-up, VPN, and a direct connection. If another incoming connection attempt is made with the same type, such as two dial-up connections, the second connection request is rejected.
  • Users do not need to use incoming connections to allow access to shared resources, such as files and printers, over a local area network. In order to enable shared access to resources on the local computer, you must enable file and print sharing, share the resources, and then set the appropriate permissions. For information about sharing a folder, see To share a folder or drive with other people.
  • Multilinking is automatically enabled in XOX and XOX.


Make an incoming network connection

Microsoft Windows graphic

To make an incoming network connection

XOX

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Set up an advanced connection, and then click Next.
  4. Click Accept incoming connections, click Next, and then follow the instructions in the New Connection Wizard.

Notes

  • XOX
  • If you make another incoming network connection, and you use the New Connection Wizard again, the existing incoming network connection is reconfigured.
  • If your incoming connection and Fax Service have problems working together (for example, you cannot receive incoming connection calls on a device enabled for Fax receive), the modem may not support adaptive answer. Check your modem documentation to verify that you need to disable Fax receive for that device to accept incoming connections.
  • Incoming connections are only used for dial-up, VPN, or direct connection clients.


Grant incoming connection access rights to your computer

Microsoft Windows graphic

To grant incoming connection access rights to your computer

XOX

  1. Open Network Connections.
  2. Click Incoming Connections, and then, under Network Tasks, click Change settings of this connection.
  3. On the General tab, do one or more of the following:
    • Under Incoming connections, in Devices, click the check boxes next to the devices through which incoming connections can connect.
    • If you want to enable others to make private connections to your computer by tunneling through the Internet or other network, select the Allow others to make private connections to my computer by tunneling through the Internet or other network check box.
    • If you want to show icons in the notification area when incoming connections are connected, select the Show icons in notification area when connected check box.
  4. On the Users tab, do one or more of the following:
    • If you want to allow a user to connect, select the check box next to the user's name.
    • If you want to revoke a user's right to connect, clear the check box next to a user's name.
    • To create a new user and grant them access to connect, click New.
    • To remove a user, select a name in the list, and then click Delete.
    • To modify a user's name, password, and callback privileges, click Properties.
    • If you want all users to connect by using securely encrypted passwords and data, select the Require all users to secure their passwords and data check box.
    • If you want directly connected devices to connect without providing a password, select the Always allow directly connected devices such as palmtop computers to connect without providing a password check box.
  5. On the Networking tab, do one or more of the following:
    • If you want to enable a network component, in Network Components, select the check box next to the component name.
    • If you want to disable a network component, in Network Components, clear the check box next to the component name.
    • To add a network component, click Install.
    • To remove a network component, select a component, and then click Uninstall.
    • To configure a network component, select a component, and then click Properties.

Notes

  • XOX
  • XOX and XOX can accept three incoming connections at a time, provided they are different types. For example, there can be three simultaneous connections, one each, from dial-up, VPN, and a direct connection. If another incoming connection attempt is made with the same type, such as two dial-up connections, the second connection request is rejected.
  • If you enable or disable TCP/IP or the NWLink IPX/SPX/NetBIOS compatible Transport Protocol in incoming connections, the settings affect only incoming connections. XOX
  • Internet Protocol (TCP/IP) is installed by default and cannot be uninstalled.


Incoming connections and IP addresses

The incoming connections computer assigns IP addresses to the remote computers that connect to it. The IP address is assigned in one of two ways:

  • They are automatically allocated by DHCP.
  • They are assigned based on a range of addresses that is defined in the TCP/IP properties for the incoming connection.

If you want to specify a range of IP addresses, you must provide a starting IP address and an ending IP address for the range. Network Connections calculates the number of addresses that can be used within the starting and ending addresses of the range. For more information about specifying the range, and the affects of a subnet on the address range, see To configure an incoming connection to use TCP/IP.

If the incoming connections computer is attached to another network, and the specified address range consists of a subset of IP addresses for the network to which the computer is attached, you must ensure that the addresses in the range are not already assigned to other TCP/IP nodes within the attached network. This is recommended because using a subset of the larger network's addresses requires less manual configuration of the intranet nodes.

If you must use a range of addresses that is not a subset of the network to which the incoming connections computer is attached, then steps must be taken to ensure that computers on the network attached to the incoming connections computer can reach the incoming connection clients. To do this, on each of the computer on the network, you can create a route to the incoming client computers with the IP address of the incoming connections computer as the associated gateway.

  • If the incoming connections computer has Internet Connection Sharing (ICS) enabled on a dial-up, VPN, or local area connection, then no special configuration is required. The DHCP addressing in ICS configures the client computers on the network to use the ICS host computer as the default gateway.

For more information, see To configure a default gateway.

Note

  • Internet Connection Sharing cannot be enabled on incoming connections.


Configure an incoming connection to use TCP/IP

Microsoft Windows graphic

To configure an incoming connection to use TCP/IP

  1. Open Network Connections.
  2. Click Incoming Connections, and then, under Network Tasks, click Change settings of this connection.
  3. On the Networking tab, under This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties
    4. .
  4. If you want incoming users to be able to access the local area network on which the dial-up computer resides, select the Allow callers to access my local area network check box.
  5. Do one of the following:
    • If you want to automatically assign TCP/IP addresses, click Assign TCP/IP addresses automatically using DHCP.
    • If you want to specify TCP/IP addresses, click Specify TCP/IP addresses, and do the following:
      • In From, type the starting IP address.
      • In To, type the ending IP address.

        • Based on the addresses you type in From and To, the number of addresses that are allocated is displayed in Total. The starting and ending IP addresses that you choose depend on the originating address space and the number of addresses needed. For more information on defining IP addresses for incoming connections, click Related Topics.

  6. If you want incoming connections to be able to use a specific TCP/IP address, select the Allow calling computer to specify its own IP address check box.

Notes

  • XOX
  • Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. The closest matching subnet is calculated for the range that you specified in From and To. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.
  • Allowing remote clients to specify their own TCP/IP address is a potential security risk to your network. A client can impersonate a previously connected client and gain access to network resources that were accessed by the other client.
  • If you select Allow callers to access my local area network or Allow calling computer to specify its own IP address, these changes take effect immediately.
  • If you select Assign TCP/IP addresses automatically using DHCP, but there is no DHCP server available, random address from the range 169.254.0.1 to 169.254.255.254 are assigned.


Configure an incoming connection to use IPX

Microsoft Windows graphic

To configure an incoming connection to use IPX

  1. Open Network Connections.
  2. Click Incoming Connections, and then, under Network Tasks, click Change settings of this connection.
  3. On the Networking tab, click NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, and then click Properties
    4. .
  4. If you want incoming users to be able to access the local area network that the dial-up computer resides on, select the Allow callers to access my local area network check box.
  5. If you want the same network number to be used consistently, select the Assign same network number to all computers check box, and do one of the following:
    • If you want the incoming connection to use the NetWare Router Information Protocol (RIP) to determine an IPX network number that is not in use in the IPX network, click Assign network number automatically. The incoming connection then assigns that number to the incoming computer.
    • If you want more control of network number assignments for security or monitoring purposes, click Assign specified network number, and type the network number.
  6. If you want incoming connections to be able to use specific network numbers, select the Allow callers to specify their own node numbers check box.

Notes

  • XOX
  • XOX
  • If the IPX protocol is not listed in Network Components, you need to install it. To install IPX, click Install, and in the Select Network Component Type box, click Protocol, and then click Add. Select NWLink IPX/SPX/NetBios Compatible Transport Protocol.
  • Allowing remote clients to choose their own node number is a potential security threat to your network; a client can impersonate a previously connected client and gain access to network resources that were accessed by the other client.
  • If you select Allow callers to access my local area network or Allow callers to specify their own node numbers, these changes take effect immediately.
  • If you select Assign same network number to all computers, Assign network numbers automatically, or Assign specified network number, these changes take effect as soon as there are no callers.


Configure callback for incoming connections

Microsoft Windows graphic

To configure callback for incoming connections

  1. Open Network Connections.
  2. Click Incoming Connections, and then, under Network Tasks, click Change settings of this connection.
  3. On the Users tab, click the user for which you want to configure callback, and then click Properties.
  4. On the Callback tab, do one of the following:
    • If you do not want to use callback for incoming connections, click Do not allow callback.
    • If you want to give incoming connections the option of setting a specific callback number, click Allow the caller to set the callback number.
    • If you want to consistently use the same callback number, click Always use the following callback number, and type the number.

Note

  • XOX


Incoming connection clients

XOX supports incoming connections from clients running XOX, Windows 2000, and the following operating systems:

  • Windows NT version 4.0 clients

    • Windows NT version 4.0 clients can take full advantage of all incoming connection features except dynamic allocation of multilinked lines, Extensible Authentication Protocol (EAP), IPSec client to server data security, and L2TP for tunneling across intervening networks.

  • Windows NT version 3.1, 3.5, and 3.51 clients

    • Windows NT version 3.5x clients can take full advantage of incoming connection features, except for Multilink functionality. Windows NT 3.5x clients negotiate the logon process and authentication with the incoming connection. You can also configure these clients to use scripts that completely automate the logon process.

    Windows NT version 3.1 clients do not support the Point-to-Point Protocol (PPP) introduced in Windows NT 3.5. Only Windows NT 3.5x or other PPP clients provide the support necessary to run TCP/IP or IPX programs on clients that directly communicate with servers on the LAN by using TCP/IP or IPX.

  • Windows Millennium Edition clients

    • Windows Millennium Edition clients can take full advantage of incoming connection features, except dynamic allocation of multilinked lines and the Extensible Authentication Protocol. Windows Millennium Edition clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Windows 98 clients

    • Windows 98 clients can take full advantage of incoming connection features, except dynamic allocation of multilinked lines and the Extensible Authentication Protocol. Windows 98 clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Windows 95 clients

    • Windows 95 clients can take full advantage of incoming connection features, except the use of Multilink, dynamic allocation of multilinked lines, and Extensible Authentication Protocol. Windows 95 clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Windows For Workgroups, MS-DOS, and LAN Manager clients

    • Windows 2000 Server or later provides a Microsoft Network Client version 3.0 for MS-DOS and a Windows for Workgroups client that provide remote access. Separately purchased Windows for Workgroups and LAN Manager Network Connections clients can also connect to an incoming connection.

    You must set up the Microsoft Network Client 3.0 for MS-DOS to use the full redirector (the default setting). If the basic redirector is used, the remote access program Rasphone cannot start, and an incoming connection cannot be reached.

    Windows for Workgroups, MS-DOS, and LAN Manager clients can use the remote access NetBIOS gateway to access NetBIOS servers running TCP/IP or IPX but these clients cannot run programs that must use TCP/IP or IPX on the client.

    These clients also do not support the PPP protocol introduced in Windows NT 3.5.

  • PPP clients

    • Non-Microsoft PPP clients that use TCP/IP or IPX can access an incoming connection. The incoming connection automatically negotiates authentication with PPP clients; special configuration for non-Microsoft PPP clients is not required.

    For more information about your PPP client, see the software documentation for your PPP client.

XOX


Virtual private network (VPN) connections overview

With the Point-to-Point Tunneling Protocol (PPTP)or Layer Two Tunneling Protocol (L2TP), which are automatically installed on your computer, you can securely access resources on a network by connecting to a remote access server through the Internet or other network. The use of both private and public networks to create a network connection is called a virtual private network (VPN). The following table describes the advantages of using VPN connections.

Advantage | Example
Cost advantages | The Internet is used as a connection instead of a long distance telephone number or 1-800 service. Because an ISP maintains communications hardware such as modems and ISDN adapters, your network requires less hardware to purchase and manage.
Outsourcing dial-up networks | You can make a local call to the telephone company or Internet service provider (ISP), which then connects you to a remote access server and your corporate network. It is the telephone company or ISP that manages the modems and telephone lines required for dial-up access. Because the ISP supports complex communications hardware configurations, a network administrator is free to centrally manage user accounts at the remote access server.
Enhanced security | The connection over the Internet is encrypted and secure. New authentication and encryption protocols are enforced by the remote access server. Sensitive data is hidden from Internet users, but made securely accessible to appropriate users through a VPN.
Network protocol support | Because the most common network protocols (including TCP/IP and IPX) are supported, you can remotely run any application dependent upon these particular network protocols. XOX
IP address security | Because the VPN is encrypted, the addresses you specify are protected, and the Internet only sees the external IP address. For organizations with nonconforming internal IP addresses, the repercussions of this are substantial, as no administrative costs are associated with having to change IP addresses for remote access via the Internet.

There are two ways to create a VPN connection: By dialing an ISP, or by connecting directly to the Internet, as shown in the following examples.

In the first example, the VPN connection first makes a call to an ISP. After the connection is established, the connection then makes another call to the remote access server that establishes the PPTP or L2TP tunnel. After authentication, you can access the corporate network, as shown in the following illustration.

VPN connection by using an ISP

In the second example, a user who is already connected to the Internet uses a VPN connection to dial the number for the remote access server. Examples of this type of user include a person whose computer is connected to a local area network, a cable modem user, or a subscriber of a service such as ADSL, where IP connectivity is established immediately after the user's computer is turned on. The PPTP or L2TP driver makes a tunnel through the Internet and connects to the PPTP-enabled or L2TP-enabled remote access server. After authentication, the user can access the corporate network, achieving the same functionality as the preceding example.

VPN connection by using an existing Internet connection

Notes

  • Connecting directly to the Internet means direct IP access without going through an ISP. (For example, some hotels allow you to use an Ethernet cable to connect to the Internet.)
  • If you have an active Winsock Proxy client, you cannot create a VPN. A Winsock Proxy client immediately redirects data to a configured proxy server before the data can be processed in the fashion required by a VPN. To establish a VPN, you should disable the Winsock Proxy client.


Make a virtual private network (VPN) connection

Microsoft Windows graphic

To make a virtual private network (VPN) connection

  1. Open Network Connections.
  2. Under Network Tasks, click Create a new connection, and then click Next.
  3. Click Connect to the network at my workplace, and then click Next.
  4. Click Virtual Private Network connection, click Next, and then follow the instructions in the wizard.

Notes

  • XOX
  • You can create multiple VPN connections by copying them in the Network Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple hosts, security options, and so on.


VPN cost advantages

By using virtual private networks (VPNs), mobile professionals and telecommuters can access their corporate local area network (LAN) over the Internet for a fraction of the cost of traditional remote access solutions. Just as it is more cost effective to make use of the phone company's massive switching system, rather than stringing up your own telephone lines and investing in your own switch, dialing the IP address or DNS name of your PPTP-enabled remote access server makes use of the physical base of routers of the Internet, ATM switches, and digital and analog lines, without sacrificing security.

You can use a network adapter to dial in to a virtual private network, as you would dial a modem to connect to a traditional remote server. VPNs offer corporations a release from the cost and maintenance obligations of components such as modem banks and dedicated analog (1-800) phone lines. The modems and their associated infrastructure remain centralized at the Internet service provider's locations, without sacrificing security or the ability to control remote connections. At the same time, the benefits of secure access to private data are ensured by additional VPN-required authenticated access, encryption, and user data compression.


VPN enhanced security

Virtual private network (VPN) connections enabled with PPTP and L2TP are authenticated by using PPP user-level authentication methods. These include Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), Shiva Password Authentication Protocol (SPAP), Microsoft Challenge Authentication Protocol (MS-CHAP), and optionally, Extensible Authentication Protocol (EAP).

By using the new Extensible Authentication Protocol (EAP) and Internet Protocol security (IPSec) security options, a virtual private network provides enhanced security for remote users. For example, if your remote access server has been configured to require EAP for authorization, the highest level of authentication is enforced for the dial-up or virtual network connections of the remote access server. By taking advantage of Point-to-Point Protocol (PPP) authentication and encryption options, defining PPTP filtering on your remote access server, and restricting remote access servers on the Internet to only accept authenticated PPTP clients who encrypt data, your system administrator can tighten data security and manage remote users much more efficiently.

In some environments, data is so sensitive that it needs to be physically separated, and hidden, from the majority of corporate users. Finance or human resources data are examples of this type of data. Corporations can use VPN connections through a VPN server to physically separate extremely sensitive data servers, yet allow secure access to the data by selected users. Users on the corporate intranet who have been granted the appropriate permissions can establish a remote client VPN connection with the VPN server and can access the protected resources of the sensitive department network. Additionally, all communication across the VPN is encrypted for data confidentiality. Users who do not have proper permissions to establish a VPN with the VPN server cannot see the hidden server.


