Network and Dial-up Connections

Microsoft Windows 2000 Network and Dial-up Connections provides connectivity between your computer and the Internet, a network, or another computer. With the Network and Dial-up Connections feature, you can configure settings to reach local or remote network resources or functions.

Network and Dial-up Connections combines Windows NT version 4.0 Dial-Up Networking with features that were formerly located in the Network Control Panel, such as network protocol and service configuration. Each connection in the Network and Dial-up Connections folder contains a set of features that creates a link between your computer and another computer or network. By using Network and Dial-up Connections, performing a task, such as modifying a network protocol, is as easy as right-clicking a connection and then clicking Properties.

  • Before using Network and Dial-up Connections, see Checklist: Configuring Network and Dial-up Connections.

  • To find features that have been moved in Windows 2000, see New ways to do familiar tasks.

  • For tips about using Network and Dial-up Connections, see Best practices.

  • For help with specific tasks, see How to.

  • For general background information, see Concepts.

  • For problem-solving instructions, see Troubleshooting.


Checklist: Configuring Network and Dial-up Connections

Step | Reference
Review key concepts. | Network and Dial-up Connections overview
Connect to a local area network. | To make a local area connection
Connect to a network by using a phone line. | To make a dial-up connection by using a phone line; To connect to the network
Connect to an Internet service provider (ISP). | To make an Internet connection; To connect to the Internet
Connect to a private network through the Internet (virtual private network). | To make a virtual private network (VPN) connection; To connect to the network
Create a direct connection to another computer. | To make a direct network connection; To connect to the network
Let other computers connect to this computer. | To make an incoming network connection
Monitor a connection. | To monitor a connection


New ways to do familiar tasks

This table lists common tasks for Network and Dial-up Connections. The user interface for performing these tasks is different in Windows 2000 than it was in Windows NT 4.0.

If you want to | In Windows NT 4.0 use | In Windows 2000 use
Connect to a dial-up server | Dial-Up Networking in My Computer | Open Network and Dial-up Connections. For more information, see To connect to the network.
Connect to a network by using a modem or ISDN line | Dial-Up Networking in My Computer (click New) | Open Network and Dial-up Connections. For more information, see To make a dial-up connection by using a phone line.
Connect to a network by using a virtual private network (VPN) | Dial-Up Networking in My Computer (click New) | Open Network and Dial-up Connections. For more information, see To make a virtual private network (VPN) connection.
Configure a computer for incoming connections | Network in Control Panel | Open Network and Dial-up Connections. For more information, see To make an incoming network connection.
Configure the TCP/IP protocol | Network in Control Panel | Open Network and Dial-up Connections. For more information, see To configure TCP/IP settings.
Configure a connection | Dial-Up Networking in My Computer (click More) | Open Network and Dial-up Connections. For more information, see To configure a connection.
Add a client or service | Network in Control Panel | Open Network and Dial-up Connections. For more information, see To add a network component.
Add a protocol | Network in Control Panel | Open Network and Dial-up Connections. For more information, see To add a network component.
Add optional networking components | Network in Control Panel | Open Network and Dial-up Connections. For more information, see To add optional networking components.
Monitor incoming or outgoing connections | Dial-Up Monitor in Control Panel | Open Network and Dial-up Connections. For more information, see To monitor a connection.


Best practices

The following list provides best practices for implementing Network and Dial-up Connections:

  • Verify required connection settings with your Internet service provider (ISP).

    • Before you create an Internet connection, check with your ISP to verify the required connection settings. A connection to your ISP may require one or more of the following settings:

    • A specific IP address.
    • IP header compression (for PPP).
    • DNS addresses and domain names.
    • Optional settings, such as Internet Protocol security (IPSec).
  • Use automated IP settings (DHCP) whenever possible.

    • You should use automated IP settings for the following reasons:

    • DHCP is enabled by default.
    • If your location changes, you do not have to modify your IP settings.
    • Automated IP settings are used for all connections, and they eliminate the need to configure settings such as DNS, WINS, and so on.

    For more information about enabling DHCP, see To configure TCP/IP settings.

  • When using multiple network adapters, rename each local area connection.

    • Windows 2000 detects network adapters and automatically creates a local area connection in the Network and Dial-up Connections folder for each network adapter. If more than one network adapter is installed, you can eliminate possible confusion by immediately renaming each local area connection to reflect the network that it connects to.

    You need to add or enable the network clients, services, and protocols that are required for each connection. When you do so, the client, service, or protocol is added or enabled in all other network and dial-up connections.

  • Create multiple dial-up, VPN, or direct connections by copying them in the Network and Dial-up Connections folder.

    • After you copy the connections, you can rename them and modify the connection settings. By doing so, you can easily create different connections to accommodate multiple modems, ISPs, dialing profiles, and so on.

    For more information, see To copy a network or dial-up connection.

  • When using one network adapter and connecting to multiple LANs, enable or disable the network components for each LAN connection.

    • If your computer has one network adapter, but you need to connect to multiple LANs (for example, when traveling to a regional office), your local area connection network components need to be enabled or disabled each time you connect to a different LAN.

    For information about enabling or disabling a network component, see To enable a network component or To disable a network component. For information about adding or removing a network component, see To add a network component or To remove a network component.

  • Specify the order that Windows 2000 accesses network providers and protocols.

    • By changing the order of protocols bound to those providers, you can improve performance. For example, if your LAN connection is enabled to access NetWare and Microsoft Windows networks, which use IPX and TCP/IP, but your primary connection is to a Microsoft Windows network that uses TCP/IP, you can move Microsoft Windows Network to the top of the Network providers list on the Provider Order tab, and move Internet Protocol (TCP/IP) to the top of the File and Printer Sharing for Microsoft Networks binding on the Adapters and Bindings tab.

    For more information about modifying the the order of network providers, see To modify the network provider order. For more information about modifying the order of protocol bindings, see To modify the protocol bindings order.

  • Only install and enable the network protocols that you need.

    • Limiting the number of protocols on your computer enhances network performance and reduces network traffic.

    If Windows 2000 encounters a problem with network connectivity, it attempts to establish connectivity by using every network protocol that is installed. By only installing and enabling the protocols that your system can use, Windows 2000 does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.


How to...

  • Connect to the network
  • Disconnect from the network
  • Add optional networking components
  • Make network and dial-up connections
  • Configure network and dial-up connections
  • Monitor network and dial-up connections


Connect to the network

To connect to the network

  1. Open Network and Dial-up Connections.
  2. Double-click the connection you want to connect to the network.
  3. If you are prompted, in the Connect connection type dialog box, type your user name, password, and logon domain.

    If Logon domain does not appear in this dialog box, and you want to log on to a Windows 2000 domain, type your user name and the Windows 2000 domain name in one of two ways:

    • Your user principal name prefix (your user name) and your user principal name suffix (your Windows 2000 domain name), joined by the at sign (@). For example, user@sales.westcoast.microsoft.com.
    • Your Windows 2000 domain name and your user name, separated by the backslash (\) character. For example, sales\user.

      • Note that the suffix in the first example is a fully-qualified DNS domain name. Your administrator might have created an alternative suffix to simplify the logon process. For example, creating a user principal name suffix of "microsoft" allows the same user to log on by using the much simpler user@microsoft.com. For more information, see your system administrator.

    Once you are connected to the network, you can minimize your connection window and use e-mail, Windows Explorer, and so on.

Notes

  • If you are connecting to your local area network, the local area connection connects automatically.
  • Windows 2000 authentication is implemented in two steps: an interactive logon process and a network authentication process. Typically, the same set of credentials is used by the interactive logon process and the network authentication process. If your credentials differ, you are prompted to provide Windows domain credentials each time you access a network resource. You can avoid this by logging on to your computer using your Windows domain name, your Windows domain user name, and Windows domain password before you try to connect to a network resource. If you log on without being connected to the network, Windows 2000 recognizes the information from a previous successful logon. You receive the message "Windows cannot connect to a server to confirm your logon settings. You have been logged on using previously stored account information." When you connect to your network, the cached credentials are passed to your Windows 2000 domain and you are able to access network resources without having to provide a password again. For more information about Windows 2000 authentication, see Related Topics.
  • The logon domain name you type should be the Windows 2000 domain that the Windows 2000 server is in. This is not the DNS domain name given by some PPP/SLIP providers.
  • If you are using IP connectivity on your local network connection and on your remote connection, you may not be able to see all computers on your local network. This is because after you connect, your remote connection becomes your default path for network routing. Consequently, you see computers on the remote network, and you see other computers on the same LAN segment to which your computer is connected. But you cannot communicate with computers on networks that were previously reached through a router on your local LAN.
  • In order to run applications over any configured connection, you may need to modify proxy client settings. For example, if you use a laptop in your office and use the same computer to connect to an ISP or other network from your home, you may have problems running all of your applications when you use the ISP connection. If this is the case, you should disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) to run the applications that you typically run when you use your laptop in the corporate office.

Related Topics


Disconnect from the network

To disconnect from the network

  1. Open Network and Dial-up Connections.
  2. Right-click the connection you want to disconnect, and then click Disconnect.

Notes

  • If you disconnect a local area connection, it disables the network adapter driver until the connection is reactivated.

Related Topics


Add optional networking components

To add optional networking components

  1. Open Network and Dial-up Connections.
  2. On the Advanced menu, click Optional Networking Components.
  3. Do one of the following:
    • To install all optional networking components, select the Management and Monitoring Tools, Networking Services, and Other Network File and Print Services check boxes, and then click Next.
    • To install specific optional networking components, select its corresponding check box, and then click Details.

      In Subcomponents of component, select the check boxes next to the components you want to install, and then click OK.

Notes

  • Examples of optional networking components include Simple Network Management Protocol (SNMP), Simple TCP/IP Services, and Print Services for Unix.

Related Topics


Make network and dial-up connections

  • Make a virtual private network (VPN) connection
  • Make a local area connection
  • Enable and configure Internet connection sharing
  • Copy a network or dial-up connection
  • Dial-up connections
  • Internet connections
  • Direct connections
  • Incoming connections


Make a virtual private network (VPN) connection

To make a virtual private network (VPN) connection

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Connect to a private network through the Internet, and click Next.
  4. If you have already established a dial-up connection
    5. , do one of the following:
    • If you need to establish a connection with your ISP or some other network before tunneling to your destination computer or network, click Automatically dial this initial connection, click a connection in the list, and then click Next.
    • If you do not want to automatically dial an initial connection, click Do not dial the initial connection, and then click Next.
  5. Type the host name or IP address of the computer or network to which you are connecting, and then click Next.
  6. Do one of the following:
    • If you want this connection to be made available to all users on your network, click For all users, and then click Next.
    • If you want to reserve the connection for your own use, click Only for myself, and then click Next.
  7. If you want to let other computers access resources through this dial-up connection, select the Enable Internet connection sharing for this connection check box, and then click Next.
  8. Type a name for the connection, and then click Finish.

Notes

  • To make the connection available to all users, you must be logged on as Administrator or as a member of the Administrators group.
  • You can create multiple VPN connections by copying them in the Network and Dial-up Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple hosts, security options, and so on.

Related Topics


Make a local area connection

To make a local area connection

  • Typically, most Windows 2000 users belong to a local area network. When you start your computer, Windows 2000 detects your network adapter and automatically starts the local area connection. Unlike other types of connections, the local area connection is created automatically, and you do not have to click the local area connection in order to start it.

Notes

  • Windows 2000 automatically creates a local area connection for each network adapter that it detects.
  • If more than one network adapter is installed, you can eliminate possible confusion by immediately renaming each local area connection to reflect the network that it connects to.
  • If your computer has one network adapter, but you need to connect to multiple LANs (for example, when traveling to a regional office), the network components for your local area connection need to be enabled or disabled each time you connect to a different LAN.
  • If more than one network adapter is installed, you need to add or enable the network clients, services, and protocols that are required for each local area connection. When you do so, the client, service, or protocol is added or enabled for all other network and dial-up connections.

Related Topics


Enable and configure Internet connection sharing

  • Enable Internet connection sharing on a network connection
  • Configure Internet connection sharing for applications and services
  • Configure Internet options for Internet connection sharing


Enable Internet connection sharing on a network connection

To enable Internet connection sharing on a network connection

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up, VPN, or incoming connection you want to share, and then click Properties.
  3. On the Sharing tab, select the Enable Internet connection sharing for this connection check box.
  4. If you want this connection to dial automatically when another computer on your home network attempts to access external resources, select the Enable on-demand dialing check box.

Important

  • You should not use this feature in a network with other Windows 2000 Server domain controllers, DNS servers, gateways, DHCP servers, or systems configured for static IP.
  • When you enable Internet connection sharing, the network adapter connected to the home or small office network is given a new static IP address configuration. Existing TCP/IP connections on the Internet connection sharing computer are lost and need to be reestablished.
  • To use the Internet connection sharing feature, users on your home office or small office network must configure TCP/IP on their local area connection to obtain an IP address automatically. For more information, see To configure TCP/IP settings. Home office or small office network users must also configure Internet options for Internet connection sharing. For more information, see To configure Internet options for Internet connection sharing.
  • If the Internet connection sharing computer is using ISDN or a modem to connect to the Internet, you must select the Enable on-demand dialing check box.

Notes

  • To enable Internet connection sharing, you must be a member of the Administrators group.
  • For information about the protocols, services, interfaces, and routes that are automatically configured, see Related Topics.

Related Topics


Configure Internet connection sharing for applications and services

To configure Internet connection sharing for applications and services

  1. Open Network and Dial-up Connections.
  2. Right-click the shared connection, and then click Properties.
  3. On the Sharing tab, verify the Enable Internet connection sharing for this connection check box is selected, and then click Settings.
  4. If you want to configure a network application for the computers sharing the connection, on the Applications tab, click Add, and then do the following:
    • In Name of application, type an easily recognized name for the application.
    • In Remote server port number, type the port number of the remote server where the application resides, and then click either TCP or UDP.
    • In TCP or UDP or both, type the port number for the port on your home network that the application will connect to. Some applications require TCP and UDP port numbers.
  5. If you want to configure a service to provide to users on remote networks, on the Services tab, click Add, and then do the following:
    • In Name of Service, type an easily recognized name for the service.
    • In Service port number, type the port number of the computer where the service resides, and then click either TCP or UDP.
    • In Name or address of server computer on private network, type the name or TCP/IP address of the computer on your home network where the service resides.

Important

  • If you do not know the values for the remote server port number, incoming response port numbers, or the service port number, see your system administrator.

Notes

  • To configure Internet connection sharing, you must be logged on as an Administrator or a member of the Administrators group.
  • You must enable Internet connection sharing to configure applications and services.

Related Topics


Configure Internet options for Internet connection sharing

To configure Internet options for Internet connection sharing

  1. Open Internet Explorer.
  2. If you have not previously established an Internet connection, do the following:
    • Click I want to set up my Internet connection manually, or I want to connect through a local area network (LAN), and then click Next.
    • Click I connect through a local area network (LAN), and then click Next.
    • Clear the Automatic discovery of proxy server [recommended] check box, and then click Next.
    • Do one of the following:
      • If you want to set up an Internet mail account now, and know your connection information, click Yes, and provide the e-mail account information for which the wizard prompts you.
      • If you do not want to set up an Internet mail account, click No, click Next, and then click Finish.
  3. If you have previously established an Internet connection, you will be prompted for the following:
    • From the Tools menu, click Internet Options.
    • On the Connections tab, click Never dial a connection, and then click LAN Settings.
    • In Automatic configuration, clear the Automatically detect settings and Use automatic configuration script check boxes.
    • In Proxy Server, clear the Use a proxy server check box.

Note

  • To open Internet Explorer, click Start, point to Programs, and then click Internet Explorer.

Related Topics


Copy a network or dial-up connection

To copy a network or dial-up connection

  1. Open Network and Dial-up Connections.
  2. Right-click your dial-up, VPN, or direct connection, and then click Create Copy.

Notes

  • You cannot copy local area and incoming connections.
  • You can create multiple dial-up, virtual private network, or direct connections by copying them in the Network and Dial-up Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple modems, ISPs, dialing profiles, and so on.

Related Topics


Dial-up connections

  • Make a dial-up connection by using a phone line
  • Configure a modem for a dial-up connection
  • Start Remote Access Auto Connection Manager
  • ISDN connections
  • X.25 connections
  • Configure dial-up options


Make a dial-up connection by using a phone line

To make a dial-up connection by using a phone line

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Dial-up to private network, click Next, and then follow the instructions in the Network Connection wizard.

Notes

  • When you connect to a remote access server, you can access data files across the telephone line; you cannot run programs remotely. For most applications, running a program across a telephone wire is unacceptably slow. For the best performance, you should install licensed copies of the applications you need on your local computer.

Related Topics


Configure a modem for a dial-up connection

To configure a modem for a dial-up connection

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. Under Connect using, click the modem you want to configure, and then click Configure.
  4. Under Hardware Features, select the check box options you want to enable.
  5. Under Initialization, select the check box options you want to enable.
  6. If you want to enable the modem speaker, select the Enable modem speaker check box.

Notes

  • To ensure compatibility, you need to use the same kind of modem as the one connected to the remote access server, select the same initial speed, and enable the same features. If you do not select the same model, at least select a modem with the same ITU-T standard as the modem on the server.

  • Selecting a feature that is not supported by your modem has no effect on its performance.

  • Network and Dial-up Connections automatically configures connections according to the devices that are available. For example, you might use a laptop and docking station when you are in the office, with your connection configured to use the docking station modem. When you are on the road, and the docking station modem is not available, the connection is automatically configured to use the laptop's PCMCIA modem. When you return to the office and re-dock your laptop into its docking station, Network and Dial-up Connections detects that the docking station modem is available again, and automatically reconfigures the connection to use the docking station modem.

Related Topics


Start Remote Access Auto Connection Manager

To start Remote Access Auto Connection Manager

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Computer Management
    • System Tools
    • Services
  3. In the details pane, right-click Remote Access Auto Connection Manager, and then click Start.

    4. Under the Status column, Started appears.

Note

  • To open Computer Management, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Computer Management.

Related Topics


ISDN connections

  • Make a dial-up connection by using an ISDN line
  • Install an ISDN adapter
  • Configure ISDN settings


Make a dial-up connection by using an ISDN line

To make a dial-up connection by using an ISDN line

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Dial-up to private network, click Next, and then follow the instructions in the Network Connection wizard.

Note

Related Topics


Install an ISDN adapter

To install an ISDN adapter

  1. Install an Integrated Services Digital Network (ISDN) adapter and start your computer. If you install more than one ISDN adapter, you must restart your computer after you have installed the ISDN drivers. Otherwise, all available ISDN ports may not show up when you configure your network connection for ISDN.
  2. You can use Device Manager to configure your system so that your ISDN adapter knows what type of telephone switch it is connected to. The switch type simply refers to the brand of equipment and software revision level that the telephone company uses to provide you with ISDN service. There are only a few types of switches in the world and usually just one in countries other than the United States. Some examples of switch types include ATT (AT&T), NI-1 (National ISDN-1), and NTI (Northern Telecom).

Notes

  • To open Device Manager, click Start, point to Programs, point to Administrative Tools, and then click Computer Management. In the console tree, double-click System Tools, and then click Device Manager.
  • To use Device Manager, you must be logged on as Administrator or a member of the Administrators group.
  • If your ISDN adapter is internal to your computer, it appears in Network adapters. If the ISDN adapter is external to your computer, it appears in Modems.

Related Topics


Configure ISDN settings

To configure ISDN settings

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up connection that uses ISDN, and then click Properties.
  3. On the General tab, in Connect using, click the ISDN device, and then click Configure.
  4. In the ISDN Configure dialog box, do one or both of the following:
    • In Line type, click the line type you want to use. The line types are listed from highest to lowest quality.
    • If you want to start negotiation with the line type you selected, and then negotiate with a lower-quality line type depending on the line's condition, select the Negotiate line type check box.

Note

  • Depending on the type of ISDN adapter that you are using, when you click Configure in step 3, you may be presented with Modem Configuration settings.

Related Topics


X.25 connections

  • Make a dial-up connection by using X.25
  • Install X.25


Make a dial-up connection by using X.25

To make a dial-up connection by using X.25

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Dial-up to private network, click Next, and then follow the instructions in the Network Connection wizard.
  4. When the wizard is finished, right-click the new connection, and then click Properties.
  5. On the Options tab, click X.25.
  6. In Network, click your X.25 network provider.
  7. In X.121 address, type the X.121 address (the X.25 equivalent of a phone number) for the server you want to call.
  8. If required by the X.25 host computer, in User Data, type additional connection information.
  9. In Facilities, type any additional facility options you want to request from your X.25 provider. (For example, some providers support the /r option to specify reverse charging.)

Notes

  • For details on facility options, consult your X.25 documentation or provider.

Related Topics


Install X.25

To install X.25

  • Install the X.25 card or PAD card and start your computer.

    For instructions on installing the card, see your X.25 manufacturer's documentation.

Related Topics


Configure dial-up options

  • Configure callback
  • Configure autodial
  • Enable multiple device dialing
  • Configure phone number modifiers
  • Configure redial options
  • Assign multiple phone numbers to a connection
  • Enable operator-assisted calls or manual dialing


Configure callback

To configure callback

  1. Open Network and Dial-up Connections.
  2. On the Advanced menu, click Dial-up Preferences.
  3. On the Callback tab, do one of the following:
    • If you do not want to use callback, click No callback.
    • If you want to decide whether to use callback at the time you connect, click Ask me during dialing when the server offers.
    • If you want to consistently use callback, click Always call me back at the number(s) below, and select the modem or device you want to be called back.
      • If Phone number is blank for the device you have selected, click Edit, and then type the number.
      • If you want to remove a modem or device from the list of possible callback devices, click the modem or device, and then click Delete.

Notes

  • Your callback privileges are determined by your system administrator and override any callback settings that you configure here. Through server settings, the administrator can deny the use of callback, allow you to set callback options, or require callback to a particular number. Contact your system administrator to determine your callback options.
  • To use callback, Link Control Protocol (LCP) extensions must be enabled.

Related Topics


Configure autodial

To configure autodial

  1. Open Network and Dial-up Connections.
  2. On the Advanced menu, click Dial-up Preferences.
  3. On the Autodial tab, select the check box next to the location where you want to enable autodial, and then click OK.

Notes

  • Autodial maps the resources that are required to initially make a connection, but does not map resources once the connection is made.
  • The autodial feature works only when the Remote Access Auto Connection Manager service is started. For more information, see Related Topics.

Related Topics


Enable multiple device dialing

To enable multiple device dialing

  1. Open Network and Dial-up Connections.
  2. Right-click the connection on which you want to enable the dialing of multiple devices, and then click Properties.
  3. On the Options tab, in Multiple devices, do one of the following:
    • If you want Windows 2000 to dial only the first available device, click Dial only first available device.
    • If you want Windows 2000 to use all of your devices, click Dial all devices.
    • If you want Windows 2000 to dynamically dial and hang up devices as needed, click Dial devices only as needed, and then click Configure.

      In Automatic dialing, click the Activity at least percentage and Duration at least time you want to set. Another line is dialed when connection activity reaches this level for the amount of time that you specify.

      In Automatic hangup, click the Activity no more than percentage and Duration at least time you want to set. A device is hung up when connection activity decreases to this level for at least the amount of time that you specify.

Notes

  • If you selected Dial devices only as needed, the last multilinked device ignores the Automatic hangup setting, and a twenty-minute time-out is used for the last device.
  • If you use multiple devices to dial a server that requires callback, then only one of your multilinked devices is called back. This is because only one number is stored in a user account. Therefore, only one device connects and all other devices fail to complete the connection, and your connection loses Multilink functionality.

