Sometimes it works sometimes it doesn't (VPN data issues)

I am running a windows2k3 SBS server behind a linksys firewall. I
have about three users that I would like to connect remotely using the
built in windows VPN. I have followed the recomended steps, made sure
the proper ports are opened, the server is configured correctly, and
everything seemed to be running perfectly.

Over the last few months, I've had numerous complaints about the
remote users having troubles connecting to our network. Aparently
they all can connect without an issue and work properly about 35% of
the time, but the rest, they time out waiting to verify user name and
password.

I figured this was a firewall issue blocking VPN data, but the problem
is that the firewall has been set to allow the proper ports open and
I've verified that it is indeed true (I"ve even switched firewalls,
but no luck).

The funny thing is that if I get the user to try and connect multiple
times as quick as possible by clicking cancel quickly after they see
the connection will stall and then starting the connection process
over, they can eventally connect in, but I"m sure this is exploiting
some bug as a potential security breach and either way, it is not an
efficient way to connect.

I also noticed that there are times when connected to the VPN that it
will timeout. What I mean is that the connection will still show as
active, but the data connection is effectively terminated and the
remote user is forced to disconnect and reconnect.

I have been playing around with this VPN problem at my house (with a
netgear router) and I"ve noticed that there are times I can connect
without an issue and other times it does not let me in, and about 1/2
the time I can't get in (even with the reconnect trick) I can unplug
my router at home, let it reset and then I can connect to the VPN.
While this is anoying, I have access to my router and can reset it,
but this same problem happens for users from hotels or other internet
connections where they don't have physical access to the router or its
settings.

I was under the impression that the intergrated VPN solution from MS
was a nice simple tool that was easily implimented. I have been very
pleased with it up until this point, but the data connection troubles
are getting to the point where I"m going to be forced to buy some
external VPN solution to make sure my users can always connect to our
business network.

Does anyone have an idea on what my problem is, I feel like my problem
is on the remote side, but it seems independant of all hardware/ISPs
so I"m thinking there must be some setting to change off the defaults
to allow the VPN to work without getting filtered on the remote side.

Your help is much appreciated.

Thanks,
Andrew

What's the error code? assuming it is 721 or 800, I would check if there is firmware for the router/firewall. Or this ink may help,

Case Studies - VPN error 721 and 800Troubleshooting: Upgrading the firmware fixes the problem. Note: you may need to re-set the router. Case 2: When a user attempts to access the Windows VPN ...
www.chicagotech.net/VPN/vpncase800.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
<(E-Mail Removed)> wrote in message news:(E-Mail Removed) ups.com...
I am running a windows2k3 SBS server behind a linksys firewall. I
have about three users that I would like to connect remotely using the
built in windows VPN. I have followed the recomended steps, made sure
the proper ports are opened, the server is configured correctly, and
everything seemed to be running perfectly.

Over the last few months, I've had numerous complaints about the
remote users having troubles connecting to our network. Aparently
they all can connect without an issue and work properly about 35% of
the time, but the rest, they time out waiting to verify user name and
password.

I figured this was a firewall issue blocking VPN data, but the problem
is that the firewall has been set to allow the proper ports open and
I've verified that it is indeed true (I"ve even switched firewalls,
but no luck).

The funny thing is that if I get the user to try and connect multiple
times as quick as possible by clicking cancel quickly after they see
the connection will stall and then starting the connection process
over, they can eventally connect in, but I"m sure this is exploiting
some bug as a potential security breach and either way, it is not an
efficient way to connect.

I also noticed that there are times when connected to the VPN that it
will timeout. What I mean is that the connection will still show as
active, but the data connection is effectively terminated and the
remote user is forced to disconnect and reconnect.

I have been playing around with this VPN problem at my house (with a
netgear router) and I"ve noticed that there are times I can connect
without an issue and other times it does not let me in, and about 1/2
the time I can't get in (even with the reconnect trick) I can unplug
my router at home, let it reset and then I can connect to the VPN.
While this is anoying, I have access to my router and can reset it,
but this same problem happens for users from hotels or other internet
connections where they don't have physical access to the router or its
settings.

