PPTP authentication problems

I have setup a Win2008 server with RRAS and want to get a PPTP VPN working.
This seems to be pretty straightforward but whenever I try to connect I get
an error that the authentication timed out. The initial connection to the
server is successful however. Is there anything special I need to do to make
the auth happen or should it 'just work'? The server is not in a domain so I
assume local accounts that have been allowed dial-in access should be able to
authenticate. Thanks.

I am not sure the issue. Can you establish the VPN but not access the
resources? Or when trying to establish the VPN, your username or password is
denied? Any errors in the Event Viewer?

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"phavel" <(E-Mail Removed)> wrote in message
newsB726B57-F6F3-4720-9362-(E-Mail Removed)...
>I have setup a Win2008 server with RRAS and want to get a PPTP VPN working.
> This seems to be pretty straightforward but whenever I try to connect I
> get
> an error that the authentication timed out. The initial connection to the
> server is successful however. Is there anything special I need to do to
> make
> the auth happen or should it 'just work'? The server is not in a domain
> so I
> assume local accounts that have been allowed dial-in access should be able
> to
> authenticate. Thanks.

The initial connection is made to the server but then the process times out
trying to authenticate. The actual VPN is never established. One thing I
neglected to mention is that the RRAS server is a virtual running in a
Hyper-V environment, I would think this would not matter but unsure.

I also tried creating a Win2003 virtual in the same environment and
witnessed the same behavior. There was an event 20209 logged however and the
details of it are below. A firewall or some type of filtering is the first
thing I thought of also, but there is a working PPTP VPN on this same network
(different domain) behind the same ISP. All Windows firewalls have been
turned off. I just want to see if there is anything special needed to make
authentication work or if folks had other ideas. Thanks.

Event Type: Warning
Event Source: Rasman
Event Category: None
Event ID: 20209
Date: 8/3/2008
Time: 2:24:39 PM
User: N/A
Computer: LBE-7374BB142F7
Description:
A connection between the VPN server and the VPN client 75.88.96.66 has been
established, but the VPN connection cannot be completed. The most common
cause for this is that a firewall or router between the VPN server and the
VPN client is not configured to allow Generic Routing Encapsulation (GRE)
packets (protocol 47). Verify that the firewalls and routers between your VPN
server and the Internet allow GRE packets. Make sure the firewalls and
routers on the user's network are also configured to allow GRE packets. If
the problem persists, have the user contact the Internet service provider
(ISP) to determine whether the ISP might be blocking GRE packets.


"Robert L. (MS-MVP)" wrote:

> I am not sure the issue. Can you establish the VPN but not access the
> resources? Or when trying to establish the VPN, your username or password is
> denied? Any errors in the Event Viewer?
>
> --
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on
> http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on
> http://www.HowToNetworking.com
> "phavel" <(E-Mail Removed)> wrote in message
> newsB726B57-F6F3-4720-9362-(E-Mail Removed)...
> >I have setup a Win2008 server with RRAS and want to get a PPTP VPN working.
> > This seems to be pretty straightforward but whenever I try to connect I
> > get
> > an error that the authentication timed out. The initial connection to the
> > server is successful however. Is there anything special I need to do to
> > make
> > the auth happen or should it 'just work'? The server is not in a domain
> > so I
> > assume local accounts that have been allowed dial-in access should be able
> > to
> > authenticate. Thanks.
>
>

Is the VPN client using MS-Chap V1? I don't think think this is supported in
Server 2008? It could also be an issue with port forwarding on the router.

--
Kerry Brown
MS-MVP - Windows Desktop Experience: Systems Administration
http://www.vistahelp.ca/phpBB2/
http://vistahelpca.blogspot.com/




"phavel" <(E-Mail Removed)> wrote in message
newsB726B57-F6F3-4720-9362-(E-Mail Removed)...
>I have setup a Win2008 server with RRAS and want to get a PPTP VPN working.
> This seems to be pretty straightforward but whenever I try to connect I
> get
> an error that the authentication timed out. The initial connection to the
> server is successful however. Is there anything special I need to do to
> make
> the auth happen or should it 'just work'? The server is not in a domain
> so I
> assume local accounts that have been allowed dial-in access should be able
> to
> authenticate. Thanks.

This could be GRE issue. This search result may help.
Event ID 20209
Event ID 20209 - A connection between the VPN server and the VPN
client has been established, but the VPN connection cannot be completed. ...
http://www.chicagotech.net/troublesh...entid20209.htm


--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"phavel" <(E-Mail Removed)> wrote in message
news:C6D729B3-4F6B-473F-B2B9-(E-Mail Removed)...
> The initial connection is made to the server but then the process times
> out
> trying to authenticate. The actual VPN is never established. One thing I
> neglected to mention is that the RRAS server is a virtual running in a
> Hyper-V environment, I would think this would not matter but unsure.
>
> I also tried creating a Win2003 virtual in the same environment and
> witnessed the same behavior. There was an event 20209 logged however and
> the
> details of it are below. A firewall or some type of filtering is the
> first
> thing I thought of also, but there is a working PPTP VPN on this same
> network
> (different domain) behind the same ISP. All Windows firewalls have been
> turned off. I just want to see if there is anything special needed to
> make
> authentication work or if folks had other ideas. Thanks.
>
> Event Type: Warning
> Event Source: Rasman
> Event Category: None
> Event ID: 20209
> Date: 8/3/2008
> Time: 2:24:39 PM
> User: N/A
> Computer: LBE-7374BB142F7
> Description:
> A connection between the VPN server and the VPN client 75.88.96.66 has
> been
> established, but the VPN connection cannot be completed. The most common
> cause for this is that a firewall or router between the VPN server and the
> VPN client is not configured to allow Generic Routing Encapsulation (GRE)
> packets (protocol 47). Verify that the firewalls and routers between your
> VPN
> server and the Internet allow GRE packets. Make sure the firewalls and
> routers on the user's network are also configured to allow GRE packets. If
> the problem persists, have the user contact the Internet service provider
> (ISP) to determine whether the ISP might be blocking GRE packets.
>
>
> "Robert L. (MS-MVP)" wrote:
>
>> I am not sure the issue. Can you establish the VPN but not access the
>> resources? Or when trying to establish the VPN, your username or password
>> is
>> denied? Any errors in the Event Viewer?
>>
>> --
>> Bob Lin, MS-MVP, MCSE & CNE
>> Networking, Internet, Routing, VPN Troubleshooting on
>> http://www.ChicagoTech.net
>> How to Setup Windows, Network, VPN & Remote Access on
>> http://www.HowToNetworking.com
>> "phavel" <(E-Mail Removed)> wrote in message
>> newsB726B57-F6F3-4720-9362-(E-Mail Removed)...
>> >I have setup a Win2008 server with RRAS and want to get a PPTP VPN
>> >working.
>> > This seems to be pretty straightforward but whenever I try to connect I
>> > get
>> > an error that the authentication timed out. The initial connection to
>> > the
>> > server is successful however. Is there anything special I need to do
>> > to
>> > make
>> > the auth happen or should it 'just work'? The server is not in a
>> > domain
>> > so I
>> > assume local accounts that have been allowed dial-in access should be
>> > able
>> > to
>> > authenticate. Thanks.
>>
>>