    • You can avoid this problem if the multilinked phonebook entry is an ISDN with two channels that have the same phone number.

  • Multiple device dialing is available only if multiple adapters are available on the computer.
  • If you select Dial all devices, dropped links in the multilinked bundle are not automatically reinitialized. You can force links to reinitialize by selecting Dial devices only as needed, then Configure, and then setting easily achieved Automatic dialing conditions which cause another line to be dialed. For example, set Activity at least to 1% and Duration at least to 3 seconds.

Related Topics


Configure phone number modifiers

To configure phone number modifiers

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. Modify the phone number by using one or more characters from the following list.
Character | Function
, (comma) | Pauses briefly (two seconds for most modems) before continuing.
P | Switches from touch-tone to pulse/rotary dialing.
T | Switches from pulse/rotary to touch-tone dialing.
$ | Waits for a calling card prompt tone.

For example, when you dial in from a hotel room, you may have to add 9 to the number you are calling to get an outside line. Your number may look similar to the following:

9,555-0100

The comma after the 9 gives a pause long enough to get an outside line before continuing to dial the full number.

Notes

  • To configure phone number modifiers, you must be logged on as a member of the Administrators group.
  • By selecting the Use area code and dialing rules check box, and then clicking Rules, you can create a Location for which specific dialing rules automatically apply. For example, if you frequently connect from home and need to disable call waiting, you can create a location for use from home that automatically dials the code to disable call waiting before the connection call is placed.
  • If you see unfamiliar characters being dialed before your number, check to make sure the Use area code and dialing rules check box is not selected. If it is selected, a location may be enforcing a dialing rule that you do not need. For example, a location may be selected that always dials 1 to accommodate long distance dialing.

Related Topics


Configure redial options

To configure redial options

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. On the Options tab, in Redial attempts, click the arrows to set the number of times the dial-up connection is automatically redialed if the first attempt to connect fails.
  4. In Time between redial attempts, click the arrows to set the amount of time to pause between the end of one attempt and the beginning of another.
  5. In Idle time before hanging up, click the arrows to set the amount of idle time before a client hangs up a connection.
  6. If you want the connection to automatically redial if the line is dropped, select the Redial if line is dropped check box.

Notes

  • The Time between redial attempts pause lets the device reset itself before redialing. The default is one minute. If that is not enough time, increase this setting. You can also experiment with shorter times, but if you make the pause too short, the device does not have time to reset itself.
  • Keep in mind that the remote access server also has a disconnect timer. If Idle time before hanging up is set to a high time-out number, there is no guarantee that the connection will not disconnect before the time passes. This is because the server may choose to disconnect you before the time set here.
  • If you are using Internet Explorer, the browser's own settings for dial-up connections may conflict with these redial options.

Related Topics


Assign multiple phone numbers to a connection

To assign multiple phone numbers to a connection

  1. Open Network and Dial-up Connections.
  2. Right-click the connection to which you want to assign multiple phone numbers, and then click Properties.
  3. On the General tab, click Alternates.
  4. If you want the connection to attempt a different phone number if the first number in the list is not successful, select the If number fails, try next number check box.
  5. If you want the connection to move the first successful phone number to the top of the list under Phone numbers and use it on the next connection attempt, click Move successful number to top of list.
  6. To add a new phone number to the list, click Add, and in Phone number, type the phone number.
  7. If you want the connection to use established area code and dialing rules, select the Use area code and dialing rules check box.
  8. When you are finished adding the new phone number, click OK.
  9. If you want to change the order of phone numbers under Phone numbers, click a phone number, and then click the Up button or Down button until the phone number is in the correct order.
  10. If you want to remove a phone number under Phone numbers, click the phone number, and then click Delete.

Notes

  • If you have alternate phone numbers defined for a connection, you can specify a particular phone number at the time you initiate your connection.

Related Topics


Enable operator-assisted calls or manual dialing

To enable operator-assisted calls or manual dialing

  1. Open Network and Dial-up Connections.
  2. On the Advanced menu, click Operator-Assisted Dialing.
  3. Double-click the connection you want to dial.
  4. Pick up the telephone handset, and then dial the number or ask the operator to dial it for you.

    5. The number assigned to the entry is displayed in the dialog box for easy reference.

  5. Immediately after you have finished dialing, click Dial.
  6. Hang up the handset only after the modem takes control of the line, which is typically signaled with a click followed by silence.

    7. It is always safe to replace the handset once Network and Dial-up Connections begins verifying your user name and password. The status message will remind you of this.

Notes

  • If operated-assisted dialing is enabled, a check mark appears next to Operator-Assisted Dialing on the Advanced menu.


Internet connections

  • Make an Internet connection
  • Use Windows 2000 to connect to MSN


Make an Internet connection

To make an Internet connection

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Dial-up to the Internet, click Next, and then follow the instructions in the Network Connection wizard.

Notes

  • Before you create an Internet connection, check with your Internet service provider (ISP) to verify the required connection settings. A connection to your ISP may require one or more of the following settings:
    • A specific IP address.
    • IP header compression (for PPP).
    • DNS addresses and domain names.
    • POP3 settings.
    • SMTP settings.
    • Optional settings, such as Internet Protocol security.

Related Topics


Use Windows 2000 to connect to MSN

To use Windows 2000 to connect to MSN

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Dial-up to private network, click Next, and then follow the instructions in the wizard.
  4. When the wizard is finished, right-click the new connection, and then click Properties.
  5. On the Networking tab, do the following:
    • If NetBEUI Protocol is installed and enabled, clear its check box to disable it.
    • If NWLink IPX/SPX/NetBIOS Compatible Transport Protocol is installed and enabled, clear its check box to disable it.
    • If Internet Protocol (TCP/IP) is disabled, click its check box to enable it.

Notes

  • When you connect to The Microsoft Network (MSN) by using this connection, supply your MSN user name by typing MSN/username. Type your MSN password, click OK, and then click Dial.
  • You can use MSN as your Internet service provider only if you have already created an MSN account in Windows 95 or Windows 98.
  • To connect to the Internet through Windows 2000 by using MSN and access proprietary online services such as mail or bulletin boards, you must be running MSN version 2.5 or later. Otherwise, these services are not available.


Direct connections

  • Make a direct network connection
  • Make a direct network connection by using a DirectParallel cable


Make a direct network connection

To make a direct network connection

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Connect directly to another computer, click Next, and then follow the instructions in the Network Connection wizard.

Notes

  • To create a direct network connection that acts as a host, you must be logged on as Administrator or be a member of the Administrators group. Guest direct network connections do not require administrator-level rights.
  • If you specify your connection as a host when you create it, the connection appears as Incoming Connections in the Network and Dial-up Connections folder.
  • You can create multiple direct connections by copying them in the Network and Dial-up Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple ports, host computers, and so on.
  • Direct connections can bypass authentication requirements. This is useful for devices such as palmtop computers. You must configure this setting in the host incoming connection. For more information, see Related Topics.
  • If you create a direct connection by using a serial (RS-232C) cable, the port that you select in the Network Connection wizard is enabled for connections that use a null modem.
  • If you are logged on to your computer as Administrator or a member of the Administrators group when you create a direct connection, you are presented with a list of connection devices to choose from that includes all of the parallel ports for the computer, infrared ports that are installed and enabled, and COM ports. If you are logged on as a user who is not a member of the Administrators group, and create a direct connection, the list of devices includes the parallel ports for the computer, infrared ports that are installed and enabled, and only the COM ports that are configured with null modems. If you need to use a COM port for a direct connection, ask your system administrator to configure one of the COM ports on your computer with a null modem by using Phone and Modem Options in Control Panel.
  • Users do not need to use direct connections to allow access to shared resources, such as files and printers, over a local area network. In order to enable shared access to resources on the local computer, you must enable file and print sharing, share the resources, and then set up the appropriate permissions.

Related Topics


Make a direct network connection by using a DirectParallel cable

To make a direct network connection by using a DirectParallel cable

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Connect directly to another computer, click Next, and then do one of the following:
    • If you want your computer to act as the host (your computer contains the information you need to access), click Host.
    • If you want your computer to act as the guest (your computer accesses information on another computer), click Guest, and then click Direct Parallel (LPT1) in Select a device.
  4. Follow the remaining instructions in the Network Connection wizard.

Notes

  • A direct network connection that uses a DirectParallel cable requires a stand-alone computer running Windows 2000.
  • To create a direct network connection, you must be logged on as Administrator or as a member of the Administrators group.
  • For information about contacting Parallel Technologies or their local dealers to order DirectParallel cables, see Related Topics.

Related Topics


Incoming connections

  • Make an incoming network connection
  • Grant incoming connection access rights to your computer
  • Configure an incoming connection to use TCP/IP
  • Configure an incoming connection to use IPX
  • Configure callback for incoming connections


Make an incoming network connection

To make an incoming network connection

  1. Open Network and Dial-up Connections.
  2. Double-click Make New Connection, and then click Next.
  3. Click Accept incoming connections, click Next, and then follow the instructions in the Network Connection wizard.

Notes

  • If you make another incoming network connection, and you use the Network Connection wizard again, the existing incoming network connection is reconfigured.
  • To create an incoming network connection, you must be a member of the Administrators group.
  • For large numbers of incoming connections on a computer running Windows 2000 Server that operates as part of a distributed network or as a domain controller, use Windows 2000 Server Routing and Remote Access to create a remote access server.
  • If your incoming connection and Fax Service have problems working together (for example, you cannot receive incoming connection calls on a device enabled for Fax receive), the modem may not support adaptive answer. Check your modem documentation to verify that you need to disable Fax receive for that device to accept incoming connections.
  • If you connect to a computer running Windows 2000 Professional or stand-alone Windows 2000 Server that is configured for incoming connections, and you are running Windows 95 or Windows 98 and want to log on to the computer by using a local user account, you can use your Windows 95 or Windows 98 user name, domain, and password. When you connect, the computer running Windows 2000 replaces the Windows 95 or Windows 98 domain name with the local computer name when you provide your user name and password authentication information.
  • Incoming connections are only used for dial-up, VPN, or direct connection clients.

Related Topics


Grant incoming connection access rights to your computer

To grant incoming connection access rights to your computer

  1. Open Network and Dial-up Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the General tab, do one or more of the following:
    • In Devices, click the check boxes next to the devices through which incoming connections can connect.
    • If you have more than one device selected, and you want to enable Multilink dialing, select the Enable multilink check box.
    • If you want to enable others to make private connections to your computer by tunneling through the Internet or other network, select the Allow others to make private connections to my computer by tunneling through the Internet or other network check box.
    • If you want to show icons on the taskbar when incoming connections are connected, select the Show icons on taskbar when connected check box.
  4. On the Users tab, do one or more of the following:
    • If you want to allow a user to connect, select the check box next to the user's name.
    • If you want to revoke a user's right to connect, clear the check box next to a user's name.
    • To create a new user and grant them access to connect, click New.
    • To remove a user, click Delete.
    • To modify a user's name, password, and callback privileges, click Properties.
    • If you want all users to connect by using securely encrypted passwords and data, select the Require all users to secure their passwords and data check box.
    • If you want directly connected devices to connect without providing a password, select the Always allow directly connected devices such as palmtop computers to connect without providing a password check box.
  5. On the Networking tab, do one or more of the following:
    • If you want to enable a network component, in Network Components, select the check box next to the component name.
    • If you want to disable a network component, in Network Components, clear the check box next to the component name.
    • To add a network component, click Install.
    • To remove a network component, click Uninstall.
    • To configure a network component, click Properties.

Notes

  • If you enable incoming connections access on the Users tab, other factors may prevent a user from logging in. A user's account may be disabled or locked out, or the user may attempt to connect outside of allowed hours.
  • To modify an incoming connection, you must be logged on as a member of the Administrators group.
  • If you enable or disable TCP/IP, NetBEUI, or the NWLink IPX/SPX/NetBIOS compatible Transport Protocol in incoming connections, the settings affect only incoming connections. Other protocols, such as AppleTalk, are enabled or disabled for all connection types.
Related Topics


Configure an incoming connection to use TCP/IP

To configure an incoming connection to use TCP/IP

  1. Open Network and Dial-up Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the Networking tab, click Internet Protocol (TCP/IP), and then click Properties
    4. .
  4. If you want incoming users to be able to access the local area network on which the dial-up computer resides, select the Allow callers to access my local area network check box.
  5. Do one of the following:
    • If you want to automatically assign TCP/IP addresses, select the Assign TCP/IP addresses automatically using DHCP check box.
    • If you want to specify TCP/IP addresses, click Specify TCP/IP addresses, and do the following:
      • In From, type the starting IP address.
      • In To, type the ending IP address.

        • Based on the addresses you type in From and To, the number of addresses that are allocated is displayed in Total. The starting and ending IP addresses that you choose depend on the originating address space and the number of addresses needed. For more information on defining IP addresses for incoming connections, see Related Topics.

  6. If you want incoming connections to be able to use a specific TCP/IP address, select the Allow calling computer to specify its own IP address check box.

Notes

  • Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. For the range that you specified in From and To, Windows 2000 calculates the closest matching subnet. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.
  • Allowing remote clients to specify their own TCP/IP address is a potential security risk to your network. A client can impersonate a previously connected client and gain access to network resources that were accessed by the other client.
  • If you select Allow callers to access my local area network or Allow calling computer to specify its own IP address, these changes take effect immediately.
  • If you select Assign TCP/IP addresses automatically using DHCP, but there is no DHCP server available, random addresss from the range 169.254.0.1 to 169.254.255.254 are assigned.

Related Topics


Configure an incoming connection to use IPX

To configure an incoming connection to use IPX

  1. Open Network and Dial-up Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the Networking tab, click NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, and then click Properties
    4. .
  4. If you want incoming users to be able to access the local area network that the dial-up computer resides on, select the Allow callers to access my local area network check box.
  5. If you want the same network number to be used consistently, select the Assign same network number to all computers check box, and do one of the following:
    • If you want the incoming connection to use the NetWare Router Information Protocol (RIP) to determine an IPX network number that is not in use in the IPX network, click Assign network number automatically. The incoming connection then assigns that number to the incoming computer.
    • If you want more control of network number assignments for security or monitoring purposes, click Assign specified network number, and type the network number.
  6. If you want to specify different network numbers, clear the Assign same network number to all computers check box, and do the following:
    • If you want the network numbers to be uniquely assigned, click Assign network numbers sequentially from, and type the first network number. Subsequent network numbers are assigned sequentially from this number.
  7. If you want incoming connections to be able to use specific network numbers, select the Allow callers to specify their own node numbers check box.

Notes

  • Allowing remote clients to choose their own node number is a potential security threat to your network; a client can impersonate a previously connected client and gain access to network resources that were accessed by the other client.
  • If you select Allow callers to access my local area network or Allow callers to specify their own node numbers, these changes take effect immediately.
  • If you select Assign same network number to all computers, Assign network numbers automatically, or Assign specified network number, these changes take effect as soon as there are no callers.


Configure callback for incoming connections

To configure callback for incoming connections

  1. Open Network and Dial-up Connections.
  2. Right-click Incoming Connections, and then click Properties.
  3. On the Users tab, click the user for which you want to configure callback, and then click Properties.
  4. On the Callback tab, do one of the following:
    • If you do not want to use callback for incoming connections, click Do not allow callback.
    • If you want to give incoming connections the option of setting a specific callback number, click Allow the caller to set the callback number.
    • If you want to consistently use the same callback number, click Always use the following callback number, and type the number.

Note

Related Topics


Configure network and dial-up connections

  • Configure a connection
  • Network components
  • Security


Configure a connection

To configure a connection

  1. Open Network and Dial-up Connections.
  2. Right-click the connection you want to configure, and then click Properties.
  3. Do one or more of the following:
    • To configure dialing devices, phone numbers, host address, country/region codes, or dialing rules, click the General tab.
    • To configure dialing and redialing options, multilink configuration, or X.25 parameters, click the Options tab.
    • To configure identity authentication, data encryption, or terminal window and scripting options, click the Security tab.
    • To configure the remote access server and protocols used for this connection, click the Networking tab.
    • To enable or disable Internet connection sharing and on-demand dialing, click the Sharing tab.

Notes

  • Depending on the type of connection you are configuring, different options appear. For example, a local area connection only displays the General tab.
  • For more information about a specific item on a tab, right-click the item, and then click What's This?

Related Topics


Network components

  • Configure TCP/IP settings
  • Add a network component
  • Remove a network component
  • Enable a network component
  • Disable a network component
  • Modify the protocol bindings order
  • Modify the network provider order
  • Configure Client for Microsoft Networks
  • Configure File and Printer Sharing for Microsoft Networks
  • PPP settings


Configure TCP/IP settings

To configure TCP/IP settings

  1. Open Network and Dial-up Connections.
  2. Right-click the connection you want to configure, and then click Properties.
  3. Do one of the following:
    • If the connection is a local area connection, under Components checked are used by this connection, click Internet Protocol (TCP/IP), and then click Properties.
    • If the connection is a dial-up, VPN, or incoming connection, on the Networking tab, under Network components used in this connection, click Internet Protocol (TCP/IP), and then click Properties.
  4. Do one of the following:
    • If you want IP settings to be assigned automatically, click Obtain an IP address automatically, and then click OK.
    • If you want to specify an IP address or a DNS server address, do the following:
      • Click Use the following IP address, and in IP address, type the IP address.
      • Click Use the following DNS server addresses, and in Primary DNS server and Secondary DNS server, type the addresses of the primary and secondary DNS servers.
  5. To configure DNS, WINS, and other options, click Advanced.

Notes

  • You should use automated IP settings (DHCP) whenever possible, for the following reasons:
    • DHCP is enabled by default.
    • If your location changes, you do not have to modify your IP settings.
    • Automated IP settings are used for all connections, and they eliminate the need to configure settings such as DNS, WINS, and so on.

Related Topics


Add a network component

To add a network component

  1. Open Network and Dial-up Connections.
  2. Right-click the connection to which you want to add a network component, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, click Install.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, click Install.
  4. In the Select Network Component Type dialog box, click either Client, Service, or Protocol, and then click Add.
  5. Do one of the following:
    • If you do not have an installation disk for the component, click the appropriate client, service, or protocol, and then click OK.
    • If you have an installation disk for the component, click the appropriate client, service, or protocol, click Have Disk, insert the installation disk into the selected drive, and then click OK.

Notes

  • You should only install the network components that you need, for the following reasons:
    • Network performance is enhanced and network traffic is reduced when only the required protocols and clients are installed.
    • If Windows 2000 encounters a problem with a network or dial-up connection, it attempts to establish connectivity by using every network protocol that is installed and enabled. By only installing and enabling the protocols that your system can use, Windows 2000 does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.
    • Excessive services can hinder performance on your local computer.

Related Topics


Remove a network component

To remove a network component

  1. Open Network and Dial-up Connections.
  2. Right-click the connection on which you want to remove a network component, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, in Components checked are used by this connection, click the client, service, or protocol you want to remove, and then click Uninstall.
    • If this is a dial-up, VPN, or incoming connection, in Components checked are used by this connection, on the Networking tab, click the client, service, or protocol you want to remove, and then click Uninstall.
  4. In the Uninstall component name dialog box, click Yes.

Note

Related Topics


Enable a network component

To enable a network component

  1. Open Network and Dial-up Connections.
  2. Right-click a connection, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, in Components checked are used by this connection, select the check box next to the client, service, or protocol you want to enable.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in Components checked are used by this connection, select the check box next to the client, service, or protocol you want to enable.

Notes

  • You should only enable the network components that you need, for the following reasons:
    • Network performance is enhanced and network traffic is reduced when only the required protocols and clients are enabled.
    • If Windows 2000 encounters a problem with with a network or dial-up connection, it attempts to establish connectivity by using every network protocol that is installed and enabled. By only enabling the protocols that your system can use, Windows 2000 does not attempt to connect with protocols it cannot use, and returns status information to you more efficiently.
    • Excessive services can hinder performance on your local computer.

Related Topics


Disable a network component

To disable a network component

  1. Open Network and Dial-up Connections.
  2. Right-click the connection on which you want to disable a network component, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, in Components checked are used by this connection, clear the check box next to the client, service, or protocol you want to disable.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in Components checked are used by this connection, clear the check box next to the client, service, or protocol you want to disable.

Note

Related Topics


Modify the protocol bindings order

To modify the protocol bindings order

  1. Open Network and Dial-up Connections.
  2. Click the connection you want to modify, and on the Advanced menu, click Advanced Settings.
  3. On the Adapters and Bindings tab, in Bindings for adapter name, click the protocol that you want to move up or down in the list, and then click the Up or Down button.

Notes

  • To modify the protocol bindings order, you must be logged on as a member of the Administrators group.

Related Topics


Modify the network provider order

To modify the network provider order

  1. Open Network and Dial-up Connections.
  2. Click the connection you want to modify, and on the Advanced menu, click Advanced Settings.
  3. On the Provider Order tab, in Network Providers, click the provider you want to move up or down in the list, and then click the Up or Down button.

Notes

  • Network providers are accessed in the order they appear in this list.
  • To modify the network provider order, you must be logged on as a member of the Administrators group.

Related Topics


Configure Client for Microsoft Networks

To configure Client for Microsoft Networks

  1. Open Network and Dial-up Connections.
  2. Right-click a connection, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in Components checked are used by this connection, click Client for Microsoft Networks, and then click Properties.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in Components checked are used by this connection, click Client for Microsoft Networks, and then click Properties.
  4. In Name service provider, click an RPC name service provider.
  5. If you selected DCE Cell Directory Service in Network address, type the network address of your provider.
  6. If you use Banyan Vines networking software, select the Enable RPC support for Banyan check box.

Notes

  • Only change your name service provider if instructed to do so by your system administrator.
  • The default name service provider installed with Windows 2000 is Windows Locator.
  • The Client for Microsoft Networks component is the equivalent of the Workstation service in Windows NT 4.0.

Related Topics


Configure File and Printer Sharing for Microsoft Networks

To configure File and Printer Sharing for Microsoft Networks

  1. Open Network and Dial-up Connections.
  2. Right-click a connection, and then click Properties.
  3. Do one of the following:
    • If this is a local area connection, on the General tab, in Components checked are used by this connection, click File and Printer Sharing for Microsoft Networks, and then click Properties.
    • If this is a dial-up, VPN, or incoming connection, on the Networking tab, in Components checked are used by this connection, Click File and Printer Sharing for Microsoft Networks, and then click Properties.
  4. Do one of the following:
    • To optimize the server for a small number of clients, click Minimize memory used.
    • To optimize the server for a mixed usage of file and printer sharing in addition to other services, such as serving as an interactive workstation, click Balance.
    • To dedicate as many resources as possible to file and print server services, click Maximize data throughput for file sharing.
    • To optimize server memory for distributed applications that perform their own memory caching, such as Microsoft SQL Server, click Maximize data throughput for network applications.
  5. To specify that LAN Manager 2.x clients on your network can browse for shared resources on this computer, select the Make browser broadcasts to LAN Manager 2.x clients check box.

Notes

  • You can only configure File and Printer Sharing for Microsoft Networks on a computer running Windows 2000 Server.
  • To share local folders, you must enable File and Printer Sharing for Microsoft Networks. For more information, see Related Topics.
  • The File and Printer Sharing for Microsoft Networks component is the equivalent of the Server service in Windows NT 4.0.

Related Topics


PPP settings

  • Stop requesting LCP extensions in PPP
  • Start requesting LCP extensions in PPP
  • Turn off IP header compression in PPP
  • Disable software compression


Stop requesting LCP extensions in PPP

To stop requesting LCP extensions in PPP

  1. Disconnect from the remote server.
  2. Open Network and Dial-up Connections.
  3. Right-click the connection you want to configure, and then click Properties.
  4. On the Networking tab, click Settings, and clear the Enable LCP extensions check box.