I was under the impression that the intergrated VPN solution from MS
was a nice simple tool that was easily implimented. I have been very
pleased with it up until this point, but the data connection troubles
are getting to the point where I"m going to be forced to buy some
external VPN solution to make sure my users can always connect to our
business network.

Does anyone have an idea on what my problem is, I feel like my problem
is on the remote side, but it seems independant of all hardware/ISPs
so I"m thinking there must be some setting to change off the defaults
to allow the VPN to work without getting filtered on the remote side.

Your help is much appreciated.

Thanks,
Andrew

In news:(E-Mail Removed) ups.com,
(E-Mail Removed) <(E-Mail Removed)> typed:
> I am running a windows2k3 SBS server behind a linksys firewall. I
> have about three users that I would like to connect remotely using the
> built in windows VPN. I have followed the recomended steps, made sure
> the proper ports are opened, the server is configured correctly, and
> everything seemed to be running perfectly.
>
> Over the last few months, I've had numerous complaints about the
> remote users having troubles connecting to our network. Aparently
> they all can connect without an issue and work properly about 35% of
> the time, but the rest, they time out waiting to verify user name and
> password.
>
> I figured this was a firewall issue blocking VPN data, but the problem
> is that the firewall has been set to allow the proper ports open and
> I've verified that it is indeed true (I"ve even switched firewalls,
> but no luck).
>
> The funny thing is that if I get the user to try and connect multiple
> times as quick as possible by clicking cancel quickly after they see
> the connection will stall and then starting the connection process
> over, they can eventally connect in, but I"m sure this is exploiting
> some bug as a potential security breach and either way, it is not an
> efficient way to connect.
>
> I also noticed that there are times when connected to the VPN that it
> will timeout. What I mean is that the connection will still show as
> active, but the data connection is effectively terminated and the
> remote user is forced to disconnect and reconnect.
>
> I have been playing around with this VPN problem at my house (with a
> netgear router) and I"ve noticed that there are times I can connect
> without an issue and other times it does not let me in, and about 1/2
> the time I can't get in (even with the reconnect trick) I can unplug
> my router at home, let it reset and then I can connect to the VPN.
> While this is anoying, I have access to my router and can reset it,
> but this same problem happens for users from hotels or other internet
> connections where they don't have physical access to the router or its
> settings.
>
> I was under the impression that the intergrated VPN solution from MS
> was a nice simple tool that was easily implimented. I have been very
> pleased with it up until this point, but the data connection troubles
> are getting to the point where I"m going to be forced to buy some
> external VPN solution to make sure my users can always connect to our
> business network.
>
> Does anyone have an idea on what my problem is, I feel like my problem
> is on the remote side, but it seems independant of all hardware/ISPs
> so I"m thinking there must be some setting to change off the defaults
> to allow the VPN to work without getting filtered on the remote side.
>
> Your help is much appreciated.
>
> Thanks,
> Andrew

Two portrs need to be open to allow PPTP:
TCP 1723 (which is GRE)
Protocol ID #47 (not really a port, but rather a Protocol #)

Protocol ID #47 on a Linksys can be opened up by stipulating allowing "PPTP
Pass Through". I believe the same with a NetGear.

What ports did you allow in your router? Can you elaborate? Also, Bob asked
what error is the client side getting? Any errors on the server side in the
Event logs?


--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations

Having difficulty reading or finding responses to your post?
Try using Outlook Express or any other newsreader, configure a news
account, and point it to news.microsoft.com. Anonymous access. It's
easy and it's free:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

"Life isn't like a box of chocolates or a bowl of cherries or
peaches... Life is more like a jar of jalapenos. What you do today
may burn your butt tomorrow." - Garfield

The users get the error 800 I believe (can't check while at work). It
is a connection timeout error. I have opened up port 1723 on the
firewall for the server and allowed VPN passthrough (assuming that
opens up protocol 47). Just for the heck of it, I also opened up TCP/
UDP port 47 to see if that helped any (didn't).