VPN network protocol support

Because virtual private networks (VPNs) support the most common network protocols, it is easy for clients on Ethernet, TCP/IP, and IPX networks to use VPNs. Any network protocol supported by remote access is inherently supported in a VPN. This means that you can remotely run programs that are dependent upon particular network protocols. In turn, this translates to reduced costs in setting up and maintaining VPN connections.

XOX


IP address security

If you are using a nonregistered IP address (or an address that InterNIC has reserved for private networks such as the 10.x.y.z range), you can route through the Internet by providing a valid public IP address. Inside the virtual private network (VPN) envelope are packets with your address and the destination private address. Because the packet is encrypted, the addresses you specify on the remote private network are protected. The Internet only sees the public IP address. For organizations with nonconforming internal IP addresses, the repercussions of this are substantial, as no administrative costs are associated with having to change IP addresses for remote access.


VPN administration

By using access policies in the remote access server network, your system administrator can configure virtual private network (VPN) user settings that significantly tighten security measures, such as required levels of data and password encryption and authentication. These requirements can be applied to individual users, or to a group (or profile) of similar users. For example, a system administrator can configure remote access dial-in settings to define a group profile such that all users who are assigned to that profile are required to authenticate by using the Extensible Authentication Protocol (EAP) and encrypt their data by using strong (128-bit) data encryption. By assigning a user to the group profile, these security measures are automatically required when anyone in that group profile connects to the remote access server.

You should configure your VPN connection to match the policies set by your network administrator. For information about configuring connections, see To configure a connection.


Network Bridge overview

Network Bridge provides an inexpensive and easy way to connect local area network (LAN) segments. A LAN segment is a single section of network media that connects computers. For example, suppose you have three computers: computer A, computer B, and computer C. Computer A has two Ethernet network adapters, and computers B and C have one Ethernet network adapter each. An Ethernet cable connecting A to B creates one LAN segment. Another Ethernet cable connecting A to C creates another LAN segment.

Traditionally, if you want a network with more than one segment, you have two options: routing or bridging. IP routing is a common solution for connecting network segments. However, to set up IP routing you either must buy hardware routers or set up the computers at the junctions between segments to operate as routers. IP routing requires difficult IP addressing configuration for each computer on each network segment, and each network segment must be configured as a separate subnet. IP routing is a good solution for large networks, where scalability is important, and where there is an experienced staff to configure and maintain the network. A bridge does not require difficult configurations, but you must purchase additional hardware bridges. Neither of these options are ideal if you have a home or small office network, do not want to purchase expensive bridging hardware, and do not have experienced staff to administer an IP routing network.

With Network Bridge, you can connect LAN segments by selecting the appropriate network connection icons and clicking Bridge Connections. Equally easily, you can enable the bridge and add connections to it. The network bridge manages your network segments and creates a single subnet for the entire network. There is no configuration required, and you do not need to purchase additional hardware such as routers or bridges. IP addressing, address allocation, and name resolution is easy to do in a single subnet IP network.

The network bridge can create connections between different types of network media. In a traditional network, if you are using mixed media types you need a separate subnet for each type of media, and packet forwarding is required for each one of the network's multiple subnets. Packet forwarding is required because different protocols are used for different types of media. Network Bridge automates the configuration required to forward information from one type of media to another.

Only one bridge can exist on a computer running XOX, but you can use it to bridge as many network connections as the computer can physically accommodate. For information about creating a network bridge, see Bridge Connections.

Spanning tree algorithm

Network Bridge uses the IEEE spanning tree algorithm (STA) to establish a loop-free forwarding topology. When there are multiple paths in a bridged network, loops can form and the simple forwarding rules of a bridge can cause forwarding storms, a condition in which the same frame is relayed endlessly from one bridge to another. STA provides an automated mechanism to selectively disable bridge forwarding on individual ports as necessary to ensure that the forwarding topology is loop-free. You do not need to configure Network Bridge for the spanning tree algorithm.


Bridge connections

Microsoft Windows graphic

To bridge connections

XOX

  1. Open Network Connections.
  2. Under LAN or High-Speed Internet, hold down the CTRL key and select each of the private network connections that you want to be part of the bridge.
  3. Right-click one of the highlighted private network connections, and then click Bridge Connections.

Notes

  • XOX
  • You must select at least two eligible network connections to create a bridge.
  • Only Ethernet, IEEE-1394 adapters, or Ethernet compatible adapters such as Wireless and home phoneline adapters (HPNA), can be part of the network bridge.
  • Adapters that have Internet Connection Sharing (ICS) enabled cannot be part of the network bridge and will not appear on the Network Bridge checklist. Similarly, the Add to Bridge option is available only for adapters that you can add as connections to Network Bridge.
  • Do not create a bridge between a public Internet connection and a private network connection, or add the public Internet connection to an existing network bridge. To do so will create an unprotected link between your network and the Internet, and your network could be vulnerable to intrusions.
  • You can create only one network bridge on a computer, but the bridge can accommodate any number of network connections.
  • You cannot create a bridge connection on a computer running Windows 2000 or earlier versions of Windows.
  • Network adapters that previously appeared under LAN or High-Speed Internet, appear under Network Bridge when they are added as connections. Network adapters that provide Internet connectivity, such as DSL and cable modems, cannot be bridged and will always appear under LAN or High-Speed Internet.


Add a connection to the network bridge

Microsoft Windows graphic

To add a connection to a network bridge

XOX

  1. Open Network Connections.
  2. Under Network Bridge, right-click Network Bridge, and then click Properties.
  3. On the General tab, under Adapters, select the check box of each adapter that you want to add to the bridge and then click OK.

Notes

  • XOX
  • Do not add a public Internet connection to an existing network bridge, because it creates an unprotected link between your network and the Internet, which could leave your network vulnerable to intrusions.
  • Network adapters that previously appeared under LAN or High-Speed Internet, appear under Network Bridge when you add them as connections. Network adapters that provide Internet connectivity, such as DSL and cable modems cannot be bridged and always appear under LAN or High-Speed Internet.


Remove a connection from the network bridge

Microsoft Windows graphic

To remove a connection from the network bridge

XOX

  1. Open Network Connections.
  2. Under Network Bridge, right-click Network Bridge, and then click Properties.
  3. On the General tab, under Adapters, select the check box next to the adapter or adapters that you want to remove, and then click OK.

Notes

  • XOX
  • When you remove an adapter from the network bridge, the adapter will have Windows Firewall enabled if Windows Firewall is turned on.
  • If you remove adapters from the network bridge, and fewer than two adapters remain, the network bridge will not perform its intended function, but will continue to use system resources.


Enable or disable the network bridge

Microsoft Windows graphic

To enable or disable the network bridge

XOX

  1. Open Network Connections.
  2. Under Network Bridge, right-click Network Bridge, and then do one of the following:
    • To enable Network Bridge, click Enable.
    • To disable Network Bridge, click Disable.

Notes

  • XOX
  • You must use Bridge Connections to create the network bridge before you can enable it.
  • If you disable the network bridge, computers on your network will be unable to communicate with computers that are on different network segments. Some of the computers on your network may also lose Internet connectivity.


Remove the network bridge

Microsoft Windows graphic

To remove the network bridge

XOX

  1. Open Network Connections.
  2. Under Network Bridge, right-click Network Bridge, and then click Delete.

Notes

  • XOX
  • When removed from the network bridge, adapters will have Windows Firewall enabled if Windows Firewall is turned on.
  • If you remove the network bridge, some computers on your network might be unable to communicate with other computers on your network that are on different network segments. Also, some of the computers on your network might lose Internet connectivity.


Enable UPnP network functionality

Microsoft Windows graphic

To enable UPnP network functionality

Windows Firewall is turned on by default in XOX, which can help provide security for your computer. Consequently, the firewall blocks ports 1900 and 2869—the ports that the UPnP framework in Windows requires for network communication. Follow this procedure to open those ports.

XOX

  1. Open Windows Firewall.
  2. On the General tab, click On (recommended). (If the Don’t allow exceptions check box is selected, the UPnP ports remain closed even if you complete the rest of the steps in this procedure.)
  3. Click the Exceptions tab.
  4. Select the UPnP framework check box, and then click OK.

Notes

  • XOX
  • By default, this procedure sets up ports 1900 and 2869 to accept connections from your home or small office network only. To receive connections from all Internet Protocol (IP) addresses, select the UPnP framework check box, and then click Edit.
  • When ports 1900 and 2869 are blocked, UPnP messages are not sent over the network. Therefore, a UPnP control point program, such as Internet Gateway Device Discovery and Control Client, will not be able to discover or control UPnP devices attached to the network. Also, you will not see changes in the status of networked UPnP-certified devices (for example, when a device's power status changes from off to on), because Windows Firewall blocks incoming event messages.


Group Policy for Network Bridge

Prohibit installation, configuration, and use of the Network Bridge on your DNS domain network determines whether computer users with administrative privileges can enable Network Bridge on your DNS domain network.

The Network Bridge lets computer administrators create a bridge across two or more network connections to allow network traffic to flow across all network connections that are included in the bridge as if all were part of the same network subnet. For more information about the Network Bridge, see Network Bridge overview.Group Policy settings define the various components of the user's desktop environment that a system administrator needs to manage. For more information about Group Policy, see Group Policy overview.

Important

The Network Bridge menu command Bridge Connections is only available when two or more network adapters are present. By default, the Network Bridge is disabled, but administrators can use the menu on network connection icons to enable it. If you enable the Prohibit installation, configuration, and use of Network Bridge on your DNS domain network setting to prohibit the use of Network Bridge on your domain network, Network Bridge cannot be created because the Bridge Connections command is removed from the menu on network connection icons. Computer users with limited privileges are prohibited from configuring the Network Bridge, regardless of this setting.

If the Network Bridge already exists on a computer on your network before the policy is enabled, then the bridge will continue to exist because this setting is location aware. It only applies when a computer is connected to the same DNS domain network that it was connected to when the setting was last refreshed. If a computer, such as a laptop computer, is connected to your DNS domain network, but the setting on the computer was last refreshed on another network, then the setting on your network will not apply to that computer.


Monitoring network connections

You can obtain information about an active connection by using the Status menu command.

By using Status, you can view:
  • The duration of a connection.
  • The speed at which you initially connected.

    For a single-link connection and for individual links in a multilink connection, this speed is negotiated (and fixed) at the time the connection or link is established. For multilink connections, this speed is equal to the sum of the speeds of the individual links. For multilink connections, this speed varies as links are added or deleted.

  • For local area connections, the number of bytes transmitted and received during a connection. For other types of connections, the number of bytes transmitted and received during a connection, and the associated compression and error statistics.
  • The diagnostic tools that you can use for a connection, if any. For example, the Windows Network Troubleshooter, TCP/IP Autoping, and TCP/IP Windows IP Configuration. These tools are explicitly registered in XOX by their providers, whether the provider is Microsoft or another organization.

For more information, see To monitor a connection.

Note

  • If your computer is set up to accept incoming connections, a connection icon with a user name assigned to it appears in the Network Connections folder as each user connects. You can view the progress of incoming connections by right-clicking a named connection, and then clicking Status.


Monitor a connection

Microsoft Windows graphic

To monitor a connection

  1. Open Network Connections.
  2. Do one of the following:
    • To monitor activity for the current session, right-click the connection you want to monitor, and then click Status.
    • To automatically enable the status monitor each time the connection is active, right-click the connection, click Properties, and then select the Show icon in notification area when connected check box.
  3. To see how the IP address is obtained, the IP address, subnet mask, and default gateway, click the Support tab.

Notes

  • XOX
  • For more information about the network connection, on the Support tab, click Details.
  • To repair the connection and reset the IP information, on the Support tab, click Repair.
  • If your computer is set up to accept incoming connections, a connection with a user name assigned to it appears in the Network Connections folder as each user connects. You can view the progress of incoming connections by right-clicking a named connection, and then clicking Status.
  • You can also monitor a connection by clicking Status on the File menu or by clicking the status icon in the taskbar.
  • If you want to view the general status (Disconnected, Connected) of all of your connections, on the View menu, click Details.
  • To disconnect a local area connection, click Disable,in the Status dialog box. To disconnect dial-up, VPN, and incoming connections, click Disconnect in the Status dialog box.
  • By default, the status monitor is disabled for local area connections, but enabled for all other types of connections.


View the status of a local area connection

Microsoft Windows graphic

To view the status of a local area connection

  1. Open Network Connections.
  2. Do one of the following:
    • To monitor activity for the current session, right-click the local area connection, and then click Status.
    • To automatically enable the status monitor each time the connection is active, right-click the local area connection, click Properties, and then select the Show icon in notification area when connected check box.

Notes

  • XOX
  • You can view and modify the network components of a local area connection, such as network protocol settings, by clicking Properties.
  • By default, the status monitor is disabled for local area connections, but enabled for all other types of connections.


Network communications overview

Network protocols, access methods, and server protocols provide a communications link between your computer and a network.

Whether information is transported from your computer to a server by using a direct serial cable, or across a secure VPN from your Internet service provider (ISP) to the corporate network, different combinations of access methods and protocols are used to send information. These access methods and protocols are listed in the following table.

Network protocols | Access methods | Server protocols
TCP/IP | Using phone lines and modems | Point-to-Point Protocol (PPP)
IPX | ISDN access | SLIP
 | Serial (RS-232) access | Layer Two Tunneling Protocol (L2TP)
 | DirectParallel access |

XOX


TCP/IP overview

Transmission Control Protocol/Internet Protocol (TCP/IP) is the most popular network protocol, and the basis for the Internet. Its routing capabilities provide maximum flexibility in an enterprise-wide network. In XOX TCP/IP is automatically installed.

On a TCP/IP network, you must provide IP addresses to clients. Clients may also require a naming service or a method for name resolution. This section explains IP addressing and name resolution for Network Connections on TCP/IP networks. It also describes the FTP and Telnet tools that are provided by TCP/IP.

Assigning IP addresses to dial-up and virtual private network (VPN) connections

Each remote computer connecting to a remote access server on a Windows TCP/IP network is provided an IP address by the remote access server.

If you use a specific IP address, the remote access server must be configured to permit users to request a specific address.

Name resolution for network and dial-up connections

In addition to requiring an IP address, network and dial-up connections on a TCP/IP network may require a mechanism to map computer names to IP addresses. Four name resolution options are available: DNS, WINS, broadcast name resolution, and the Hosts and Lmhosts files.

In small networks where IP addresses do not change, network and dial-up connections can use a Hosts or Lmhosts file for name resolution. By using these files on the local drive, you do not need to transmit name resolution requests to a WINS or DNS server and wait for the response.

Internet tools

TCP/IP provides File Transfer Protocol (FTP) and Telnet. FTP is a character-based utility that permits you to connect to FTP servers and transfer files. Telnet is graphical application that lets you log in to remote computers and issue commands as if you were at the keyboard of the computer. Multiple variations of FTP, Telnet, and other programs based on earlier Internet standards are also available on the Internet or commercially.

For information about configuring a connection, see To configure a connection. For information about configuring TCP/IP, see To configure TCP/IP settings.


IPX

Internetwork Packet Exchange (IPX) is the native NetWare protocol used on many earlier Novell networks. This section explains how to integrate Network Connections clients into a NetWare IPX network.

XOX

Support for NetWare

Your computer must run a NetWare redirector to see a Novell NetWare network. This redirector is called Client Service for NetWare (CSNW).

A remote access server is also an IPX router and Service Advertising Protocol (SAP) agent. Once configured, remote access servers enable file and print services and the use of Windows Sockets programs over IPX on the NetWare network for Network Connections clients. Remote access servers and their Network Connections clients use the PPP IPX Configuration Protocol (IPXCP), as defined in RFC 1552, "The PPP Internet Protocol Control Protocol (IPXCP)," to configure the remote access line for IPX.

IPX addressing for remote clients

Network Connections clients are always provided an IPX address by the remote access server. The IPX network number is either generated automatically by the remote access server, or a static pool of network numbers is given to the remote access server for assignment to Network Connections.