Note

Related Topics


Start requesting LCP extensions in PPP

To start requesting LCP extensions in PPP

  1. Disconnect from the remote server.
  2. Open Network and Dial-up Connections.
  3. Right-click the connection you want to configure, and then click Properties.
  4. On the Networking tab, click Settings, and then select the Enable LCP extensions check box.

Note

Related Topics


Turn off IP header compression in PPP

To turn off IP header compression in PPP

  1. Disconnect from the remote server.
  2. Open Network and Dial-up Connections.
  3. Right-click the connection you want to configure, and then click Properties.
  4. On the Networking tab, click Internet Protocol (TCP/IP), and then click Properties.
  5. Click Advanced, and then clear the Use IP header compression check box.

Notes

  • To turn off IP header compression, you must be logged on as Administrator or a member of the Administrators group.

Related Topics


Disable software compression

To disable software compression

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up, VPN, or incoming connection you want to configure, and then click Properties.
  3. On the Networking tab, click Settings, and clear the Enable software compression check box.

Note

Related Topics


Security

  • Configure authentication and data encryption settings for a dial-up connection
  • Configure authentication and data encryption settings for a VPN connection
  • Enable smart card or other certificate authentication
  • Terminal and scripting options


Configure identity authentication and data encryption settings for a dial-up connection

To configure identity authentication and data encryption settings for a dial-up connection

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up connection you want to configure, and then click Properties.
  3. On the Security tab, do one of the following:
    • To select preconfigured combinations of identity authentication methods and data encryption requirements, click Typical (recommended settings), and in Validate my identity as follows, click a method to use for validation.

      Depending on your Validate my identity as follows selection, you can select (enable) or clear (disable) the Automatically use my Windows logon name and password (and domain if any) or Require data encryption (disconnect if none) check boxes. The following table shows which selections are available.

      If Require data encryption (disconnect if none) is not enabled, encryption is optional. To prevent encryption, click Advanced (custom settings), and then click Settings. In Data encryption, click No encryption allowed (disconnect if server required encryption).

      • Validate my identity as follows | Automatically use my Windows logon name and password (and domain if any) | Require data encryption (disconnect if none)
Allow unsecured password | Unavailable | Unavailable
Require secured password | Available | Available
Use smart card | Unavailable | Available

    • To individually enable, configure, and disable authentication methods and encryption requirements, click Advanced (custom settings), and then click Settings.

Important

  • Modifying Advanced (custom settings) requires a knowledge of security protocols.

Note

Related Topics


Configure identity authentication and data encryption settings for a VPN connection

To configure identity authentication and data encryption settings for a VPN connection

  1. Open Network and Dial-up Connections.
  2. Right-click the VPN connection you want to configure, and then click Properties.
  3. On the Security tab, do one of the following:
    • To select preconfigured combinations of identity authentication methods and data encryption requirements, click Typical (recommended settings), and in Validate my identity as follows, click a method to use for validation.

      Depending on your Validate my identity as follows selection, you can select (enable) or clear (disable) the Automatically use my Windows logon name and password (and domain if any) or Require data encryption (disconnect if none) check boxes. The following table shows which selections are available.

      If Require data encryption (disconnect if none) is not enabled, encryption is optional. To prevent encryption, click Advanced (custom settings), and then click Settings. In Data encryption, click No encryption allowed (disconnect if server required encryption).

      • Validate my identity as follows | Automatically use my Windows logon name and password (and domain if any) | Require data encryption (disconnect if none)
Require secured password | Available | Available (enabled by default)
Use smart card | Unavailable | Available (enabled by default)

    • To individually enable, configure, and disable authentication methods and encryption requirements, click Advanced (custom settings), and then click Settings.

Important

  • Modifying Advanced (custom settings) requires a knowledge of security protocols.

Note

Related Topics


Enable smart card or other certificate authentication

To enable smart card or other certificate authentication

  1. Open Network and Dial-up Connections.
  2. Right-click the dial-up, VPN, or incoming connection on which you want to use smart card or other certificate authentication, and then click Properties.
  3. If you are using typical settings for your smart card, on the Security tab, click Typical (recommended settings), and in Validate my identity as follows, click Use smartcard.
  4. If you are individually enabling, configuring, and disabling authentication methods and encryption requirements, on the Security tab, click Advanced (custom settings), click Settings, and then do the following:
    • Under Logon security, click Use Extensible Authentication Protocol (EAP), click Smart card or other certificate (TLS) (encryption enabled), click Properties, and then do the following:
      1. If you want to use the certificate that resides on your smart card, click Use my smartcard.
      2. If you want to use the certificate that resides in the certificate store on your computer, click Use a certificate on this computer.
      3. If you want verify that the server certificate presented to your computer has not expired, has the correct signature, and has a trusted root certificate authority, select the Validate server certificate check box.
      4. If you only want to connect to servers within a particular domain, select the Connect only if server name ends with check box, and then type the name of the domain.
      5. To specify that the root certificate authority for your server certificate must be in a particular root certificate authority, in Trusted root certificate authority, click the appropriate certificate authority.
      6. To use a different user name when the user name in the smart card or certificate is not the same as the user name in the domain that you are logging on to, select the Use a different user name for the connection check box.

Notes

  • If, for example, you only want to connect to servers that reside in Microsoft.com, you type Microsoft.com in Connect only if server name ends in.
  • If, for example, you are working for a consulting company where you need to log on to the domain of the company to which you are assigned, but your smart card contains a user name specific to your home company, select the Send a different user name from the one on the smartcard or certificate check box.
  • If you select the Send a different user name from the one on the smartcard or certificate check box, your certificate is exported without private keys and submitted to your system administrator to be explicitly mapped to your domain user account. For more information, see Related Topics.
  • If you select the Connect only if server name ends with check box, and do not type a domain name, at the time you connect you are prompted to use the domain name in the server certificate.

Related Topics


Terminal and scripting options

  • Use the Terminal feature to log on to a remote computer
  • Activate a logon script
  • Log and view modem commands


Use the Terminal feature to log on to a remote computer

To use the Terminal feature to log on to a remote computer

  1. Open Network and Dial-up Connections.
  2. Right-click the connection on which you want to use Terminal, and then click Properties.
  3. On the Security tab, select the Show terminal window check box.

Notes

  • After you connect, the After Dial Terminal window appears and prompts you from the remote computer display. You then use this window to log on to the remote computer. After you have completed all interactions with the remote computer, click Done. At this point, authentication on the remote access server begins.
  • If the logon sequence does not vary, you can write a script that automatically passes information to the remote computer during the logon sequence, which enables completely automatic connections.

Related Topics


Activate a logon script

To activate a logon script

  1. Open Network and Dial-up Connections.
  2. Right-click the connection on which you want to run a script, and then click Properties.
  3. On the Security tab, select the Run script check box.
  4. To use an existing script file, click Browse.

    Or, to use Switch.inf, click Edit.

Notes

  • In addition to Switch.inf, the Windows 95 scripting language is supported for computers running Windows 2000 that connect to computers running a non-Microsoft operating system. You may find the Windows 95 scripting language easier to use than Switch.inf. For more information, see Related Topics.
  • If you click Edit and load Switch.inf into Notepad, immediately resave the file with a different name to preserve the default Switch.inf file.

Related Topics


Monitor network and dial-up connections

  • Monitor a connection
  • View the status of a local area connection


Monitor a connection

To monitor a connection

  1. Open Network and Dial-up Connections.
  2. Do one of the following:
    • To monitor activity for the current session, right-click the connection you want to monitor, and then click Status.
    • To automatically enable the status monitor each time the connection is active, right-click the connection, click Properties, and then select the Show icon in taskbar when connected check box.

Notes

  • If your computer is set up to accept incoming connections, a connection with a user name assigned to it appears in the Network and Dial-up Connections folder as each user connects. You can view the progress of incoming connections by right-clicking a named connection, and then clicking Status.
  • You can also monitor a connection by clicking Status on the File menu or by clicking the status icon in the taskbar.
  • If you want to view the general status (Disconnected, Connected) of all of your connections, on the View menu, click Details.
  • You also can disconnect an active connection by clicking Disconnect in the Status dialog box.
  • By default, the status monitor is disabled for local area connections, but enabled for all other types of connections.

Related Topics


View the status of a local area connection

To view the status of a local area connection

  1. Open Network and Dial-up Connections.
  2. Do one of the following:
    • To monitor activity for the current session, right-click the local area connection, and then click Status.
    • To automatically enable the status monitor each time the connection is active, right-click the local area connection, click Properties, and then select the Show icon in taskbar when connected check box.

Notes

  • You can view and modify the network components of a local area connection, such as network protocol settings, by clicking Properties.
  • By default, the status monitor is disabled for local area connections, but enabled for all other types of connections.

Related Topics


Concepts

This section covers:

  • Network and Dial-up Connections overview
  • Understanding Network and Dial-up Connections
  • Using Network and Dial-up Connections


Network and Dial-up Connections overview

This section covers:

  • About Network and Dial-up Connections
  • Hardware requirements for network and dial-up connections
  • Network and dial-up connection types
  • Network communications


About Network and Dial-up Connections

Network and Dial-up Connections provides connectivity between your computer and the Internet, a network, or another computer. With Network and Dial-up Connections, you can gain access to network resources and functionality, whether you are physically located at the location of the network or in a remote location. Connections are created, configured, stored, and monitored from within the Network and Dial-up Connections folder. For information about creating connections, see Make network and dial-up connections.

Each connection in the Network and Dial-up Connections folder contains a set of features that you can use to create a link between your computer and another computer or network. Outgoing connections contact a remote access server by using a configured access method (LAN, modem, ISDN line, and so on) to establish a connection with the network. Conversely, an incoming connection enables a computer running Windows 2000 Professional or a stand-alone computer running Windows 2000 Server to be contacted by other computers. This means your computer can operate as a remote access server. Whether you are connected locally (LAN), remotely (dial-up, ISDN, and so on), or both, you can configure any connection so that it can perform any needed network function. For example, you can print to network printers, access network drives and files, browse other networks, or access the Internet.

Because all services and communication methods are configured within the connection, you do not need to use external management tools to configure connection settings. For example, the settings for a dial-up connection include features to be used before, during, and after connecting. These include the modem you use to dial, the type of password encryption you want to use upon connecting, and the network protocols you use after you connect. Connection status, which includes the duration and speed of a connection, is viewed from the connection itself; you do not need to use an external status tool. For information about configuring a connection, see To configure a connection.

Windows 2000 logon and domain security, support for security hosts, data encryption, authentication, and callback provide secure network access for network and dial-up connections. For more information about security features, see Security features of Network and Dial-up Connections.


Hardware requirements for network and dial-up connections

Depending on your configuration, you may need some or all of the following hardware:

  • Network adapter with a certified Network Driver Interface Specification (NDIS) driver for LAN connectivity
  • One or more compatible modems and an available COM port
  • Modem or ISDN adapter (if you are using an ISDN line)
  • DSL adapter
  • X.25 card or PAD (if you are using X.25)
  • Analog telephone line
  • If your computer is set up for incoming connections, a multiport adapter may improve performance for multiple connections.

To verify the compatibility of all hardware in a computer running Windows 2000, see the Microsoft Windows Hardware Compatibility List at the Microsoft Web site. (http://www.microsoft.com/)

For information about configuring a connection, see To configure a connection.


Network and dial-up connection types

There are five types of network and dial-up connections. The following table shows each connection type, the communication methods used to establish the connection type, and an example of the connection. For more information, click the appropriate connection type in the table.

Connection type | Communication method | Example
Dial-up connections | Modem, ISDN, X.25 | Connect to a corporate network or the Internet by using remote access
Local area connections | Ethernet, Token Ring, cable modem, DSL, FDDI, IP over ATM, IrDA, wireless, WAN technologies (T1, Frame Relay) | Typical corporate user
Virtual private network (VPN) connections | VPNs over PPTP or L2TP to corporate networks or the Internet | Connect securely to a corporate network over the Internet
Direct connections | Serial cabling, infrared link, DirectParallel cable | Synchronize information between a Windows CE Handheld PC and a desktop computer
Incoming connections | Dial-up, VPN, or direct connections | Call in to a remote access server at home


Dial-up connections

A dial-up connection connects you to a network or the Internet by using a device that utilizes the telephone network. This device can be a modem that uses a standard phone line, an ISDN card with a high-speed ISDN line, or an X.25 network.

If you are a typical user, you may have one or two dial-up connections, perhaps to the Internet and to your corporate network. In a more complex Windows 2000 Server scenario, you can use multiple dial-up connections to implement advanced routing.

You can create multiple dial-up connections by copying them in the Network and Dial-up Connections folder. You can then rename the connections and modify connection settings. By doing so, you can easily create different connections to accommodate multiple modems, dialing profiles, and so on.

For more information about creating dial-up connections, see Dial-up connections.


Network communications

Network protocols, access methods, and server protocols provide a communications link between your computer and a network.

Whether information is transported from your computer to a server by using a direct serial cable, or across a secure VPN from your Internet service provider (ISP) to the corporate network, different combinations of access methods and protocols are used to send information. These access methods and protocols are listed in the following table.

Network protocols | Access methods | Server protocols
TCP/IP | Using phone lines and modems | Point-to-Point Protocol (PPP)
IPX | ISDN access | SLIP
NetBEUI | Using X.25 | Point-to-Point Tunneling Protocol (PPTP)
AppleTalk | Serial (RS-232) access | Layer Two Tunneling Protocol (L2TP)
 | DirectParallel access | ATCP


TCP/IP

Transmission Control Protocol/Internet Protocol (TCP/IP) is the most popular protocol, and the basis for the Internet. Its routing capabilities provide maximum flexibility in an enterprise-wide network.

On a TCP/IP network, you must provide IP addresses to clients. Clients may also require a naming service or a method for name resolution. This section explains IP addressing and name resolution for Network and Dial-up Connections on TCP/IP networks. It also describes the FTP and Telnet tools that are provided by Windows 2000 TCP/IP.

Assigning IP addresses to network and dial-up connections

In the Windows 2000 operating system, each remote computer connecting to a remote access server on a Windows TCP/IP network is provided an IP address. The IP address is either automatically provided by DHCP, or selected from a static range assigned to the remote access server.

If you use a specific IP address, the Windows 2000 remote access server must be configured to permit users to request a specific address.

Name resolution for network and dial-up connections

In addition to requiring an IP address, network and dial-up connections on a TCP/IP network may require a mechanism to map computer names to IP addresses. Four name resolution options are available on a Windows 2000 network: DNS, WINS, broadcast name resolution, and the Hosts and Lmhosts files.

You can assign network and dial-up connections the same WINS and DNS servers that are assigned to the remote access server. The TCP/IP settings of a network or dial-up connection can override these automatic assignments.

In small networks where IP addresses do not change, network and dial-up connections can use a Hosts or Lmhosts file for name resolution. By using these files on the local drive, you do not need to transmit name resolution requests to a WINS or DNS server and wait for the response.

Internet tools

Windows 2000 TCP/IP provides File Transfer Protocol (FTP) and Telnet. FTP is a character-based utility that permits you to connect to FTP servers and transfer files. Telnet is graphical application that lets you log in to remote computers and issue commands as if you were at the keyboard of the computer. Multiple variations of FTP, Telnet, and other programs based on earlier Internet standards are also available on the Internet or commercially.

For information about configuring a connection, see To configure a connection. For information about configuring TCP/IP, see To configure TCP/IP settings.


IPX

Internet Packet Exchange (IPX) is the native NetWare protocol used on many earlier Novell networks. This section explains how to integrate Windows 2000 Network and Dial-up Connections clients into a NetWare IPX network.

Windows 2000 support for NetWare

Your computer must run a NetWare redirector to see a Novell NetWare network. In computers running Windows 2000 Professional, this redirector is called Client Service for NetWare. In computers running Windows 2000 Server, this redirector is called Gateway Service for NetWare.

A Windows 2000 remote access server is also an IPX router and Service Advertising Protocol (SAP) agent. Once configured, remote access servers enable file and print services and the use of Windows Sockets applications over IPX on the NetWare network for Network and Dial-up Connections clients. Remote access servers and their Network and Dial-up Connections clients use the PPP IPX Configuration Protocol (IPXCP), as defined in RFC 1552, "The PPP Internet Protocol Control Protocol (IPXCP)," to configure the remote access line for IPX.

IPX addressing for remote clients

Network and Dial-up Connections clients are always provided an IPX address by the remote access server. The IPX network number is either generated automatically by the remote access server, or a static pool of network numbers is given to the remote access server for assignment to Network and Dial-up Connections.

For automatically generated IPX network numbers, the remote access server running Windows 2000 uses the NetWare Router Information Protocol (RIP) to determine an IPX network number that is not in use in the IPX network. The remote access server assigns that number to the connection.

For information about configuring a connection, see To configure a connection. For information about configuring NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, which is the Windows 2000 implementation of IPX, see To configure NWLink.

To configure incoming connections to use IPX, see To configure an incoming connection to use IPX.


NetBEUI

NetBIOS Extended User Interface (NetBEUI) is suited for use in small workgroups or LANs. You can install a NetBIOS gateway and the NetBEUI client protocol on all remote access servers running Windows 2000 and most Windows networking clients. Previous Windows NT remote access clients, LAN Manager remote access clients, MS-DOS remote access clients, and Windows for Workgroups remote access clients may use NetBEUI. NetBEUI is not routable, and the only configuration required for the protocol is a computer name.

For information about configuring a connection, see To configure a connection.


AppleTalk

Networking on an Apple Macintosh computer is implemented through the AppleTalk protocol. Applications and processes can communicate across a single AppleTalk network or an AppleTalk internet, which is a number of interconnected AppleTalk networks. By using AppleTalk, applications and processes can transfer and exchange data and share resources, such as printers and file servers. AppleTalk remote access is supported by the AppleTalk Control Protocol (ATCP).

With ATCP, Macintosh clients can run the AppleTalk network protocol over the Point-to-Point Protocol (PPP). With ATCP support, a remote user can access a Web server over TCP/IP, print a document to an AppleTalk printer, and connect to a Macintosh file server (over TCP/IP or AppleTalk), all with the same dial-up connection over PPP.

For information about configuring a connection, see To configure a connection.


ISDN access

To enhance your network connection speed, you can use an Integrated Services Digital Network (ISDN) line. Whereas standard phone lines typically transmit at up to 56 kilobits per second (Kbps), ISDN lines can transmit at speeds of 64 or 128 Kbps.

An ISDN line must be installed by the phone company at both the server and at the remote site. ISDN also requires that you install an ISDN card in both the server and your computer. Costs for ISDN equipment and lines may be higher than standard modems and phone lines. However, the speed of communication reduces the duration of the connection, possibly saving toll charges.

An ISDN line comes with two B channels that transmit data at 64 Kbps, and one D channel for signaling that transmits data at 16 Kbps. You can configure each B channel to operate as a port. With some ISDN drivers, you can aggregate the channels. This means you can statically assign a higher bandwidth by configuring both B channels to act as a single port. With this configuration, line speed increases to 128 Kbps. For information about configuring a connection to use ISDN, see To make a dial-up connection by using an ISDN line or To configure ISDN settings.

The Multilink feature of Windows 2000 performs channel aggregation for ISDN. Multilink combines multiple physical links into a logical bundle. This aggregate link increases the bandwidth of a connection. In addition, you can allocate multiple links dynamically, which means ISDN lines are used only as they are required. This eliminates excess bandwidth, representing a significant efficiency advantage to users. You can configure the conditions under which extra lines are dialed, and underused lines are hung up, through Network and Dial-up Connections settings. For more information, see Configuring multiple device dialing.


Serial (RS-232) cable access

Suppose you have two networks in the same location that are not physically connected. To use resources on both networks from one computer, you can use RS-232C cables and COM ports to create null modems. You connect an RS-232C cable from a COM port to a COM port on each remote access server. To the servers, the COM ports then appear to be modems. You can use Windows 2000 Server remote access, part of the integrated Routing and Remote Access service, to create network access.

For information about creating a direct connection by using serial access, see To make a direct network connection.


DirectParallel cable access

The DirectParallel feature in Windows 2000 supports computer-to-computer connections by using standard and enhanced (ECP) parallel ports, which use Parallel Technologies' Basic or Fast parallel cables. For information about configuring a direct network connection to use a DirectParallel cable, see To make a direct network connection by using a DirectParallel cable. Direct Cable Connection cables are available from several sources. You can obtain DirectParallel cables from Parallel Technologies or from their local dealers. For more information, see To contact Parallel Technologies or a local dealer to order Direct Cable Connection cables.


SLIP

Serial Line Internet Protocol (SLIP) is an older remote access standard typically used by UNIX remote access servers. Windows 2000 Network and Dial-up Connections supports SLIP, and you can make connections to any remote access server by using the SLIP standard.

When you connect to a SLIP server, a Windows Terminal dialog box appears for an interactive logon session with the UNIX SLIP server. The UNIX logon overrides and prevents the remote access logon session from appearing. After a connection is established, remote network access becomes transparent to the user.

The RFCs supported in Windows 2000 remote access are:

  • RFC 1144, "Compressing TCP/IP Headers for Low-Speed Serial Links"

  • RFC 1055, "A Nonstandard for Transmission of IP Datagrams Over Serial Lines: SLIP"

For information about configuring a network or dial-up connection, see To configure a connection.

Notes

  • You cannot configure a computer running Windows 2000 as a SLIP server. Only Windows 2000 clients that connect to other SLIP servers are supported.
  • You must use the TCP/IP protocol and a serial COM port to connect to a SLIP server.


Point-to-Point Protocol (PPP)

The Point-to-Point Protocol (PPP) is a set of standard protocols that allow remote access software from different vendors to interoperate. A PPP-enabled connection can dial into remote networks through any industry-standard PPP server. PPP also permits a computer running Windows 2000 Server remote access to receive calls from, and provide network access to, other vendors' remote access software that complies with the PPP standards.

The PPP standards also permit advanced features that are not available with older standards such as SLIP. PPP supports several authentication methods, as well as data compression and encryption. With most PPP implementations, you can automate the entire logon sequence.

PPP also supports multiple LAN protocols. You can use TCP/IP, IPX, or NetBEUI as your network protocol.

PPP is the basis for the PPTP and L2TP protocols, which are used in secure virtual private network (VPN) connections.

PPP is the primary standard for most remote access computing.

This section covers:

  • PPP operation and protocols
  • PPP RFCs
  • Using PPP for Internet connections


PPP operation and protocols

Point-to-Point Protocol (PPP) connections must adhere to standards established in PPP RFCs. This section gives an overview of PPP operations and the protocols used in a PPP connection. For information about configuring PPP settings, see PPP settings.

PPP dial-up sequence

After an initial connection to a remote PPP server, the following negotiations establish a PPP connection:

  • Link Control Protocols (LCP)

    • LCP is used to establish and configure link and framing settings such as maximum frame size.

  • Authentication protocols

    • Authentication protocols are used to determine what level of security validation the remote access server can perform and what the server requires. The level of security that can be negotiated ranges from unencrypted (plaintext) password authentication, to encrypted, highly secure smart card authentication.

  • Network control protocols (NCP)

    • NCPs are used to establish and configure different network protocol settings for IP, IPX, and NetBEUI. This negotiation includes negotiating protocol header compression and compression control protocol.

The resulting connection remains active until the line is disconnected for any of the following reasons:

  • The user explicitly hangs up the line.
  • The line drops due to idle time-out.
  • The administrator hangs up the line.
  • An unrecoverable link error occurs.

Link Control Protocols

Link Control Protocols (LCP) establish and configure PPP framing. PPP framing defines how data is encapsulated before transmission on the wide area network. The PPP standard framing format ensures any vendors' remote access software can communicate and recognize data packets from any remote access software that adheres to the PPP standards.

