Server 2k3 cannot connect to VPN via L2TP over IPsec in Virtual Private Networking

Server 2k3 cannot connect to VPN via L2TP over IPsec in Virtual Private Networking http://www.dslreports.com/forum/r20450497 en Mon, 06 Oct 2008 09:02:20 EDT Mon, 06 Oct 2008 09:02:20 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20528848 johnpsph : Thanks, but there are no filters in place.

Edit: Also, I'm posting all over the web about this, and one response I keep getting is that it HAS to be a NAT-T problem, because of the 809 error. What's weird though is that

a) I can't connect from the LAN, I still get the 809 error with nothing but the AP and switch between my client and VPN server

and

b) when I try to connect from the internet, I also get the 809 error, and in that case, I'd be willing to believe that there is a NAT-T problem, except for the fact that I can, using that same internet connection, connect to another L2TP over IPsec VPN without any issues

I suppose that what I'm trying to say is that my feeling is that it is a configuration issue, but I'd definately love to hear what some more experienced people think. Thanks]]> http://www.dslreports.com/forum/remark,20528848 Fri, 23 May 2008 12:04:42 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20528203 MattE :

said by johnpsph

:

Huh, I just tried it, but didn't get any message about filters.

You can check for them here.

RRAS Filters

]]> http://www.dslreports.com/forum/remark,20528203 Fri, 23 May 2008 10:00:52 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20527227 johnpsph : Huh, I just tried it, but didn't get any message about filters.]]> http://www.dslreports.com/forum/remark,20527227 Fri, 23 May 2008 01:44:16 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20527163 johnpsph : Hmm, I'll give it a try tomorrow.]]> http://www.dslreports.com/forum/remark,20527163 Fri, 23 May 2008 01:17:37 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20527050 MattE : Hrm, I don't have any experience doing that.

When you configured RRAS, during the last step it asks if you want to apply filters, did you answer yes or no? I'd re-configure RRAS and answer no.]]> http://www.dslreports.com/forum/remark,20527050 Fri, 23 May 2008 00:42:35 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20526835 johnpsph : I'm not using a router anymore per se, I have 2k3 set up for RRAS as a router using dual NIC's.

]]> http://www.dslreports.com/forum/remark,20526835 Thu, 22 May 2008 23:46:18 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20526819 MattE :

said by johnpsph

:

All right, I finally got things straightened out with installing a second NIC, and I set up RRAS all over again. I can, once again, successfully connect using PPTP, but get the following error when I try to connect using L2TP over IPsec: Error 809: the network connection...cannot be established because the remote server is not responding.

As I said, I can connect just fine using PPTP, and I have the following ports opened in my RRAS firewall: IKE and IKE NAT transversal. Please let me know if any screenshots of my RRAS configuration might help, I'm really at a loss here. Thanks

Your router needs to support ESP protocol forwarding, which is not a port. Do you know if it does?

Here are the 2 port and 1 protocol forwards my firewall requires.

Port/Protocol Forwards

]]> http://www.dslreports.com/forum/remark,20526819 Thu, 22 May 2008 23:41:31 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20526754 johnpsph : All right, I finally got things straightened out with installing a second NIC, and I set up RRAS all over again. I can, once again, successfully connect using PPTP, but get the following error when I try to connect using L2TP over IPsec: Error 809: the network connection...cannot be established because the remote server is not responding.

As I said, I can connect just fine using PPTP, and I have the following ports opened in my RRAS firewall: IKE and IKE NAT transversal. Please let me know if any screenshots of my RRAS configuration might help, I'm really at a loss here. Thanks]]> http://www.dslreports.com/forum/remark,20526754 Thu, 22 May 2008 23:24:11 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20508133 DocLarge : At this point, I must say it sounds like the issue is with your router (I say this from experience). Grab youself either a linksy WRV200 or a SMC SMCBR14UP and your vpn configuration should be fine then.

For what it's worth, making a vpn connection "from behind a router to another connection on the same segment" does not guarantee success at all for your vpn working; if you can't connect from a remote location, your vpn doesn't work, period. :( Yeah, that sucks...

Anyhoo, I own both of the mentioned routers and have used them effectively with the vpn servers I've configured in the past.

jay]]> http://www.dslreports.com/forum/remark,20508133 Mon, 19 May 2008 18:48:25 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20508020 johnpsph : Tried it, but got the same error. I think I'm going to hold off on this project for a few days until I get in a new mobo and have 2 NIC's, so that I can set up my 2k3 box as a router. Hopefully that will eliminate some of these issues, plus it will be a fresh install of 2k3, which shouldn't hurt. ]]> http://www.dslreports.com/forum/remark,20508020 Mon, 19 May 2008 18:30:14 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20505545 MattE :

said by johnpsph

:

All right, I tried it from the LAN and got the following:

Error 809: The network connection between your computer and the VPN server could not be established because the remote server is not responding. This could be because one of the network devices between your computer and the remote server is not configured to allow VPN connections.

All right, so it sounds like a router problem, yea?