For automatically generated IPX network numbers, the remote access server uses the NetWare Router Information Protocol (RIP) to determine an IPX network number that is not in use in the IPX network. The remote access server assigns that number to the connection.

For information about configuring a connection, see To configure a connection. For information about configuring NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, which is the XOX implementation of IPX, see To configure NWLink.

To configure incoming connections to use IPX, see To configure an incoming connection to use IPX.


ISDN access

To enhance your network connection speed, you can use an Integrated Services Digital Network (ISDN) line. Standard phone lines typically transmit at up to 56 kilobits per second (KBps), while ISDN lines can transmit at speeds of 64 or 128 KBps.

An ISDN line must be installed by the phone company at both the server and at the remote site. ISDN also requires that you install an ISDN card in both the server and in your computer. Costs for ISDN equipment and lines can be higher than standard modems and phone lines. However, the speed of communication reduces the duration of the connection, possibly saving some toll charges.

An ISDN line comes with two B channels that transmit data at 64 KBps, and one D channel for signaling that transmits data at 16 KBps. You can configure each B channel to operate as a port. With some ISDN drivers, you can aggregate the channels. This means you can statically assign a higher bandwidth by configuring both B channels to act as a single port. With this configuration, line speed increases to 128 KBps.

The Multilink feature performs channel aggregation for ISDN. Multilink combines multiple physical links into a logical bundle. This aggregate link increases the bandwidth of a connection. In addition, you can allocate multiple links dynamically, which means ISDN lines are used only as they are required. This eliminates excess bandwidth, representing a significant efficiency advantage to users. You can configure the conditions under which extra lines are dialed, and underused lines are hung up through Network Connections settings.


Serial (RS-232) cable access

Suppose you have two networks in the same location that are not physically connected. To use resources on both networks from one computer, you can use RS-232C cables and COM ports to create null modems. You connect an RS-232C cable from a COM port to a COM port on each remote access server. To the servers, the COM ports then appear to be modems. You can use server remote access, a part of the integrated Routing and Remote Access service, to create network access.


DirectParallel cable access

The DirectParallel feature supports computer-to-computer connections by using standard and enhanced (ECP) parallel ports, which use Parallel Technologies' Basic or Fast parallel cables. For information about configuring a direct network connection to use a DirectParallel cable, see To make a direct network connection by using a DirectParallel cable. Direct Cable Connection cables are available from several sources. You can obtain DirectParallel cables from Parallel Technologies or from their local dealers. For more information, see To contact Parallel Technologies or a local dealer to order Direct Cable Connection cables.


SLIP

Serial Line Internet Protocol (SLIP) is an older remote access standard typically used by UNIX remote access servers. Network Connections supports SLIP, and you can make connections to any remote access server by using the SLIP standard.

When you connect to a SLIP server, a Windows Terminal dialog box appears for an interactive logon session with the UNIX SLIP server. The UNIX logon overrides and prevents the remote access logon session from appearing. After a connection is established, remote network access becomes transparent to the user.

The RFCs supported in remote access are:

  • RFC 1144, "Compressing TCP/IP Headers for Low-Speed Serial Links"

  • RFC 1055, "A Nonstandard for Transmission of IP Datagrams Over Serial Lines: SLIP"

For information about configuring a network or dial-up connection, see To configure a connection.

Notes

  • You cannot configure a computer running XOX as a SLIP server. Only XOX clients that connect to other SLIP servers are supported.
  • You must use the TCP/IP protocol and a serial COM port to connect to a SLIP server.


Configure TCP/IP settings

Microsoft Windows graphic

To configure TCP/IP settings

  1. Open Network Connections.
  2. Click the connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. Do one of the following:
    • If the connection is a local area connection, on the General tab, under This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties.
    • If this is a dial-up, VPN, or incoming connection, click the Networking tab. In This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties.
  4. Do one of the following:
    • If you want IP settings to be assigned automatically, click Obtain an IP address automatically, and then click OK.
    • If you want to specify an IP address or a DNS server address, do the following:
      • Click Use the following IP address, and in IP address, type the IP address.
      • Click Use the following DNS server addresses, and in Preferred DNS server and Alternate DNS server, type the addresses of the primary and secondary DNS servers.
  5. To configure DNS, WINS, and IP Settings, click Advanced.

Notes

  • XOX
  • You should use automated IP settings (DHCP) whenever possible, for the following reasons:
    • DHCP is enabled by default.
    • If your location changes, you do not have to modify your IP settings.
    • Automated IP settings are used for all connections, and they eliminate the need to configure settings such as DNS, WINS, and so on.


Add a network component

Microsoft Windows graphic

To add a network component

  1. Open Network Connections.
  2. Click the connection to which you want to add a network component, and then, under Network Tasks, click Change settings of this connection.
  3. Do one of the following:
    • If this is a local area connection, click Install.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, click Install.
  4. In the Select Network Component Type dialog box, click either Client, Service, or Protocol, and then click Add.
  5. Do one of the following:
    • If you do not have an installation disk for the component, click the appropriate client, service, or protocol, and then click OK.
    • If you have an installation disk for the component, click the appropriate client, service, or protocol, click Have Disk, insert the installation disk into the selected drive, and then click OK.

Notes

  • XOX
  • You should only install the network components that you need, for the following reasons:
    • Network performance is enhanced and network traffic is reduced when only the required protocols and clients are installed.
    • If a problem with a network or dial-up connection occurs, your computer attempts to establish connectivity by using every network protocol that is installed and enabled. By only installing and enabling the protocols that your system can use, the operating system does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.
    • Excessive services can hinder performance on your local computer.


Remove a network component

Microsoft Windows graphic

To remove a network component

  1. Open Network Connections.
  2. Click the connection on which you want to remove a network component, and then, under Network Tasks, click Change settings of this connection.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, click the client, service, or protocol you want to remove, and then click Uninstall.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in This connection uses the following items, click the client, service, or protocol you want to remove, and then click Uninstall.
  4. In the Uninstall component name dialog box, click Yes.

Notes

  • XOX
  • Internet Protocol (TCP/IP) is installed by default and cannot be uninstalled.


Enable a network component

Microsoft Windows graphic

To enable a network component

  1. Open Network Connections.
  2. Click a connection, and then, under Network Tasks, click Change settings of this connection.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, select the check box next to the client, service, or protocol you want to enable.
    • If this is a dial-up, VPN, or incoming connection, click the Networking tab. In This connection uses the following items, select the check box for the client, service, or protocol you want to enable.

Notes

  • XOX
  • You should only enable the network components that you need, for the following reasons:
    • Network performance is enhanced and network traffic is reduced when only the required protocols and clients are enabled.
    • If your computer encounters a problem with a network or dial-up connection, it attempts to establish connectivity by using every network protocol that is installed and enabled. By only enabling the protocols that your system can use, the operating system does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.
    • Excessive services can hinder performance on your local computer.


Disable a network component

Microsoft Windows graphic

To disable a network component

  1. Open Network Connections.
  2. Click the connection on which you want to disable a network component, and then, under Network Tasks, click Changes settings of this connection.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, clear the check box next to the client, service, or protocol you want to disable.
    • If this is a dial-up, VPN, or incoming connection, click the Networking tab. In This connection uses the following items, clear the check box for the client, service, or protocol you want to disable.

Note

  • XOX


Modify the protocol bindings order

Microsoft Windows graphic

To modify the protocol bindings order

XOX

  1. Open Network Connections.
  2. On the Advanced menu, click Advanced Settings
  3. On the Adapters and Bindings tab, under Connections, click the connection you want to modify.
  4. Under Bindings for Local Area Connection, click the protocol that you want to move up or down in the list, and then click the up or down arrow button.

Note

  • XOX


Modify the network provider order

Microsoft Windows graphic

To modify the network provider order

XOX

  1. Open Network Connections.
  2. Click the connection you want to modify, and on the Advanced menu, click Advanced Settings.
  3. On the Provider Order tab, in Network providers, click the provider you want to move up or down in the list, and then click the Up or Down button.

Notes

  • XOX
  • Network providers are accessed in the order they appear in this list.


Client for Microsoft Networks

The Client for Microsoft Networks component allows a computer to access resources on a Microsoft network.

The component is installed and enabled by default. You should not need to configure the component unless you are running software from The Open Group, such as Distributed Computing Environment (DCE) server or client kits. If you are, contact your system administrator for the correct DCE Cell Directory Service network address.

The Client for Microsoft Networks component is the equivalent of the Workstation service in Windows NT 4.0.


Configure Client for Microsoft Networks

Microsoft Windows graphic

To configure Client for Microsoft Networks

  1. Open Network Connections.
  2. Click a connection, and then then, under Network Tasks, click Change settings of this connection.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in This connection uses the following items, click Client for Microsoft Networks, and then click Properties.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in This connection uses the following items, click Client for Microsoft Networks, and then click Properties.
  4. In Name service provider, click an RPC name service provider.
  5. If you selected DCE Cell Directory Service in Network address, type the network address of your provider.
  6. If you use Banyan Vines networking software, select the Enable RPC support for Banyan check box.

Notes

  • XOX
  • Only change your name service provider if instructed to do so by your system administrator.
  • Windows Locator is the default name service provider.
  • The Client for Microsoft Networks component is the equivalent of the Workstation service in Windows NT 4.0.


File and Printer Sharing for Microsoft Networks

The File and Printer Sharing for Microsoft Networks component allows other computers on a network to access resources on your computer by using a Microsoft network.

The component is installed and enabled by default. It is enabled per connection ising TCP/IP and is necessary to share local folders.

The File and Printer Sharing for Microsoft Networks component is the equivalent of the Server service in Windows NT 4.0.


Point-to-Point Protocol (PPP)

The Point-to-Point Protocol (PPP) is a set of standard protocols that allow remote access software from different vendors to interoperate. A PPP-enabled connection can dial into remote networks through any industry-standard PPP server. PPP also permits a remote access server to receive calls from, and provide network access to, other vendors' remote access software that complies with the PPP standards.

The PPP standards also permit advanced features that are not available with older standards such as SLIP. PPP supports several authentication methods, as well as data compression and encryption. With most PPP implementations, you can automate the entire logon sequence.

PPP also supports multiple LAN protocols. You can use TCP/IP, or IPX as your network protocol. XOX

PPP is the basis for the PPTP and L2TP protocols, which are used in secure virtual private network (VPN) connections.

PPP is the primary standard for most remote access computing.


PPP operation and protocols

Point-to-Point Protocol (PPP) connections must adhere to standards established in PPP RFCs. This section gives an overview of PPP operations and the protocols used in a PPP connection.

PPP dial-up sequence

After an initial connection to a remote PPP server, the following negotiations establish a PPP connection:

  • Link Control Protocols (LCP)

    • LCP is used to establish and configure link and framing settings such as maximum frame size.

  • Authentication protocols

    • Authentication protocols are used to determine what level of security validation the remote access server can perform and what the server requires. The level of security that can be negotiated ranges from unencrypted (plaintext) password authentication, to encrypted, highly secure smart card authentication.

  • Network control protocols (NCP)

    • NCPs are used to establish and configure different network protocol settings for IP and IPX. This negotiation includes negotiating protocol header compression and compression control protocol.

The resulting connection remains active until the line is disconnected for any of the following reasons:

  • The user explicitly hangs up the line.
  • The line drops due to idle time-out.
  • The administrator hangs up the line.
  • An unrecoverable link error occurs.

Link Control Protocols

Link Control Protocols (LCP) establish and configure PPP framing. PPP framing defines how data is encapsulated before transmission on the wide area network. The PPP standard framing format ensures any vendors' remote access software can communicate and recognize data packets from any remote access software that adheres to the PPP standards.

PPP and XOX use variants of High-level Data Link Control (HDLC) framing for serial or ISDN connections.

Authentication protocols

Negotiation of authentication protocols occurs immediately after link quality determination and before network layer negotiation.

Network control protocols

Network control protocols establish and configure different network protocol settings for TCP/IP and IPX. The following table describes network control protocols used with a PPP connection.

XOX

Network control protocol | Description
Internet Protocol Control Protocol (IPCP) | IPC is used to configure, enable, and disable IP modules at both ends of the connection.
Internetwork Packet Exchange Control Protocol (IPXCP) | IPXCP is used to configure, enable, and disable IPX modules at both ends of the connection. IPXCP is widely implemented by PPP vendors. The IPX WAN protocol is Novell's alternative to IPXCP. IPX WAN is not compatible with IPXCP. XOX supports IPXCP, which is implemented by the vast majority of remote access software.


PPP RFCs

Requests for Comments (RFCs) are an evolving series of technical reports, proposals for protocols, and protocol standards used by the Internet community. Routing standards are defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups. The following table lists the PPP RFCs.

RFC number | Title
1549 | PPP in HDLC Framing
1552 | The PPP Internetwork Packet Exchange Control Protocol (IPXCP)
1334 | PPP Authentication Protocols
1332 | The PPP Internet Protocol Control Protocol (IPCP)
1661 | Link Control Protocol (LCP)
1990 | PPP Multilink Protocol
2125 | The PPP Bandwidth Allocation Protocol (BAP), The PPP Bandwidth Allocation Control Protocol (BACP)
2097 | The PPP NetBIOS Frames Control Protocol (NBFCP)
1962 | The PPP Compression Control Protocol (CCP)
1570 | PPP LCP Extensions
2284 | PPP Extensible Authentication Protocol (EAP)

Obtaining RFCs

XOX This Web site is currently maintained by members of the Information Sciences Institute (ISI) who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standards, proposed Internet standards (circulated in draft form for review), Internet best practices, or For Your Information (FYI) documents.

Note

  • XOX


Using PPP for Internet connections

The default connections use Point-to-Point Protocol (PPP).

If a computer is running Windows 2000 Professional or XOX or a stand-alone computer is running Windows 2000 Server and that computer is configured for incoming connections, it requires no special configuration to support inbound PPP calls. If connections are configured properly, PPP calls are automatically negotiated.

If you are dialing a remote PPP server, the default settings are usually ideal, and no additional configuration is necessary. However, you can configure PPP settings for the connection that dials a PPP server.


Start requesting LCP extensions in PPP

Microsoft Windows graphic

To start requesting LCP extensions in PPP

  1. Disconnect from the remote server.
  2. Open Network Connections.
  3. Click the dial-up or VPN connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  4. On the Networking tab, click Settings, and then select the Enable LCP extensions check box.

Note

  • XOX


Stop requesting LCP extensions in PPP

Microsoft Windows graphic

To stop requesting LCP extensions in PPP

  1. Disconnect from the remote server.
  2. Open Network Connections.
  3. Click the dial-up or VPN connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  4. On the Networking tab, click Settings, and clear the Enable LCP extensions check box.

Note

  • XOX


Turn off IP header compression in PPP

Microsoft Windows graphic

To turn off IP header compression in PPP

XOX

  1. Disconnect from the remote server.
  2. Open Network Connections.
  3. Click the dial-up connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  4. On the Networking tab, under This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties.
  5. Click Advanced, and then clear the Use IP header compression check box.

Note

  • XOX


Disable software compression

Microsoft Windows graphic

To disable software compression

  1. Open Network Connections.
  2. Click the dial-up, VPN, or incoming connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the Networking tab, click Settings, and clear the Enable software compression check box.

Note

  • XOX


Point-to-Point Protocol over Ethernet (PPPoE) Protocols

Using Point-to-Point Protocol over Ethernet (PPPoE) and a broadband modem, LAN users can gain individual authenticated access to high-speed data networks. By combining Ethernet and Point-to-Point Protocol (PPP), PPPoE provides an efficient way to create a separate connection for each user to a remote server. Access, billing, and choice of service are managed on a per-user basis, rather than a per-site basis.

PPPoE RFCs

Requests for Comments (RFCs) are an evolving series of technical reports, proposals for protocols, and protocol standards used by the Internet community. Routing standards are defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups. The following table lists PPPoE RFCs.

RFC number | Title
2516 | A Method for Transmitting PPP Over Ethernet (PPPoE)

Obtaining RFCs

XOX This Web site is currently maintained by members of the Information Sciences Institute (ISI) who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standards, proposed Internet standards (circulated in draft form for review), Internet best practices, or For Your Information (FYI) documents.