I will try updating the firmware on the firewall at the company, but
what really stumps me is that sometimes the VPN connects without an
issue and other times it won't connect all, all this without changing
ANY settings on either side. If the VPN never connected then I would
know it was a setting issue, but why would it connect without an issue
only sometimes?

Hopefully the firmware update on the server end will fix this, but if
this needs to be done on the remote side too, the useres who happen to
find a hotel that doesn't work are SOL.

I am thinking about getting something like the WatchGuard Firebox
x20e. I see that allows "Mobile User VPN tunnels (5inc/25max)", but
I"m a bit unclear if "VPN tunnels" is a fancy way of saying that it
will allow 5 people to connect to another VPN server behind the
firewall or if the users can connect directly to the watchguard. I"m
just looking for a reliable way to connect remote users to our
internal network that people w/ mild computer illiteracy can use. the
MS solution worked for the computer illiterate, but that is useless if
the connection never completes.

Thanks for the help.

Andrew


On Sep 5, 7:05 am, "Ace Fekay [MVP]" <PleaseAs...@SomeDomain.com>
wrote:
> Innews:(E-Mail Removed) roups.com,
> trump26...@gmail.com <trump26...@gmail.com> typed:
>
>
>
>
>
> > I am running a windows2k3 SBS server behind a linksys firewall. I
> > have about three users that I would like to connect remotely using the
> > built in windows VPN. I have followed the recomended steps, made sure
> > the proper ports are opened, the server is configured correctly, and
> > everything seemed to be running perfectly.
>
> > Over the last few months, I've had numerous complaints about the
> > remote users having troubles connecting to our network. Aparently
> > they all can connect without an issue and work properly about 35% of
> > the time, but the rest, they time out waiting to verify user name and
> > password.
>
> > I figured this was a firewall issue blocking VPN data, but the problem
> > is that the firewall has been set to allow the proper ports open and
> > I've verified that it is indeed true (I"ve even switched firewalls,
> > but no luck).
>
> > The funny thing is that if I get the user to try and connect multiple
> > times as quick as possible by clicking cancel quickly after they see
> > the connection will stall and then starting the connection process
> > over, they can eventally connect in, but I"m sure this is exploiting
> > some bug as a potential security breach and either way, it is not an
> > efficient way to connect.
>
> > I also noticed that there are times when connected to the VPN that it
> > will timeout. What I mean is that the connection will still show as
> > active, but the data connection is effectively terminated and the
> > remote user is forced to disconnect and reconnect.
>
> > I have been playing around with this VPN problem at my house (with a
> > netgear router) and I"ve noticed that there are times I can connect
> > without an issue and other times it does not let me in, and about 1/2
> > the time I can't get in (even with the reconnect trick) I can unplug
> > my router at home, let it reset and then I can connect to the VPN.
> > While this is anoying, I have access to my router and can reset it,
> > but this same problem happens for users from hotels or other internet
> > connections where they don't have physical access to the router or its
> > settings.
>
> > I was under the impression that the intergrated VPN solution from MS
> > was a nice simple tool that was easily implimented. I have been very
> > pleased with it up until this point, but the data connection troubles
> > are getting to the point where I"m going to be forced to buy some
> > external VPN solution to make sure my users can always connect to our
> > business network.
>
> > Does anyone have an idea on what my problem is, I feel like my problem
> > is on the remote side, but it seems independant of all hardware/ISPs
> > so I"m thinking there must be some setting to change off the defaults
> > to allow the VPN to work without getting filtered on the remote side.
>
> > Your help is much appreciated.
>
> > Thanks,
> > Andrew
>
> Two portrs need to be open to allow PPTP:
> TCP 1723 (which is GRE)
> Protocol ID #47 (not really a port, but rather a Protocol #)
>
> Protocol ID #47 on a Linksys can be opened up by stipulating allowing "PPTP
> Pass Through". I believe the same with a NetGear.
>
> What ports did you allow in your router? Can you elaborate? Also, Bob asked
> what error is the client side getting? Any errors on the server side in the
> Event logs?
>
> --
> Regards,
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
> MVP Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> Infinite Diversities in Infinite Combinations
>
> Having difficulty reading or finding responses to your post?
> Try using Outlook Express or any other newsreader, configure a news
> account, and point it to news.microsoft.com. Anonymous access. It's
> easy and it's free:
>
> How to Configure OEx for Internet Newshttp://support.microsoft.com/?id=171164
>
> "Life isn't like a box of chocolates or a bowl of cherries or
> peaches... Life is more like a jar of jalapenos. What you do today
> may burn your butt tomorrow." - Garfield- Hide quoted text -
>
> - Show quoted text -