PPP and Windows 2000 use variants of High-level Data Link Control (HDLC) framing for serial or ISDN connections.

Authentication protocols

Negotiation of authentication protocols occurs immediately after link quality determination and before network layer negotiation. For more information about available authentication protocols, see Authentication.

Network control protocols

Network control protocols establish and configure different network protocol settings for TCP/IP, IPX, NetBEUI, and AppleTalk. The following table describes network control protocols used with a PPP connection.

Network control protocol | Description
Internet Protocol Control Protocol (IPC) | IPC is used to configure, enable, and disable IP modules at both ends of the connection.
Internet Packet Exchange Control Protocol (IPXCP) | IPXCP is used to configure, enable, and disable IPX modules at both ends of the connection. IPXCP is widely implemented by PPP vendors. The IPX WAN protocol is Novell's alternative to IPXCP. IPX WAN is not compatible with IPXCP. Windows 2000 supports IPXCP, which is implemented by the vast majority of remote access software.
NetBEUI Control Protocol (NBTP) | NBTP is used to configure, enable, and disable NetBEUI protocol modules at both ends of the connection.
AppleTalk Control Protocol (ATCP) | ATCP is used to configure, enable, and disable the AppleTalk protocol modules at both ends of the connection.


PPP RFCs

Requests for Comments (RFCs) are an evolving series of technical reports, proposals for protocols, and protocol standards used by the Internet community. Routing standards are defined in RFCs published by the Internet Engineering Task Force (IETF) and other working groups. For information about configuring PPP settings in connections, see PPP settings. The following table lists the PPP RFCs.

RFC number | Title
1549 | PPP in HDLC Framing
1552 | The PPP Internetwork Packet Exchange Control Protocol (IPXCP)
1334 | PPP Authentication Protocols
1332 | The PPP Internet Protocol Control Protocol (IPCP)
1661 | Link Control Protocol (LCP)
1990 | PPP Multilink Protocol
2125 | The PPP Bandwidth Allocation Protocol (BAP), The PPP Bandwidth Allocation Control Protocol (BACP)
2097 | The PPP NetBIOS Frames Control Protocol (NBFCP)
1962 | The PPP Compression Control Protocol (CCP)
1570 | PPP LCP Extensions
2284 | PPP Extensible Authentication Protocol (EAP)

Obtaining RFCs

You can obtain RFCs from the Request for Comments Web site. (http://www.rfc-editor.org/) This Web site is currently maintained by members of the Information Sciences Institute (ISI) who publish a classified listing of all RFCs. RFCs are classified as one of the following: approved Internet standards, proposed Internet standards (circulated in draft form for review), Internet best practices, or For Your Information (FYI) documents.

Note


Using PPP for Internet connections

Point-to-Point Protocol (PPP) connections are the default for Windows 2000.

A computer running Windows 2000 Professional or stand-alone Windows 2000 Server that is configured for incoming connections requires no special configuration to support inbound PPP calls. If connections are configured properly, PPP calls are automatically negotiated.

If you are dialing a remote PPP server, the default settings are usually ideal, and no additional configuration is necessary. However, you can configure PPP settings for the connection that dials a PPP server. For more information, see PPP settings.


Understanding Network and Dial-up Connections

This section covers:

  • Security
  • Tunneling protocols


Security

This section covers:

  • Security features of Network and Dial-up Connections
  • Intermediary devices


Security features of Network and Dial-up Connections

You can configure your dial-up, virtual private network (VPN), and direct connections to enforce various levels of password authentication and data encryption. Authentication methods range from unencrypted to custom, such as the Extensible Authentication Protocol (EAP). EAP provides flexible support for a wide range of authentication methods, including smart cards, certificates, one-time passwords, and public keys. You can also specify the type of data encryption, depending on the level of password authentication (MS-CHAP or EAP) that you select. Finally, you can configure callback options to increase dial-up security.

Windows 2000 user accounts and domains provide security with encrypted authentication and encrypted data. For more information about Windows 2000 security, see Security.

This section covers:

  • Callback
  • How security works at connection
  • Data encryption
  • Authentication


Callback

The callback feature instructs your remote access server to disconnect, and then to call you back, after you dial in. Callback provides cost advantages to you and security advantages to your network. By immediately hanging up, and then dialing you back, callback reduces your phone charges. Required callback enhances network security by ensuring that only users from specific locations can access the server. By dropping the call, and then calling back a moment later to the preassigned callback number, most impersonators can be thwarted.

If callback has been required by your administrator, the following steps occur when your call reaches the remote access server:

  1. The server determines whether your user name and password are correct.
  2. If they are correct, the server disconnects and then returns the call.

If callback has been configured for your connection through the Dial-up Preferences menu option, the following steps occur when your call reaches the remote access server:

  1. The server determines whether your user name and password are correct.
  2. If they are correct, the Callback dialog box appears on your computer.
  3. You then type the current callback number in the dialog box and wait for the server to disconnect and return the call.

    Optionally, you can press ESC to cancel the callback process and remain connected.

For more information about configuring your callback options, see To configure callback.

Notes

  • Your callback privileges are determined by your system administrator. The administrator may deny the use of callback, allow user-defined callback, or require callback to a particular number. You can contact your system administrator to determine your callback options.
  • If your computer is configured to accept incoming connections, you can enforce callback options on that computer. For more information, see To configure callback for incoming connections.


How security works at connection

The following steps describe what happens during a call to a remote access server:

  1. Your computer dials a remote access server.
  2. Depending on the authentication methods you select, one of the following happens:
    • If you are using PAP or SPAP:
      • Your computer sends its password to the server.
      • The server checks the account credentials against the user database.
    • If you are using CHAP or MS-CHAP:
      • The server sends a challenge to your computer.
      • Your computer sends an encrypted response to the server.
      • The server checks the response against the user database.
    • If you are using MS-CHAP v2:
      • The server sends a challenge to your computer.
      • Your computer sends an encrypted response to the server.
      • The server checks the response against the user database and sends back an authentication response.
      • Your computer verifies the authentication response.
    • If you are using certificate-based authentication:
      • The server requests credentials from your computer and sends its own certificate.
      • If you configured your connection to validate the server certificate, it is validated. If not, this step is skipped.
      • Your computer presents its certificate to the server.
      • The server verifies that the certificate is valid and has not been revoked.
  3. If the account is valid, the server checks for remote access permission.
  4. If remote access permission has been granted, the server accepts your connection.

    5. If callback is enabled, the server calls your computer back and repeats steps 2 through 4.

Notes

  • Remote access permissions are granted based on the dial-in settings of your user account and remote access policies. Remote access policies are a set of conditions and connection settings that give network administrators more flexibility in granting remote access permissions and usage. If the settings of your connection do not match at least one of the remote access policies that apply to your connection, the connection attempt is rejected, regardless of your dial-in settings.
  • When you use Network and Dial-up Connections in a Windows domain environment, changes in remote access permission do not take effect immediately on all servers. It can take up to 15 minutes for replication of the change to other servers in the domain. If necessary, you can resynchronize the domain to ensure that a user with revoked permissions cannot access the network before the change is automatically replicated.
  • Network and Dial-up Connections authentication methods control access to your network, not to resources on the network. In Windows 2000, once you are present on a network, resource control is managed in various ways: Local Users and Groups, Active Directory, Group Policy, file and printer sharing, and so on.
  • Authentication methods are designed for remote computing environments where the computer dialing in does not have access to the network until credentials such as user name and passwords are exchanged.
  • For information about configuring security options for your connections, such as identity authentication protocols and data encryption settings, see Security.


Data encryption

You can think of encryption as locking something valuable into a strong box with a key. Sensitive data is encrypted by using a key algorithm, which renders it unreadable without the knowledge of the key. Data encryption keys are determined at connect time between a connection and the computer on the other end. The use of data encryption can be initiated by your computer or by the server you are connecting to.

Network and Dial-up Connections supports two types of encryption: Microsoft MPPE, which uses RSA RC4 encryption, and an implementation of Internet Protocol security (IPSec) that uses Data Encryption Standard (DES) encryption. Both MPPE and IPSec support multiple levels of encryption, as shown in the following table.

Encryption implementation | Used
MPPE Standard (40-bit, 56-bit) | International use
MPPE Strong (128-bit) | North America
IPSec DES (56-bit) | International use
IPSec Triple DES (3DES) | North American high-security environments

By default, standard (40-bit and 56-bit) MPPE encryption files are installed. However, if you upgraded to Windows 2000 and previously used strong (128-bit) encryption, strong encryption files are installed. If you want to convert from standard to strong encryption, obtain the Microsoft Encryption Pack. For Windows 2000 Server users, see Windows 2000 Server at the Microsoft Web site (http://www.microsoft.com/). For Windows 2000 Professional users, see Windows 2000 Professional at the Microsoft Web site (http://www.microsoft.com/). The Encryption Pack is accessible only to users in the United States, its territories, possessions and dependencies, and Canada. Many users located outside North America may be eligible to receive the Encryption Pack, but not from these secure download sites. Global customers who are eligible for the Encryption Pack and other Microsoft strong encryption products are described at the Microsoft Web site (http://www.microsoft.com/). If you believe that you are eligible to receive strong encryption under United States export law, contact your Microsoft representative.

For more information, see the following:

  • Microsoft Point-to-Point Encryption (MPPE)
  • Internet Protocol security (IPSec)

Notes

  • Server controls are flexible and can be set to deny the use of encryption, require a specific encryption method, or allow your computer to select an encryption method. By default, most servers allow encryption and allow clients to select their encryption methods. This works for most computers. A system administrator sets encryption requirements. To determine your options, contact your system administrator.
  • To enable MPPE-based data encryption for dial-up or virtual private network (VPN) connections, you must select the MS-CHAP, MS-CHAP v2, or EAP-TLS authentication methods. These authentication methods generate the keys used in the encryption process.
  • Virtual Private Networks (VPNs) use encryption depending on the type of server they are connecting to. If the VPN connection is configured to connect to a PPTP server, then MPPE encryption is used. If the VPN is configured to connect to an L2TP server, then IPSec encryption methods are used. If the VPN is configured for an Automatic server type, which is the default selection, then L2TP, and its associated IPSec encryption, will be attempted first, then PPTP, and its associated MPPE encryption.


Microsoft Point-to-Point Encryption (MPPE)

Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPP-based dial-up connections or PPTP VPN connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported. MPPE provides data security between your PPTP connection and the tunnel server. You can use the 40-bit version worldwide; it is built into every computer running Windows 2000. The 128-bit level of encryption is available only in the United States and Canada. You can enable the 128-bit version by installing a specific version of both client and server software.

For more information about configuring connections, see To configure a connection.

Note

  • MPPE requires common client and server keys as generated by MS-CHAP or EAP authentication.


Internet Protocol security (IPSec)

The long-term direction for secure networking, IPSec is a suite of cryptography-based protection services and security protocols. Because it requires no changes to applications or protocols, you can easily deploy IPSec for existing networks.

IPSec provides machine-level authentication, as well as data encryption, for VPN connections that use the L2TP protocol. IPSec negotiates between your computer and its remote tunnel server before an L2TP connection is established, which secures both passwords and data.

L2TP uses standard PPP-based authentication protocols, such as EAP, MS-CHAP, CHAP, SPAP, and PAP with IPSec.

Encryption is determined by the IPSec Security Association, or SA. A security association is a combination of a destination address, a security protocol, and a unique identification value, called a Security Parameters Index (SPI). The available encryptions include:

  • Data Encryption Standard (DES) with a 56-bit key, which is designed for international use and adheres to United States export encryption laws.
  • Triple DES (3DES), which uses two 56-bit keys and is designed for high-security environments in North America.

If you are using a computer running Windows 2000 Server and want more information about IPSec, see Internet Protocol security (IPSec).

For more information about configuring connections, see To configure a connection.


Authentication

This section covers:

  • Windows 2000 authentication
  • Authentication methods and protocols


Windows 2000 authentication

Windows 2000 authentication consists of two parts: an interactive logon process and a network authentication process. Successful user authentication depends on both of these processes.

Interactive logon process

The interactive logon process confirms the user's identification to either a domain account or a local computer. Depending on the type of user account, the interactive logon process is different:

  • With a domain account, a user logs on to the network with a password or smart card by using single sign-on credentials stored in Active Directory. By logging on with a domain account, an authorized user can access resources in the domain and any trusting domains. If a password is used to log on to a domain account, Windows 2000 uses Kerberos V5 for authentication. If a smart card is used instead, Windows 2000 uses Kerberos V5 authentication with certificates.
  • With a local computer account, a user logs on to a local computer by using credentials stored in Security Accounts Manager (SAM), which is the local security account database. Any workstation or member server can store local user accounts, but those accounts can only be used for access to that local computer.

Network authentication process

Network authentication confirms the user's identification to any network service that the user is attempting to access. To provide this type of authentication, the Windows 2000 security system supports many different authentication mechanisms, including Kerberos V5, Secure Socket Layer/Transport Layer Security (SSL/TLS), and, for compatibility with Windows NT 4.0, LAN Manager.

Users who use a domain account do not see network authentication. Users who use a local computer account must provide credentials (such as a user name and password) every time they access a network resource. By using the domain account, the user has credentials that are automatically used for single sign-on.

For information about authentication methods and protocols used by Network and Dial-up Connections, see Authentication methods and protocols.


Authentication methods and protocols

With Network and Dial-up Connections, you can use the following authentication methods and protocols:

  • Password Authentication Protocol (PAP)
  • Challenge Handshake Authentication Protocol (CHAP)
  • Shiva Password Authentication Protocol (SPAP)
  • Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
  • Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2)
  • Extensible Authentication Protocol (EAP)
  • Smart card and other certificate authentication


Password Authentication Protocol (PAP)

Password Authentication Protocol (PAP) uses plaintext (unencrypted) passwords and is the least sophisticated authentication protocol. PAP is typically used if your connection and the server cannot negotiate a more secure form of validation. You may need to use this protocol if you are calling a server running an operating system other than Windows.

To configure a connection for PAP, see To configure identity authentication and data encryption settings for a dial-up connection.


Challenge Handshake Authentication Protocol (CHAP)

The Challenge Handshake Authentication Protocol (CHAP) negotiates a secure form of encrypted authentication by using Message Digest 5 (MD5), an industry-standard hashing scheme. A hashing scheme is a method for transforming data (for example, a password) in such a way that the result is unique and cannot be changed back to its original form. CHAP uses challenge-response with one-way MD5 hashing on the response. In this way, you can prove to the server that you know the password without actually sending the password over the network. By supporting CHAP and MD5, Network and Dial-up Connections is able to securely connect to almost all other PPP servers.

When you connect to other remote access servers or clients, Windows 2000 remote access may negotiate plaintext authentication if the other product does not support encrypted authentication.

To configure a connection for CHAP, see To configure identity authentication and data encryption settings for a dial-up connection.

Note

  • If the connection is configured to require encrypted authentication, and connects to a server that is only configured for plaintext authentication, the connection hangs up.


Shiva Password Authentication Protocol (SPAP)

With the Shiva Password Authentication Protocol (SPAP), Shiva clients can dial in to computers running Windows 2000 Server, and Windows 2000 clients can dial in to Shiva servers.

To configure a connection for SPAP, see To configure identity authentication and data encryption settings for a dial-up connection.

Note

  • If a server requires you to use SPAP, you cannot require data encryption.


Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)

Microsoft created MS-CHAP to authenticate remote Windows workstations, providing the functionality to which LAN-based users are accustomed while integrating the encryption and hashing algorithms used on Windows networks. It uses a challenge-response mechanism with one-way encryption on the response.

Where possible, MS-CHAP is consistent with standard CHAP. Its response packet is in a format specifically designed for Windows NT and Windows 2000, and Windows 95 and later, networking products. In addition, MS-CHAP does not require the use of plaintext or reversibly encrypted passwords.

A system administrator can define authentication retry and password changing rules for the users connecting to your server.

A version of MS-CHAP is available specifically for connecting to a server running Windows 95. You must use this version if your connection is to a server running Windows 95.

To configure a connection for MS-CHAP, see To configure identity authentication and data encryption settings for a virtual private network (VPN) connection or To configure identity authentication and data encryption settings for a dial-up connection.

Note

  • MS-CHAP v2 is a mutual authentication protocol, which means that both the client and the server prove their identities. If your connection is configured to use MS-CHAP v2 as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authentication and simply accept the call. This change ensures that you can configure a your connection can be configured to connect to the expected server.


Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2)

A new version of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP v2) is available. This new protocol provides mutual authentication, stronger initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAP v2 drops support for the MS-CHAP password change and does not transmit the encoded password.

For VPN connections, Windows 2000 Server offers MS-CHAP v2 before offering the legacy MS-CHAP. Updated Windows clients accept MS-CHAP v2 when it is offered. Dial-up connections are not affected.

Windows 2000 dial-up and VPN connections can use MS-CHAP v2. Windows NT 4.0 and Windows 98 computers can use only MS-CHAP v2 authentication for VPN connections.

To configure a connection for MS-CHAP v2, see To configure identity authentication and data encryption settings for a virtual private network (VPN) connection.


Extensible Authentication Protocol (EAP)

The Extensible Authentication Protocol (EAP) is an extension to the Point-to-Point Protocol (PPP). EAP was developed in response to an increasing demand for remote access user authentication that uses other security devices. EAP provides a standard mechanism for support of additional authentication methods within PPP. By using EAP, support for a number of authentication schemes may be added, including token cards, one-time passwords, public key authentication using smart cards, certificates, and others. EAP, in conjunction with strong EAP authentication methods, is a critical technology component for secure virtual private network (VPN) connections because it offers more security against brute-force or dictionary attacks and password guessing than other authentication methods, such as CHAP.

To find out if EAP authentication methods are being used, see your system administrator.

To configure a connection for EAP, see To configure identity authentication and data encryption settings for a virtual private network (VPN) connection or To configure identity authentication and data encryption settings for a dial-up connection.

Windows 2000 provides the EAP-MD5 CHAP and EAP-TLS authentication methods. EAP-TLS is a mutual authentication method, which means that both the client and the server prove their identities. If your connection is configured to use EAP-TLS as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authenticating themselves to clients and simply accept the call. The use of EAP-TLS ensures that you can configure a connection to connect to the expected server.


Smart card and other certificate authentication

If a certificate is installed either in the certificate store on your computer or on a smart card, and the Extensible Authentication Protocol (EAP) is enabled, you can use certificate-based authentication in a single network logon process, which provides tamper-resistant storage of authentication information.

A certificate is an encrypted set of authentication credentials. A certificate includes a digital signature from the certificate authority that issued the certificate. In the certificate authentication process, your computer presents its certificate to the server, and the server presents its certificate to your computer, enabling mutual authentication. Certificates are authenticated by using a public key to verify this digital signature, which is contained in a trusted authority root certificate that is stored on your computer. These root certificates are the basis for certificate verification and should be supplied only by a system administrator. Windows 2000 provides a number of trusted root certificates. You should add or remove trusted root certificates only if your system administrator advises.

Certificates can reside either in the certificate store on your computer or on a smart card. A smart card is a credit-card-sized device that is inserted into a smart card reader, which is either installed internally in your computer or connected externally to your computer.

By setting the security options of a connection, you can choose to use a smart card or other certificate, and you can specify particular certificate requirements. For example, you can specify that the certificate for the server must be validated, and you can also specify the certificate root authority for the server, which is highly trusted.

When you double-click Make New Connection in the Network and Dial-up Connections folder and a smart card reader is installed, Windows 2000 detects it and prompts you to use it as the authentication method for the connection. If you decide not to use the smart card at the time you create a connection, you can modify the connection to use the smart card or other certificate at a later time. For more information, see To enable smart card or other certificate authentication.

If you are a member of an Active Directory domain, and need to request a certificate, see To request a certificate. If you are not a member of an Active Directory domain, or you need to request a certificate from the Internet, see To submit a user certificate request via the Web. For information about mobile users and certificates, see Mobile users and certificates.


Intermediary devices

This section covers:

  • Using an intermediary device
  • Security hosts
  • Writing scripts for intermediary devices


Using an intermediary device

Network and Dial-up Connections supports various kinds of intermediary devices (security hosts and switches) between the remote access client and the remote access server. These devices include:

  • Modem-pool switches
  • Security hosts
  • X.25 networks

Before you connect to the remote access server, you can have one of two possible dialogs (user input and computer response screens) with each intermediary device:

  • Static (a dialog that never changes and requires no input from you)
  • Interactive (a dialog that always changes and requires input from you)

You must configure your connection to work with each intermediary device.

If you require both static and interactive dialogs, you must take the following steps:

  1. Write a script for the static dialog. For more information, see Writing scripts for intermediary devices.
  2. Activate Terminal mode for the interactive dialogs. For more information, see To use the Terminal feature to log on to a remote computer.

If you require only one kind of dialog, take only one of the preceding steps. For example:

  • If your clients connect through only one intermediary device with a static dialog (such as an X.25 network), skip step 2.
  • If your clients connect through a security host with an interactive dialog, skip step 1.


Security hosts

A security host is an authentication device that verifies whether a connection is authorized to connect to a remote access server. This verification supplements security already supplied by Network and Dial-up Connections and by Windows 2000 Server. There are two kinds of security hosts:

  • Those which perform authentication checks during a modem call

    This type of security host sits between you and the remote access server and performs an authentication check before remote access server authentication. This type of security host generally provides an extra layer of security by requiring a hardware key of some sort in order to provide authentication. Verification that you are in physical possession of the key takes place before access to the remote access server is granted. With this open architecture, your system administrator can select from a variety of security hosts to augment the security in Network and Dial-up Connections, but the authentication check is restricted to modem calls.

    For example, one such security system consists of two hardware devices: the security host and the security card. The security host is installed between the remote access server and its modem. The security card is a small unit the size of a credit card that resembles a pocket calculator without keys. The security card displays a different access number every minute. This number is synchronized with a similar number calculated in the security host every minute. When connecting, you send a PIN number and the number on the security card to the host. If these match the number calculated on the host, the security host connects you with the remote access server.

    Another security host of the same type prompts you to type in a user name (which may or may not be the same as the remote access user name) and a password (which differs from the remote access password). The security host must be configured to allow the remote access server to initialize the modem before the security functions take effect. The remote access server must also be able to directly initialize the modem connected to the security host without security checks from the security host.

  • Those which are called during the authentication process of the connection

    This type of security host provides custom authentication during the remote access authentication process. This authentication may augment or replace the standard verification of your Windows 2000 network credentials by Routing and Remote Access. RADIUS servers are examples of this type of security host in that they perform user authentication on behalf of Routing and Remote Access. With the introduction of the Extensible Authentication Protocol (EAP), other vendors can create interfaces between remote access authentication and their own proprietary servers. Servers of this type are used to verify smart cards and other forms of extended authentication.

Note

  • To make other security devices work with your connection, you must activate Terminal mode to interact with the security host. For more information, see To use the Terminal feature to log on to a remote computer.


Writing scripts for intermediary devices

Each script for a static dialog is a section of the Switch.inf file. You add a script for each intermediary device to the Switch.inf file. For an example of X.25 network scripts, see the Pad.inf file, located in the systemroot\System32\Ras folder.

When you connect by using modem pools or security hosts, you must have a dialog with that device. The dialog occurs either before dialing or after dialing. Although preconnect and postconnect dialogs can be either static or interactive, the preconnect dialog is normally static and the postconnect is normally interactive.

The Switch.inf file included in Windows 2000 provides a generic script that will probably work with little or no modification when you are connecting to PPP servers. You should try to connect by using the generic Switch.inf script. If that does not work, you can copy—and then modify—the generic script to match the logon sequence of the remote computer to which you want to connect.