Note

  • XOX


Point-to-Point Tunneling Protocol (PPTP)

You can access a private network through the Internet or other public network by using a virtual private network (VPN) connection with the Point-to-Point Tunneling Protocol (PPTP).

PPTP enables the secure transfer of data from a remote computer to a private server by creating a VPN across TCP/IP-based data networks. PPTP supports on-demand, multiprotocol, virtual private networking over public networks, such as the Internet.

Developed as an extension of the Point-to-Point Protocol (PPP), PPTP adds a new level of enhanced security and multiprotocol communications over the Internet. Specifically, by using the new Extensible Authentication Protocol (EAP), data transfer through a PPTP-enabled VPN is as secure as within a single LAN at a corporate site.

PPTP tunnels, or encapsulates, IP or IPX protocols inside of PPP datagrams. This means that you can remotely run programs that are dependent upon particular network protocols. The tunnel server performs all security checks and validations, and enables data encryption, which makes it much safer to send information over nonsecure networks. You can also use PPTP in private LAN-to-LAN networking.

XOX

PPTP tunnel

PPTP does not require a dial-up connection. It does, however, require IP connectivity between your computer and the server. If you are directly attached to an IP LAN and can reach a server, then you can establish a PPTP tunnel across the LAN. However, if you are creating a tunnel over the Internet, and your normal Internet access is a dial-up connection to an ISP, you must dial up your Internet connection before you can establish the tunnel.


Layer Two Tunneling Protocol (L2TP)

You can access a private network through the Internet or other public network by using a virtual private network (VPN) connection with the Layer Two Tunneling Protocol (L2TP). L2TP is an industry-standard Internet tunneling protocol with roughly the same functionality as the Point-to-Point Tunneling Protocol (PPTP). The XOX implementation of L2TP is designed to run natively over IP networks. This implementation of L2TP does not support native tunneling over X.25, Frame Relay, or ATM networks.

Based on the Layer Two Forwarding (L2F) and Point-to-Point Tunneling Protocol (PPTP) specifications, you can use L2TP to set up tunnels across intervening networks. Like PPTP, L2TP encapsulates Point-to-Point Protocol (PPP) frames, which then encapsulate IP or IPX protocols, allowing users to remotely run programs that are dependent on specific network protocols.

XOX

L2TP tunnel

With L2TP, the computer running Windows 2000 Server that you are logging on to performs all security checks and validations. It also enables data encryption, which makes it much safer to send information over nonsecure networks. By using the new Internet Protocol security (IPSec) authentication and encryption protocol, data transfer through a L2TP-enabled VPN is as secure as within a single LAN at a corporate site.


Security features of Network Connections

You can configure your dial-up, virtual private network (VPN), and direct connections to enforce various levels of password authentication and data encryption. Authentication methods range from unencrypted to custom, using the Extensible Authentication Protocol (EAP). EAP provides an infrastructure to support a wide range of authentication methods, including smart cards, certificates, one-time passwords, and public keys. You can also specify the type of data encryption, depending on the level of password authentication (MS-CHAP, EAP, MS-CHAP v2, or EAP-TLS) that you select. Finally, you can configure callback options to increase dial-up security.

User accounts and domains provide security with encrypted authentication and encrypted data.


How security works at connection

The following steps describe what happens during a call to a remote access server:

  1. The remote access client computer calls a remote access server.
  2. Depending on the authentication methods you select, one of the following happens:
    • For PAP or SPAP:
      • The client sends its user name and password to the server.
      • The server checks the account credentials against the user database.
    • For CHAP or MS-CHAP:
      • The server sends a challenge to the client.
      • The client sends an encrypted response to the server.
      • The server checks the response against the user database.
    • If you are using MS-CHAP v2:
      • The server sends a challenge to the client.
      • The client sends an encrypted response and a challenge to the server.
      • The server checks the encrypted response of the client against the user database and sends the client its own encrypted response.
      • The client verifies the encrypted response of the server.
    • If you are using certificate-based authentication:
      • The server sends its computer certificate to the client.
      • If configured, the client validates the server certificate.
      • The client sends its user certificate to the server.
      • The server verifies that the user certificate is valid and has not been revoked.
  3. If the connection attempt is both authenticated (the user credentials are valid, the user account is enabled and not locked out, the connection is occurring within allowed login hours) and authorized (for Incoming Connections, the user account has remote access permission), the server accepts the remote access connection.

    4. If callback is enabled, the server calls your computer back and repeats steps 2 through 3.

Notes

  • For the Routing and Remote Access service, authorization of the connection is determined by the dial-up properties of the user account and remote access policies. Remote access policies are a set of conditions and connection settings that give network administrators more flexibility in granting remote access permissions and usage. If the settings of the connection do not match at least one of the remote access policies that apply to your connection, the connection attempt is rejected, regardless of the dial-up properties of the user account.
  • Network Connections authentication methods control access to your network, not to resources on the network. Once connected to a network, resource access control is managed through access control lists (ACLs) in various ways: Local Users and Groups, Active Directory, Group Policy, file and printer sharing, and so on.
  • Authentication methods are designed for remote computing environments where the computer dialing in does not have access to the network until credentials such as user name and passwords are validated.
  • For information about configuring security options for your connections, such as identity authentication protocols and data encryption settings, see Security features of Network Connections.
  • If you start the Routing and Remote Access Service (RRAS) from the command line, you must also configure ports in Windows Firewall so that RRAS works properly. To do this, on the Windows Firewall Exceptions tab, click Add Port, and then open the following ports: PPTP – TCP Port 1723, L2TP – UDP port 1701, and IKE – UDP port 500. To open these ports for a specific connection only, use Network Connection Settings on the Advanced tab.


Data encryption

You can think of encryption as locking something valuable into a strong box with a key. Sensitive data is encrypted by using a key algorithm, which renders it unreadable without the knowledge of the key. Data encryption keys are determined at connect time between a connection and the computer on the other end. The use of data encryption can be initiated by your computer or by the server you are connecting to.

Network Connections supports two types of encryption: Microsoft MPPE, which uses RSA RC4 encryption, and an implementation of Internet Protocol security (IPSec) that uses Data Encryption Standard (DES) and Triple DES encryption algorithms. Both MPPE and IPSec support multiple levels of encryption, as shown in the following table.

Encryption implementation
MPPE Standard (40-bit, 56-bit)
MPPE Strong (128-bit)
IPSec DES (56-bit)
IPSec Triple DES (3DES, 168-bit)

Notes

  • Server controls are flexible and can be set to deny the use of encryption, require a specific encryption method, or allow your computer to select an encryption method. By default, most servers allow encryption and allow clients to select their encryption methods. This works for most computers. A system administrator sets encryption requirements. To determine your options, contact your system administrator.
  • To enable MPPE-based data encryption for dial-up or virtual private network (VPN) connections, you must select the MS-CHAP, MS-CHAP v2, or EAP-TLS authentication methods. These authentication methods generate the keys used in the encryption process.
  • Virtual Private Networks (VPNs) use encryption depending on the type of server they are connecting to. If the VPN connection is configured to connect to a PPTP server, then MPPE encryption is used. If the VPN is configured to connect to an L2TP server, then IPSec encryption methods are used. If the VPN is configured for an Automatic server type, which is the default selection, then L2TP, and its associated IPSec encryption, will be attempted first if the computer has a machine certificate, then PPTP, and its associated MPPE encryption.


Microsoft Point-to-Point Encryption (MPPE)

Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPP-based dial-up connections or PPTP VPN connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported. MPPE provides data security between your PPTP connection and the tunnel server.

For more information about configuring connections, see To configure a connection.

Note

  • MPPE requires common client and server keys as generated by MS-CHAP or EAP authentication.


Internet Protocol security (IPSec) overview

The long-term direction for secure networking, IPSec is a suite of cryptography-based protection services and security protocols. Because it requires no changes to programs or protocols, you can easily deploy IPSec for existing networks.

IPSec provides computer-level authentication, as well as data encryption, for VPN connections that use the L2TP protocol. IPSec negotiates between your computer and its remote tunnel server before an L2TP connection is established, which secures both passwords and data.

L2TP uses standard PPP-based authentication protocols, such as EAP, MS-CHAP, CHAP, SPAP, and PAP with IPSec.

Encryption is determined by the IPSec Security Association, or SA. A security association is a combination of a destination address, a security protocol, and a unique identification value, called a Security Parameters Index (SPI). The available encryptions include:

  • Data Encryption Standard (DES) which uses 56-bit key.
  • Triple DES (3DES), which uses two 56-bit keys and is designed for high-security environments in North America.

If you want more information about IPSec, see Internet Protocol security (IPSec).

For more information about configuring connections, see To configure a connection.


Using an intermediary device

Network Connections supports various kinds of intermediary devices (security hosts and switches) between the remote access client and the remote access server. These devices include:

  • Modem-pool switches
  • Security hosts
  • X.25 networks

Before you connect to the remote access server, you can have one of two possible dialogs (user input and computer response screens) with each intermediary device:

  • Static (a dialog that never changes and requires no input from you)
  • Interactive (a dialog that always changes and requires input from you)

You must configure your connection to work with each intermediary device.

If you require both static and interactive dialogs, you must take the following steps:

  1. Write a script for the static dialog. For more information, see Writing scripts for intermediary devices.
  2. Activate Terminal mode for the interactive dialogs. For more information, see To use the Terminal feature to log on to a remote computer.

If you require only one kind of dialog, take only one of the preceding steps. For example:

  • If your clients connect through only one intermediary device with a static dialog (such as an X.25 network), skip step 2.
  • If your clients connect through a security host with an interactive dialog, skip step 1.


Security hosts

A security host is an authentication device that verifies whether a connection is authorized to connect to a remote access server. This verification supplements security already supplied by Network Connections and by Windows 2000 Server. There are two kinds of security hosts:

  • Those which perform authentication checks during a modem call

    This type of security host sits between you and the remote access server and performs an authentication check before remote access server authentication. This type of security host generally provides an extra layer of security by requiring a hardware key of some sort in order to provide authentication. Verification that you are in physical possession of the key takes place before access to the remote access server is granted. With this open architecture, your system administrator can select from a variety of security hosts to augment the security in Network Connections, but the authentication check is restricted to modem calls.

    For example, one such security system consists of two hardware devices: the security host and the security card. The security host is installed between the remote access server and its modem. The security card is a small unit the size of a credit card that resembles a pocket calculator without keys. The security card displays a different access number every minute. This number is synchronized with a similar number calculated in the security host every minute. When connecting, you send a PIN number and the number on the security card to the host. If these match the number calculated on the host, the security host connects you with the remote access server.

    Another security host of the same type prompts you to type in a user name (which may or may not be the same as the remote access user name) and a password (which differs from the remote access password). The security host must be configured to allow the remote access server to initialize the modem before the security functions take effect. The remote access server must also be able to directly initialize the modem connected to the security host without security checks from the security host.

  • Those which are called during the authentication process of the connection

    This type of security host provides custom authentication during the remote access authentication process. This authentication may augment or replace the standard verification of your XOX network credentials by Routing and Remote Access. RADIUS servers are examples of this type of security host in that they perform user authentication on behalf of Routing and Remote Access. With the introduction of the Extensible Authentication Protocol (EAP), other vendors can create interfaces between remote access authentication and their own proprietary servers. Servers of this type are used to verify smart cards and other forms of extended authentication.

Note

  • To make other security devices work with your connection, you must activate Terminal mode to interact with the security host. For more information, see To use the Terminal feature to log on to a remote computer.
  • If you start the Routing and Remote Access Service (RRAS) from the command line, you must also configure ports in Windows Firewall so that RRAS works properly. To do this, on the Windows Firewall Exceptions tab, click Add Port, and then open the following ports: PPTP – TCP Port 1723, L2TP – UDP port 1701, and IKE – UDP port 500. To open these ports for a specific connection only, use Network Connection Settings on the Advanced tab.


Configure identity authentication and data encryption settings for a dial-up connection

Microsoft Windows graphic

To configure identity authentication and data encryption settings for a dial-up connection

  1. Open Network Connections.
  2. Click the dial-up connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the Security tab, do one of the following:
    • To select preconfigured combinations of identity authentication methods and data encryption requirements, click Typical (recommended settings), and in Validate my identity as follows, click a method to use for validation.

      Depending on your Validate my identity as follows selection, you can select (enable) or clear (disable) the Automatically use my Windows logon name and password (and domain if any) or Require data encryption (disconnect if none) check boxes. The following table shows which selections are available.

      If Require data encryption (disconnect if none) is not enabled, encryption is optional. To prevent encryption, click Advanced (custom settings), and then click Settings. In Data encryption, click No encryption allowed (disconnect if server required encryption).

      • Validate my identity as follows | Automatically use my Windows logon name and password (and domain if any) | Require data encryption (disconnect if none)
Allow unsecured password | Unavailable | Unavailable
Require secured password | Available | Available
Use smart card | Unavailable | Available

    • To individually enable, configure, and disable authentication methods and encryption requirements, click Advanced (custom settings), and then click Settings.

Important

  • Modifying Advanced (custom settings) requires a knowledge of security protocols.

Note

  • XOX


Configure identity authentication and data encryption settings for a VPN connection

Microsoft Windows graphic

To configure identity authentication and data encryption settings for a VPN connection

  1. Open Network Connections.
  2. Click the VPN connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the Security tab, do one of the following:
    • To select preconfigured combinations of identity authentication methods and data encryption requirements, click Typical (recommended settings), and in Validate my identity as follows, click a method to use for validation.

      Depending on your Validate my identity as follows selection, you can select (enable) or clear (disable) the Automatically use my Windows logon name and password (and domain if any) or Require data encryption (disconnect if none) check boxes. The following table shows which selections are available.

      If Require data encryption (disconnect if none) is not enabled, encryption is optional. To prevent encryption, click Advanced (custom settings), and then click Settings. In Data encryption, click No encryption allowed (server will disconnect if it requires encryption).

      • Validate my identity as follows | Automatically use my Windows logon name and password (and domain if any) | Require data encryption (disconnect if none)
Require secured password | Available | Available (enabled by default)
Use smart card | Unavailable | Available (enabled by default)

    • To individually enable, configure, and disable authentication methods and encryption requirements, click Advanced (custom settings), and then click Settings.

Important

  • Modifying Advanced (custom settings) requires a knowledge of security protocols.

Note

  • XOX


Remote Access Authentication Process

When you connect to the Internet, remote access authentication is a one-step process. Your computer presents credentials, typically a user name and password, that are acceptable to a remote access server at the Internet Service Provider (ISP), and you are granted a connection to the Internet.

When you connect to a corporate network that uses a Windows domain, a similar remote access authentication occurs. But in this case, a second step of authentication is required. After you have connected to the network, resources that you access, such as file and print servers, will ask your computer for its domain credentials on each attempt to access them. These domain network credentials may not be the same as the credentials required by the remote access server.

In addition, computers running a secure operating system such as XOX require logon credentials in order to allow the user access to the computer itself.

This means that your computer could require three sets of credentials for remote access: one to log on to the computer itself; one to satisfy the remote access server; and a third to handle challenges from resources on the network. These credentials can be the same, as described below, but they can also be different.

Corporate computers on secured networks are typically members of the domain. In XOX this means that the credentials the user presents when logging on to the computer are verified against the domain controller before granting the user access to the computer. As a result, these are the same credentials needed to satisfy network resources. To simplify remote access, many corporate networks are arranged so that the remote access server will also accept the same domain credentials. This allows a single logon for member computers of a domain. One set of credentials unlocks your computer, provides remote access to the corporate network, and allows access to network resources once the connection is established.

To assist in the single-credential case for computers that are members of a domain, network connections in XOX can be configured to present the user's logon credentials to the remote access server. This eliminates the need to supply explicit credentials for the remote access server. Since the logon credentials are the same as the user's domain credentials, the same credentials satisfy resource challenges from the network.

However, computers outside the workplace (such as home computers), are generally not members of a domain, so the user logon credentials that unlock the computer do not provide access to the domain. There are also cases in which a remote access server requires credentials that are independent of the network domain's credentials. In this scenario, you would have to provide three different credentials in order to log on to the computer, connect to the remote network, and then access resources on that network.


Dial-up connection authentication and data encryption

The Typical (recommended settings) security options that you select on the Security tab result in a predefined set of authentication methods and encryption requirements that are negotiated with the server during a PPP exchange.

