Microsoft KB Archive/926179

= How to configure an L2TP/IPsec server behind a NAT-T device in Windows Vista and in Windows Server &quot;Longhorn&quot; =

Article ID: 926179

Article Last Modified on 3/15/2007

-

APPLIES TO


 * Windows Vista Business
 * Windows Vista Enterprise
 * Windows Vista Home Premium
 * Windows Vista Home Basic
 * Windows Vista Ultimate
 * Windows Vista Enterprise 64-bit edition
 * Microsoft Windows Server &quot;Longhorn&quot; Beta 1

-



Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry



INTRODUCTION
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

By default, Windows Vista and the Microsoft Windows Server Code Name &quot;Longhorn&quot; operating system do not support Internet Protocol security (IPsec) network address translation (NAT) Traversal (NAT-T) security associations to servers that are located behind a NAT device. Therefore, if the virtual private network (VPN) server is behind a NAT device, a Windows Vista-based VPN client computer or a Windows Server &quot;Longhorn&quot;-based VPN client computer cannot make a Layer Two Tunneling Protocol (L2TP)/IPsec connection to the VPN server. This scenario includes VPN servers that are running Windows Server &quot;Longhorn&quot; and Microsoft Windows Server 2003.

Because of the way in which NAT devices translate network traffic, you may experience unexpected results when you put a server behind a NAT device and then use an IPsec NAT-T environment. Therefore, if you must have IPsec for communication, we recommend that you use public IP addresses for all servers that you can connect to from the Internet. However, if you have to put a server behind a NAT device and then use an IPsec NAT-T environment, you can enable communication by changing a registry value on the VPN client computer and the VPN server.

To create and configure the  registry value, follow these steps:  Log on to the Windows Vista client computer as a user who is a member of the Administrators group. Click Start, point to All Programs, click Accessories, click Run, type regedit, and then click OK. If the User Account Control dialog box is displayed on the screen and prompts you to elevate your administrator token, click Continue. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent

Note You can also apply the  DWORD value to a Microsoft Windows XP Service Pack 2 (SP2)-based VPN client computer. To do this, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec

 On the Edit menu, point to New, and then click DWORD (32-bit) Value. Type AssumeUDPEncapsulationContextOnSendRule, and then press ENTER. Right-click AssumeUDPEncapsulationContextOnSendRule, and then click Modify. In the Value Data box, type one of the following values: <ul>  0

A value of 0 (zero) configures Windows so that it cannot establish security associations with servers that are located behind NAT devices. This is the default value.</li>  1

A value of 1 configures Windows so that it can establish security associations with servers that are located behind NAT devices.</li>  2

A value of 2 configures Windows so that it can establish security associations when both the server and the Windows Vista-based or Microsoft Windows Server Code Name &quot;Longhorn&quot;-based VPN client computer are behind NAT devices.</li></ul> </li> Click OK, and then exit Registry Editor.</li> Restart the computer.</li></ol>

<div class="moreinformation_section">

MORE INFORMATION
For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

818043 L2TP/IPsec NAT-T update for Windows XP and Windows 2000

885348 IPSec NAT-T is not recommended for Windows Server 2003 computers that are behind network address translators

Keywords: kbinfo kbhowto KB926179

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.