VPN Connection Error 628 and 721 over Linksys

Help With VPN.

Here is the basic setup.

The office setup:

Two client computers running Win XP SP2
One Server running Windows 2003 SP 1(Single NIC)
Internet connection is through a Linksys WRT564G SRX Router
VoIP with Vonage through a Linksys RT31P2 Router

The VPN server sits behind the WRT54G and the basic configuration is as
follows:

On the properties page of the VPN server:

General tab:
Enable this computer as a:
Router
Lan and Demand-dial routing
Remote access server
All are enabled

Security Tab:
Windows Authentication

IP Tab
Enable IP Routing
Allow IP based remote access and demand dial connections
Using Static address pool.
192.168.1.10 to 192.168.1.20

PPP Tab
All defaults

Logging Tab
Log all events enabled

PORT
WAN Miniport (L2TP) 0
WAAN Miniport (PPTP) 5
Rest Defaults

REMOTE ACCESS POLICY
Day-And-Time Restriction set to default
Tunnel-Type matches Generic Route Encapsulation
Point-to-Point Tunneling Protocol
Windows-Groups matches “VPN Server\VPN Group�

EDIT PROFILE
Authentication TAB
MS-CHAP v2
User can change PW
MS-CHAP
User can change PW

IP TAB
Server settings determine IP address assignments
All other Tabs are default

REMOTE ACCESS LOGGING
Authentication request is enabled

VPN Server IP Addressing:
IP 192.168.1.5
SM 255.255.255.0
DG 192.168.1.1
Static DNS Addresses

WRT54G IP Configuration (updated firmware)
IP 192.168.1.1
DG ISP
PPTP Pass-through is enabled
PPTP 1723 Port is forwarded to VPN Server at 1923168.1.5
DHCP is enabled
MTU 1400

RT31P2 (updated firmware)
IP 192.168.15.1
DG 192.168.1.1
Nothing sits behind this. Just the VoIP service

The DSL Line is setup with Vonage.

Remote Clients
Windows XP Sp2
Both access through DSL
One with a Linksys WRT54G Router and the other through a BEFSR41
PPTP enable and 1723 forwarded.

Client Connection Configuration

General TAB
VPN Server IP Address
Dial another Connection first is Disabled

OPTIONS TAB
Defaults

SECURITY TAB
Advance (custom setting)
Data encryption
Require encryption (disconnect if server declines)
Allow these Protocols are:
MS-CHAP
MS-CHAPv2

NETWORKING TAB
Unchecked Use default gateway on remote network

ADVANCE TAB
Tried firewall both Enabled and Disabled

When connecting to VPN Server I get two errors. One client it is Error 721
and on the other Client it is 628

Both the ISP and Vonage say that I can VPN through their connection.
On the VPN server, I get an Event ID Warning Type error 20209-Source Rasman
It is telling me that a connection has been established but the VPN
connection cannot be completed. It suggests that the most probable cause is
that somewhere along the line, GRE is not being permitted.

Please, any help would be most welcomed.

~e

It could be GRE issue. We have seen many case like that. I would upgrade the
firmware on WRT54G first.