The following table shows the authentication and data encryption methods that you can use with each combination of Validate my identity as follows and Require data encryption (disconnect if none) selections. You can also view these settings by making your identity validation and data encryption requirement selections in Typical (recommended) settings, and then clicking Settings in Advanced (custom) settings.

You may individually enable, configure, and disable these combinations of security settings by using Advanced (custom settings), but this requires a knowledge of security protocols.

For more information about a specific authentication or data encryption method, click the method in the table. For information about configuring a connection, see To configure a connection.

Validate my identity using | Require data encryption | Authentication methods negotiated | Encryption enforcement
Allow unsecured password | No | PAP, CHAP, SPAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP/TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP/TLS | Require encryption (disconnect if server declines)

Notes

  • Data is only encrypted if MS-CHAP, MS-CHAP v2, or EAP/TLS authentication is negotiated. These are the only authentication protocols that generate their own initial encryption keys, which are required for encryption.
  • Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPP-based dial-up connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported.
  • MS-CHAP v2 and EAP are mutual authentication protocols, which means that both the client and the server prove their identities. If your connection is configured to use either MS-CHAP v2 or EAP as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authentication and simply accept the call. This change ensures that you can configure a connection to connect to the expected server.


VPN connection authentication and data encryption

The Typical (recommended settings) security options that you select on the Security tab result in a predefined set of authentication methods and encryption requirements that are negotiated with the server during a PPP exchange.

The following tables show the authentication and data encryption methods that you can use with each combination of Validate my identity as follows and Require data encryption (disconnect if none) selections. You can also view these settings by making your identity validation and data encryption requirement selections in Typical (recommended settings), and then clicking Settings in Advanced (custom settings).

You may individually enable, configure, and disable these combinations of security settings, by using Advanced (details for all possible settings), but this requires a knowledge of security protocols.

For more information about a specific authentication or data encryption method, click the method in the table. For information about configuring a connection, see To configure a connection.

Point-to-Point Tunneling Protocol (PPTP) or automatic remote access server

Validate my identity using | Require data encryption | Authentication methods negotiated | Encryption enforcement
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP/TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP/TLS | Require encryption (disconnect if server declines)

Layer Two Tunneling Protocol (L2TP) remote access server

Validate my identity using | Require data encryption | Authentication methods negotiated | Encryption enforcement
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | CHAP, MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP/TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP/TLS | Require encryption (disconnect if server declines)

Notes

  • In L2TP VPN connections, data is encrypted by using Internet Protocol security (IPSec).
  • Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPTP VPN connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported.
  • Data is only encrypted by MPPE if MS-CHAP, MS-CHAP v2, or EAP/TLS authentication is negotiated. These are the only authentication protocols that generate their own initial encryption keys. MPPE requires common client and server keys as generated by these types of authentication.
  • MS-CHAP v2 and EAP/TLS are mutual authentication protocols, which means that both the client and the server prove their identities. If your connection is configured to use either MS-CHAP v2 or EAP/TLS as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authenticating themselves to clients and simply accept the call. This change ensures that you can configure a connection to connect to the expected server.


Password Authentication Protocol (PAP)

Password Authentication Protocol (PAP) is a simple authentication protocol in which the user name and password is sent to the remote access server in a plaintext (unencrypted) form. Using PAP is strongly discouraged because your passwords are easily readable from the Point-to-Point Protocol (PPP) packets exchanged during the authentication process. PAP is typically only used when connecting to older UNIX-based remote access servers that do not support any additional authentication protocols.

Notes

  • You cannot use Microsoft Point-to-Point Encryption (MPPE) if PAP is used to authenticate the connection.
  • If the connection is configured to require a secured password, and connects to a server that is only configured for PAP, the XOX remote access client terminates the connection.


Challenge Handshake Authentication Protocol (CHAP)

The Challenge Handshake Authentication Protocol (CHAP) is a widely-supported authentication method in which the knowledge of the user's password, rather than the password itself, is sent during the authentication process. With CHAP, the remote access server sends the remote access client a challenge string. The remote access client uses the challenge string and the user's password, and computes a Message Digest-5 (MD5) hash. Hash functions or algorithms are known as one-way encryption because it is easy to calculate the hash result for a block of data, but it is mathematically infeasible to determine the original data block from the hash. The MD5 hash is sent to the remote access server. The remote access server, who has access to the user's password, performs the same hash calculation and compares the result with the hash sent by the client. If they match, the remote access client's credentials are considered authentic.

Note

  • You cannot use Microsoft Point-to-Point Encryption (MPPE) if CHAP is used to authenticate the connection.
  • If you are using CHAP and connecting to a remote access server running Windows 2000 and the Routing and Remote Access service, the user account of the connecting client must be configured to allow the storage of the password in a reversibly encrypted form. For more information, see Windows 2000 Server Help.


Shiva Password Authentication Protocol (SPAP)

The Shiva Password Authentication Protocol (SPAP) is a simple encrypted password authentication protocol supported by Shiva remote access servers. With SPAP, the remote access client sends an encrypted password to the remote access server. SPAP uses a two-way encryption algorithm. The remote access server decrypts the password and uses the plaintext form to authenticate the remote access client.

Note

  • You cannot use Microsoft Point-to-Point Encryption (MPPE) if PAP is used to authenticate the connection.


Microsoft Challenge Handshake Authentication Protocol (MS CHAP)

Microsoft Windows graphic

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

Microsoft created MS-CHAP to authenticate remote Windows workstations, providing the functionality to which LAN-based users are accustomed while integrating the hashing algorithms used on Windows networks. Like CHAP, MS-CHAP uses a challenge-response mechanism to keep the password from being sent during the authentication process.

MS-CHAP uses the Message Digest 4 (MD4) hashing algorithm and the Data Encryption Standard (DES) encryption algorithm to generate the challenge and response and provides mechanisms for reporting connection errors and for changing the user's password. The response packet is in a format specifically designed to work with networking products in Windows 95, Windows 98, Windows Millennium Edition, Windows NT, Windows 2000, and XOX.

Notes

  • A version of MS-CHAP is available specifically for connecting to a server running Windows 95. You must use this version if your connection is to a server running Windows 95. To enable this version, select the Allow older MS-CHAP version for Windows 95 servers check box on the Advanced Security Settings dialog box.
  • Unlike CHAP, MS-CHAP does not require that the user account's password be stored in a reversibly encrypted form.
  • During the MS-CHAP authentication process, shared secret encryption keys for Microsoft Point-to-Point Encryption (MPPE) are generated.


Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2)

XOX supports Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2). MS-CHAP v2 provides mutual authentication, the generation of stronger initial data encryption keys for Microsoft Point-to-Point Encryption (MPPE), and different encryption keys for sent and received data. To minimize the risk of password compromise during a password change, support for older methods of the MS-CHAP password change are not supported.

Because MS-CHAP v2 is more secure than MS-CHAP, it is offered before MS-CHAP (if enabled) for all connections.

MS-CHAP v2 is supported by computers running XOX, Windows 2000, Windows 98, Windows Millennium Edition, and Windows NT 4.0. For computers running Windows 95, MS-CHAP v2 is only supported for VPN connections, not for dial-up connections.

Note

  • MS-CHAP v2 is a mutual authentication protocol, which means that both the client and the server prove that they have knowledge of the user's password. At first, the remote access server asks for proof by sending a challenge to the remote access client. Then, the remote access client asks for proof by sending a challenge to the remote access server. If the server cannot prove that it has knowledge of the user's password by correctly answering the client's challenge, the client terminates the connection. Without mutual authentication, a remote access client could not detect a connection to an impersonating remote access server.


Extensible Authentication Protocol (EAP)

The Extensible Authentication Protocol (EAP) is an extension to the Point-to-Point Protocol (PPP) that allows arbitrary authentication methods using credential and information exchanges of arbitrary lengths. EAP was developed in response to an increasing demand for authentication methods that uses other security devices and provides an industry-standard architecture for support of additional authentication methods within PPP.

By using EAP, support for a number of specific authentication schemes known as EAP types may be added, including token cards, one-time passwords, public key authentication using smart cards, certificates, and others. EAP, in conjunction with strong EAP types, is a critical technology component for secure virtual private network (VPN) connections. Strong EAP types such as those based on certificates offer better security against brute-force or dictionary attacks and password guessing than password-based authentication protocols, such as CHAP or MS-CHAP.

To find out if an EAP type is being used in your organization, contact your network administrator.

XOX includes support for two EAP types:

  • EAP-MD5 CHAP (equivalent to the CHAP authentication protocol)
  • EAP-TLS used for user certificate-based authentication.

EAP-TLS is a mutual authentication method, which means that both the client and the server prove their identities to each other. During the EAP-TLS exchange, the remote access client sends its user certificate and the remote access server sends its computer certificate. If either certificate is not sent or is invalid, the connection is terminated.

Notes

  • During the EAP-TLS authentication process, shared secret encryption keys for Microsoft Point-to-Point Encryption (MPPE) are generated.


Smart card and other certificate authentication

If a certificate is installed either in the certificate store on your computer or on a smart card, and the Extensible Authentication Protocol (EAP) is enabled, you can use certificate-based authentication in a single network logon process, which provides tamper-resistant storage of authentication information.

A certificate is an encrypted set of authentication credentials. A certificate includes a digital signature from the certification authority that issued the certificate. In the certificate authentication process, your computer presents its certificate to the server, and the server presents its certificate to your computer, enabling mutual authentication. Certificates are authenticated by using a public key to verify this digital signature, which is contained in a trusted authority root certificate that is stored on your computer. These root certificates are the basis for certificate verification and should be supplied only by a system administrator. A number of trusted root certificates are provided. You should add or remove trusted root certificates only if your system administrator advises.

Certificates can reside either in the certificate store on your computer or on a smart card. A smart card is a credit-card-sized device that is inserted into a smart card reader, which is either installed internally in your computer or connected externally to your computer.

By setting the security options of a connection, you can choose to use a smart card or other certificate, and you can specify particular certificate requirements. For example, you can specify that the certificate for the server must be validated, and you can also specify the certificate root authority for the server, which is highly trusted.

When you when you create a new connection using the New Connection Wizard and a smart card reader is installed, the operating system detects it and prompts you to use it as the authentication method for the connection. If you decide not to use the smart card at the time you create a connection, you can modify the connection to use the smart card or other certificate at a later time. For more information, see To enable smart card or other certificate authentication.

If you are a member of an Active Directory domain, and need to request a certificate, see To request a certificate. If you are not a member of an Active Directory domain, or you need to request a certificate from the Internet, see To submit a user certificate request via the Web. For information about mobile users and certificates, see Mobile users and certificates.


Enable smart card or other certificate authentication

Microsoft Windows graphic

To enable smart card or other certificate authentication

  1. Open Network Connections.
  2. Click the dial-up, VPN, or incoming connection on which you want to use smart card or other certificate authentication, and then, under Network Tasks, click Change settings of this connection.
  3. If you are using typical settings for your smart card, on the Security tab, click Typical (recommended settings), and in Validate my identity as follows, click Use smart card.
  4. If you are individually enabling, configuring, and disabling authentication methods and encryption requirements, on the Security tab, click Advanced (custom settings), click Settings, and then do the following:
    • Under Logon security, click Use Extensible Authentication Protocol (EAP), click Smart card or other certificate (encryption enabled), click Properties, and then do the following:
      1. If you want to use the certificate that resides on your smart card, click Use my smart card.
      2. If you want to use the certificate that resides in the certificate store on your computer, click Use a certificate on this computer.
      3. If you want verify that the server certificate presented to your computer has not expired, has the correct signature, and has a trusted root certification authority, select the Validate server certificate check box.
      4. If you only want to connect to servers within a particular domain, select the Connect only if server name ends with check box, and then type the name of the domain.
      5. To specify that the root certification authority for your server certificate must be in a particular root certification authority, in Trusted root certification authority, click the appropriate certification authority.
      6. To use a different user name when the user name in the smart card or certificate is not the same as the user name in the domain that you are logging on to, select the Use a different user name for the connection check box.

Notes

  • XOX
  • For example, if you only want to connect to servers that reside in Microsoft.com, type Microsoft.com in Connect only if server name ends with box.
  • For example, if you are working for a consulting company where you need to log on to the domain of the company to which you are assigned, but your smart card contains a user name specific to your home company, select the Use a different user name for the connection check box.
  • If you select the Use a different user name for the connection check box, your certificate is exported without private keys and submitted to your system administrator to be explicitly mapped to your domain user account. XOX
  • If you select the Connect only if server name ends with check box, and do not type a domain name, at the time you connect you are prompted to use the domain name in the server certificate.


Mobile users and certificates

If you are a mobile user, you need to enable the use of certificates on your computer. Unless your system administrator preconfigures your computer with machine and user certificates before you receive it, you must connect to your corporate network by using conventional, password-based authentication methods to get your machine and user certificates. At the time you connect, you join your computer to the corporate domain, obtain certificates, and set certificates policy. The next time you connect to the corporate network, you can use certificate-based authentication methods such as EAP.

To enable the use of certificates on a computer, do the following:

  1. Connect to the corporate network by using a dial-up or PPTP network connection, and authentication protocols such as MS-CHAP, or MS-CHAP v2. When you connect, your computer name joins the corporate domain and receives machine certificates.

  2. Request a user certificate. For more information about requesting certificates, see To request a certificate, To submit a user certificate request via the Web, and Requesting certificates.
  3. Create another connection that uses certificate-based authentication, and then connect again by using certificate-based authentication methods such as EAP or IPSec. For more information about enabling a connection to use a smart card or other certificate, see To enable smart card or other certificate authentication.

You can avoid these steps by having your system administrator load machine and user certificates before you take your laptop out onto the road.

Note

  • For machine certificates to be received automatically, you must implement public key policies (by using Group Policy) that auto-enroll computers to receive certificates. If the machine certificate process is not automated, you must log on to your computer as an Administrator, install Certificate Services, and request a computer certificate. For more information, see To manage certificates for a computer and To manage certificates for your user account.


Terminal Window and scripting overview

If you are connecting to a remote access server that is not running Windows, you may need to provide logon information in a separate logon Terminal window. Your connection must be configured to accommodate this requirement.

You can use one of two possible scripting methods to automate the remote Terminal logon process: Switch.inf scripts or Windows scripting. Switch.inf is an older scripting method that was developed for earlier versions of Windows NT. You may find the Windows 95 scripting language easier to use than Switch.inf.


Using the Terminal Window feature for the remote logon process

For a PPP or SLIP server, if the remote computer you connect to requires that you log on with a terminal-emulation screen, you must configure the script settings for that network connection to use a Terminal logon window. With this logon process, after your connection connects to the remote system, a character-based window displays the logon sequence from the remote computer. You can use this window for logging on to the remote computer. For more information, see To use the Terminal Window feature to log on to a remote computer. Alternatively, you can automate this manual logon process as described in Automating the dial-up logon process by using Switch.inf scripts.

Some commercial networks present a large menu of available services before you log on. On SLIP servers, typically running on UNIX, you may go through an extensive sequence of commands that updates files, collects data about you, or configures your SLIP connection during your logon process. On a newer PPP server, you may be prompted for only your user name and password before you are given a connection.

Note

  • If the remote computer is a remote access server running Windows, you do not need to use a Terminal logon window. Instead, the logon process is completely automated for you.


Use the Terminal Window feature to log on to a remote computer

Microsoft Windows graphic

To use the Terminal Window feature to log on to a remote computer

  1. Open Network Connections.
  2. Click the dial-up connection on which you want to use Terminal Window.
  3. Under Network Tasks, click Change settings of this connection.
  4. On the Security tab, under Interactive logon and scripting, select the Show terminal window check box.

Notes

  • XOX
  • After you connect, the After Dial Terminal window appears and prompts you from the remote computer display. You then use this window to log on to the remote computer. After you have completed all interactions with the remote computer, click Done. At this point, authentication on the remote access server begins.
  • If the logon sequence does not vary, you can write a script that automatically passes information to the remote computer during the logon sequence, which enables completely automatic connections.


Using device command (.inf) files

Network Connections uses the Switch.inf and Pad.inf files to automate the interactive logon process with servers and to initialize X.25 packet assemblers/disassemblers (PADs). These device command (.inf) files, located in the systemroot\System32\Ras folder, use the same commands and syntax to communicate with devices or computers automatically.