In news:(E-Mail Removed) ups.com,
(E-Mail Removed) <(E-Mail Removed)> typed:
> The users get the error 800 I believe (can't check while at work). It
> is a connection timeout error. I have opened up port 1723 on the
> firewall for the server and allowed VPN passthrough (assuming that
> opens up protocol 47). Just for the heck of it, I also opened up TCP/
> UDP port 47 to see if that helped any (didn't).
>
> I will try updating the firmware on the firewall at the company, but
> what really stumps me is that sometimes the VPN connects without an
> issue and other times it won't connect all, all this without changing
> ANY settings on either side. If the VPN never connected then I would
> know it was a setting issue, but why would it connect without an issue
> only sometimes?
>
> Hopefully the firmware update on the server end will fix this, but if
> this needs to be done on the remote side too, the useres who happen to
> find a hotel that doesn't work are SOL.
>
> I am thinking about getting something like the WatchGuard Firebox
> x20e. I see that allows "Mobile User VPN tunnels (5inc/25max)", but
> I"m a bit unclear if "VPN tunnels" is a fancy way of saying that it
> will allow 5 people to connect to another VPN server behind the
> firewall or if the users can connect directly to the watchguard. I"m
> just looking for a reliable way to connect remote users to our
> internal network that people w/ mild computer illiteracy can use. the
> MS solution worked for the computer illiterate, but that is useless if
> the connection never completes.
>
> Thanks for the help.
>
> Andrew
>
>

Microsoft's solution does work. Obviously something is not working for you.
You don't need TCP 47. The pass-thru thing opens up GRE.

Are there any errors in the Event logs of the server? Maybe it;s a RRAS
policy issue.

Does the VPN work internally when you test it from a client to the RRAS
server? If so, then you KNOW it's a Linksys or Netgear issue.

The 5/25 I believe means 5 included with the purchase but you can buy up to
25 maximum. You will need to check out watchguard's website for more info on
that. If I may suggest, try a Cisco Pix 501 unlimited users with unlimited
tunnels. Works like a charm. I have them in use with most of my small
clients. YOu need to install their VPN client software to make it work.


Ace

Thanks Ace,

I knew I didn't need to open up port 47, but it wasn't consistently
working before so I figured opening the port might help as it certanly
wouldn't stop the VPN from functioning (as I said before, it didn't
help). I currently have vpn passthrough and port 1723 opened and I
checked that 1723 was not blocked by either the external firewall or
anything in windows.

I updated the firmware on the business's firewall and hopefully the
problem is fixed. I don't have people trying to get on too often and
so I can't find the error I would see in the logs, but to paraphrase
what I remember from the error, it would say "VPN connection attempt
Timeout: check to make sure data ports for VPN are open".

What really pisses me off about the problem is that the vpn does work
about 50% of the time. If it always didn't work, then I could figure
out what settings I messed up, but there doesn't seem to be any rhyme
or reason behind when/why I can't get on other than just random luck.
I mentioned that I've had the problem w/ Linksys and Netgear, but I
don't even know what other hotels/airports are using, but the problem
has been seen everywhere.