Bob Lin, MS-MVP, MCSE & CNE
How to Setup Windows, Network, Remote Access on
http://www.HowToNetworking.com
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
This posting is provided "AS IS" with no warranties.
"edisonrus" <(E-Mail Removed)> wrote in message
news71A94FF-1898-48F5-A54D-(E-Mail Removed)...
> Help With VPN.
>
> Here is the basic setup.
>
> The office setup:
>
> Two client computers running Win XP SP2
> One Server running Windows 2003 SP 1(Single NIC)
> Internet connection is through a Linksys WRT564G SRX Router
> VoIP with Vonage through a Linksys RT31P2 Router
>
> The VPN server sits behind the WRT54G and the basic configuration is as
> follows:
>
> On the properties page of the VPN server:
>
> General tab:
> Enable this computer as a:
> Router
> Lan and Demand-dial routing
> Remote access server
> All are enabled
>
> Security Tab:
> Windows Authentication
>
> IP Tab
> Enable IP Routing
> Allow IP based remote access and demand dial connections
> Using Static address pool.
> 192.168.1.10 to 192.168.1.20
>
> PPP Tab
> All defaults
>
> Logging Tab
> Log all events enabled
>
> PORT
> WAN Miniport (L2TP) 0
> WAAN Miniport (PPTP) 5
> Rest Defaults
>
> REMOTE ACCESS POLICY
> Day-And-Time Restriction set to default
> Tunnel-Type matches Generic Route Encapsulation
> Point-to-Point Tunneling Protocol
> Windows-Groups matches "VPN Server\VPN Group"
>
> EDIT PROFILE
> Authentication TAB
> MS-CHAP v2
> User can change PW
> MS-CHAP
> User can change PW
>
> IP TAB
> Server settings determine IP address assignments
> All other Tabs are default
>
> REMOTE ACCESS LOGGING
> Authentication request is enabled
>
> VPN Server IP Addressing:
> IP 192.168.1.5
> SM 255.255.255.0
> DG 192.168.1.1
> Static DNS Addresses
>
> WRT54G IP Configuration (updated firmware)
> IP 192.168.1.1
> DG ISP
> PPTP Pass-through is enabled
> PPTP 1723 Port is forwarded to VPN Server at 1923168.1.5
> DHCP is enabled
> MTU 1400
>
> RT31P2 (updated firmware)
> IP 192.168.15.1
> DG 192.168.1.1
> Nothing sits behind this. Just the VoIP service
>
> The DSL Line is setup with Vonage.
>
> Remote Clients
> Windows XP Sp2
> Both access through DSL
> One with a Linksys WRT54G Router and the other through a BEFSR41
> PPTP enable and 1723 forwarded.
>
> Client Connection Configuration
>
> General TAB
> VPN Server IP Address
> Dial another Connection first is Disabled
>
> OPTIONS TAB
> Defaults
>
> SECURITY TAB
> Advance (custom setting)
> Data encryption
> Require encryption (disconnect if server declines)
> Allow these Protocols are:
> MS-CHAP
> MS-CHAPv2
>
> NETWORKING TAB
> Unchecked Use default gateway on remote network
>
> ADVANCE TAB
> Tried firewall both Enabled and Disabled
>
> When connecting to VPN Server I get two errors. One client it is Error 721
> and on the other Client it is 628
>
> Both the ISP and Vonage say that I can VPN through their connection.
> On the VPN server, I get an Event ID Warning Type error 20209-Source
> Rasman
> It is telling me that a connection has been established but the VPN
> connection cannot be completed. It suggests that the most probable cause
> is
> that somewhere along the line, GRE is not being permitted.
>
> Please, any help would be most welcomed.
>
> ~e
>
>
>
>
>
>

Hello Robert,
When I first started to have this problem I suspected it might be a firmware
problem so I contacted Linksys about my concern with the PPTP through with
it's current firmware and they seemed to know right away what the problem
was. They emailed me the current updated which is 1.02.08 and said this would
correct the Passthrough issue. It did not. I've been successful with some of
the older Linksys routers with the VPN but this one is just been a real pain.
The only difference with this setup is it's got the Vonage VoIP with it. But
they say that should not present a problem.
Again thanks for you response.