For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts. For information about configuring a connection to use a Switch.inf script, see To activate a logon script.


Tunneling protocols

This section covers:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer Two Tunneling Protocol (L2TP)


Point-to-Point Tunneling Protocol (PPTP)

You can access a private network through the Internet or other public network by using a virtual private network (VPN) connection with the Point-to-Point Tunneling Protocol (PPTP).

PPTP enables the secure transfer of data from a remote computer to a private server by creating a VPN across TCP/IP-based data networks. PPTP supports on-demand, multiprotocol, virtual private networking over public networks, such as the Internet.

Developed as an extension of the Point-to-Point Protocol (PPP), PPTP adds a new level of enhanced security and multiprotocol communications over the Internet. Specifically, by using the new Extensible Authentication Protocol (EAP), data transfer through a PPTP-enabled VPN is as secure as within a single LAN at a corporate site. For more information on EAP, see Extensible Authentication Protocol (EAP).

PPTP tunnels or encapsulates, IP, IPX, or NetBEUI protocols inside of PPP datagrams. This means that you can remotely run applications that are dependent upon particular network protocols. The tunnel server performs all security checks and validations, and enables data encryption, which makes it much safer to send information over nonsecure networks. You can also use PPTP in private LAN-to-LAN networking.

PPTP tunnel

PPTP does not require a dial-up connection. It does, however, require IP connectivity between your computer and the server. If you are directly attached to an IP LAN and can reach a server, then you can establish a PPTP tunnel across the LAN. If, however, you are creating a tunnel over the Internet, and your normal Internet access is a dial-up connection to an ISP, you must dial up your Internet connection before you can establish the tunnel.

For more information about VPNs, see Virtual private network (VPN) connections. For information about creating a VPN, see To make a virtual private network (VPN) connection.


Layer Two Tunneling Protocol (L2TP)

You can access a private network through the Internet or other public network by using a virtual private network (VPN) connection with the Layer Two Tunneling Protocol (L2TP). L2TP is an industry-standard Internet tunneling protocol with roughly the same functionality as the Point-to-Point Tunneling Protocol (PPTP). The Windows 2000 implementation of L2TP is designed to run natively over IP networks. This implementation of L2TP does not support native tunneling over X.25, Frame Relay, or ATM networks.

Based on the Layer Two Forwarding (L2F) and Point-to-Point Tunneling Protocol (PPTP) specifications, you can use L2TP to set up tunnels across intervening networks. Like PPTP, L2TP encapsulates Point-to-Point Protocol (PPP) frames, which in turn encapsulate IP, IPX, or NetBEUI protocols, thereby allowing users to remotely run applications that are dependent upon specific network protocols.

L2TP tunnel

With L2TP, the computer running Windows 2000 Server that you are logging on to performs all security checks and validations, and enables data encryption, which makes it much safer to send information over nonsecure networks. By using the new Internet Protocol security (IPSec) authentication and encryption protocol, data transfer through a L2TP-enabled VPN is as secure as within a single LAN at a corporate site. For more information about IPSec, see Internet Protocol security (IPSec).

For more information about VPNs, see Virtual private network (VPN) connections. For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


Using Network and Dial-up Connections

When you install Windows 2000, the Network and Dial-up Connections feature is automatically installed. This section covers:

  • Monitoring network and dial-up connections

  • Making network and dial-up connections

  • Configuring network and dial-up connections


Monitoring network and dial-up connections

You can obtain information about an active connection by using the Status menu command.

By using Status, you can view:
  • The duration of a connection.
  • The speed at which you initially connected.

    For a single-link connection and for individual links in a multilink connection, this speed is negotiated (and fixed) at the time the connection or link is established. For multilink connections, this speed is equal to the sum of the speeds of the individual links. For multilink connections, this speed varies as links are added or deleted.

  • For local area connections, the number of bytes transmitted and received during a connection. For other types of connections, the number of bytes transmitted and received during a connection, and the associated compression and error statistics.
  • The diagnostic tools that you can use for a connection, if any. For example, the Windows Network Troubleshooter, TCP/IP Autoping, and TCP/IP Windows IP Configuration. These tools are explicitly registered in Windows 2000 by their providers, whether the provider is Microsoft or another organization.

For more information, see To monitor a connection.

Note

  • If your computer is set up to accept incoming connections, a connection icon with a user name assigned to it appears in the Network and Dial-up Connections folder as each user connects. You can view the progress of incoming connections by right-clicking a named connection, and then clicking Status.


Making network and dial-up connections

This section covers:

  • Using phone lines and modems

  • Using ISDN lines

  • Using X.25

  • Local area connections

  • Direct connections

  • Incoming connections

  • Incoming connections and IP addresses

  • Incoming connection clients

  • Internet connection sharing

  • Internet connection sharing settings

  • Internet connections

  • Virtual private network (VPN) connections


Using phone lines and modems

The most common dial-up connection is made by using a standard analog telephone line and a modem. Standard analog phone lines are available worldwide and meet most requirements of a mobile user. Standard analog phone lines are also called PSTN (public switched telephone network) or POTS (plain old telephone service).

Hundreds of modems are compatible with Windows 2000. Most modems that comply with industry standards should interoperate. However, many difficult-to-detect problems are the result of incompatible modems. To verify the compatibility of a modem, see the Microsoft Windows Hardware Compatibility List at the Microsoft Web site.

(http://www.microsoft.com/)

Windows 2000 automatically detects modems. This is especially useful for users who are not sure what modem is installed (for example, an internal modem). You can use shared modem pools for dial-up connections. Modem data compression and error control are available on most modems. However, built-in software compression offers enhanced performance over modem data compression.

For information about connecting to a network by using a phone line, see To make a dial-up connection by using a phone line.


Using ISDN lines

To enhance connection speeds, you can use an Integrated Services Digital Network (ISDN) line. Whereas standard phone lines typically transmit from 28.8 to 56 kilobits per second (Kbps), typical ISDN devices are capable of 64 or 128 Kbps. This is slower than local area networks supported by high-speed data communications technology, but faster than analog telephone lines. ISDN provides end-to-end digital connectivity between your computer and a remote computer or network by using a local telephone line for network connection.

An ISDN line must be installed by the phone company at your site and at the remote access server. Also, an ISDN adapter must be installed in place of a modem in both your computer and the remote access server. For information about installing an ISDN adapter, see To install an ISDN adapter. Costs for ISDN equipment and lines may be higher than standard modems and phone lines. However, the speed of communication reduces the duration of the connection time, thereby possibly saving toll charges.

An ISDN line comes with two B channels that transmit data at 64 Kbps, and one D channel for signaling that transmits data at 16 Kbps. You can configure each B channel to operate as a port. With this configuration, line speed increases to 128 Kbps. Channel aggregation schemes are specific to each driver, so you must use the same driver and equipment on the client and server.

Multilink dialing over ISDN combines multiple physical links into a logical bundle. This aggregate link increases your bandwidth. To use Multilink, both your connection and the remote access server must have Multilink enabled. For more information about the Multilink feature, see Configuring multiple device dialing.

For information about creating an ISDN network connection, see To make a dial-up connection by using an ISDN line. For information about configuring ISDN network connection settings, see To configure ISDN settings.


Using X.25

An X.25 network transmits data with a packet-switching protocol, bypassing noisy telephone lines. This protocol relies on an elaborate worldwide network of packet-forwarding nodes that can participate in delivering an X.25 packet to its designated address.

Network and Dial-up Connections supports X.25 by using packet assemblers/disassemblers (PADs) and X.25 cards. You can also use a modem and special dial-up X.25 carriers (such as Sprintnet and Infonet) in place of a PAD or X.25 smart card on your computer.

Remote access clients running Windows 2000 Professional or Windows 2000 Server can use either an X.25 card or dial in to an X.25 PAD to create connections. To accept incoming connections on a computer using X.25 running Windows 2000 Professional or Windows 2000 Server, you must use an X.25 card.

For more information about installing an X.25 card, see To install X.25.

For information about creating an X.25 connection, see To make a dial-up connection by using X.25.


Local area connections

Typically, computers running Windows 2000 are connected to a local area network (LAN). When you install Windows 2000, the operating system detects your network adapter and creates a local area connection for you. It appears, like all other connection types, in the Network and Dial-up Connections folder. By default, a local area connection is always activated. A local area connection is the only type of connection that is automatically created and activated.

If you disconnect your local area connection, the connection is no longer automatically activated. Because your hardware profile remembers this, it accommodates your location-based needs as a mobile user. For example, if you travel to a remote sales office and use a separate hardware profile for that location that does not enable your local area connection, you do not waste time waiting for your network adapter to time out. The adapter does not even try to connect.

If your computer has more than one network adapter, a local area connection icon for each adapter is displayed in the Network and Dial-up Connections folder.

Examples of LAN connections include Ethernet, Token Ring, cable modems, DSL, FDDI, IP over ATM, IrDA (Infrared), wireless, and ATM-emulated LANs. Emulated LANs are based on virtual adapter drivers such as the LAN Emulation Protocol.

If changes are made to your network, you can modify the settings of an existing local area connection to reflect those changes. For information about modifying a connection, see To configure a connection. With the Status menu option in Network and Dial-up Connections, you can view connection information such as connection duration, speed, amounts of data transmitted and received, and any diagnostic tools available for a particular connection. For information about using the Status menu option, see To view the status of a local area connection.

If you install a new LAN adapter in your computer, the next time you start Windows 2000, a new local area connection icon appears in the Network and Dial-up Connections folder. Plug and Play functionality finds the network adapter and creates a local area connection for it. You can add a PC card while the computer is on, and you do not have to restart Windows 2000. The local area connection icon is immediately added to the folder. You cannot manually add local area connections to the Network and Dial-up Connections folder.

You can configure multiple LAN adapters through the Advanced Settings menu option. You can modify the order of adapters that are used by a connection, and the associated clients, services, and protocols for the adapter. You can modify the provider order in which this connection gains access to information on the network, such as networks and printers.

You configure the device a connection uses, and all of the associated clients, services, and protocols for the connection, through the Properties menu option. Clients define the access of the connection to computers and files on your network. Services provide features such as file and printer sharing. Protocols, such as TCP/IP, define the language your computer uses to communicate with other computers.

Depending on the status of your local area connection, the icon changes appearance in the Network and Dial-up Connections folder, or a separate icon appears in the taskbar. By design, if a LAN adapter is not detected by your computer, a local area connection icon does not appear in the Network and Dial-up Connections folder. The following table describes the different local area connection icons.

Icon | Description | Location
Active local area connection icon | The local area connection is active | Network and Dial-up Connections folder
Media disconnected local area connection folder icon | The media is disconnected | Network and Dial-up Connections folder
Media disconnected local area connection taskbar icon | The media is disconnected | Taskbar
Driver disabled local area connection icon | The driver is disabled | Network and Dial-up Connections folder


Direct connections

With Network and Dial-up Connections, you can create a physical connection to another computer by using a serial cable, a DirectParallel cable, a modem, an ISDN device, or other method. For example, you may have a Windows CE Handheld PC that you want to connect to your network. Or, you may have two or more networks in the same location that are not physically connected. If you want to use resources on both networks from one computer, you can use a serial cable connection with an RS-232C null modem cable. You connect an RS-232C cable from a COM port on the computer to a COM port on your remote access server, which is used to create network access. You can also use an RS-232C null modem as a substitute for a network adapter if your computer is located physically near (less than 50 feet of cable) a remote access server. For more information about null modem cabling, see Null modem cabling.

The DirectParallel driver supports computer-to-computer connections by using standard and enhanced (ECP) parallel ports, which use Parallel Technologies' Basic or Fast parallel cables. For more information about using a DirectParallel cable for a direct connection, see DirectParallel access.

Remote access authentication methods control access to your network, not resources on the network. Having a Windows CE device directly attached to a computer on your network is analogous to having a computer attached to your network, but not logged on. In that instance, you attached and accessed the network without using authentication of any kind.

In Windows 2000, once you are present on a network, resource control is managed in various ways: Local Users and Groups, Active Directory, Group Policy, file and printer sharing, and so on.

Therefore, if you have set up a direct network connection using, for example, a Windows CE device, you need to ensure that resource control is in place that enforces access to privileged folders, printers, and so on.

Authentication methods are designed for remote computing, where the computer dialing in does not have access to the network until credentials such as user name and password are exchanged.

For information about creating a direct network connection, see To make a direct network connection.

Note

  • To create or modify a direct network connection, you must be a member of the Administrators group.


Incoming connections

By creating an incoming connection, a computer running Windows 2000 Professional or stand-alone Windows 2000 Server can act as a remote access server. You can configure an incoming connection to accept the following connection types: dial-up (modem, ISDN, X.25), virtual private network (VPN) (PPTP, L2TP), or direct (serial, infrared). On a computer running Windows 2000 Professional, an incoming connection can accept up to three incoming calls, up to one of each of these types. On a computer running Windows 2000 Server, the number of inbound calls is only limited by the computer and its hardware configuration. For information about earlier versions of Windows NT Server (and other operating systems) that can connect to an incoming connection, see Incoming connection clients.

You can use the Mulitlink feature to configure multiple modems or ISDN adapters for use with incoming dial-up connections. For more information on Multilink, see Configuring multiple device dialing.

When you create a connection, the users that can connect to your incoming connection and their network protocols are selected. Each user that connects to an incoming connection must have established a local user account. For more information about user settings such as name, password, and callback rights, see To grant incoming connection access rights to your computer. For more information about configuring your connection for the TCP/IP network protocol, see To configure an incoming connection to use TCP/IP. For more information about configuring your connection for the IPX network protocol, see To configure an incoming connection to use IPX.

For information about creating an incoming connection, see To make an incoming network connection.

Notes

  • For large numbers of incoming connections on a computer running Windows 2000 Server that operates as part of a distributed network, or as a domain controller, you can use Windows 2000 Server Routing and Remote Access to create a remote access server.
  • To create an incoming connection, you must be a member of the Administrators group.
  • Users do not need to use incoming connections to allow access to shared resources, such as files and printers, over a local area network. In order to enable shared access to resources on the local computer, you must enable file and print sharing, share the resources, and then set the appropriate permissions. For information about sharing a folder, see To share a folder or drive with other people.


Incoming connections and IP addresses

IP addresses are assigned to computers that connect to an incoming connections computer in one of two ways:

  • They are automatically allocated by DHCP.
  • They are assigned based on a range of addresses that is defined in the TCP/IP properties for the incoming connection.

If you want to specify a range of IP addresses, you must provide a starting IP address and an ending IP address for the range. Network and Dial-up Connections calculates the number of addresses that can be used within the starting and ending addresses of the range. For more information about specifying the range, and the affects of a subnet on the address range, see To configure an incoming connection to use TCP/IP.

If the incoming connections computer is attached to another network, and the specified address range consists of a subset of IP addresses for the network to which the computer is attached, you must ensure that the addresses in the range are not already assigned to other TCP/IP nodes within the attached network. This is recommended because using a subset of the larger network's addresses requires less manual configuration of the intranet nodes.

If you must use a range of addresses that is not a subset of the network to which the incoming connections computer is attached, then steps must be taken to ensure that computers on the network attached to the incoming connections computer can reach the incoming connection clients. To do this, you can create a route to the incoming client computers on the intranet computers by configuring your intranet hosts with the IP address of the incoming connections computer as a default gateway.

  • If your intranet hosts are configured to obtain an IP address automatically and a Dynamic Host Configuration Protocol (DHCP) server is present, you can configure your DHCP server to assign the default gateway.
  • If your intranet hosts are configured to obtain an IP address automatically and a DHCP server is not present (you are using the Automatic Private IP Addressing feature of Windows 2000 and Windows 98), then you must manually configure all of your intranet hosts with an IP address, subnet mask, and default gateway.

For more information, see To configure a default gateway.

Note

  • If the incoming connections computer is already configured for Internet connection sharing, you do not need to configure the default gateway setting. Internet connection sharing automatically makes its Internet interface the default gateway for all computers on the intranet.


Incoming connection clients

Windows 2000 provides support to incoming connections from the following operating systems, in addition to Windows 2000 clients:

  • Windows NT version 4.0 clients

    • Windows NT version 4.0 clients can take full advantage of all incoming connection features except dynamic allocation of multilinked lines, Extensible Authentication Protocol (EAP), IPSec client to server data security, and L2TP for tunneling across intervening networks.

  • Windows NT version 3.1, 3.5, and 3.51 clients

    • Windows NT version 3.5x clients can take full advantage of incoming connection features, except for Multilink functionality. Windows NT 3.5x clients negotiate the logon process and authentication with the incoming connection. You can also configure these clients to use scripts that completely automate the logon process.

    Windows NT version 3.1 clients do not support the Point-to-Point Protocol (PPP) introduced in Windows NT 3.5. Only Windows NT 3.5x or other PPP clients provide the support necessary to run TCP/IP or IPX applications on clients that directly communicate with servers on the LAN by using TCP/IP or IPX.

  • Windows 98 clients

    • Windows 98 clients can take full advantage of incoming connection features, except dynamic allocation of multilinked lines and the Extensible Authentication Protocol. Windows 98 clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Windows 95 clients

    • Windows 95 clients can take full advantage of incoming connection features, except the use of Multilink, dynamic allocation of multilinked lines, and Extensible Authentication Protocol. Windows 95 clients negotiate the logon process and authentication with the server. You can also configure these clients to use scripts that completely automate the logon process.

  • Macintosh clients

    • Macintosh users can connect to a computer running Windows 2000 Server and access Macintosh file volumes and AppleTalk printers by using the AppleTalk Control Protocol (ATCP).

  • Windows For Workgroups, MS-DOS, and LAN Manager clients

    • Windows 2000 Server provides a Microsoft Network Client version 3.0 for MS-DOS and a Windows for Workgroups client that provide remote access. Separately purchased Windows for Workgroups and LAN Manager Network and Dial-up Connections clients can also connect to an incoming connection.

    You must set up the Microsoft Network Client 3.0 for MS-DOS to use the full redirector (the default setting). If the basic redirector is used, the remote access program Rasphone cannot start, and an incoming connection cannot be reached.

    Windows for Workgroups, MS-DOS, and LAN Manager clients can use the remote access NetBIOS gateway to access NetBIOS servers running TCP/IP, IPX, or NetBEUI, but these clients cannot run applications that must use TCP/IP or IPX on the client.

    These clients also do not support the PPP protocol introduced in Windows NT 3.5.

  • PPP clients

    • Non-Microsoft PPP clients that use TCP/IP, IPX, or NetBEUI can access an incoming connection. The incoming connection automatically negotiates authentication with PPP clients; special configuration for non-Microsoft PPP clients is not required.

    For more information about your PPP client, see the software documentation for your PPP client.

For information about creating and configuring incoming connections, see Incoming connections.


Internet connection sharing

With the Internet connection sharing feature of Network and Dial-up Connections, you can use Windows 2000 to connect your home network or small office network to the Internet. For example, you might have a home network that connects to the Internet by using a dial-up connection. By enabling Internet connection sharing on the computer that uses the dial-up connection, you are providing network address translation, addressing, and name resolution services for all computers on your home network. For information about enabling Internet connection sharing, see To enable Internet connection sharing on a network connection.

After Internet connection sharing is enabled, and users verify their networking and Internet options, home network or small office network users can use applications such as Internet Explorer and Outlook Express as if they were already connected to the Internet Service Provider (ISP). The Internet connection sharing computer then dials the ISP and creates the connection so that the user can reach the specified Web address or resource. To use the Internet connection sharing feature, users on your home office or small office network must configure TCP/IP on their local area connection to obtain an IP address automatically. For more information, see To configure TCP/IP settings. Also, home office or small office network users must configure Internet options for Internet connection sharing. For more information, see To configure Internet options for Internet connection sharing.

The Internet connection sharing feature is intended for use in a small office or home office where network configuration and the Internet connection are managed by the computer running Windows 2000 where the shared connection resides. It is assumed that on its network, this computer is the only Internet connection, the only gateway to the Internet, and that it sets up all internal network addresses.

You might need to configure applications and services on the Internet connection sharing computer to work properly across the Internet. For example, if users on your home network want to play the Diablo game with other users on the Internet, you must configure the Diablo application on the connection where Internet connection sharing is enabled. Conversely, services that you provide must be configured so that Internet users can access them. For example, if you are hosting a Web server on your home network and want Internet users to be able to connect to it, you must configure the Web server service on the Internet connection sharing computer. For more information, see To configure Internet connection sharing for applications and services.

For information about the protocols, services, interfaces, and routes that are configured by enabling Internet connection sharing, see Internet connection sharing settings.

Important

  • To configure Internet connection sharing, you must be a member of the Administrators group.
  • You should not use this feature in an existing network with other Windows 2000 Server domain controllers, DNS servers, gateways, DHCP servers, or systems configured for static IP addresses. If you are running Windows 2000 Server, and one or more of these components exist, you must use network address translation to achieve the same result. For more information, see Deploying network address translation.
  • A computer with Internet connection sharing needs two connections. One connection, typically a LAN adapter, connects to the computers on the home network. The other connection connects the home network to the Internet. You need to ensure that Internet connection sharing is enabled on the connection that connects your home network to the Internet. By doing this, the home network connection appropriately allocates TCP/IP addresses to its own users, the shared connection can connect your home network to the Internet, and users outside your home network are not at risk of receiving inappropriate addresses from your home network. By enabling Internet connection sharing on a connection, the Internet connection sharing computer becomes a Dynamic Host Configuration Protocol (DHCP) allocator for the home network. DHCP distributes TCP/IP addresses to users as they start up. If Internet connection sharing is enabled on the wrong network adapter, users outside your home network might be granted TCP/IP addresses by the home network DHCP allocator, causing problems on their own networks.
  • When you enable Internet connection sharing, the adapter connected to the home or small office network is given a new static IP address configuration. Consequently, TCP/IP connections established between any small office or home office computer and the Internet connection sharing computer at the time of enabling Internet connection sharing are lost and need to be reestablished.

Notes

  • You cannot modify the default configuration of Internet connection sharing. This includes items such as disabling the DHCP allocator or modifying the range of private IP addresses that are distributed, disabling the DNS proxy, configuring a range of public IP addresses, or configuring inbound mappings. If you want to modify any of these items, you must use network address translation.
  • If your home office users need to access a corporate network that is connected to the Internet by a tunnel server from an Internet connection sharing network, they need to create a virtual private network (VPN) connection to tunnel from the computer on the Internet connection sharing network to the corporate tunnel server on the Internet. The VPN connection is authenticated and secure and creating the tunneled connection allocates proper IP addresses, DNS server addresses, and WINS server addresses for the corporate network. For more information about creating a virtual private network (VPN) connection, see To make a virtual private network (VPN) connection.


Internet connection sharing settings

When you enable Internet connection sharing, certain protocols, services, interfaces, and routes are configured automatically. The following table describes these configured items.

Configured item | Action
IP address 192.168.0.1 | Configured with a subnet mask of 255.255.255.0 on the LAN adapter that is connected to the small office or home office network.
Autodial feature | Enabled.
Static default IP route | Created when the dial-up connection is established.
Internet connection sharing service | Started.
DHCP allocator | Enabled with the default range of 192.168.0.1 and a subnet mask of 255.255.255.0.
DNS proxy | Enabled.

For information about Internet connection sharing, see Internet connection sharing.

Note

  • If you are enabling Internet connection sharing on a LAN connection, TCP/IP for the LAN interface that is connected to the Internet must be configured with a default gateway. If static TCP/IP addressing is used for this interface, see To configure TCP/IP for static addressing. If DHCP is being used by your ISP to allocate addresses for this interface, see To configure TCP/IP for dynamic addressing.


