Windows Vista: changes in ISAKMP

Unanswered Question
Jan 30th, 2008
User Badges:

Has anybody experienced problems with Windows Vista? We have hundreds of customers which successfully connect to our Cisco router from Windows XP. They manually (via wizard) create VPN-connection using their login, pswd and preshared key (all other settings are set to defaults). Router is configured to use transport mode, l2tp, 3DES, MD5, DH group 2, and a preshared key. But when they try to establish the same VPN-connection on Vista they most often get error 789 (negotiation failed). May be there is some new policy or enabled option which affects ISAKMP in Windows Vista?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
yuri.volkov Fri, 02/01/2008 - 03:49
User Badges:

The problem proved to be simple: we had only one ISAKMP policy (encryption: 3DES, hash: MD5) and it was o.k. with Windows XP. But in Windows Vista MD5 is removed. Though it's possible to get back MD5 by editing registry of operating system, we just added another ISAKMP policy with "Secure Hash Standard" istead of "Message Digest 5" as hash algorithm.

For more details see: http://blogs.technet.com/rrasblog/archive/2006/11/01/vista-lh-security-changes-for-remote-access-scenarios.aspx

Actions

This Discussion