Looks like there are a couple of issues going on. You should definitely be able to establish a VPN connection form behind the router, but when you try it's telling you the server isn't responding.

Try to use the internal LAN IP as the VPN server IP on the client and see if you can connect then.]]> http://www.dslreports.com/forum/remark,20505545 Mon, 19 May 2008 10:13:52 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20502870 johnpsph : All right, I tried it from the LAN and got the following:

Error 809: The network connection between your computer and the VPN server could not be established because the remote server is not responding. This could be because one of the network devices between your computer and the remote server is not configured to allow VPN connections.

All right, so it sounds like a router problem, yea?]]> http://www.dslreports.com/forum/remark,20502870 Sun, 18 May 2008 18:12:35 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20502791 johnpsph : Oh I know, the wording is atrocious. Let me try connecting from the the same LAN the VPN server is on to the 2K3 machine and see what sort of fun errors I get.]]> http://www.dslreports.com/forum/remark,20502791 Sun, 18 May 2008 17:53:04 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20502401 MattE :

said by johnpsph

:

Here's what the router claims in the manual (it is a 3Com OfficeConnect, actually a pretty decent router):

"Enabling IPSec VPN disables pass-through to IPSec and L2TP over IPSec Virtual Servers on the LAN. Pass-through outbound from clients on the LAN to servers on the Internet is unaffected."

Wow. What strange, confusing wording. So it sounds like that setting should be disabled to allow IPSec traffic to servers behind the router? Have you tried to connect from a client behind the router on the same LAN as the server? That would tell you if it's a router configuration or server configuration issue.]]> http://www.dslreports.com/forum/remark,20502401 Sun, 18 May 2008 16:12:16 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20501927 johnpsph : Here's what the router claims in the manual (it is a 3Com OfficeConnect, actually a pretty decent router):

"Enabling IPSec VPN disables pass-through to IPSec and L2TP over IPSec Virtual Servers on the LAN. Pass-through outbound from clients on the LAN to servers on the Internet is unaffected."]]> http://www.dslreports.com/forum/remark,20501927 Sun, 18 May 2008 13:58:36 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20501053 DocLarge : AAARGH!!

Good point, Matt, regarding support of the protocol...

Joe, what brand of router are you using? If it's a Linksys WRT54G Version 5 or later, this router "does not" support tunneling GRE/L2TP. Basically, if you can't tunnel GRE (at the minimum), nothing else is going across either.

Jay]]> http://www.dslreports.com/forum/remark,20501053 Sun, 18 May 2008 09:55:53 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20500222 MattE : Do you know for a fact that your router supports forwarding ESP? In needs to allow it WAN -> LAN, not just LAN -> WAN.]]> http://www.dslreports.com/forum/remark,20500222 Sun, 18 May 2008 00:26:56 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20498958 johnpsph : Well, I tried that, and it didn't work. I also tried turning the firewall on the router off altogether for a minute, but I'm still getting the 691 message....]]> http://www.dslreports.com/forum/remark,20498958 Sat, 17 May 2008 18:13:47 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20482256 johnpsph : Alternately, I have to run out, but I may try putting my server in the DMZ to see if that works.]]> http://www.dslreports.com/forum/remark,20482256 Wed, 14 May 2008 15:58:23 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20481416 johnpsph : All right, I forwarded the ports in question, but i'm still getting the same error, even though I have the router set up for IPsec and L2TP over IPsec passthrough. I'd be happy to post up a few screenshots of the router's setup if that might help.]]> http://www.dslreports.com/forum/remark,20481416 Wed, 14 May 2008 13:28:26 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20478286 MattE :

said by johnpsph

:

I set up IPsec passthrough on the router previously, but that doesn't seem to have been the issue. The 2k3 server is behind a NAT Router with firewall port 1723 forwarded to it. Are there any other ports I should forward?

For IPSec/L2TP you need to forward UDP 4500 for IPSec NAT-T, UDP 500 for ISAKMP, and the ESP protocol to the RRAS server. The ESP protocol portion may be where you're running into trouble.

You only need 1723 and the GRE protocol for PPTP.]]> http://www.dslreports.com/forum/remark,20478286 Tue, 13 May 2008 21:52:36 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20477829 johnpsph : I set up IPsec passthrough on the router previously, but that doesn't seem to have been the issue. The 2k3 server is behind a NAT Router with firewall port 1723 forwarded to it. Are there any other ports I should forward?]]> http://www.dslreports.com/forum/remark,20477829 Tue, 13 May 2008 20:30:03 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20476857 MattE : Hrm, I'd start looking at whether or not your routers pass IPSec through properly. Are there NAT routers at either end?

If so, check for an IPSec passthru setting in the router and make sure it's enabled (or disabled as some need to be).]]> http://www.dslreports.com/forum/remark,20476857 Tue, 13 May 2008 17:25:46 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20475547 johnpsph : Yes, looks like 1-99.]]> http://www.dslreports.com/forum/remark,20475547 Tue, 13 May 2008 13:21:35 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20474266 MattE :

said by johnpsph

:

Oh ok. Well, I tried that too, but got the same 691 error.