Switch.inf

You can use the commands in this file when you connect to the network through a security host or a remote server that requires you to log on interactively (for example, a UNIX server). You can create a script by typing the name of the device in brackets and then adding one or more commands following the device name. After you create the script, activate the script (on the Security tab) for each connection that will use the script. You can use the scripts before you dial (for example, modem pools) or after you dial (for example, using security hosts or actually logging on to a remote server). For more information, see Automating the remote logon process by using Switch.inf scripts.

Pad.inf

You can use the commands in this file when you connect to the network through an X.25 PAD. Most supported PADS have scripts that are provided in Pad.inf. If necessary, you can create a script by typing the name of the device within brackets and then adding one or more commands following the device name. After you create the script, activate the script (on the Security tab) for each connection that will use the script.


Automating the dial-up logon process by using Windows scripting

As an alternative to using the Switch.inf file, you can also use the Windows 95 scripting language to automate the logon process for dial-up connections.

Many Internet service providers (ISPs) and online services require you to manually enter information, such as your user name and password, to establish a connection. With scripting support for Network Connections, you can write a script to automate this process.

A script is a text file that contains a series of commands, parameters, and expressions required by your ISP or online service to establish the connection and use the service. You can use any text editor, such as Microsoft Notepad, to create a script file. Once you create the script file, you can then assign it to a specific connection.

The following sample scripts are located in systemroot\System32\Ras.

File | Description
Cis.scp | How to establish a PPP connection with Compuserve.
Pppmenu.scp | How to establish a PPP connection with a host that uses a menu system.
Slip.scp | How to establish a SLIP connection with a host.
Slipmenu.scp | How to establish a SLIP connection with a host that uses a menu system.

For information about activating a script, see To activate a logon script.

For more information about using the Windows 95 scripting language, see the following:

  • Basic structure of a script
  • Variables
  • System variables
  • String literals
  • Expressions
  • Comments
  • Keywords
  • Commands
  • Reserved words


Basic structure of a script

A command is the basic instruction that a script file contains. Some commands require options that further define what the command should do. An expression is a combination of operators and arguments that create a result. You can use expressions as values in any command. Examples of expressions include arithmetic, relational comparisons, and string concatenations.

The basic form of a script for Network Connections is as follows:

;

; A comment begins with a semicolon and extends to

; the end of the line.

;

proc main

; A script can have any number of variables

; and commands.

variable declarations

command block

endproc

A script must have a main procedure, specified by the proc keyword, and a matching endproc keyword, indicating the end of the procedure.

You must declare variables before you add commands. The first command in the main procedure is executed, and then any subsequent commands are executed in the order they appear in the script. The script ends when the end of the main procedure is reached.

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Variables

Scripts may contain variables. Variable names must begin with a letter or an underscore (_) and may contain any sequence of uppercase or lowercase letters, digits, and underscores. You cannot use a reserved word as a variable name. For more information, see Reserved words.

You must declare variables before you use them. When you declare a variable, you must also define its type. A variable of a certain type can only contain values of that same type. The following table describes the three types of variables that are supported.

Type | Description
integer | A negative or positive number, such as 7, -12, or 5,698
string | A series of characters enclosed in straight quotation marks. For example, "Hello world!" or "Enter password:"
boolean | A logical boolean value of TRUE or FALSE
Variables are assigned values by using the following assignment statement:

variable = expression

The variable gets the evaluated expression.

For example:

integer count = 5

integer timeout = (4 * 3)

integer i

boolean bDone = FALSE

string szIP = (getip 2)

set ipaddr szIP

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


System variables

System variables are set by scripting commands or are determined by the information you enter when you set up a connection. System variables are read-only, which means they cannot be changed within the script. The system variables are described in the following table.

Name | Type | Description
$USERID | String | The user identification for the current connection. This variable is the value of the user name specified in the Connect To dialog box.
$PASSWORD | String | The password for the current connection. This variable is the value of the password specified in the Connect To dialog box.
$SUCCESS | Boolean | This variable is set by certain commands to indicate whether or not the command succeeded. A script can make decisions based upon the value of this variable.
$FAILURE | Boolean | This variable is set by certain commands to indicate whether or not the command failed. A script can make decisions based upon the value of this variable.

These variables may be used wherever an expression of a similar type is used. For example:

transmit $USERID

This is a valid command because $USERID is a variable of type string.

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


String literals

Scripting supports escape sequences and caret translations, as described in the following table.

String literal | Description
^char Caret translation.

If char is a value between '@' and '_', the character sequence is translated into a single-byte value from 0 through 31. For example, ^M is converted to a carriage return.

If char is a value between a and z, the character sequence is translated into a single-byte value from 1 through 26.

If char is any other value, the character sequence is not specially treated.
<cr> | Carriage return.
<lf> | Line feed.
\" Quotation mark.
\^ Single caret.
\< Single angle bracket.
\\ Backslash.
For example:

transmit "^M"

transmit "Joe^M"

transmit "<cr><lf>"

waitfor "<cr><lf>"

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Expressions

An expression is a combination of operators and arguments that evaluate to a result. You can use expressions as values in any command.

An expression can combine any variable, integer, string, or boolean value with any of the unary and binary operators in the following tables. All unary operators take the highest precedence. The precedence of binary operators is indicated by their position in the table.

The unary operators are listed in the following table.

Operator | Type of operation
- | Unary minus
! | One's complement

The binary operators are listed in the following table in their order of precedence. Operators with higher precedence are listed first.

Operators | Type of operation | Type restrictions
* / | Multiplicative | Integers
+ - | Additive integers | Strings (+ only)
<> <= >= | Relational | Integers
== != | Equality | Integers, strings, booleans
and | Logical AND | Booleans
or | Logical OR | Booleans

For example:

count = 3 + 5 * 40

transmit "Hello" + "there"

delay 24 / (7 - 1)

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Comments

All text on a line following a semicolon is ignored. For example:

; this is a comment

transmit "hello" ; transmit the string "hello"

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Keywords

Keywords specify the structure of a script. Unlike commands, they do not perform an action. The keywords are described in the following table.

Keyword | Description
proc name | Indicates the beginning of a procedure. All scripts must have a main procedure (proc main). Script execution starts at the main procedure and terminates at the end of the main procedure.
endproc | Indicates the end of a procedure. When the script is executed to the endproc statement for the main procedure, Network Connections starts PPP or SLIP.
integer name [ = value ] | Declares a variable of type integer. You can use any numerical expression or variable to initialize the variable.
string name [ = value ] | Declares a variable of type string. You can use any string literal or variable to initialize the variable.
boolean name [ = value ] | Declares a variable of type boolean. You can use any boolean expression or variable to initialize the variable.

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Commands

All commands are reserved words, which means you cannot declare variables that have the same names as the commands. The commands are described in the following table.

Command | Description | Example
delay nSeconds Pauses for the number of seconds specified by nSeconds before executing the next command in the script. delay 2 ; pauses for 2 seconds

delay x * 3 ; pauses for x * 3 seconds
getip value Waits for an IP address to be received from the remote computer. If your Internet service provider (ISP) returns several IP addresses in a string, use value to specify which IP address the script should use. ; get the second IP address

set ipaddr getip 2

; assign the first received

; IP address to a variable

szAddress = getip
goto label Jumps to the location in the script specified by label and continues executing the commands following it. waitfor "Prompt:" until 10

if !$SUCCESS then

goto BailOut ; jumps to

;BailOut and executes

;commands following it

endif

transmit "bbs^M"

goto End

BailOut:

transmit "^M"

halt | Stops the script. This command does not remove the Terminal window. You must click Continue to establish the connection. You cannot restart the script.
if condition then

commands

endif

         Executes the series of commands if condition is TRUE. if $USERID == "John" then

transmit "Johnny^M"

endif
label: Specifies the place in the script to jump to. A label must be a unique name and follow the naming conventions of variables.
set port databits 5 | 6 | 7 | 8 | Changes the number of bits in the bytes that are transmitted and received during the session. The number of bits is from 5 through 8. If you do not include this command, Network Connections uses the settings specified for the connection. | set port databits 7
set port parity none | odd | even | mark | space | Changes the parity scheme for the port during the session. If you do not include this command, Network Connections uses the settings specified for the connection. | set port parity even
set port stopbits 1 | 2 | Changes the number of stop bits for the port during the session. This number is either 1 or 2. If you do not include this command, Network Connections uses the settings specified for the connection. | set port stopbits 2
set screen keyboard on | off | Enables or disables keyboard input in the scripting Terminal window. | set screen keyboard on
set ipaddr string Specifies the IP address of the workstation for the session. String must be in the form of an IP address. szIPAddress = "10.0.0.0"

set ipaddr szIPAddress

set ipaddr "10.0.0.0"

set ipaddr getip
transmit string [ , raw ] Sends the characters specified by string to the remote computer.

The remote computer recognizes escape sequences and caret translations, unless you include the raw option with the command. The raw option is useful when transmitting $USERID and $PASSWORD system variables when the user name or password contains character sequences that, without the raw option, are interpreted as caret or escape sequences.

 transmit "slip" + "^M"

transmit $USERID, raw
waitfor string [ , matchcase ] [ then label { , string [ , matchcase ] then label } ] [ until time ] Waits until your computer receives one or more of the specified strings from the remote computer. String is not case-sensitive, unless you include the matchcase option.

If a matching string is received and the then label option is used, this command jumps to the place in the script file designated by label.

The optional until time option defines the maximum number of seconds that your computer waits to receive the string before it executes the next command. Without this option, your computer waits forever.

If your computer receives one of the specified strings, the system variable $SUCCESS is set to TRUE. Otherwise, it is set to FALSE if the number of seconds specified by time elapses before the string is received. 		waitfor "Login:"

waitfor "Password?", matchcase

waitfor "prompt:" until 10

waitfor

"Login:" then DoLogin,

"Password:" then DoPassword,

"BBS:" then DoBBS,

"Other:" then DoOther

until 10
while condition do

commands

endwhile

 Executes the series of commands until condition is FALSE. integer count = 0

while count < 4 do

transmit "^M"

waitfor "Login:" until 10

if $SUCCESS then

goto DoLogin

endif

count = count + 1

endwhile

...

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Reserved words

The following words are reserved and cannot be used as variable names.

and | boolean | databits | delay
do | endif | endproc | endwhile
even | FALSE | getip | goto
halt | if | integer | ipaddr
keyboard | mark | matchcase | none
odd | off | on | or
parity | port | proc | raw
screen | set | space | stopbits
string | then | transmit | TRUE
until | waitfor | while

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Automating the dial-up logon process by using Switch.inf scripts

To automate the logon process, you can use the Switch.inf file (or Pad.inf on X.25 networks) instead of the manual Terminal window described in Using the Terminal feature for the remote logon process.

Automated scripts are especially useful when a constant connection to a remote computer is needed. If your network connection is configured to use a script, and a remote connection fails, your connection automatically redials the number and reestablishes the connection. Scripts also save time if you frequently log on to a remote system and do not want to manually log on each time.

The Switch.inf file provides a generic script that you can use with little or no modification. You can try Switch.inf without modification and if it does not work, then copy and modify the generic script to match the logon sequence of the remote computer to which you want to connect.

The script language is also designed to communicate with other devices, including modems. If you are unfamiliar with modem scripts, scripting can be difficult to understand. You may find it easier to copy, then modify, one of the generic sample scripts.


Creating Switch.inf scripts for network and dial-up connections

The Switch.inf file, located in the systemroot\System32\Ras folder, is like a set of small batch files (scripts) contained in one file. The Switch.inf file contains a different script for each intermediary device or online service that a connection calls.

A Switch.inf script has six elements:

  • Section headers
  • Comment lines
  • Commands
  • Responses
  • Response keywords
  • Macros

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Section headers

Section headers divide the Switch.inf file into individual scripts. A section header marks the beginning of a script for a particular remote computer and must not exceed 31 characters. The text of a section header appears in Network Connections when you activate the script. The section header is enclosed in square brackets. For example:

[Route 66 Logon Process]

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Comment lines

Comment lines must have a semicolon (;) in column one and can appear anywhere in the file. Comment lines contain information for people who maintain the Switch.inf file. For example:

; This script was created by Martha on September 29, 1996.

For more information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Commands

Each line in a script is a command from your local computer to a remote computer or a response from a remote computer to your local computer. Each command or response is a stream of data or text. For example, the following command sends a user name (Martha) and a carriage return (the macro <cr>) to the remote computer:

COMMAND=Martha<cr>

The commands and responses must be in the exact order the remote computer expects them. Branching statements, such as GOTO or IF, are not supported.

The required sequence of commands and responses for a specific remote device should be in the documentation for that device or, if you are connecting to a commercial service, from the support staff of that service. If the exact sequence is not available, you can activate the generic script provided with Network Connections and modify it to match the logon sequence of the remote computer as described in Troubleshooting logon scripts.

You can use the COMMAND= statement in two additional ways:

  • COMMAND= NoResponse

    This is the default behavior and causes an approximate two-second delay. This is useful when an intermediate device requires a delay.

  • COMMAND= string

    In this case, string is not followed by a carriage return (<cr>). This is useful when a device requires slow input. Instead of receiving the whole command string, the device requires characters to be sent one-by-one.

The following example shows a script for an intermediary device that is so slow, it is able to receive and process only one character of the command PPP at a time:

COMMAND=P
NoResponse
COMMAND=P
NoResponse
COMMAND=P
NoResponse

Note

  • To activate a script.inf file, see To activate a logon script.


Responses

A response is sent from the remote device or computer. To write an automatic script, you must know the responses you will receive from the remote device. If a gap of two or more seconds occurs between characters, the received text is sent as a response. This gap is the only cue that a response is over. For more information, see Getting through two-second gaps and large blocks of text.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Response keywords

The keyword in a response line specifies what to do with the responses you receive from the remote computer, as follows:

  • OK=remote computer response<macro>

    The script continues to the next line if the response or macro is encountered.

  • LOOP=remote computer response<macro>

    The script returns to the previous line if the response or macro is encountered.

  • CONNECT=remote computer response<macro>

    Used at the end of a successful modem script. Not generally useful with the Switch.inf file.

  • ERROR=remote computer response<macro>

    Causes Network Connections to display a generic error message if the response is encountered. Useful for notifying you when the remote computer reports a specific error.

  • ERROR_DIAGNOSTICS=remote computer response<diagnostics>

    Causes Network Connections to display the specific cause for an error returned by the device. Not all devices report specific errors. Use ERROR= if your device does not return specific errors that can be identified with Network Connections diagnostics.

  • NoResponse

    Used when no response comes from the remote device.

A connection always expects a response from the remote device and waits until a response is received unless a NoResponse statement follows the COMMAND= line. If there is no statement for a response following a COMMAND= line, the COMMAND= line executes and stops the script at that point.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Macros

Macros are enclosed in angle brackets (<>) and perform a variety of special functions, as follows:

  • <cr>

    Inserts a carriage return.

  • <lf>

    Inserts a line feed.

  • <match> "string"

    Reports a match if the string enclosed in quotation marks is found in the device response. Each character in the string is matched according to upper and lower case. For example, <match> "Smith" matches Jane Smith and John Smith III, but not SMITH.

  • <?>

    Inserts a wildcard character, for example, CO<?><?>2 matches COOL2 or COAT2, but not COOL3.

  • <hXX>

    (XX are hexadecimal digits)

    Allows any hexadecimal character to appear in a string—including the zero byte, <h00>.

  • <ignore>

    Ignores the rest of a response from the macro on.

  • <diagnostics>

    Passes specific error information from a device to remote access, which displays the specific error to you. Otherwise, a nonspecific error message appears.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Stepping through an example Switch.inf script

This section describes each part of the generic script provided in the Switch.inf file.

