VPN - L2TP over IPSec Certificate Issues

[grnfvr]

I have successfully set up PPTP VPN. I now want to set up the more secure L2TP over IPSec. Its my understanding that i need a "computer certificate" on both the VPN server and client. I had no problem installing certificate services and configuring a Certificate Authority on my domain controller at home. So my VPN server has a personal (local computer) certificate from my CA at home. I followed the Win2k online documentation in this process.

My problem is now how to get a computer certificate on my machine at work. I know the domain my computer is a member of does not have a CA. There is a domain in my domain forest that may have a CA. I do have the ability to join the domain, but i do not then have the privelages to add the certificate management add-in for the local computer in the MMC, so that i can request a computer certificate.

My question is do i have any options here? Is there a way to get a certificate from my CA at home. If there is a way, will that enable me to move forward with IPSec?

Thanks for the help,
Matt

 

[grnfvr]

can anybody help on this?

 

[scottcm]

I haven't tried what you're doing but even if you get the certificate installed I think you're going to have problems. First, the certificate didn't come from a CA that W2K trusts. Second, if the work computer attempts to contact the cert's revocation list it probably won't be able to. Third, both computers need a certificate not just your work computer.

As for your specific problem of insufficient privilages: you need admin rights most likely. If you're not an admin and you're doing this on your work network then do your NT and Security admins a favor and stop Otherwise, I'm pretty sure MS technet (

http://www.microsoft.com/technet)

has details on how to do this.

 

[grnfvr]

Actually, I have full administrative rights to the domain which my work comp is currently a part of. But that domain does not have a CA. There is another domain in our domain forest that i think has a CA, but i do not have administrative rights on that domain. Not that a certificate from the other domains CA will do me any good neccessarily.

my question is do i have to get certificates from the same CA on both the comp at work and the VPN server at home? I don't know enough about certificates or ipsec to know what my options are.

if i understand it right, ipsec is what needs a certificate in order to encode (on sender) and decode (on reciever) packets. again i don't know if the certificates have to be from the same CA. somehow i doubt this because the whole idea is to join remote machines to networks. how in the world does a machine in New York get a certificate from a domain in LA unless they are WANed or the machine is taken to LA?