Bạn có thể sử dụng một phương pháp khác cho L2TP/IPSec xác thực được biết đến như một chìa khóa chia sẻ trước, mà có thể được sử dụng thay cho giấy chứng nhận nếu giấy chứng nhận dịch vụ không có sẵn, nhưng phương pháp này chỉ là tối thiểu hỗ trợ bởi các hệ thống điều hành của Microsoft | 70 PART II VPN Deployment Security EAP-TLS authentication protocol you can use either a user certificate or a smart card. You can use another method for L2TP IPSec authentication known as a presbared key which can be used in place of certificates if certificate services are not available but this method is only minimally supported by Microsoft operating systems because of security issues inherent with preshared keys. Microsoft recommends the use of certificates for all IPSec-enabled communications including L2TP IPSec. For user certificate-based authentication if a company has not deployed the Microsoft Active Directory directory service the computer user must request a user certificate from a Windows Server 2003 certificate authority CA on the company intranet. If the company has a deployment of Active Directory on Windows Server 2003 users can be automatically configured with certificates upon logon to the system by using the new auto-enrollment CA features of Windows Server 2003. For smart card-based authentication a network administrator must configure an enrollment station and issue smart cards with certificates that are mapped to individual user accounts. The use of smart cards is an excellent idea if you want to have two-factor authentication for all users. By using two-factor authentication you can maintain security much more easily because a hacker cannot break in if he discovers one of the factors. The hacker would need to have the smart card and the personal identification number PIN to activate the smart card. Only the actual user in physical possession of the smart card can provide both of those items. For more information about installing certificates on VPN client computers see the Certificate Infrastructure section in this chapter. Design Point Configuring the VPN Client If the following criteria match your situation we can make certain recommendations for the deployment of your VPN clients. When configuring your VPN clients for remote access VPN .