Every script must start with a command to the remote computer, followed by one or more response lines. This initial command might be simply to wait for the remote computer to initialize and send its logon banner. The default initial command is to wait two seconds for the logon banner. It appears as follows in the Switch.inf file:

COMMAND=

If the response (the logon banner from the remote computer) is the following:

Welcome to Electronic, Inc. Net. Please enter your login:

then the corresponding response line in the Switch.inf file should be:

OK=<match>"Please enter your login:"

If the remote computer sends the "Please enter your login:" string, then this indicates that everything is correct. You respond by sending a command with the characters in your user name and the carriage return, as follows:

COMMAND=Martha<cr>

If the response from the remote computer is the following:

Please enter your password:

then the corresponding response line in the Switch.inf file should be:

OK=<match>"Please enter your password:"

To send your password, you send the following command:

COMMAND=mUs3naB<cr>

On many PPP computers, this script automatically logs you on.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Getting through two-second gaps and large blocks of text in Switch.inf

If the computer you are connecting to has a two-second gap in the data stream response to your computer, the remote access server assumes that the gap is the end of the response. These gaps can occur anywhere, even between words, and are detected by using modem diagnostics. For more information, see To log and view modem commands.

If you write a script that fails for no apparent reason, you can use modem diagnostics, and then consult systemroot\ModemLog_model.txt to see if a response ends in the middle of a word. Model is the name of the modem as it appears in the list of installed modems in Modem Properties. If a response ends in the middle of a word, your script must account for the two-second gap. A simple way to do this is to include the following command:

COMMAND=<cr>

You can skip to the end of large blocks of text that contain multiple gaps by using the LOOP= keyword and by matching text at the end of a block. For example:

COMMAND=<cr>

OK=<match>"Enter the service to start:"

LOOP=<ignore>

In this example, the network connection sends a null command (waits two seconds). The network connection then waits for the "Enter the service to start:" message. If this is a long block of text, the connection does not find the string. The connection then moves to the LOOP command. The LOOP command causes Network Connections to return to the line above, and the connection waits for the words "Enter the service to start:" in the second response. In this manner, you can loop though long blocks of text until you reach the text of the desired prompt.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Using commands and carriage returns in Switch.inf

In Switch.inf scripts, you usually must include <cr>, which indicates a carriage return, at the end of a command. The carriage return causes the remote computer to process the command immediately. If you do not include <cr>, the remote computer may not recognize the command.

In other situations, you cannot use <cr> because the remote computer accepts a command without a carriage return and requires time to process the command. This situation mainly applies when you are sending a series of commands without expecting a response.

For more information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Troubleshooting logon scripts

You can log all information passed between your network connection, the modem, and the remote device, including errors reported by the remote device.

You can view modem commands by enabling logging. After you enable logging, commands sent to the modem are captured in the file systemroot\ModemLog_model.txt. Model is the name of the modem as it appears in the list of installed modems. For instructions about logging modem commands, see To log and view modem commands.


Activate a logon script

Microsoft Windows graphic

To activate a logon script

  1. Open Network Connections.
  2. Right-click the connection on which you want to run a script, and then click Properties.
  3. On the Security tab, select the Run script check box.
  4. To use an existing script file, click Browse.

    Or, to use Switch.inf, click Edit.

Notes

  • XOX
  • In addition to Switch.inf, the Windows 95 scripting language is supported for computers running XOX that connect to computers running a non-Microsoft operating system. You may find the Windows 95 scripting language easier to use than Switch.inf. XOX
  • If you click Edit and load Switch.inf into Notepad, immediately resave the file with a different name to preserve the default Switch.inf file.


Troubleshooting network and dial-up connections

What problem are you having?

The modem does not work.

Cause: The modem is incompatible.

Solution: If you have access to another computer with an Internet connection, check the list of compatible modems. XOX

Cause: The modem is not connected properly or is turned off.

Solution: Verify that the modem is connected properly to the correct port on your computer. If the modem is external, verify that the power is on.

See Also: Troubleshooting Modems.

Unable to connect to my Internet service provider (ISP).

Cause: The ISP's server is not running.

Solution: Ask your ISP to verify that the remote access server is running.

Cause: You do not have a valid user account, or you do not have remote access permission.

Solution: Verify with your ISP that your user account has been established, and that you have remote access permission.

Cause: You dialed the wrong number, or you dialed the correct number but forgot to dial an external line-access number, such as 9.

Solution: Verify that the number is correct as dialed.

Cause: Your modem cannot negotiate with the modem of the server.

Solution: Try using the same type of modem as the server.

Cause: The modem cabling is faulty.

Solution: Do not use the 9-to-25-pin converters that are included with most mouse hardware because some of them do not carry modem signals. To be safe, you should use a converter made especially for this purpose.

Cause: The telephone line (for example, in your hotel room) does not accommodate your modem speed.

Solution: Select a lower bits-per-second (bps) rate (or call the hotel manager to request a direct line).

See also: To change the maximum modem port speed.

Cause: The line you are trying to use is digital.

Solution: Most modems work only with analog phone lines. Verify that you have analog phone lines installed or, if you have digital phone lines installed, verify that the servers and clients have digital modems.

When trying to connect, a message is received that says the ISP server is not responding.

Cause:

  • At higher bits-per-second (bps) rates, your modem is incompatible with the modem of the server.
  • There is a lot of static on the phone line, which prevents a modem from connecting at a higher bps rate.
  • There is some kind of switching equipment between the client and server that prevents the two modems from negotiating at a higher bps rate.

Solution: Adjust the speed of your modem to a lower bits-per-second (bps) rate.

See also: To change the maximum modem port speed.

Cause: The ISP server is not running.

Solution: Ask your ISP to verify that the server is running.

The modem always connect at a lower bits-per-second (bps) rate than specified.

Cause: The modem and telephone line are not operating correctly. Excessive static on the telephone line causes sessions to be dropped.

Solution: You can use modem diagnostics to confirm correct modem operation.

See also: To log and view modem commands.

Cause: The quality of your line is insufficient.

Solution: Contact your telephone company to verify the quality of your line.

Cause: The line you are dialing is affecting the speed.

Solution: If you can connect to your ISP by using more than one number, try another number and see if the speed improves.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

The sessions with my ISP on the network keep getting dropped.

Cause: Call waiting is disrupting your connection.

Solution: Verify that the phone has call waiting. If so, disable call waiting and try calling again.

See also: To change dialing properties for a location.

Cause: The ISP disconnected you because of inactivity.

Solution: Try calling again.

Cause: Someone picked up the phone. Picking up the phone automatically disconnects you.

Solution: Try calling again.

Cause: Your modem cable is disconnected.

Solution: Verify that the modem cable is connected properly.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

Cause: Your modem settings need to be changed because the ISP changed settings on their server.

Solution: Verify the modem settings with your ISP's system administrator.

Connections are disconnecting abnormally.

Cause: The ISP server is not running.

Solution: Ask your ISP system administrator to verify that the server is running.

Cause:

  • Your modem is unable to negotiate correctly with the modem of the ISP server.
  • The serial port of the computer cannot keep up with the speed you have selected.

Solution: Try to connect at a lower initial port speed.

See also: To change the maximum modem port speed.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

When trying to connect, a hardware error is received.

Cause: The modem is turned off.

Solution: Verify that the modem is turned on. If the modem is turned off, turn it on and redial.

Cause: Your modem is not functioning properly.

Solution: Enable modem logging to test the connection.

See also: To log and view modem commands.

Cause: Your cable is incompatible.

Solution: If your modem communicates through Terminal, but not through Network Connections, the cable that attaches your modem to the computer is probably incompatible. You need to install a compatible cable.

Conflicts between serial ports are causing connection problems.

Cause: The serial ports are conflicting.

Solution: Com1 and Com3 share interrupt request (IRQ) 4. Com2 and Com4 share IRQ 3. As a result, for serial communications, you cannot use COM1 and COM3 simultaneously, or COM2 and COM4 simultaneously. For example, you cannot use Network Connections on COM1 and Terminal on COM3.

This rule applies if you are using the mouse in addition to other serial communications programs such as Network Connections or the Terminal program. The rule does not apply if you are using an intelligent serial adapter such as a DigiBoard serial card.

See Also: To configure a connection; To change the COM port for a modem.

When trying to connect by using ISDN, a "No Answer" message is received.

Cause: The ISP server did not answer because it is turned off or the modem is not connected.

Solution: Contact your system administrator.

Cause: The line is busy.

Solution: Try calling later, or contact your system administrator.

Cause: There is a problem with the hardware.

Solution: Verify that the ISDN adapters are installed and configured correctly.

Cause: Your phone number is not configured correctly.

Solution: In some cases, each B channel on an ISDN line has its own number, while in other cases both B channels share a single number. Your telephone company can tell you how many numbers your ISDN line has.

Cause: If you are located in the United States or Canada, your Service Profile Identifier (SPID) is configured incorrectly. The SPID normally consists of the phone number with additional digits added to the beginning, the end, or both. The SPID helps the switch understand what type of equipment is attached to the line and routes calls to appropriate devices on the line. If an ISDN channel requires a SPID, but it is not entered correctly, then the device cannot place or accept calls.

Solution: Verify that the SPID is entered correctly.

Cause: A poor line condition (for example, too much static) interrupted your connection.

Solution: Wait a few minutes and try dialing again.

Cause: You did not enable line-type negotiation, or a connection cannot be made with the line type you selected.

Solution: Enable line-type negotiation.

Cause: Your ISDN switching facility is busy.

Solution: Try again later.

Cause: Your DigiBoard card is too old.

Solution: If you do not have the latest PCIMAC-ISA DigiBoard card, serial number A14308 or greater, contact DigiBoard for a replacement.

Connections made by using X.25 fail.

Cause: The dial-up PAD is configured with the wrong X.3 parameters or serial settings.

Solution: If the remote access server is running and you cannot connect to it directly through an X.25 smart card or an external PAD, modify the dial-up PAD X.3 parameters or serial settings. Ask your system administrator for the correct settings.

See also: To configure a connection.

Cause: New Pad.inf entries are incorrect.

Solution: You can check other Pad.inf entries for direct connections and external PADs, and view the comments that go with them. You may need a line analyzer or a terminal program to see the response for the PAD. For dial-up PAD entries, you can use an entry in Pad.inf as an example, paying attention to the comments that go with the example.

Cause: Your modem is incompatible.

Solution: If the modem that connects to a dial-up PAD connects at a lower speed than it should, replace the modem with a compatible one.

See also: The modem does not work with Network Connections

Cause: The line for the remote access server is congested. If a connection has been established, but the network drives are disconnecting, and you are dropping sessions or getting network errors, the cause may be congestion on the leased line for the remote access server.

For example, four clients connecting at 9600 bps (through dial-up PADs) require a 38,400-bps (four times 9600) leased line on the server end. If the leased line does not have adequate bandwidth, it can cause time-outs and degrade performance for connected clients. This example assumes that Routing and Remote Access is using all the bandwidth. If Routing and Remote Access is sharing the bandwidth, fewer connections can be made.

Solution: Your system administrator needs to verify that the speed of the leased line can support all the COM ports at all speeds clients use to dial in.

Connections through PPTP fail.

Cause: TCP/IP connectivity problems are keeping you from connecting to the PPTP server.

Solution: You or your system administrator can use the ipconfig and ping commands to verify a connection to your server.

Cause: A Winsock Proxy client is active.

Solution: A VPN connection cannot operate with an active Winsock Proxy client. Winsock Proxy immediately redirects packets to the proxy server before they can be processed by a virtual network connection for encapsulation. Ask your system administrator to disable the Winsock Proxy client.

Cause: You do not have the appropriate connection and domain permissions on the remote access server.

Solution: Contact your system administrator.

Cause: If you are using the TCP/IP protocol, you do not have a unique TCP/IP address.

Solution: Contact your system administrator.

Cause: Name resolution problems are keeping you from resolving names to IP addresses.

Solution: Specify fully qualified domain names and IP addresses in your connection.

See Also: To configure TCP/IP settings

Connections made by using PPP or TCP/IP utilities are failing.

Cause: The server does not support LCP extensions.

Solution: If you cannot connect to a server by using PPP, or the remote computer terminates your connection, the server may not support LCP extensions. In Network Connections, clear the Enable LCP extensions check box.

Cause: IP header compression is keeping TCP/IP utilities from running. If you successfully connect to a remote server by using PPP, but TCP/IP utilities do not work, the problem may be IP header compression.

Solution: Try to reconnect after turning off IP header compression.

See Also: To stop requesting LCP extensions in PPP; To turn off IP header compression in PPP.

A specific program experiences Internet connectivity issues and Internet Connection Sharing, Windows Firewall, or both are enabled.

Cause: Windows Firewall, Internet Connection Sharing, or both are obstructing the program or prohibiting the program from successfully establishing full, two-way communications across the Internet.

Solution: Obtain an Internet Connection Sharing and Windows Firewall plug-in from the program manufacturer. Internet Connection Sharing and Windows Firewall plug-ins are designed to fix any Internet connectivity problems that you may encounter with specific programs when either Internet Connection Sharing (ICS) or Windows Firewall are enabled. The plug-ins are provided on disk or over the Internet as an executable file. Because Internet Connection Sharing and Windows Firewall plug-ins can potentially open your network to security risks, you should only install them when they are from a trusted source. For more information, see Using Internet Connection Sharing and Windows Firewall Plug-ins.

Connections made by using Internet Connection Sharing are failing.

Cause: The wrong LAN network adapter is shared.

Solution: A computer with Internet Connection Sharing needs two connections. One connection, typically a network adapter, connects to the computers on the home or small office network and the other connection connects the home or small office network to the Internet. You need to ensure that Internet Connection Sharing is enabled on the connection that connects your home network to the Internet.

Cause: TCP/IP is not installed on home or small office network computers.

Solution: By default, the TCP/IP protocol is installed on computers running XOX, Windows 2000, Windows Millennium Edition, Windows 98, and Windows NT version 4.0. If users on your home or small office network are running operating systems other than these, verify that TCP/IP is installed on their computers.

Cause: If users on your home or small office network cannot reach the Internet, TCP/IP is incorrectly configured on their computers.

Solution: Verify that the following TCP/IP settings are established on local area connections:

  • IP Address: Obtain an IP address automatically (through DHCP)
  • DNS server: Obtain DNS server address automatically
  • Default gateways: None specified

For computers running Windows 95, Windows 98, Windows Millennium, or Windows NT version 4.0, you can find the TCP/IP settings in Network in Control Panel.

Cause: If users on your home or small office network cannot reach the Internet, their Internet options need to be modified.

Solution: Internet options must be modified for Internet Connection Sharing. For more information, see To configure Internet options for Internet Connection Sharing.

Cause: The Internet Connection Sharing service is not started.

Solution: Use Event Viewer to verify that the Internet Connection Sharing service is started.

See also: Using Event Viewer.

Cause: The Internet Connection Sharing computer is not properly configured for name resolution.

Solution: You may need to configure the WINS or DNS name resolution services on the computer. If computers on the home or small office network cannot resolve names to IP addresses, you can check the name resolution configuration of the Internet Connection Sharing computer by using the ipconfig command. There are two ways that your ISP can configure name resolution:

  • Statically assigned name servers

    • You must manually configure the TCP/IP protocol with the IP address (or addresses) of the name servers provided by the ISP. If you have statically assigned name servers, you can use the ipconfig command at any time to get the IP addresses of your configured name servers.

  • Dynamically assigned name servers

    • Manual configuration is not required. The IP addresses of the name servers provided by the ISP are dynamically assigned whenever you dial the ISP. If you have dynamically assigned name servers, you must run the ipconfig command after a connection to the ISP has been made.

Cause: If you cannot play a game across the Internet, the protocol used by the application is not translatable.

Solution: Try running the program from the Internet Connection Sharing computer. If the program works there but not at another computer on the home or small office network, then the program may not be translatable.

Cause: If you cannot play a game across the Internet, the program is not configured on the computer running Internet Connection Sharing.

Solution: Verify that the program, including port numbers, is configured correctly.

See also: Programs and services overview

Cause: If Internet users cannot see services on your home or small office network, such as a Web server, the service is not configured correctly.

Solution: Verify that the service, including port numbers and TCP/IP addresses, is configured correctly.

Cause: If users on your home network cannot reach the Internet sites by using friendly names, there is a DNS resolution problem.

Solution: Have users on your home network use fully qualified domain names or IP addresses when accessing Internet resources.

See Also: Service definitions overview; Internet Connection Sharing; To configure TCP/IP to use WINS; To configure TCP/IP to use DNS; To test a TCP/IP configuration by using the ping command

When using a local area network connection, there is no response.

Cause: There may be problems with your network adapter.