Hopefully the firmware update will fix my problem, but before I was
using a Linksys firewall, I was using Netgear's ProSafe line with the
same issues. I'll check out the Cisco you mentioned, I hear good
things about them, but I"ve usually stayed away since they tend to
charge major $$$ and this is for a small business.

I was hoping some other people might have had experiance with this
problem in the past and had some advice. I"ll try connecting from
home again tonight to see if the problem continues.


On Sep 6, 12:20 am, "Ace Fekay [MVP]" <PleaseAs...@SomeDomain.com>
wrote:
> Innews:(E-Mail Removed) roups.com,
> trump26...@gmail.com <trump26...@gmail.com> typed:
>
>
>
>
>
> > The users get the error 800 I believe (can't check while at work). It
> > is a connection timeout error. I have opened up port 1723 on the
> > firewall for the server and allowed VPN passthrough (assuming that
> > opens up protocol 47). Just for the heck of it, I also opened up TCP/
> > UDP port 47 to see if that helped any (didn't).
>
> > I will try updating the firmware on the firewall at the company, but
> > what really stumps me is that sometimes the VPN connects without an
> > issue and other times it won't connect all, all this without changing
> > ANY settings on either side. If the VPN never connected then I would
> > know it was a setting issue, but why would it connect without an issue
> > only sometimes?
>
> > Hopefully the firmware update on the server end will fix this, but if
> > this needs to be done on the remote side too, the useres who happen to
> > find a hotel that doesn't work are SOL.
>
> > I am thinking about getting something like the WatchGuard Firebox
> > x20e. I see that allows "Mobile User VPN tunnels (5inc/25max)", but
> > I"m a bit unclear if "VPN tunnels" is a fancy way of saying that it
> > will allow 5 people to connect to another VPN server behind the
> > firewall or if the users can connect directly to the watchguard. I"m
> > just looking for a reliable way to connect remote users to our
> > internal network that people w/ mild computer illiteracy can use. the
> > MS solution worked for the computer illiterate, but that is useless if
> > the connection never completes.
>
> > Thanks for the help.
>
> > Andrew
>
> Microsoft's solution does work. Obviously something is not working for you.
> You don't need TCP 47. The pass-thru thing opens up GRE.
>
> Are there any errors in the Event logs of the server? Maybe it;s a RRAS
> policy issue.
>
> Does the VPN work internally when you test it from a client to the RRAS
> server? If so, then you KNOW it's a Linksys or Netgear issue.
>
> The 5/25 I believe means 5 included with the purchase but you can buy up to
> 25 maximum. You will need to check out watchguard's website for more info on
> that. If I may suggest, try a Cisco Pix 501 unlimited users with unlimited
> tunnels. Works like a charm. I have them in use with most of my small
> clients. YOu need to install their VPN client software to make it work.
>
> Ace- Hide quoted text -
>
> - Show quoted text -

This is the error I"m getting on the server side: (this is AFTER I
upgraded the firmware, I"ll try resetting the device to factory
settings tonight and trying again).


Source: Rasman
Event ID: 20209 Type: Warning
Description: A connection between the VPN server and the VPN client
xxx.xxx.xxx.xxx has been established, but the VPN connection cannot be
completed. The most common cause for this is that a firewall or router
between the VPN server and the VPN client is not configured to allow
Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that
the firewalls and routers between your VPN server and the Internet
allow GRE packets. Make sure the firewalls and routers on the user's
network are also configured to allow GRE packets. If the problem
persists, have the user contact the Internet service provider (ISP) to
determine whether the ISP might be blocking GRE packets.

Again, this doesn't happen every time, but enough to matter. I don't
know how to test the GRE settings beyond looking at the check box in
the firewall settings.

I just checked my firewall settings in Routing and REmote Access, and
under NAT/Basic Firewall, I have the box for PPTP VPN Gateway selected
and it says to go to IP 127.0.0.1, but my HTTP, remote web, and other
services all say to go to 127.0.0.1. I'm assuming this is ok.