Internet connections

With Network and Dial-up Connections, connecting to the Internet is easy. You can use the following components to gain access to the Internet:

  • The TCP/IP protocol that is enabled for your network connection.
  • If you are part of a corporate domain, a user account with remote access permissions.
  • A modem or other connection to an Internet service provider (ISP).
  • An account with an ISP.

Your Internet connection dials the ISP and logs you on to the system. The actual sequence for logging on varies based on the requirements of the ISP you are calling. PPP connections are often entirely automatic. SLIP connections may require you to log on by using Terminal, which may or may not permit you to automate the logon process with scripts in the Switch.inf file.

For more information, see:

  • TCP/IP
  • ISP access methods
  • Internet service providers
  • Using PPP for Internet connections
  • To make an Internet connection
  • To use Windows 2000 to connect to MSN

Note

  • Before you create an Internet connection, check with your ISP to verify the required connection settings. A connection to your ISP may require one or more of the following settings:
    • A specific IP address.
    • IP header compression (for PPP).
    • DNS addresses and domain names.
    • Optional settings, such as Internet Protocol security (IPSec).


ISP access methods

A connection to an Internet service provider (ISP) can be through a modem and telephone line, an ISDN adapter and ISDN line, the AppleTalk Control Protocol (ATCP), an X.25 network, the Point-to-Point Tunneling Protocol (PPTP), or the Layer Two Tunneling Protocol (L2TP).

If you are using a modem, you will want the fastest possible speed to reduce downloading time while on the Internet. A modem of 28.8 Kbps or above is recommended. For more information about modems, see Modems.

For information about creating an Internet connection, see To make an Internet connection.


Internet service providers

There are Internet service providers (ISPs) around the world. Similar to other online services or bulletin boards, you dial the service number and log on to the remote system. Once connected, you have access to the Internet and any other services, such as electronic mail, that are provided by the ISP. Fees usually apply for commercial ISPs.

For information about creating an Internet connection, see To make an Internet connection.


Virtual private network (VPN) connections

With the Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP), which are automatically installed on your computer, you can securely access resources on a network by connecting to a remote access server running Windows 2000 through the Internet or other network. The use of both private and public networks to create a network connection is called a virtual private network (VPN). The following table describes the advantages of using VPN connections. For more information, click an advantage.

Advantage | Example
Cost advantages | The Internet is used as a connection instead of a long-distance telephone number or 1-800 service. Because an ISP maintains communications hardware such as modems and ISDN adapters, your network requires less hardware to purchase and manage.
Outsourcing dial-up networks | You can make a local call to the telephone company or Internet service provider (ISP), which then connects you to a remote access server running Windows 2000 and your corporate network. It is the telephone company or ISP that manages the modems and telephone lines required for dial-up access. Because the ISP supports complex communications hardware configurations, a network administrator is free to centrally manage user accounts at the remote access server.
Enhanced security | The connection over the Internet is encrypted and secure. New authentication and encryption protocols are enforced by the remote access server. Sensitive data is hidden from Internet users, but made securely accessible to appropriate users through a VPN.
Network protocol support | Because the most common network protocols (including TCP/IP, IPX, and NetBEUI) are supported, you can remotely run any application dependent upon these particular network protocols.
IP address security | Because the VPN is encrypted, the addresses you specify are protected, and the Internet only sees the external IP address. For organizations with nonconforming internal IP addresses, the repercussions of this are substantial, as no administrative costs are associated with having to change IP addresses for remote access via the Internet.

There are two ways to create a VPN connection: By dialing an ISP, or by connecting directly to the Internet, as shown in the following examples.

In the first example, the VPN connection first makes a call to an ISP. After the connection is established, the connection then makes another call to the remote access server that establishes the PPTP or L2TP tunnel. After authentication, you can access the corporate network, as shown in the following illustration.

VPN connection by using an ISP

In the second example, a user who is already connected to the Internet uses a VPN connection to dial the number for the remote access server. Examples of this type of user include a person whose computer is connected to a local area network, a cable modem user, or a subscriber of a service such as ADSL, where IP connectivity is established immediately after the user's computer is turned on. The PPTP or L2TP driver makes a tunnel through the Internet and connects to the PPTP-enabled or L2TP-enabled remote access server. After authentication, the user can access the corporate network, achieving the same functionality as the preceding example.

VPN connection by using an existing Internet connection

For information about creating a VPN connection, see To make a virtual private network (VPN) connection. For information about the ways Active Directory can tighten security measures for VPNs, see VPN administration.

Notes

  • Connecting directly to the Internet means direct IP access without going through an ISP. (For example, some hotels allow you to use an Ethernet cable to connect to the Internet.)
  • If you have an active Winsock Proxy client, you cannot create a VPN. A Winsock Proxy client immediately redirects data to a configured proxy server before the data can be processed in the fashion required by a VPN. To establish a VPN, you should disable the Winsock Proxy client.


Cost advantages

By using virtual private networks (VPNs), mobile professionals and telecommuters can access their corporate local area network (LAN) over the Internet for a fraction of the cost of traditional remote access solutions. Just as it is more cost effective to make use of the phone company's massive switching system, rather than stringing up your own telephone lines and investing in your own switch, dialing the IP address or DNS name of your PPTP-enabled remote access server makes use of the physical base of routers of the Internet, ATM switches, and digital and analog lines, without sacrificing security.

You can use a network adapter to dial in to a virtual private network, as you would dial a modem to connect to a traditional remote server. VPNs offer corporations a release from the cost and maintenance obligations of components such as modem banks and dedicated analog (1-800) phone lines. The modems and their associated infrastructure remain centralized at the Internet service provider's locations, without sacrificing security or the ability to control remote connections. At the same time, the benefits of secure access to private data are ensured by additional VPN-required authenticated access, encryption, and user data compression.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


Outsourcing dial-up networks

The communications hardware that is available for supporting dial-up needs can be complicated and not well-integrated. For a large organization, putting together a remote access server running Windows 2000 requires modems, serial controllers, and many cables. Furthermore, many solutions do not provide a single integrated way to efficiently support V.34 and ISDN dial-up lines.

Many corporations like to outsource dial-up access to their corporate backbone networks in a manner that is cost-effective, hassle-free, protocol-independent, secure, and that requires no changes to the existing network addressing. Virtual WAN support by using virtual private network (VPN) connections is one way an Internet service provider (ISP) can meet the needs of corporations. In this way, the oursourcing company maintains and manages remote access modems and lines, leaving a system administrator free to manage users and their authentication needs.

This type of solution takes advantage of proven PPP authentication, encryption, and compression technologies. For information about creating a VPN connection, see To make a virtual private network (VPN) connection.

The following illustration shows an example of outsourcing.

Outsourced dial-up network

The connection does not need to have a PPTP driver; the client simply makes a PPP connection to the modem pool or communications server. The communication server or modem pool must implement PPTP for communication with the remote access server.


Enhanced security

Virtual private network (VPN) connections enabled with PPTP and L2TP are authenticated by using PPP user-level authentication methods. These include Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), Shiva Password Authentication Protocol (SPAP), Microsoft Challenge Authentication Protocol (MS-CHAP), and optionally, Extensible Authentication Protocol (EAP).

By using the new Extensible Authentication Protocol (EAP) and Internet Protocol security (IPSec) security options, a virtual private network provides enhanced security for remote users. For example, if your remote access server has been configured to require EAP for authorization, the highest level of authentication is enforced for the dial-up or virtual network and dial-up connections of the remote access server. By taking advantage of Point-to-Point Protocol (PPP) authentication and encryption options, defining PPTP filtering on your remote access server, and restricting remote access servers on the Internet to only accept authenticated PPTP clients who encrypt data, your system administrator can tighten data security and manage remote users much more efficiently.

In some environments, data is so sensitive that it needs to be physically separated, and hidden, from the majority of corporate users. Finance or human resources data are examples of this type of data. Corporations can use VPN connections through a VPN server to physically separate extremely sensitive data servers, yet allow secure access to the data by selected users. Users on the corporate intranet who have been granted the appropriate permissions can establish a remote client VPN connection with the VPN server and can access the protected resources of the sensitive department network. Additionally, all communication across the VPN is encrypted for data confidentiality. Users who do not have proper permissions to establish a VPN with the VPN server cannot see the hidden server.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


Network protocol support

Because virtual private networks (VPNs) support the most common network protocols, it is easy for clients on Ethernet, TCP/IP, IPX, and NetBEUI networks to use VPNs. Any network protocol supported by Windows 2000 remote access is inherently supported in a VPN. This means that you can remotely run applications that are dependent upon particular network protocols. In turn, this translates to reduced costs in setting up and maintaining VPN connections.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


IP address security

If you are using a nonregistered IP address (or an address that InterNIC has reserved for private networks such as the 10.x.y.z range), you can route through the Internet by providing a valid public IP address. Inside the virtual private network (VPN) envelope are packets with your address and the destination private address. Because the packet is encrypted, the addresses you specify on the remote private network are protected. The Internet only sees the public IP address. For organizations with nonconforming internal IP addresses, the repercussions of this are substantial, as no administrative costs are associated with having to change IP addresses for remote access.

For information about creating a VPN connection, see To make a virtual private network (VPN) connection.


VPN administration

By using Active Directory in Windows 2000 Server, your system administrator can configure virtual private network (VPN) user settings that significantly tighten security measures, such as required levels of data and password encryption and authentication. These requirements can be applied to individual users, or to a group (or profile) of similar users. For example, a system administrator can configure remote access dial-in settings to define a group profile such that all users who are assigned to that profile are required to authenticate by using the Extensible Authentication Protocol (EAP) and encrypt their data by using strong (128-bit) data encryption. By assigning a user to the group profile, these security measures are automatically required when anyone in that group profile connects to the remote access server.

For information about configuring connections, see To configure a connection.


Configuring network and dial-up connections

This section covers:

  • Configuring a network or dial-up connection
  • Configuring dial-up options
  • Configuring redial options
  • Configuring multiple device dialing
  • Optional network components
  • Client for Microsoft Networks
  • File and Printer Sharing for Microsoft Networks
  • Mobile users and certificates
  • Using Terminal and scripting
  • Configuring authentication and data encryption
  • Automating a network or dial-up connection


Configuring a network or dial-up connection

You can change a network or dial-up connection by modifying its settings. Dial-up settings, such as the phone number of the connection, the number of redial attempts, and so on, are defined for each connection. These pre and post connection settings do not modify or affect the settings of other connections. For example, you may have a dial-up connection that attempts to redial 10 times a server that is frequently busy. You may have a second dial-up connection that attempts to redial three times another server that is more readily available. The redial setting of the first connection never causes the second connection to redial more than its own established three times. There is no need to make changes to any settings outside of the settings of the dial-up connection.

Changes to some networking settings of a connection can affect other connections. For example, if you add the AppleTalk protocol to the list of available network components for one connection, the AppleTalk protocol also is available to other connections on the same computer.

You can modify connection settings when you are connected. You can also rename a connection when it is connected. However, the connection may need to be reconnected in order to save the changes. If this happens, the connection is disconnected, the changes are stored, and the connection is immediately reconnected.

Each connection is configured with general settings that are the minimum information needed to successfully connect. These options are found on the General tab. For example, a local area connection only needs to list its network adapter. For a dial-up connection, the General tab includes required information, such as the device used to dial, the area code, the phone number, and the country/region code to dial.

For outgoing connections, you can set additional configuration options on the Options, Security, Networking, and Sharing tabs. You can set additional configuration options for an incoming connection on the Users and Networking tabs.

You can configure advanced settings from Advanced Settings on the Advanced menu of the Network and Dial-up Connections folder. By modifying these settings, you can improve performance. For example, Windows 2000 accesses network providers and protocols in the order specified in Advanced Settings. If your LAN connection is enabled to access NetWare and Microsoft Windows networks that use TCP/IP and IPX, but your primary connection is to a Microsoft Windows network that uses TCP/IP, you can move Microsoft Windows Network to the top of the Network Providers list on the Provider Order tab, and move Internet Protocol (TCP/IP) to the top of the File and Printer Sharing for Microsoft Networks binding on the Adapters and Bindings tab. By changing your provider order, and by changing the order of protocols bound to those providers, you can improve performance. For more information about modifying the order of network providers, see To modify the network provider order. For more information about modifying the protocol binding order, see To modify the protocol bindings order.

For more information about configuring connections, see To configure a connection.


Configuring dial-up options

There are many dialing features that you can use to streamline the dial-up connection process. For instructions about configuring a dialing feature, click the feature in the following table.

Dialing feature | Function
To configure callback | Reduces phone charges by having the remote access server dial back to your location after you initially connect.
To configure autodial | Remembers network addresses to connection destinations, which allows them to be automatically dialed when referenced from an application or from the command prompt.
To enable multiple device dialing | Combines multiple physical links, which increases the aggregate bandwidth of your connection, and dynamically dials and drops multilinked lines as needed.
To configure phone number modifiers | Manually inserts characters to force dialing behaviors (pause, suspend dialing until input provided, and so on).
To configure redial options | Specifies the number of times your connection automatically redials when you fail to connect to your remote access server. You can also set this feature to reconnect automatically when an inactive link is dropped.
To assign multiple phone numbers to a connection | Assigns more than one destination phone number to your dial-up connection. This is useful if you have a pool of phone numbers to connect to.
To enable operator-assisted calls or manual dialing | Overrides automatic dial-up situations where intervention is required. For example, when you call through a manually operated switchboard.

Note

  • You can configure dial-up options that apply to all connections within a location (for example, dialing 9 for an outside line, disabling call waiting, using pulse dialing instead of tone dialing, and so on) in Phone and Modem Options. For more information, see To set dialing properties for a location.


Configuring redial options

With redial options, you can determine the number of times your connection automatically redials when you fail to connect to a remote access server. You can also reconnect automatically when a link is dropped.

By default, a dial-up connection is set up to redial three times (at one minute intervals) if it cannot reach its remote access server. Also by default, a connection idles indefinitely and does not redial if the line is dropped.

For information about configuring redial options, see To configure redial options.


Configuring multiple device dialing

The Network and Dial-up Connections feature performs PPP Multilink dialing over multiple ISDN, X.25, or modem lines. The feature combines multiple physical links into a logical bundle and the resulting aggregate link increases your connection bandwidth. To dial multiple devices, both your connection and your remote access server must have Multilink enabled.

Network and Dial-up Connections can dynamically control the use of multilinked lines. By allocating lines only as they are required, thereby eliminating excess bandwidth, you can realize a significant efficiency advantage. You can configure the conditions under which extra lines are dialed, and underused lines are hung up, through Network and Dial-up Connections settings.

For more information, see To configure multiple device dialing.

Note

  • If you use Multilink to dial a server that requires callback, then only one of your multilinked devices is called back. This is because you can only store one number in a user account. Therefore, only one device connects and all other devices fail to complete the connection, and your connection loses Multilink functionality.
    • You can avoid this problem:
    • If the multilinked phonebook entry uses an standard modem configuration, and the remote access server that your connection is calling uses more than one line for the same number.
    • If the multilinked phonebook entry is ISDN with two channels that have the same phone number.


Optional networking components

You can add or remove optional networking components from Windows 2000. Optional networking components support network operations performed by Windows 2000 and are not automatically installed with Windows 2000. Some of these components include the Route Listening Service, Simple TCP/IP Services, SNMP Services, and Print Services for Unix.

For information about installing optional networking components, see To add optional networking components.


Client for Microsoft Networks

The Client for Microsoft Networks component allows a computer to access resources on a Microsoft network.

The component is installed and enabled by default. You should not need to configure the component unless you are running software from The Open Group, such as Distributed Computing Environment (DCE) server or client kits. If you are, contact your system administrator for the correct DCE Cell Directory Service network address.

The Client for Microsoft Networks component is the equivalent of the Workstation service in Windows NT 4.0.

For information about configuring the Client for Microsoft Networks component, see To configure Client for Microsoft Networks.


File and Printer Sharing for Microsoft Networks

The File and Printer Sharing for Microsoft Networks component allows other computers on a network to access resources on your computer by using a Microsoft network.

The component is installed and enabled by default. It is enabled per connection and is necessary to share local folders.

The File and Printer Sharing for Microsoft Networks component is the equivalent of the Server service in Windows NT 4.0.

For information about configuring the File and Printer Sharing for Microsoft Networks component, see To configure File and Printer Sharing for Microsoft Networks. For information about sharing folders, see To share a folder or drive with other people.


Mobile users and certificates

If you are a mobile user, you need to enable the use of certificates on your computer. Unless your system administrator preconfigures your computer with machine and user certificates before you receive it, you must connect to your corporate network by using conventional, password-based authentication methods to get your machine and user certificates. At the time you connect, you join your computer to the corporate domain, obtain certificates, and set certificates policy. The next time you connect to the corporate network, you can use certificate-based authentication methods such as EAP.

To enable the use of certificates on a computer, do the following:

  1. Connect to the corporate network by using a dial-up or PPTP network connection, and authentication protocols such as MS-CHAP, or MS-CHAP v2. When you connect, your computer name joins the corporate domain and receives machine certificates.

  2. Request a user certificate. For more information about requesting certificates, see To request a certificate, To submit a user certificate request via the Web, and Requesting certificates.
  3. Create another connection that uses certificate-based authentication, and then connect again by using certificate-based authentication methods such as EAP or IPSec. For more information about enabling a connection to use a smart card or other certificate, see To enable smart card or other certificate authentication.

You can avoid these steps by having your system administrator load machine and user certificates before you take your laptop out onto the road.

Note

  • For machine certificates to be received automatically, you must implement public key policies (by using Group Policy) that autoenroll computers to receive certificates. If the machine certificate process is not automated, you must log on to your computer as an Administrator, install Certificate Services, and request a computer certificate. For more information, see To manage certificates for a computer and To manage certificates for your user account.


Using Terminal and scripting

If you are connecting to a remote access server that is not running Windows, you may need to provide logon information in a separate logon Terminal window. Your connection must be configured to accommodate this requirement.

You can use one of two possible scripting methods to automate the remote Terminal logon process: Switch.inf scripts or Windows scripting. Switch.inf is an older scripting method that was developed for earlier versions of Windows NT. You may find the Windows 95 scripting language easier to use than Switch.inf.

This section covers:

  • Using the Terminal feature for the remote logon process
  • Using device command (.inf) files
  • Automating the dial-up logon process by using Windows scripting
  • Automating the dial-up logon process by using Switch.inf scripts


Using the Terminal feature for the remote logon process

For a PPP or SLIP server, if the remote computer you connect to requires that you log on with a terminal-emulation screen, you must configure the script settings for that network connection to use a Terminal logon window. With this logon process, after your connection connects to the remote system, a character-based window displays the logon sequence from the remote computer. You can use this window for logging on to the remote computer. For more information, see To use the Terminal feature to log on to a remote computer. Alternatively, you can automate this manual logon process as described in Automating the dial-up logon process by using Switch.inf scripts.

Some commercial networks present a large menu of available services before you log on. On SLIP servers, typically running on UNIX, you may go through an extensive sequence of commands that updates files, collects data about you, or configures your SLIP connection during your logon process. On a newer PPP server, you may be prompted for only your user name and password before you are given a connection.

Note

  • If the remote computer is a remote access server running Windows, you do not need to use a Terminal logon window. Instead, the logon process is completely automated for you.


Using device command (.inf) files

Network and Dial-up Connections uses the Switch.inf and Pad.inf files to automate the interactive logon process with servers and to initialize X.25 packet assemblers/disassemblers (PADs). These device command (.inf) files, located in the systemroot\System32\Ras folder, use the same commands and syntax to communicate with devices or computers automatically.

Switch.inf

You can use the commands in this file when you connect to the network through a security host or a remote server that requires you to log on interactively (for example, a UNIX server). You can create a script by typing the name of the device in brackets and then adding one or more commands following the device name. After you create the script, activate the script (on the Security tab) for each connection that will use the script. You can use the scripts before you dial (for example, modem pools) or after you dial (for example, using security hosts or actually logging on to a remote server). For more information, see Automating the remote logon process by using Switch.inf scripts.

Pad.inf

You can use the commands in this file when you connect to the network through an X.25 PAD. Most supported PADS have scripts that are provided in Pad.inf. If necessary, you can create a script by typing the name of the device within brackets and then adding one or more commands following the device name. After you create the script, activate the script (on the Security tab) for each connection that will use the script.


Automating the dial-up logon process by using Windows scripting

As an alternative to using the Switch.inf file, you can also use the Windows 95 scripting language to automate the logon process for dial-up connections.

Many Internet service providers (ISPs) and online services require you to manually enter information, such as your user name and password, to establish a connection. With scripting support for Network and Dial-up Connections, you can write a script to automate this process.

A script is a text file that contains a series of commands, parameters, and expressions required by your ISP or online service to establish the connection and use the service. You can use any text editor, such as Microsoft Notepad, to create a script file. Once you create the script file, you can then assign it to a specific connection.

The following sample scripts are located in systemroot\System32\Ras.

File | Description
Cis.scp | How to establish a PPP connection with Compuserve.
Pppmenu.scp | How to establish a PPP connection with a host that uses a menu system.
Slip.scp | How to establish a SLIP connection with a host.
Slipmenu.scp | How to establish a SLIP connection with a host that uses a menu system.

For information about activating a script, see To activate a logon script.

For more information about using the Windows 95 scripting language, see the following:

  • Basic structure of a script
  • Variables
  • System variables
  • String literals
  • Expressions
  • Comments
  • Keywords
  • Commands
  • Reserved words


Basic structure of a script

A command is the basic instruction that a script file contains. Some commands require options that further define what the command should do. An expression is a combination of operators and arguments that create a result. You can use expressions as values in any command. Examples of expressions include arithmetic, relational comparisons, and string concatenations.

The basic form of a script for Network and Dial-up Connections is as follows:

;

; A comment begins with a semicolon and extends to

; the end of the line.

;

proc main

; A script can have any number of variables

; and commands.

variable declarations

command block

endproc

A script must have a main procedure, specified by the proc keyword, and a matching endproc keyword, indicating the end of the procedure.

You must declare variables before you add commands. The first command in the main procedure is executed, and then any subsequent commands are executed in the order they appear in the script. The script ends when the end of the main procedure is reached.

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Variables

Scripts may contain variables. Variable names must begin with a letter or an underscore (_) and may contain any sequence of uppercase or lowercase letters, digits, and underscores. You cannot use a reserved word as a variable name. For more information, see Reserved words.

You must declare variables before you use them. When you declare a variable, you must also define its type. A variable of a certain type can only contain values of that same type. The following table describes the three types of variables that are supported.

Type | Description
integer | A negative or positive number, such as 7, -12, or 5,698
string | A series of characters enclosed in straight quotation marks. For example, "Hello world!" or "Enter password:"
boolean | A logical boolean value of TRUE or FALSE
Variables are assigned values by using the following assignment statement:

variable = expression

The variable gets the evaluated expression.

For example:

integer count = 5

integer timeout = (4 * 3)

integer i

boolean bDone = FALSE

string szIP = (getip 2)

set ipaddr szIP

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


System variables

System variables are set by scripting commands or are determined by the information you enter when you set up a connection. System variables are read-only, which means they cannot be changed within the script. The system variables are described in the following table.

Name | Type | Description
$USERID | String | The user identification for the current connection. This variable is the value of the user name specified in the Connect To dialog box.
$PASSWORD | String | The password for the current connection. This variable is the value of the password specified in the Connect To dialog box.
$SUCCESS | Boolean | This variable is set by certain commands to indicate whether or not the command succeeded. A script can make decisions based upon the value of this variable.
$FAILURE | Boolean | This variable is set by certain commands to indicate whether or not the command failed. A script can make decisions based upon the value of this variable.

