It's easier to connect Windows 7 machines to each other via a HomeGroup, so
leave that on, it does not affect the WORKGROUP networking.
When the Windows 7 machines are ok, then from the XP machines, in My Network Places, set up a home or small office network.
Yes, use the existing connection for this computers internet access (recommended)
Add a computer description is optional
Change the workgroup name from the ubiquitous MSHOME to WORKGROUP, or whatever you call it.
Turn on file and printer sharing (this configures your firewall, you do not have to worry about rules and permissions here)
The network setup wizard then applies the settings via "Unknown Internet Connection Sharing".
On the next screen pcs go walkabouts and your XP windows firewall goes "pop" once.
Then just finish the wizard.
Your XP machine should then see the windows 7 shared folders etc.
Back to the Win7 machine Control Panel HomeGroup, Change HomeGroup Settings, Change advanced sharing settings...
Home or Work (current profile)
Turn on network discovery
Turn on file and printer sharing
Turn on sharing so anyone with network access... (or not if you wish)
Media streaming...
128-bit encryption should be no problem
Turn off password protected sharing (just for now)
Allow Windows to manage homegroup (sic!) connections (recommended)
!!!I just hate it when Microsoft is inconsistent with CamelCaps!!!
Then repeat all that for Public
Finally Save changes
All should finally be connected.
I have 2 work networked laptops that each multiboot 3 ways into Windows 7, XP and Linux Ubuntu/Mint. Linux is a breeze whichever way it connects - just network - workgroup - computer - shared folders, username/password into computer if required.
I did apply one firewall rule on the Windows 7 machine before I realized how straightforward it was.
I called it xpworkgroup, with 2 endpoints of the entire subnet, any port, any protocol, any profile, Requests inbound and out authenticated by the computer (Kerberos) Anonymous, no second method of authentication, no tunnelling, All interface types, no authorization or exempt IPsec protected connections.