~edison

"Robert L [MS-MVP]" wrote:

> It could be GRE issue. We have seen many case like that. I would upgrade the
> firmware on WRT54G first.
>
> Bob Lin, MS-MVP, MCSE & CNE
> How to Setup Windows, Network, Remote Access on
> http://www.HowToNetworking.com
> Networking, Internet, Routing, VPN Troubleshooting on
> http://www.ChicagoTech.net
> This posting is provided "AS IS" with no warranties.
> "edisonrus" <(E-Mail Removed)> wrote in message
> news71A94FF-1898-48F5-A54D-(E-Mail Removed)...
> > Help With VPN.
> >
> > Here is the basic setup.
> >
> > The office setup:
> >
> > Two client computers running Win XP SP2
> > One Server running Windows 2003 SP 1(Single NIC)
> > Internet connection is through a Linksys WRT564G SRX Router
> > VoIP with Vonage through a Linksys RT31P2 Router
> >
> > The VPN server sits behind the WRT54G and the basic configuration is as
> > follows:
> >
> > On the properties page of the VPN server:
> >
> > General tab:
> > Enable this computer as a:
> > Router
> > Lan and Demand-dial routing
> > Remote access server
> > All are enabled
> >
> > Security Tab:
> > Windows Authentication
> >
> > IP Tab
> > Enable IP Routing
> > Allow IP based remote access and demand dial connections
> > Using Static address pool.
> > 192.168.1.10 to 192.168.1.20
> >
> > PPP Tab
> > All defaults
> >
> > Logging Tab
> > Log all events enabled
> >
> > PORT
> > WAN Miniport (L2TP) 0
> > WAAN Miniport (PPTP) 5
> > Rest Defaults
> >
> > REMOTE ACCESS POLICY
> > Day-And-Time Restriction set to default
> > Tunnel-Type matches Generic Route Encapsulation
> > Point-to-Point Tunneling Protocol
> > Windows-Groups matches "VPN Server\VPN Group"
> >
> > EDIT PROFILE
> > Authentication TAB
> > MS-CHAP v2
> > User can change PW
> > MS-CHAP
> > User can change PW
> >
> > IP TAB
> > Server settings determine IP address assignments
> > All other Tabs are default
> >
> > REMOTE ACCESS LOGGING
> > Authentication request is enabled
> >
> > VPN Server IP Addressing:
> > IP 192.168.1.5
> > SM 255.255.255.0
> > DG 192.168.1.1
> > Static DNS Addresses
> >
> > WRT54G IP Configuration (updated firmware)
> > IP 192.168.1.1
> > DG ISP
> > PPTP Pass-through is enabled
> > PPTP 1723 Port is forwarded to VPN Server at 1923168.1.5
> > DHCP is enabled
> > MTU 1400
> >
> > RT31P2 (updated firmware)
> > IP 192.168.15.1
> > DG 192.168.1.1
> > Nothing sits behind this. Just the VoIP service
> >
> > The DSL Line is setup with Vonage.
> >
> > Remote Clients
> > Windows XP Sp2
> > Both access through DSL
> > One with a Linksys WRT54G Router and the other through a BEFSR41
> > PPTP enable and 1723 forwarded.
> >
> > Client Connection Configuration
> >
> > General TAB
> > VPN Server IP Address
> > Dial another Connection first is Disabled
> >
> > OPTIONS TAB
> > Defaults
> >
> > SECURITY TAB
> > Advance (custom setting)
> > Data encryption
> > Require encryption (disconnect if server declines)
> > Allow these Protocols are:
> > MS-CHAP
> > MS-CHAPv2
> >
> > NETWORKING TAB
> > Unchecked Use default gateway on remote network
> >
> > ADVANCE TAB
> > Tried firewall both Enabled and Disabled
> >
> > When connecting to VPN Server I get two errors. One client it is Error 721
> > and on the other Client it is 628
> >
> > Both the ISP and Vonage say that I can VPN through their connection.
> > On the VPN server, I get an Event ID Warning Type error 20209-Source
> > Rasman
> > It is telling me that a connection has been established but the VPN
> > connection cannot be completed. It suggests that the most probable cause
> > is
> > that somewhere along the line, GRE is not being permitted.
> >
> > Please, any help would be most welcomed.
> >
> > ~e
> >
> >
> >
> >
> >
> >
>
>
>