These variables may be used wherever an expression of a similar type is used. For example:

transmit $USERID

This is a valid command because $USERID is a variable of type string.

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


String literals

Scripting supports escape sequences and caret translations, as described in the following table.

String literal | Description
^char Caret translation.

If char is a value between '@' and '_', the character sequence is translated into a single-byte value from 0 through 31. For example, ^M is converted to a carriage return.

If char is a value between a and z, the character sequence is translated into a single-byte value from 1 through 26.

If char is any other value, the character sequence is not specially treated.
<cr> | Carriage return.
<lf> | Line feed.
\" Quotation mark.
\^ Single caret.
\< Single angle bracket.
\\ Backslash.
For example:

transmit "^M"

transmit "Joe^M"

transmit "<cr><lf>"

waitfor "<cr><lf>"

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Expressions

An expression is a combination of operators and arguments that evaluate to a result. You can use expressions as values in any command.

An expression can combine any variable, integer, string, or boolean value with any of the unary and binary operators in the following tables. All unary operators take the highest precedence. The precedence of binary operators is indicated by their position in the table.

The unary operators are listed in the following table.

Operator | Type of operation
- | Unary minus
! | One's complement

The binary operators are listed in the following table in their order of precedence. Operators with higher precedence are listed first.

Operators | Type of operation | Type restrictions
* / | Multiplicative | Integers
+ - | Additive integers | Strings (+ only)
<> <= >= | Relational | Integers
== != | Equality | Integers, strings, booleans
and | Logical AND | Booleans
or | Logical OR | Booleans

For example:

count = 3 + 5 * 40

transmit "Hello" + "there"

delay 24 / (7 - 1)

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Comments

All text on a line following a semicolon is ignored. For example:

; this is a comment

transmit "hello" ; transmit the string "hello"

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Keywords

Keywords specify the structure of a script. Unlike commands, they do not perform an action. The keywords are described in the following table.

Keyword | Description
proc name | Indicates the beginning of a procedure. All scripts must have a main procedure (proc main). Script execution starts at the main procedure and terminates at the end of the main procedure.
endproc | Indicates the end of a procedure. When the script is executed to the endproc statement for the main procedure, Network and Dial-up Connections starts PPP or SLIP.
integer name [ = value ] | Declares a variable of type integer. You can use any numerical expression or variable to initialize the variable.
string name [ = value ] | Declares a variable of type string. You can use any string literal or variable to initialize the variable.
boolean name [ = value ] | Declares a variable of type boolean. You can use any boolean expression or variable to initialize the variable.

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Commands

All commands are reserved words, which means you cannot declare variables that have the same names as the commands. The commands are described in the following table.

Command | Description | Example
delay nSeconds Pauses for the number of seconds specified by nSeconds before executing the next command in the script. delay 2 ; pauses for 2 seconds

delay x * 3 ; pauses for x * 3 seconds
getip value Waits for an IP address to be received from the remote computer. If your Internet service provider (ISP) returns several IP addresses in a string, use value to specify which IP address the script should use. ; get the second IP address

set ipaddr getip 2

; assign the first received

; IP address to a variable

szAddress = getip
goto label Jumps to the location in the script specified by label and continues executing the commands following it. waitfor "Prompt:" until 10

if !$SUCCESS then

goto BailOut ; jumps to

;BailOut and executes

;commands following it

endif

transmit "bbs^M"

goto End

BailOut:

transmit "^M"

halt | Stops the script. This command does not remove the Terminal window. You must click Continue to establish the connection. You cannot restart the script.
if condition then

commands

endif

         Executes the series of commands if condition is TRUE. if $USERID == "John" then

transmit "Johnny^M"

endif
label: Specifies the place in the script to jump to. A label must be a unique name and follow the naming conventions of variables.
set port databits 5 | 6 | 7 | 8 | Changes the number of bits in the bytes that are transmitted and received during the session. The number of bits is from 5 through 8. If you do not include this command, Network and Dial-up Connections uses the settings specified for the connection. | set port databits 7
set port parity none | odd | even | mark | space | Changes the parity scheme for the port during the session. If you do not include this command, Network and Dial-up Connections uses the settings specified for the connection. | set port parity even
set port stopbits 1 | 2 | Changes the number of stop bits for the port during the session. This number is either 1 or 2. If you do not include this command, Network and Dial-up Connections uses the settings specified for the connection. | set port stopbits 2
set screen keyboard on | off | Enables or disables keyboard input in the scripting Terminal window. | set screen keyboard on
set ipaddr string Specifies the IP address of the workstation for the session. String must be in the form of an IP address. szIPAddress = "10.0.0.0"

set ipaddr szIPAddress

set ipaddr "10.0.0.0"

set ipaddr getip
transmit string [ , raw ] Sends the characters specified by string to the remote computer.

The remote computer recognizes escape sequences and caret translations, unless you include the raw option with the command. The raw option is useful when transmitting $USERID and $PASSWORD system variables when the user name or password contains character sequences that, without the raw option, are interpreted as caret or escape sequences.

 transmit "slip" + "^M"

transmit $USERID, raw
waitfor string [ , matchcase ] [ then label { , string [ , matchcase ] then label } ] [ until time ] Waits until your computer receives one or more of the specified strings from the remote computer. String is not case-sensitive, unless you include the matchcase option.

If a matching string is received and the then label option is used, this command jumps to the place in the script file designated by label.

The optional until time option defines the maximum number of seconds that your computer waits to receive the string before it executes the next command. Without this option, your computer waits forever.

If your computer receives one of the specified strings, the system variable $SUCCESS is set to TRUE. Otherwise, it is set to FALSE if the number of seconds specified by time elapses before the string is received. 		waitfor "Login:"

waitfor "Password?", matchcase

waitfor "prompt:" until 10

waitfor

"Login:" then DoLogin,

"Password:" then DoPassword,

"BBS:" then DoBBS,

"Other:" then DoOther

until 10
while condition do

commands

endwhile

 Executes the series of commands until condition is FALSE. integer count = 0

while count < 4 do

transmit "^M"

waitfor "Login:" until 10

if $SUCCESS then

goto DoLogin

endif

count = count + 1

endwhile

...

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Reserved words

The following words are reserved and cannot be used as variable names.

and | boolean | databits | delay
do | endif | endproc | endwhile
even | FALSE | getip | goto
halt | if | integer | ipaddr
keyboard | mark | matchcase | none
odd | off | on | or
parity | port | proc | raw
screen | set | space | stopbits
string | then | transmit | TRUE
until | waitfor | while

For information about automating the dial-up logon process by using the Windows 95 scripting language, see Automating the dial-up logon process by using Windows scripting. For information about activating a logon script, see To activate a logon script.


Automating the dial-up logon process by using Switch.inf scripts

To automate the logon process, you can use the Switch.inf file (or Pad.inf on X.25 networks) instead of the manual Terminal window described in Using the Terminal feature for the remote logon process.

Automated scripts are especially useful when a constant connection to a remote computer is needed. If your network connection is configured to use a script, and a remote connection fails, your connection automatically redials the number and reestablishes the connection. Scripts also save time if you frequently log on to a remote system and do not want to manually log on each time.

The Switch.inf file provides a generic script that you can use with little or no modification. You can try Switch.inf without modification and if it does not work, then copy and modify the generic script to match the logon sequence of the remote computer to which you want to connect.

The script language is also designed to communicate with other devices, including modems. If you are unfamiliar with modem scripts, scripting can be difficult to understand. You may find it easier to copy, then modify, one of the generic sample scripts.

This section covers:
  • Creating Switch.inf scripts for network and dial-up connections
  • To activate a logon script
  • Stepping through an example Switch.inf script
  • Getting through two-second gaps and large blocks of text in Switch.inf
  • Using commands and carriage returns in Switch.inf
  • Troubleshooting logon scripts


Creating Switch.inf scripts for network and dial-up connections

The Switch.inf file, located in the systemroot\System32\Ras folder, is like a set of small batch files (scripts) contained in one file. The Switch.inf file contains a different script for each intermediary device or online service that a connection calls.

A Switch.inf script has six elements:

  • Section headers
  • Comment lines
  • Commands
  • Responses
  • Response keywords
  • Macros

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Section headers

Section headers divide the Switch.inf file into individual scripts. A section header marks the beginning of a script for a particular remote computer and must not exceed 31 characters. The text of a section header appears in Network and Dial-up Connections when you activate the script. The section header is enclosed in square brackets. For example:

[Route 66 Logon Process]

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Comment lines

Comment lines must have a semicolon (;) in column one and can appear anywhere in the file. Comment lines contain information for people who maintain the Switch.inf file. For example:

; This script was created by Martha on September 29, 1996.

For more information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Commands

Each line in a script is a command from your local computer to a remote computer or a response from a remote computer to your local computer. Each command or response is a stream of data or text. For example, the following command sends a user name (Martha) and a carriage return (the macro <cr>) to the remote computer:

COMMAND=Martha<cr>

The commands and responses must be in the exact order the remote computer expects them. Branching statements, such as GOTO or IF, are not supported.

The required sequence of commands and responses for a specific remote device should be in the documentation for that device or, if you are connecting to a commercial service, from the support staff of that service. If the exact sequence is not available, you can activate the generic script provided with Network and Dial-up Connections and modify it to match the logon sequence of the remote computer as described in Troubleshooting logon scripts.

You can use the COMMAND= statement in two additional ways:

  • COMMAND= NoResponse

    This is the default behavior and causes an approximate two-second delay. This is useful when an intermediate device requires a delay.

  • COMMAND= string

    In this case, string is not followed by a carriage return (<cr>). This is useful when a device requires slow input. Instead of receiving the whole command string, the device requires characters to be sent one-by-one.

The following example shows a script for an intermediary device that is so slow, it is able to receive and process only one character of the command PPP at a time:

COMMAND=P
NoResponse

COMMAND=P
NoResponse

COMMAND=P
NoResponse

Note

  • To activate a script.inf file, see To activate a logon script.


Responses

A response is sent from the remote device or computer. To write an automatic script, you must know the responses you will receive from the remote device. If a gap of two or more seconds occurs between characters, the received text is sent as a response. This gap is the only cue that a response is over. For more information, see Getting through two-second gaps and large blocks of text.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Response keywords

The keyword in a response line specifies what to do with the responses you receive from the remote computer, as follows:

  • OK=remote computer response<macro>

    The script continues to the next line if the response or macro is encountered.

  • LOOP=remote computer response<macro>

    The script returns to the previous line if the response or macro is encountered.

  • CONNECT=remote computer response<macro>

    Used at the end of a successful modem script. Not generally useful with the Switch.inf file.

  • ERROR=remote computer response<macro>

    Causes Network and Dial-up Connections to display a generic error message if the response is encountered. Useful for notifying you when the remote computer reports a specific error.

  • ERROR_DIAGNOSTICS=remote computer response<diagnostics>

    Causes Network and Dial-up Connections to display the specific cause for an error returned by the device. Not all devices report specific errors. Use ERROR= if your device does not return specific errors that can be identified with Network and Dial-up Connections diagnostics.

  • NoResponse

    Used when no response comes from the remote device.

A connection always expects a response from the remote device and waits until a response is received unless a NoResponse statement follows the COMMAND= line. If there is no statement for a response following a COMMAND= line, the COMMAND= line executes and stops the script at that point.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Macros

Macros are enclosed in angle brackets (<>) and perform a variety of special functions, as follows:

  • <cr>

    Inserts a carriage return.

  • <lf>

    Inserts a line feed.

  • <match> "string"

    Reports a match if the string enclosed in quotation marks is found in the device response. Each character in the string is matched according to upper and lower case. For example, <match> "Smith" matches Jane Smith and John Smith III, but not SMITH.

  • <?>

    Inserts a wildcard character, for example, CO<?><?>2 matches COOL2 or COAT2, but not COOL3.

  • <hXX>

    (XX are hexadecimal digits)

    Allows any hexadecimal character to appear in a string—including the zero byte, <h00>.

  • <ignore>

    Ignores the rest of a response from the macro on.

  • <diagnostics>

    Passes specific error information from a device to Windows 2000 remote access, which displays the specific error to you. Otherwise, a nonspecific error message appears.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Stepping through an example Switch.inf script

This section describes each part of the generic script provided in the Switch.inf file.

Every script must start with a command to the remote computer, followed by one or more response lines. This initial command might be simply to wait for the remote computer to initialize and send its logon banner. The default initial command is to wait two seconds for the logon banner. It appears as follows in the Switch.inf file:

COMMAND=

If the response (the logon banner from the remote computer) is the following:

Welcome to Electronic, Inc. Net. Please enter your login:

then the corresponding response line in the Switch.inf file should be:

OK=<match>"Please enter your login:"

If the remote computer sends the "Please enter your login:" string, then this indicates that everything is correct. You respond by sending a command with the characters in your user name and the carriage return, as follows:

COMMAND=Martha<cr>

If the response from the remote computer is the following:

Please enter your password:

then the corresponding response line in the Switch.inf file should be:

OK=<match>"Please enter your password:"

To send your password, you send the following command:

COMMAND=mUs3naB<cr>

On many PPP computers, this script automatically logs you on.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Getting through two-second gaps and large blocks of text in Switch.inf

If the computer you are connecting to has a two-second gap in the data stream response to your computer, the remote access server assumes that the gap is the end of the response. These gaps can occur anywhere, even between words, and are detected by using modem diagnostics. For more information, see To log and view modem commands.

If you write a script that fails for no apparent reason, you can use modem diagnostics, and then consult systemroot\ModemLog_model.txt to see if a response ends in the middle of a word. Model is the name of the modem as it appears in the list of installed modems in Modem Properties. If a response ends in the middle of a word, your script must account for the two-second gap. A simple way to do this is to include the following command:

COMMAND=<cr>

You can skip to the end of large blocks of text that contain multiple gaps by using the LOOP= keyword and by matching text at the end of a block. For example:

COMMAND=<cr>

OK=<match>"Enter the service to start:"

LOOP=<ignore>

In this example, the network connection sends a null command (waits two seconds). The network connection then waits for the "Enter the service to start:" message. If this is a long block of text, the connection does not find the string. The connection then moves to the LOOP command. The LOOP command causes Network and Dial-up Connections to return to the line above, and the connection waits for the words "Enter the service to start:" in the second response. In this manner, you can loop though long blocks of text until you reach the text of the desired prompt.

For information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Using commands and carriage returns in Switch.inf

In Switch.inf scripts, you usually must include <cr>, which indicates a carriage return, at the end of a command. The carriage return causes the remote computer to process the command immediately. If you do not include <cr>, the remote computer may not recognize the command.

In other situations, you cannot use <cr> because the remote computer accepts a command without a carriage return and requires time to process the command. This situation mainly applies when you are sending a series of commands without expecting a response.

For more information about activating a Switch.inf script, see To activate a logon script. For more information about Switch.inf scripts, see Automating the remote logon process by using Switch.inf scripts.


Troubleshooting logon scripts

With Windows 2000, you can log all information passed between your network connection, the modem, and the remote device, including errors reported by the remote device.

You can view modem commands by enabling logging. After you enable logging, commands sent to the modem are captured in the file systemroot\ModemLog_model.txt. Model is the name of the modem as it appears in the list of installed modems. For instructions about logging modem commands, see To log and view modem commands.


Configuring authentication and data encryption

This section covers:

  • Dial-up connection authentication and data encryption
  • VPN connection authentication and data encryption


Dial-up connection authentication and data encryption

The Typical (recommended settings) security options that you select on the Security tab result in a predefined set of authentication methods and encryption requirements that are negotiated with the server during a PPP exchange.

The following table shows the authentication and data encryption methods that you can use with each combination of Validate my identity as follows and Require data encryption (disconnect if none) selections. You can also view these settings by making your identity validation and data encryption requirement selections in Typical (recommended) settings, and then clicking Settings in Advanced (custom) settings.

You may individually enable, configure, and disable these combinations of security settings by using Advanced (custom settings), but this requires a knowledge of security protocols.

For more information about a specific authentication or data encryption method, click the method in the table. For information about configuring a connection, see To configure a connection.

Validate my identity using | Require data encryption | Authentication methods negotiated | Encryption enforcement
Allow unsecured password | No | PAP, CHAP, SPAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP/TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP/TLS | Require encryption (disconnect if server declines)

Notes

  • Data is only encrypted if MS-CHAP, MS-CHAP v2, or EAP/TLS authentication is negotiated. These are the only authentication protocols that generate their own initial encryption keys, which are required for encryption.
  • Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPP-based dial-up connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported. You can use the 40-bit version worldwide; it is built into every computer running Windows 2000. The 128-bit level of encryption is only available in the United States and Canada. You can enable the 128-bit version by installing a specific version of both client and server software.

Note

  • MS-CHAP v2 and EAP are mutual authentication protocols, which means that both the client and the server prove their identities. If your connection is configured to use either MS-CHAP v2 or EAP as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authentication and simply accept the call. This change ensures that you can configure a connection to connect to the expected server.


VPN connection authentication and data encryption

The Typical (recommended settings) security options that you select on the Security tab result in a predefined set of authentication methods and encryption requirements that are negotiated with the server during a PPP exchange.

The following tables show the authentication and data encryption methods that you can use with each combination of Validate my identity as follows and Require data encryption (disconnect if none) selections. You can also view these settings by making your identity validation and data encryption requirement selections in Typical (recommended settings), and then clicking Settings in Advanced (custom settings).

You may individually enable, configure, and disable these combinations of security settings, by using Advanced (details for all possible settings), but this requires a knowledge of security protocols.

For more information about a specific authentication or data encryption method, click the method in the table. For information about configuring a connection, see To configure a connection.

Point-to-Point Tunneling Protocol (PPTP) or automatic remote access server

Validate my identity using | Require data encryption | Authentication methods negotiated | Encryption enforcement
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP/TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP/TLS | Require encryption (disconnect if server declines)

Layer Two Tunneling Protocol (L2TP) remote access server

Validate my identity using | Require data encryption | Authentication methods negotiated | Encryption enforcement
Require secured password | No | CHAP, MS-CHAP, MS-CHAP v2 | Optional encryption (connect even if no encryption)
Require secured password | Yes | CHAP, MS-CHAP, MS-CHAP v2 | Require encryption (disconnect if server declines)
Smart card | No | EAP/TLS | Optional encryption (connect even if no encryption)
Smart card | Yes | EAP/TLS | Require encryption (disconnect if server declines)

Notes

  • In L2TP VPN connections, data is encrypted by using Internet Protocol security (IPSec).
  • Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPTP VPN connections. Strong (128-bit key) and standard (40-bit key) MPPE encryption schemes are supported. You can use the 40-bit version used worldwide; it is built into every computer running Windows 2000. The 128-bit level of encryption is only available in the United States and Canada. You can enable the 128-bit version by installing a specific version of both client and server software.
  • Data is only encrypted by MPPE if MS-CHAP, MS-CHAP v2, or EAP/TLS authentication is negotiated. These are the only authentication protocols that generate their own initial encryption keys. MPPE requires common client and server keys as generated by these types of authentication.

Note

  • MS-CHAP v2 and EAP/TLS are mutual authentication protocols, which means that both the client and the server prove their identities. If your connection is configured to use either MS-CHAP v2 or EAP/TLS as its only authentication method, and the server that you are connecting to does not provide proof of its identity, your connection disconnects. Previously, servers could skip authenticating themselves to clients and simply accept the call. This change ensures that you can configure a connection to connect to the expected server.


Automating a network or dial-up connection

You can automate the connection process for a network or dial-up connection by using the autodial feature. With autodial enabled, network addresses are mapped to connection destinations, which allows a destination connection to be automatically dialed when a remote resource is referenced.

You can also automate the connection process for any Microsoft client by using a simple batch file and the rasdial command or by using a custom, Windows NT and Windows 2000 application that recognizes remote access.

This section covers:

  • Autodial
  • Rasdial


Autodial

Autodial maps and maintains network addresses to connection destinations, which allows the destinations to be automatically dialed when referenced, whether from an application or from the command prompt. A network address can be an Internet host name, an IP address, or a NetBIOS server name.

The following example describes how autodial works:

  1. You are not connected to your ISP, and you click an Internet address that is embedded in a word processing document.
  2. You are asked to select which connection to use to reach your ISP. The connection you select is dialed, and then you access the Internet address.
  3. The next time you are not connected to your ISP and click the Internet address in the word processing document, the connection that you selected the first time is automatically dialed.

Autodial maps the resources that are required to initially make a connection, but does not map resources once the connection is made.

There are two possibilities when autodial attempts to make a connection:

  • If you are not connected to a network, autodial attempts to create a connection whenever an application references a remote address.

  • If you are connected to a network, autodial attempts to create a connection only for those addresses that it has previously learned. Incorrectly typed server or Internet host names do not cause an autodial attempt.

For more information, see To configure autodial.

Note

  • The autodial feature works only when the Remote Access Auto Connection Manager service is started. For more information, see To start Remote Access Auto Connection Manager.


Rasdial

You can automate the connection process for any Microsoft client by using a simple batch file and the rasdial command. The rasdial command starts a network connection by using a specified entry.

Syntax

rasdial connectionname [username [password | *]] [/domain:domain] [/phone:phonenumber] [/callback:callbacknumber] [/phonebook:phonebookpath] [/prefixsuffix]

The rasdial command disconnects a network connection by using the following syntax:

rasdial [connectionname] /disconnect

Parameters

None
Used without options, rasdial displays the status of current connections.
connectionname
Specifies an entry in the current .pbk file, located in the systemroot\System32\Ras folder. If the connection name contains spaces or special characters, enclose the connection name in quotation marks (").

The Rasphone.pbk file is used unless the Personal Phonebook option is selected. If the Personal Phonebook option is selected, the file username.pbk is used. The name is shown on the Rasphone title bar when Personal Phonebook/p is selected. Numbers are appended if name conflicts occur.

username [password | *]
Specifies a user name and password with which to connect. If an asterisk is used, the user is prompted for the password, but does not display the characters typed.
/domain:domain
Specifies the domain the user account is located in.

If not present, the last value of the Domain field in the Connect To dialog box is used.

/phone:phonenumber
Substitutes the specified phone number for the entry's phone number in Rasphone.pbk.
/callback:callbacknumber
Substitutes the specified callback number for the entry's callback number in Rasphone.pbk.
/disconnect
Disconnects the specified entry.
/phonebook:phonebookpath
Specifies the path to the phonebook file. The default is systemroot\System32\Ras\username.pbk. You can specify a full path to the file.
/prefixsuffix
Applies the current TAPI location dialing settings to the phone number. These settings are configured in Telephony, which is located in Control Panel. This option is off by default.

Rasdial examples

To connect to the OFFICE entry in Rasphone.pbk, type:

rasdial office

To connect to the OFFICE 2 entry in Rasphone.pbk and specify a callback number, type:

rasdial "office 2" /callback:555-0100

To disconnect from the EAST OFFICE entry, type:

rasdial "EAST OFFICE" /d

Note

The following Rasphone.exe features are not supported with rasdial:

  • Entries that require Terminal mode user entry during the dial sequence.
  • Operator-assisted or manual dialing.


Troubleshooting

This section covers:

  • Troubleshooting network and dial-up connections
  • Error messages


Troubleshooting network and dial-up connections

What problem are you having?

The modem does not work.

Cause: The modem is incompatible.

Solution: If you have access to another computer with an Internet connection, check the list of compatible modems in the Microsoft Windows Hardware Compatibility List at the Microsoft Web site.

(http://www.microsoft.com/)

Cause: The modem is not connected properly or is turned off.

Solution: Verify that the modem is connected properly to the correct port on your computer. If the modem is external, verify that the power is on.

See Also: Troubleshooting.

Unable to connect to a remote access server.

Cause: The remote access server is not running.