In news:(E-Mail Removed) ups.com,
(E-Mail Removed) <(E-Mail Removed)> typed:
> I just checked my firewall settings in Routing and REmote Access, and
> under NAT/Basic Firewall, I have the box for PPTP VPN Gateway selected
> and it says to go to IP 127.0.0.1, but my HTTP, remote web, and other
> services all say to go to 127.0.0.1. I'm assuming this is ok.

No, I wouldn't use the loopback. Let's put in the actual IP address of the
RRAS box.

Curious, now that you mentioned NAT on the server, then I am assuming the
server is multihomed, which can cause some issues. Which NIC is the default
NIC? Which NIC has the gateway? Can you provide an unedited ipconfig /all
please? Is this a DC too?

Ace

I"m not totally clear on the term "multihomed". This computer is
running windows SBS2k3 with two NIC cards. NIC1 "Internet" is set to
a static IP of 192.168.1.2 on netmask 255.255.255.0 gateway
192.168.1.1 (the IP of the external firewall) and the DNS is set to
10.0.0.1 and 209.137.171.10 (one of our ISP's DNS servers). The
"Local network" NIC2 is set to 10.0.0.1. The DNS is pointed to
10.0.0.1 and the gateway is not defined. There is also a PPP adapter
RAS server interface listed that is described as "WAN (PPP/SLIP)
interface" DHCP is not enabled, IP address is set to 10.0.0.15 subnet
255.255.255.255 with no gateway set and netbios over tcpip is
disabled. As per SBS config tips, this computer has the DNS service
running on 10.0.0.1 and has DHCP service enabled to give out IP
addresses for the Local network. I am not sure how to make the cmd
window dump to a text file so I couldn't just paste the info.

The physical network layout is modem -> firewall -> SBS computer ->
LAN. I have gotten mixed opinions on if I should have all outgoing
LAN traffic go through the SBS computer.

I thought the loopback was odd, thats why I mentioned it, but every
service seemed to be pointed to it and it must have been that way by
default because I know I never set that. You said not to use the
loopback, should I set it to the Internal NIC or the WAN NIC?


BTW, I tried from my house last night and the connection continues to
fail with event IP 20209

Event Type: Warning
Event Source: Rasman
Event Category: None
Event ID: 20209
Date: 9/6/2007
Time: 8:56:42 PM
User: N/A
Computer: BGD-1
Description:
A connection between the VPN server and the VPN client xxx.xxx.xxx.xxx
has been established, but the VPN connection cannot be completed. The
most common cause for this is that a firewall or router between the
VPN server and the VPN client is not configured to allow Generic
Routing Encapsulation (GRE) packets (protocol 47). Verify that the
firewalls and routers between your VPN server and the Internet allow
GRE packets. Make sure the firewalls and routers on the user's network
are also configured to allow GRE packets. If the problem persists,
have the user contact the Internet service provider (ISP) to determine
whether the ISP might be blocking GRE packets.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.




On Sep 6, 7:14 pm, "Ace Fekay [MVP]" <PleaseAs...@SomeDomain.com>
wrote:
> Innews:(E-Mail Removed) roups.com,
> trump26...@gmail.com <trump26...@gmail.com> typed:
>
> > I just checked my firewall settings in Routing and REmote Access, and
> > under NAT/Basic Firewall, I have the box for PPTP VPN Gateway selected
> > and it says to go to IP 127.0.0.1, but my HTTP, remote web, and other
> > services all say to go to 127.0.0.1. I'm assuming this is ok.
>
> No, I wouldn't use the loopback. Let's put in the actual IP address of the
> RRAS box.
>
> Curious, now that you mentioned NAT on the server, then I am assuming the
> server is multihomed, which can cause some issues. Which NIC is the default
> NIC? Which NIC has the gateway? Can you provide an unedited ipconfig /all
> please? Is this a DC too?
>
> Ace