Solution: Try the following:

  • Check the appearance of the local area connection icon. Depending on the status of the local area connection, the icon appears in different ways in the Network Connections folder. Also, if the local area connection media is disconnected (for example, the cable is unplugged), a status icon is displayed in the notification area. For more information, see Local area connections.
  • Use Device Manager to verify that your network adapter is working correctly.

Cause: The local area connection cable may not be plugged into the network adapter.

Solution: Check to make sure the local area connection cable is inserted into the network adapter.

When using a laptop to connect to an ISP, some or all of the programs do not run properly.

Cause: The WinSock Proxy Client may be preventing your programs from running properly when you use the ISP connection.

Solution: If you are a mobile user and use your laptop in your corporate environment, you may need to disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) when you use the same computer to dial to an ISP or other network. For example, if you use a laptop in your office and use the same computer to connect to an ISP or other network from your home, you may have problems running all of your applications when you use the ISP connection. (For example, your programs may not be able to find the resources or servers they need.) If this is the case, you should disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) to run the programs that you typically run when you use your laptop in the corporate office.

Incoming connection clients cannot see resources beyond the incoming connection computer.

Cause: If the addresses that are being allocated to incoming clients are not a subset of the network to which the incoming connection computer is attached, you must create a route to the incoming client computers on the intranet computers.

Solution: Reconfigure your range of IP addresses that are being allocated to incoming clients so that it is a subset of the network to which the incoming connections computer is attached. If you cannot do this, then configure your intranet hosts with the IP address of the incoming connections computer as a default gateway.

  • If your intranet hosts are configured to obtain an IP address automatically and a Dynamic Host Configuration Protocol (DHCP) server is present, you can configure your DHCP server to assign the default gateway.
  • If your intranet hosts are configured to obtain an IP address automatically and a DHCP server is not present (you are using the Automatic Private IP Addressing feature), then you must manually configure all of your intranet hosts with an IP address, subnet mask, and default gateway.

See Also: To configure a default gateway, Incoming connections and IP addresses.

Cause: The calculated range of addresses allocated to connecting clients is larger than the range that you configured.

Solution: Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. The closest matching subnet is calculated for the range that you specified in From and To. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.

See Also: To configure an incoming connection to use TCP/IP.


Error messages

You may receive one or more of the following errors when you use Network Connections. To see more information about an error, click the error message below.

600 An operation is pending.

601 An invalid port handle was detected.

602 The specified port is already open.

603 The caller's buffer is too small.

604 Incorrect information was specified.

605 The port information cannot be set.

606 The specified port is not connected.

607 An invalid event is detected.

608 A device was specified that does not exist.

609 The device type was specified that does not exist.

610 An invalid buffer was specified.

611 A route was specified that is not available.

612 A route was specified that is not allocated.

613 An invalid compression was specified.

614 There were insufficient buffers available.

615 The specified port was not found.

616 An asynchronous request is pending.

617 The modem is already disconnecting.

618 The specified port is not open.

619 The specified port is not connected.

620 No endpoints could be determined.

621 The system could not open the phonebook.

622 The system could not load the phonebook.

623 The system could not find the phonebook entry for this connection.

624 The system could not update the phonebook file.

625 The system found invalid information in the phonebook.

626 A string could not be loaded.

627 A key could not be found.

628 The connection was closed.

629 The connection was closed by the remote computer.

630 The modem was disconnected due to hardware failure.

631 The user disconnected the modem.

632 An incorrect structure size was detected.

633 The modem is already in use or is not configured for dialing out.

634 Your computer could not be registered on the remote network.

635 There was an unknown error.

636 The device attached to the port is not the one expected.

637 A string was detected that could not be converted.

638 The request has timed out.

639 No asynchronous net is available.

640 A error has occurred involving NetBIOS.

641 The server cannot allocate NetBIOS resources needed to support the client.

642 One of your computer's NetBIOS names is already registered on the remote network.

643 A network adapter at the server failed.

644 You will not receive network message popups.

645 There was an internal authentication error.

646 The account is not permitted to log on at this time of day.

647 The account is disabled.

648 The password for this account has expired.

649 The account does not have permission to dial in.

650 The remote access server is not responding.

651 The modem has reported an error.

652 There was an unrecognized response from the modem.

653 A macro required by the modem was not found in the device .INF file section.

654 A command or response in the device .INF file section refers to an undefined macro.

655 The <MESSAGE> macro was not found in the device .INF file section.

656 The <DEFAULTOFF> macro in the device .INF file section contains an undefined macro.

657 The device .INF file could not be opened.

658 The device name in the device .INF or media .INI file is too long.

659 The media .INI file refers to an unknown device name.

660 The device .INF file contains no responses for the command.

661 The device .INF file is missing a command.

662 There was an attempt to set a macro not listed in the device .INF file section.

663 The media .INI file refers to an unknown device type.

664 The system has run out of memory.

665 The modem is not properly configured.

666 The modem is not functioning.

667 The system was unable to read the media .INI file.

668 The connection was terminated.

669 The usage parameter in the media .INI file is invalid.

670 The system was unable to read the section name from the media .INI file.

671 The system was unable to read the device type from the media .INI file.

672 The system was unable to read the device name from the media .INI file.

673 The system was unable to read the usage from the media .INI file.

674 The system was unable to read the maximum connection BPS rate from the media .INI file.

675 The system was unable to read the maximum carrier connection speed from the media .INI file.

676 The phone line is busy.

677 A person answered instead of a modem.

678 There was no answer.

679 The system could not detect the carrier.

680 There was no dial tone.

681 The modem reported a general error.

691 Access was denied because the user name and/or password was invalid on the domain.

692 There was a hardware failure in the modem.

695 The state machines are not started.

696 The state machines are already started.

697 The response looping did not complete.

699 The modem response caused a buffer overflow.

700 The expanded command in the device .INF file is too long.

701 The modem moved to a connection speed not supported by the COM driver.

703 The connection needs information from you, but the application does not allow user interaction.

704 The callback number is invalid.

705 The authorization state is invalid.

707 There was an error related to the X.25 protocol.

708 The account has expired.

709 There was an error changing the password on the domain. The password might have been too short or might have matched a previously used password.

710 Serial overrun errors were detected while communicating with the modem.

711 The Remote Access Service Manager could not start. Additional information is provided in the event log.

712 The two-way port is initializing. Wait a few seconds and redial.

713 No active ISDN lines are available.

714 No ISDN channels are available to make the call.

715 Too many errors occurred because of poor phone line quality.

716 The remote access service IP configuration is unusable.

717 No IP addresses are available in the static pool of remote access service IP addresses.

718 The connection timed out waiting for a valid response from the remote computer.

719 The connection was terminated by the remote computer.

721 The remote computer is not responding.

722 Invalid data was received from the remote computer. This data was ignored.

723 The phone number, including prefix and suffix, is too long.

726 The IPX protocol cannot be used for dial-out on more than one modem at a time.

728 The system cannot find an IP adapter.

729 SLIP cannot be used unless the IP protocol is installed.

731 The protocol is not configured.

732 Your computer and the remote computer could not agree on PPP control protocols.

733 Your computer and the remote computer could not agree on PPP control protocols.

734 The PPP link control protocol was terminated.

735 The requested address was rejected by the server.

736 The remote computer terminated the control protocol.

737 Loopback detected.

738 The server did not assign an address.

739 The authentication protocol required by the remote server cannot use the stored password. Redial, entering the password explicitly.

740 An invalid dialing rule was detected.

741 The local computer does not support the required data encryption type.

742 The remote computer does not support the required data encryption type.

743 The remote server requires data encryption.

751 The callback number contains an invalid character. Only the following characters are allowed: 0 to 9, T, P, W, (,), -, @, and space.

752 A syntax error was encountered while processing a script.

753 The connection could not be disconnected because it was created by the multi-protocol router.

754 The system could not find the multi-link bundle.

755 The system cannot perform automated dial because this entry has a custom dialer specified.

756 This connection is already being dialed.

757 Remote access services could not be started automatically. Additional information is provided in the event log.

758 Internet Connection Sharing is already enabled on the connection.

760 An error occurred while routing capabilities were being enabled.

761 An error occurred while Internet Connection Sharing was being enabled for the connection.

763 Internet Connection Sharing cannot be enabled. There are two or more LAN connections in addition to the connection to be shared.

764 No smart card reader is installed.

765 Internet Connection Sharing cannot be enabled. A LAN connection is already configured with the IP address required for automatic IP addressing.

767 Internet Connection Sharing cannot be enabled. The LAN connection selected on the private network has more than one IP address configured. Reconfigure the LAN connection with a single IP address before enabling Internet Connection Sharing.

768 The connection attempt failed because of failure to encrypt data.

769 The specified destination is not reachable.

770 The remote machine rejected the connection attempt.

771 The connection attempt failed because the network is busy.

772 The remote computer's network hardware is incompatible with the type of call requested.

773 The connection attempt failed because the destination number has changed.

774 The connection attempt failed because of a temporary failure. Try connecting again.

775 The call was blocked by the remote computer.

776 The call could not be connected because the destination has invoked the Do Not Disturb feature.

777 The connection attempt failed because the modem on the remote computer is out of order.

778 It was not possible to verify the identity of the server.

780 An attempted function is not valid for this connection.

783 Internet Connection Sharing cannot be enabled. The LAN connection selected as the private network is either not present, or is disconnected from the network. Please ensure that the LAN adapter is connected before enabling Internet Connection Sharing.

784 You cannot dial using this connection at logon time, because it is configured to use a user name different than the one on the smart card. If you want to use it at logon time, you must configure it to use the user name on the smart card.

785 You cannot dial using this connection at logon time, because it is not configured to use a smart card. If you want to use it at logon time, you must edit the properties of this connection so that it uses a smart card.

788 The L2TP connection attempt failed because the security layer could not negotiate compatible parameters with the remote computer.

789 The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer.

791 The L2TP connection attempt failed because security policy for the connection was not found.

792 The L2TP connection attempt failed because security negotiation timed out.

793 The L2TP connection attempt failed because an error occurred while negotiating security.

794 The Framed Protocol RADIUS attribute for this user is not PPP.

795 The Tunnel Type RADIUS attribute for this user is not correct.

796 The Service Type RADIUS attribute for this user is neither Framed nor Callback Framed.

797 A connection to the remote computer could not be established because the modem was not found or was busy.

799 Internet Connection Sharing (ICS) cannot be enabled due to an IP address conflict on the network. ICS requires the host be configured to use 192.168.0.1. Please ensure that no other client on the network is configured to use 192.168.0.1.

800 Unable to establish the VPN connection. The VPN server may be unreachable, or security parameters may not be configured properly for this connection.


The modem does not work with Network Connections

If you have access to another computer with an Internet connection, check the list of compatible modems in the Microsoft Windows Hardware Compatibility List. XOX

If the modem appears on the list, verify that the modem is connected properly to the correct port on your computer. If the modem is external, verify that the power is on.

For additional modem troubleshooting information, see Troubleshooting Modems.


Compile Date

Microsoft Windows graphic
Compile Date: 2004-05-24


How Windows Firewall works

 Illustration of a firewall blocking some communications and allowing others


Group Policy for Network Connections

By using the Group Policy snap-in, an administrator can configure the desktop settings of many computers at once. Some Group Policy settings apply specifically to Network Connections, such as user access to connections and the ability to change the properties of connections. These settings can be found in the Administrative Templates of the Group Policy snap-in.

Where?

  • Group_Policy_object_name
  • Computer Configuration (or User Configuration)
  • Administrative Templates
  • Network
  • Network Connections

Note

  • If you do not have write access to a Group Policy object, you cannot see the settings contained in that object.


Rename a network connection icon

Microsoft Windows graphic

To rename a network connection icon

XOX

  1. Open Network Connections.
  2. Click the icon for the network connection to be renamed.
  3. Under Network Tasks, click Rename this connection.
  4. In the highlighted field under the selected icon, type a new name.

Notes

  • XOX
  • You can rename a network connection icon using a name that is easy to remember.
  • It is recommended that you do not rename the shared Internet connection icon that is automatically provided to client computers by the ICS host computer. The name of the share Internet connection on the ICS host computer shows on the client computers in:
    1. The Network Connections folder
    2. The icon that can be displayed in the notification area on the taskbar
    3. The status window for the shared Internet connection


Display network connection icons on the taskbar

Microsoft Windows graphic

To display a network connection icon on the taskbar

  1. Open Network Connections.
  2. Under LAN or High-Speed Internet, click the network connection to be displayed on the taskbar. Then, under Tasks, click Change settings of this connection.
  3. On the General tab, click the Show icon in notification area when connected check box.

Notes

  • XOX
  • If a network connection icon is displayed in the notification area on the taskbar, you can access basic connection and statistical information by pointing to the icon with the mouse pointer.
  • If the Show icon in notification area when connected check box is selected for the shared Internet connection, an icon for the shared Internet connection appears in the notification area on the taskbar each time that connection is enabled. When the shared Internet connection is disabled, the icon disappears from the notification area.


Service definitions for Internet Connection Sharing overview

Services run transparently to support other programs. An example of a service is an HTTP Web server that supports hosting Web pages from your home or small office network. If you have an HTTP Web server service enabled for your network, you can use that service to supply your own Web pages to the Internet. In addition to having a Web server on your network, you can have an FTP service that permits users to upload or download files through the Internet, an Internet mail server for storing and forwarding e-mail, and a variety of other services.

In order to permit the traffic to flow from the Internet to the computer hosting the service, you must add the service to the Services list by entering information about the services' operational settings on the Services tab of the Internet Connection Sharing (ICS) host computer. The set of operational settings provides the parameters that are required in order for Windows Firewall to allow traffic to travel from the Internet to the network and for ICS to forward traffic. The operational settings are known as a "service definition," because they define that required environment. The information that you must enter to add a service definition includes: the description of the service, the name or IP address of the computer hosting the service, and the TCP or UDP port number of the service. For more information, see Add a service definition.

Some services are predefined for ICS. FTP Server, Internet Mail Server, Secure Web Server, Telnet Server, and Web Server are examples of built-in services. These services can run on the ICS client computers or ICS host computer. You can add a new service to your network by installing the service software on one of your network computers and then adding the service definition so that ICS, if enabled, will allow the service to be accessed from the Internet. Services that are preconfigured require that only the name or IP address of the computer hosting the service for the service definition. For built-in services, information such as the description of the service and TCP or UDP port number of the service are built in and cannot be changed. For more information, see Edit a service definition.


Contact Parallel Technologies or a local dealer to order Direct Cable Connection cables

Microsoft Windows graphic

To contact Parallel Technologies to order Direct Cable Connection cables

  • Do any of the following:
    • Phone

      Within the United States and Canada: (800) 789-4784

      Outside the United States and Canada: (425) 869-1119

    • Internet

      Direct Parallel Web site

    • E-mail

      sales@lpt.com

      Compuserve e-mail 71612,3466

    • Find your local dealer

      Inside or outside the United States (425) 869-1119

Note

  • XOX


Configure a default gateway

Microsoft Windows graphic

To configure a default gateway

  1. Open Network Connections.
  2. Click the local area connection you want to configure, and then, under Network Tasks, click Change settings of this connection.
  3. On the General tab, in This connection uses the following items, click Internet Protocol (TCP/IP), and then click Properties
    4. .
  4. On the Alternate Configuration tab, click User configured. Type the values for the IP address, subnet mask, and default gateway.

Notes

  • XOX
  • If you currently have TCP/IP configured to obtain an IP address automatically, you must manually configure a TCP/IP address and subnet mask in order to configure a default gateway.


Writing scripts for intermediary devices

Each script for a static dialog is a section of the Switch.inf file. You add a script for each intermediary device to the Switch.inf file. For an example of X.25 network scripts, see the Pad.inf file, located in the systemroot\System32\Ras folder.

When you connect by using modem pools or security hosts, you must have a dialog with that device. The dialog occurs either before dialing or after dialing. Although preconnect and postconnect dialogs can be either static or interactive, the preconnect dialog is normally static and the postconnect is normally interactive.

The included Switch.inf file provides a generic script that will probably work with little or no modification when you are connecting to PPP servers. You should try to connect by using the generic Switch.inf script. If that does not work, you can copy—and then modify—the generic script to match the logon sequence of the remote computer to which you want to connect.

For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts. For information about configuring a connection to use a Switch.inf script, see To activate a logon script.