Solution: Ask your system administrator to verify that the remote access server is running. If the server is down, the administrator needs to check the error and audit logs to see why the service stopped. After the problem is fixed, restart the service. If the service is running, the administrator needs to check whether other remote access clients can connect properly. If other clients can connect, the problem may be specific to your workstation.

Cause: You do not have a valid user account, or you do not have remote access permission.

Solution: Verify with your system administrator that your user account has been established, and that you have remote access permission.

Cause: You dialed the wrong number, or you dialed the correct number but forgot to dial an external line-access number, such as 9.

Solution: Verify that the number is correct as dialed.

Cause: Your modem cannot negotiate with the modem of the server.

Solution: Try using the same type of modem as the server.

Cause: The modem cabling is faulty.

Solution: Do not use the 9-to-25-pin converters that are included with most mouse hardware because some of them do not carry modem signals. To be safe, you should use a converter made especially for this purpose.

Cause: The telephone line (for example, in your hotel room) does not accommodate your modem speed.

Solution: Select a lower bits-per-second (bps) rate (or call the hotel manager to request a direct line).

See also: To change the maximum modem port speed.

Cause: The line you are trying to use is digital.

Solution: Most modems work only with analog phone lines. Verify that you have analog phone lines installed or, if you have digital phone lines installed, verify that the servers and clients have digital modems.

When trying to connect, a message is received that says the remote access server is not responding.

Cause:

  • At higher bits-per-second (bps) rates, your modem is incompatible with the modem of the server.
  • There is a lot of static on the phone line, which prevents a modem from connecting at a higher bps rate.
  • There is some kind of switching equipment between the client and server that prevents the two modems from negotiating at a higher bps rate.

Solution: Adjust the speed of your modem to a lower bit-per-seconds (bps) rate.

See also: To change the maximum modem port speed.

Cause: The remote access server is not running.

Solution: Ask your system administrator to verify that the server is running.

The modem always connect at a lower bits-per-second (bps) rate than specified.

Cause: The modem and telephone line are not operating correctly. Excessive static on the telephone line causes sessions to be dropped.

Solution: You can use modem diagnostics to confirm correct modem operation.

See also: To log and view modem commands.

Cause: The destination server is not running properly.

Solution: Ask your system administrator to verify that the destination server is running properly. Try connecting to the same server from another workstation. If other workstations are having the same problem, there may be problems with server applications or hardware. If not, the problem is specific to your workstation.

Cause: The quality of your line is insufficient.

Solution: Contact your telephone company to verify the quality of your line.

Cause: The line you are dialing is affecting the speed.

Solution: If you can connect to your remote access server by using more than one number, try another number and see if the speed improves.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

The sessions with a remote access server on the network keep getting dropped.

Cause: Call waiting is disrupting your connection.

Solution: Verify that the phone has call waiting. If so, disable call waiting and try calling again.

See also: To change dialing properties for a location.

Cause: The remote access server disconnected you because of inactivity.

Solution: Try calling again.

Cause: Someone picked up the phone. Picking up the phone automatically disconnects you.

Solution: Try calling again.

Cause: Your modem cable is disconnected.

Solution: Verify that the modem cable is connected properly.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

Cause: Your modem settings need to be changed because of a remote access server change.

Solution: Verify the modem settings with your system administrator.

Connections are disconnecting abnormally.

Cause: The remote access server is not running.

Solution: Ask your system administrator to verify that the server is running.

Cause:

  • Your modem is unable to negotiate correctly with the modem of the remote access server.
  • The serial port of the computer cannot keep up with the speed you have selected.

Solution: Try to connect at a lower initial port speed.

See also: To change the maximum modem port speed.

Cause: Your modem software needs to be updated.

Solution: Check with your modem manufacturer for modem software updates.

When trying to connect, a hardware error is received.

Cause: The modem is turned off.

Solution: Verify that the modem is turned on. If the modem is turned off, turn it on and redial.

Cause: Your modem is not functioning properly.

Solution: Enable modem logging to test the connection.

See also: To log and view modem commands.

Cause: Your cable is incompatible.

Solution: If your modem communicates through Terminal, but not through Network and Dial-up Connections, the cable that attaches your modem to the computer is probably incompatible. You need to install a compatible cable.

Conflicts between serial ports are causing connection problems.

Cause: The serial ports are conflicting.

Solution: Com1 and Com3 share interrupt request (IRQ) 4. Com2 and Com4 share IRQ 3. As a result, for serial communications, you cannot use COM1 and COM3 simultaneously, or COM2 and COM4 simultaneously. For example, you cannot use Network and Dial-up Connections on COM1 and Terminal on COM3.

This rule applies if you are using the mouse in addition to other serial communications programs such as Network and Dial-up Connections or the Windows 2000 Terminal program. The rule does not apply if you are using an intelligent serial adapter such as a DigiBoard serial card.

See Also: To configure a connection; To change the COM port for a modem.

When trying to connect by using ISDN, a "No Answer" message is received.

Cause: The remote access server did not answer because it is turned off or the modem is not connected.

Solution: Contact your system administrator.

Cause: The line is busy.

Solution: Try calling later, or contact your system administrator.

Cause: There is a problem with the hardware.

Solution: Verify that the ISDN adapters are installed and configured correctly.

Cause: Your phone number is not configured correctly.

Solution: In some cases, each B channel on an ISDN line has its own number, while in other cases both B channels share a single number. Your telephone company can tell you how many numbers your ISDN line has.

Cause: If you are located in the United States or Canada, your Service Profile Identifier (SPID) is configured incorrectly. The SPID normally consists of the phone number with additional digits added to the beginning, the end, or both. The SPID helps the switch understand what type of equipment is attached to the line and routes calls to appropriate devices on the line. If an ISDN channel requires a SPID, but it is not entered correctly, then the device cannot place or accept calls.

Solution: Verify that the SPID is entered correctly.

Cause: A poor line condition (for example, too much static) interrupted your connection.

Solution: Wait a few minutes and try dialing again.

Cause: You did not enable line-type negotiation, or a connection cannot be made with the line type you selected.

Solution: Enable line-type negotiation.

Cause: Your ISDN switching facility is busy.

Solution: Try again later.

Cause: Your DigiBoard card is too old.

Solution: If you do not have the latest PCIMAC-ISA DigiBoard card, serial number A14308 or greater, contact DigiBoard for a replacement.

Connections made by using X.25 fail.

Cause: The dial-up PAD is configured with the wrong X.3 parameters or serial settings.

Solution: If the remote access server is running and you cannot connect to it directly through an X.25 smart card or an external PAD, modify the dial-up PAD X.3 parameters or serial settings. Ask your system administrator for the correct settings.

See also: To configure a connection.

Cause: New Pad.inf entries are incorrect.

Solution: You can check other Pad.inf entries for direct connections and external PADs, and view the comments that go with them. You may need a line analyzer or a terminal program to see the response for the PAD. For dial-up PAD entries, you can use an entry in Pad.inf as an example, paying attention to the comments that go with the example.

Cause: Your modem is incompatible.

Solution: If the modem that connects to a dial-up PAD connects at a lower speed than it should, replace the modem with a compatible one.

See also: The modem does not work with Network and Dial-up Connections

Cause: The line for the remote access server is congested. If a connection has been established, but the network drives are disconnecting, and you are dropping sessions or getting network errors, the cause may be congestion on the leased line for the remote access server.

For example, four clients connecting at 9600 bps (through dial-up PADs) require a 38,400-bps (four times 9600) leased line on the server end. If the leased line does not have adequate bandwidth, it can cause time-outs and degrade performance for connected clients. This example assumes that Routing and Remote Access is using all the bandwidth. If Routing and Remote Access is sharing the bandwidth, fewer connections can be made.

Solution: Your system administrator needs to verify that the speed of the leased line can support all the COM ports at all speeds clients use to dial in.

Connections through PPTP fail.

Cause: TCP/IP connectivity problems are keeping you from connecting to the PPTP server.

Solution: You or your system administrator can use the ipconfig and ping commands to verify a connection to your server.

Cause: A Winsock Proxy client is active.

Solution: A VPN connection cannot operate with an active Winsock Proxy client. Winsock Proxy immediately redirects packets to the proxy server before they can be processed by a virtual network connection for encapsulation. Ask your system administrator to disable the Winsock Proxy client.

Cause: You do not have the appropriate connection and domain permissions on the remote access server.

Solution: Contact your system administrator.

Cause: If you are using the TCP/IP protocol, you do not have a unique TCP/IP address.

Solution: Contact your system administrator.

Cause: Name resolution problems are keeping you from resolving names to IP addresses.

Solution: Specify fully qualified domain names and IP addresses in your connection.

See Also: To configure TCP/IP settings

Connections made by using PPP or TCP/IP utilities are failing.

Cause: The server does not support LCP extensions.

Solution: If you cannot connect to a server by using PPP, or the remote computer terminates your connection, the server may not support LCP extensions. In Network and Dial-up Connections, clear the Enable LCP extensions check box.

Cause: IP header compression is keeping TCP/IP utilities from running. If you successfully connect to a remote server by using PPP, but TCP/IP utilities do not work, the problem may be IP header compression.

Solution: Try to reconnect after turning off IP header compression.

See Also: To stop requesting LCP extensions in PPP; To turn off IP header compression in PPP.

Connections made by using Internet connection sharing are failing.

Cause: The wrong LAN network adapter is shared.

Solution: A computer with Internet connection sharing needs two connections. One connection, typically a LAN adapter, connects to the computers on the home network and the other connection connects the home network to the Internet. You need to ensure that Internet connection sharing is enabled on the connection that connects your home network to the Internet.

Cause: TCP/IP is not installed on home network computers.

Solution: By default, the TCP/IP protocol is installed on computers running Windows 2000, Windows 98, and Windows NT version 4.0. If users on your home network are running operating systems other than these, verify that TCP/IP is installed on their computers.

Cause: If users on your home network cannot reach the Internet, TCP/IP is incorrectly configured on their home network computers.

Solution: Verify that the following TCP/IP settings are established on home network local area connections:

  • IP Address: Obtain an IP address automatically (through DHCP)
  • DNS server: Obtain DNS server address automatically
  • Default gateways: None specified

For computers running Windows 9x or Windows NT version 4.0, you can find the TCP/IP settings in Network in Control Panel.

Cause: If users on your home network cannot reach the Internet, their Internet options need to be modified.

Solution: Home network user Internet options must be modified for Internet connection sharing. For more information, see To configure Internet options for Internet connection sharing.

Cause: The Internet connection sharing service is not started.

Solution: Use Event Viewer to verify that the Internet connection sharing service is started.

See also: Using Event Viewer.

Cause: The Internet connection sharing computer is not properly configured for name resolution.

Solution: You may need to configure the WINS or DNS name resolution services on the computer. If computers on the small office or home office network cannot resolve names to IP addresses, you can check the name resolution configuration of the Internet connection sharing computer by using the ipconfig command. There are two ways that your ISP can configure name resolution:

  • Statically assigned name servers

    • You must manually configure the TCP/IP protocol with the IP address (or addresses) of the name servers provided by the ISP. If you have statically assigned name servers, you can use the ipconfig command at any time to get the IP addresses of your configured name servers.

  • Dynamically assigned name servers

    • Manual configuration is not required. The IP addresses of the name servers provided by the ISP are dynamically assigned whenever you dial the ISP. If you have dynamically assigned name servers, you must run the ipconfig command after a connection to the ISP has been made.

Cause: If you cannot play a game across the Internet, the protocol used by the application is not translatable.

Solution: Try running the application from the Internet connection sharing computer. If the application works there but not at a workstation on the home network, then the the application may not be translatable.

Cause: If you cannot play a game across the Internet, the application is not configured on the computer running Internet connection sharing.

Solution: Verify that the application, including port numbers, is configured correctly.

See also: To configure Internet connection sharing for applications and services

Cause: If Internet users cannot see services on your home network, such as a Web server, the service is not configured correctly.

Solution: Verify that the service, including port numbers and TCP/IP addresses, is configured correctly.

Cause: If users on your home network cannot reach the Internet sites by using friendly names, there is a DNS resolution problem.

Solution: Have users on your home network use fully qualified domain names or IP addresses when accessing Internet resources.

See Also: To configure Internet connection sharing for applications and services; Internet connection sharing; To configure TCP/IP to use WINS; To configure TCP/IP to use DNS; To test a TCP/IP configuration by using the ping command

When using a local area network connection, there is no response.

Cause: There may be problems with your network adapter.

Solution: Try the following:

  • Check the appearance of the local area connection icon. Depending on the status of the local area connection, the icon appears in different ways in the Network and Dial-up Connections folder. Also, if the local area connection media is disconnected (for example, the cable is unplugged), a status icon is displayed in the taskbar. For more information, see Local area connections.
  • Use Device Manager to verify that your network adapter is working correctly.

Cause: The LAN cable may not be plugged into the network adapter.

Solution: Check to make sure the LAN cable is inserted into the network adapter.

When using a laptop to connect to an ISP, some or all of the applications do not run properly.

Cause: The WinSock Proxy Client may be preventing your applications from running properly when you use the ISP connection.

Solution: If you are a mobile user and use your laptop in your corporate environment, you may need to disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) when you use the same computer to dial to an ISP or other network. For example, if you use a laptop in your office and use the same computer to connect to an ISP or other network from your home, you may have problems running all of your applications when you use the ISP connection. (For example, your applications may not be able to find the resources or servers they need.) If this is the case, you should disable the Microsoft WinSock Proxy Client (WSP Client in Control Panel) to run the applications that you typically run when you use your laptop in the corporate office.

Incoming connection clients cannot see resources beyond the incoming connection computer.

Cause: If the addresses that are being allocated to incoming clients are not a subset of the network to which the incoming connection computer is attached, you must create a route to the incoming client computers on the intranet computers.

Solution: Reconfigure your range of IP addresses that are being allocated to incoming clients so that it is a subset of the network to which the incoming connections computer is attached. If you cannot do this, then configure your intranet hosts with the IP address of the incoming connections computer as a default gateway.

  • If your intranet hosts are configured to obtain an IP address automatically and a Dynamic Host Configuration Protocol (DHCP) server is present, you can configure your DHCP server to assign the default gateway.
  • If your intranet hosts are configured to obtain an IP address automatically and a DHCP server is not present (you are using the Automatic Private IP Addressing feature of Windows 2000 and Windows 98), then you must manually configure all of your intranet hosts with an IP address, subnet mask, and default gateway.

See Also: To configure a default gateway, Incoming connections and IP addresses.

Cause: The calculated range of addresses allocated to connecting clients is larger than the range that you configured.

Solution: Most TCP/IP networks use subnets in order to effectively manage routed IP addresses. For the range that you specified in From and To, Windows 2000 calculates the closest matching subnet. The range of addresses in the closest matching subnet may exceed the range that you specified. Unless the addresses specified in From and To are subnet boundaries, the range based on the calculated subnet will be larger than the range that you specified. To avoid this, specify a range that falls on subnet boundaries. For example, if you are using the 10.0.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 10.0.1.168 to 10.0.1.175. Or, if you are using the 192.168.0.0 private network ID for your intranet, a range that falls on subnet boundaries is 192.168.1.0 to 192.168.1.255.

See Also: To configure an incoming connection to use TCP/IP.


Error messages.

You may receive one or more of the following errors when you use Network and Dial-up Connections. To see more information about an error, click the error.

600 An operation is pending.

601 An invalid port handle was detected.

602 The specified port is already open.

603 The caller's buffer is too small.

604 Incorrect information was specified.

605 The port information cannot be set.

606 The specified port is not connected.

607 An invalid event is detected.

608 A device was specified that does not exist.

609 The device type was specified that does not exist.

610 An invalid buffer was specified.

611 A route was specified that is not available.

612 A route was specified that is not allocated.

613 An invalid compression was specified.

614 There were insufficient buffers available.

615 The specified port was not found.

616 An asynchronous request is pending.

617 The modem is already disconnecting.

618 The specified port is not open.

619 The specified port is not connected.

620 No endpoints could be determined.

621 The system could not open the phonebook.

622 The system could not load the phonebook.

623 The system could not find the phonebook entry for this connection.

624 The system could not update the phonebook file.

625 The system found invalid information in the phonebook.

626 A string could not be loaded.

627 A key could not be found.

628 The connection was closed.

629 The connection was closed by the remote computer.

630 The modem was disconnected due to hardware failure.

631 The user disconnected the modem.

632 An incorrect structure size was detected.

633 The modem is already in use or is not configured for dialing out.

634 Your computer could not be registered on the remote network.

635 There was an unknown error.

636 The device attached to the port is not the one expected.

637 A string was detected that could not be converted.

638 The request has timed out.

639 No asynchronous net is available.

640 A error has occurred involving NetBIOS.

641 The server cannot allocate NetBIOS resources needed to support the client.

642 One of your computer's NetBIOS names is already registered on the remote network.

643 A network adapter at the server failed.

644 You will not receive network message popups.

645 There was an internal authentication error.

646 The account is not permitted to log on at this time of day.

647 The account is disabled.

648 The password for this account has expired.

649 The account does not have permission to dial in.

650 The remote access server is not responding.

651 The modem has reported an error.

652 There was an unrecognized response from the modem.

653 A macro required by the modem was not found in the device .INF file section.

654 A command or response in the device .INF file section refers to an undefined macro.

655 The <MESSAGE> macro was not found in the device .INF file section.

656 The <DEFAULTOFF> macro in the device .INF file section contains an undefined macro.

657 The device .INF file could not be opened.

658 The device name in the device .INF or media .INI file is too long.

659 The media .INI file refers to an unknown device name.

660 The device .INF file contains no responses for the command.

661 The device .INF file is missing a command.

662 there was an attempt to set a macro not listed in the device .INF file section.

663 The media .INI file refers to an unknown device type.

664 The system has run out of memory.

665 The modem is not properly configured.

666 The modem is not functioning.

667 The system was unable to read the media .INI file.

668 The connection was terminated.

669 The usage parameter in the media .INI file is invalid.

670 The system was unable to read the section name from the media .INI file.

671 The system was unable to read the device type from the media .INI file.

672 The system was unable to read the device name from the media .INI file.

673 The system was unable to read the usage from the media .INI file.

674 The system was unable to read the maximum connection BPS rate from the media .INI file.

675 The system was unable to read the maximum carrier connection speed from the media .INI file.

676 The phone line is busy.

677 A person answered instead of a modem.

678 There was no answer.

679 The system could not detect the carrier.

680 There was no dial tone.

681 The modem reported a general error.

691 Access was denied because the user name and/or password was invalid on the domain.

692 There was a hardware failure in the modem.

695 The state machines are not started.

696 The state machines are already started.

697 The response looping did not complete.

699 The modem response caused a buffer overflow.

700 The expanded command in the device .INF file is too long.

701 The modem moved to a connection speed not supported by the COM driver.

703 The connection needs information from you, but the application does not allow user interaction.

704 The callback number is invalid.

705 The authorization state is invalid.

707 There was an error related to the X.25 protocol.

708 The account has expired.

709 There was an error changing the password on the domain. The password might have been too short or might have matched a previously used password.

710 Serial overrun errors were detected while communicating with the modem.

711 The Remote Access Service Manager could not start. Additional information is provided in the event log.

712 The two-way port is initializing. Wait a few seconds and redial.

713 No active ISDN lines are available.

714 No ISDN channels are available to make the call.

715 Too many errors occurred because of poor phone line quality.

716 The remote access service IP configuration is unusable.

717 No IP addresses are available in the static pool of remote access service IP addresses.

718 The connection timed out waiting for a valid response from the remote computer.

719 The connection was terminated by the remote computer.

720 The connection attempt failed because your computer and the remote computer could not agree on PPP control protocols.

721 The remote computer is not responding.

722 Invalid data was received from the remote computer. This data was ignored.

723 The phone number, including prefix and suffix, is too long.

726 The IPX protocol cannot be used for dial-out on more than one modem at a time.

728 The system cannot find an IP adapter.

729 SLIP cannot be used unless the IP protocol is installed.

731 The protocol is not configured.

732 Your computer and the remote computer could not agree on PPP control protocols.

733 Your computer and the remote computer could not agree on PPP control protocols.

734 The PPP link control protocol was terminated.

735 The requested address was rejected by the server.

736 The remote computer terminated the control protocol.

737 Loopback detected.

738 The server did not assign an address.

739 The authentication protocol required by the remote server cannot use the stored password. Redial, entering the password explicitly.

740 An invalid dialing rule was detected.

741 The local computer does not support the required data encryption type.

742 The remote computer does not support the required data encryption type.

743 The remote server requires data encryption.

751 The callback number contains an invalid character. Only the following characters are allowed: 0 to 9, T, P, W, (,), -, @, and space.

752 A syntax error was encountered while processing a script.

753 The connection could not be disconnected because it was created by the multi-protocol router.

754 The system could not find the multi-link bundle.

755 The system cannot perform automated dial because this entry has a custom dialer specified.

756 This connection is already being dialed.

757 Remote access services could not be started automatically. Additional information is provided in the event log.

758 Internet connection sharing is already enabled on the connection.

760 An error occurred while routing capabilities were being enabled.

761 An error occurred while Internet connection sharing was being enabled for the connection.

763 Internet connection sharing cannot be enabled. There are two or more LAN connections in addition to the connection to be shared.

764 No smart card reader is installed.

765 Internet connection sharing cannot be enabled. A LAN connection is already configured with the IP address required for automatic IP addressing.

766 The system could not find any certificate.

767 Internet connection sharing cannot be enabled. The LAN connection selected on the private network has more than one IP address configured. Reconfigure the LAN connection with a single IP address before enabling Internet connection sharing.

768 The connection attempt failed because of failure to encrypt data.

769 The specified destination is not reachable.

770 The remote machine rejected the connection attempt.

771 The connection attempt failed because the network is busy.

772 The remote computer's network hardware is incompatible with the type of call requested.

773 The connection attempt failed because the destination number has changed.

774 The connection attempt failed because of a temporary failure. Try connecting again.

775 The call was blocked by the remote computer.

776 The call could not be connected because the destination has invoked the Do Not Disturb feature.

777 The connection attempt failed because the modem on the remote computer is out of order.

778 It was not possible to verify the identity of the server.

779 To dial out using this connection, you must use a smart card.

780 An attempted function is not valid for this connection.

781 The encryption attempt failed because no valid certificate was found.


The modem does not work with Network and Dial-up Connections

If you have access to another computer with an Internet connection, check the list of compatible modems in the Microsoft Windows Hardware Compatibility List at the Microsoft Web site.

(http://www.microsoft.com/)

If the modem appears on the list, verify that the modem is connected properly to the correct port on your computer. If the modem is external, verify that the power is on.

For additional modem troubleshooting information, see Troubleshooting.


Contact Parallel Technologies or a local dealer to order Direct Cable Connection cables

To contact Parallel Technologies to order Direct Cable Connection cables

  • Do any of the following:
    • Phone

      Inside the United States: (800) 789-4784

      Outside the United States: (425) 869-1119

    • Internet

      Parallel Technologies Web site

      (http://www.lpt.com/)
    • E-mail

      sales@lpt.com

      Compuserve e-mail 71612,3466

    • Find your local dealer

      Inside or outside the United States (425) 869-1119

Note


Configure a default gateway

To configure a default gateway

  1. Open Network and Dial-up Connections.
  2. Right-click Local Area Connection, and then click Properties.
  3. Click Internet Protocol (TCP/IP), and then click Properties
    4. .
  4. In Default gateway, type the IP address of the intranet interface for the incoming connection.

Notes

  • If you currently have TCP/IP configured to obtain an IP address automatically, you must manually configure a TCP/IP address and subnet mask in order to configure a default gateway.

Related Topics