Protect VPN using L2TP/IPSec in Windows Server 2003

Every day a growing number of e-mail travels over networks worldwide (corporate networks, local networks, Internet etc.). Messaging has become so important in the information it needs to be secure. So I am here to know about securing the mail and protecting the VPN using L2TP/IPSec. I am having bit knowledge about digital certificates, but definitely not enough. So please tell me needful things that I want to know. I hope that someone hanging out there will show some interest in helping me soon.

To ensure security, both methods can be implemented:

• guarantee the identity of the sender
• data encryption

To secure your identity to your recipients when you send an e-mail, you can use a certificate of mail. This certificate allows you to send e-mail with your email account and attach your signature digital. The digitally signed messages appear in Microsoft Outlook with a particular icon and has an extra line in the header. If you want to use a certificate for Internet mail and you do not have a personal certification authority, you can create your free certificate.

To encrypt a message, the transaction is less obvious, since we must have the recipient's public key. This requires that the recipient have put you with a certificate of mail and you own it. In this case, encrypting a message with Microsoft Outlook runs very similarly to affix its electronic signature on an e-mail. To establish a tunnel between two hosts with Windows Server 2003, you must choose either PPTP (Point to Point Protocol Tuneling) or L2TP (Layer 2 Tunnel Protocol). The most secure method to use in case of a VPN (Virtual Private Network) is to opt for L2TP supplemented by IPSec (IP Security). IPSec supports three types of authentication:

• Using a pre-shared key that you enter on the server and client. This is how the least secure authentication and should be used only as a last resort.
• Using a digital certificate, which is the most reliable way of a network such as Internet
• In a domain, using Kerberos authentication tied to Active Directory. If the server and the client belong to the same forest, it is the manner best suited to perform the authentication hosts.

Certificate authentication requires the installation of an IPSec certificate on both computers need to communicate. To do this, log on http://name-CA/certsrv, request a certificate and submit an advanced certificate request ("Advanced Certificate Request and Create or submit a query request"). Complete the required information, then select "IPSec Certificate". IPSec certificates must be stored on behalf of the computer and not on behalf of the current user. To do this you must check the "Store certificate in the local computer store". When your certificate request is successful, install the certificate (on the homepage of the website of the CA, choose "Show status of a pending certificate request" and then select the "IPSec Certificate").

If you use this CA for the first time, you must install the certificate from the certifying authority, guaranteeing your confidence in that authority. To do this, always on the home page, choose "Download a CA Certificate" and "download a certificate from the CA. Close the web interface. Certificate in the MMC, expand "Certificates (Local Computer)" and then do a right click on "CA Trusted Root" to select "Import" in "All Tasks". Click Next, then click Browse. Look for the certificate previously registered then click Next again. You must store the certificate in the store "Root Certification Authorities trusted," selected by default. Click Next and then Finish. You can now log in and authenticate yourself with your client to your VPN server. Make sure that L2TP is well chosen: for the Windows client, display the properties of the VPN connection, select the tab "Networking" and then select L2TP IPSec VPN in the VPN topology.

The encrypted file system (Encrypting File System EFS) is supported by Windows 2000, XP and Server 2003. It allows users to protect access to their data by unauthorized users seamlessly. Encrypt a file with EFS on Windows XP or Server 2003 is relatively simple. Simply view the properties of the file to encrypt (right click on the file and choose "Properties"). Select the "Advanced" button and then select the "Encrypt contents to secure data". The encrypted file appears as green in Windows Explorer. To encrypt a file, EFS will first encrypt the symmetric data encryption and then add the key, called FEK File Encryption Key for. To improve security, EFS will then add the FEK with the file and encrypt it using the asymmetric encryption. The symmetric key is encrypted and stored in a field named Data Decryption Field for DDF. It is also possible to specify a recovery agent that can recover data even in case of loss of user's certificate.