When computers with changing IP addresses dial in, the identity of the remote site is unknown when the IKE negotiation (phase 1) begins. The communication relies on default values for IKE proposal lists and IKE proposal groups. During negotiation, the identity is communicated and this is used to determine the parameters for phase 2 (IPsec proposal list and PFS group). For this to occur, every single user must be entered individually into the VPN router configuration.
With certificate-based RAS, the identity is communicated via the certificate. To avoid having to make individual user entries in the router configuration, common parameters for phase 2 can be defined for all users who are identified by certificate. All the user requires for simplified RAS is a valid certificate with a signature from the publisher of the root certificate in the device. Moreover, the parameters used by the client during dial in must agree with the default values in the VPN router.
To configure the simplified dial-in in LANconfig, enable the option . If necessary, the default parameters can be found under .