I just realized that there is a fact I haven't mentioned about my setup. The machine in question just has one NIC, so I set up a custom RRAS for VPN, I was not able to go through the standard VPN bulleted option in the RRAS setup.

Do you have L2TP ports listed under ports?]]> http://www.dslreports.com/forum/remark,20474266 Tue, 13 May 2008 08:57:09 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20473667 johnpsph : Oh ok. Well, I tried that too, but got the same 691 error.

I just realized that there is a fact I haven't mentioned about my setup. The machine in question just has one NIC, so I set up a custom RRAS for VPN, I was not able to go through the standard VPN bulleted option in the RRAS setup. ]]> http://www.dslreports.com/forum/remark,20473667 Tue, 13 May 2008 02:22:04 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20471866 MattE :

said by johnpsph

:

Well, I don't have a domain field in the Vista VPN Client, but I did try username@domain.com, but still had the same problem

You have to enable the domain field in the VPN properties.

]]> http://www.dslreports.com/forum/remark,20471866 Mon, 12 May 2008 19:22:08 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20471432 johnpsph : Well, I don't have a domain field in the Vista VPN Client, but I did try username@domain.com, but still had the same problem]]> http://www.dslreports.com/forum/remark,20471432 Mon, 12 May 2008 18:01:48 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20470086 MattE : Hrm, never seen that one before but this MS KB article says it's a domain issue: »support.microsoft.com/kb/310431

You may want to try username@domain in the username field, or use the username in the username field and put the NetBIOS domain name in the domain field.

I have a few clients where one or the other works.]]> http://www.dslreports.com/forum/remark,20470086 Mon, 12 May 2008 14:00:59 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20469856 johnpsph : I think I might be cursed... All right, I set it up exactly as you said (before I'd had PEAP enabled as well), and now I get a new error message: "Error 691: The connection was denied because the username and/or password you specified is invalid." However, I double checked, and re-entered, several times, the username and password, only to keep getting the same error. If I flipped back over to PPTP on the Vista client, using the same username and password, it works just fine. It only gives me that error when I try to use L2TP over IPsec (I also double checked the PSK, but to no avail).

Edit: Also, I double checked that my user account has Dial in permission granted.]]> http://www.dslreports.com/forum/remark,20469856 Mon, 12 May 2008 13:16:09 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20469313 MattE :

said by DocLarge

:

Nice! How did you set that up if I may ask (not to get too far off topic)..

See the screenshot I have attached. You just enter the PSK on the left side of the screenshot, then enable in in your VPN client under IPSec settings.]]> http://www.dslreports.com/forum/remark,20469313 Mon, 12 May 2008 11:15:48 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20469307 MattE :

said by johnpsph

:

Well, I actually reinstalled Server 2k3 and Exchange 2003 altogether, had the same issue, tried what you suggested, but I'm still having the same issue and error. Any logs I can post up that might help?

Make sure you enable MS CHAP v2. I think it may be disabled by default and Vista doesn't support MS CHAP v1.

You can check this by opening the RRAS console, right clicking on the server and choosing properties, choosing the security tab and clicking the "Authentication" button under the Authentication provider at the top.

FWIW, I ONLY have MS CHAP v2 enabled and all my Vista/XP users have no trouble.

RRAS Authentication Methods

]]> http://www.dslreports.com/forum/remark,20469307 Mon, 12 May 2008 11:14:49 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20468305 johnpsph : Well, I actually reinstalled Server 2k3 and Exchange 2003 altogether, had the same issue, tried what you suggested, but I'm still having the same issue and error. Any logs I can post up that might help?]]> http://www.dslreports.com/forum/remark,20468305 Mon, 12 May 2008 03:34:04 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20463211 DocLarge : Nice! How did you set that up if I may ask (not to get too far off topic)..]]> http://www.dslreports.com/forum/remark,20463211 Sat, 10 May 2008 21:42:46 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20460484 MattE :

said by DocLarge

:

Are you running a certificate server? This is usually a prerequisite when using L2TP, unless I'm mistaken...

Jay

You are. But don't worry, I thought the same thing for the longest time. :D

You can use L2TP with a pre-shared key instead of certificates.]]> http://www.dslreports.com/forum/remark,20460484 Sat, 10 May 2008 06:53:52 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20459799 DocLarge : Are you running a certificate server? This is usually a prerequisite when using L2TP, unless I'm mistaken...

Jay]]> http://www.dslreports.com/forum/remark,20459799 Fri, 09 May 2008 23:29:26 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20450754 johnpsph : Thanks for the tip. I'm actually out of town for the weekend, but I'll give it a try as soon as I'm back and let you know how it works for me. Thanks again.]]> http://www.dslreports.com/forum/remark,20450754 Thu, 08 May 2008 10:33:33 EDT Re: Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20450608 MattE :

said by johnpsph

:

I recently set up a VPN server on a 2k3 machine, and it worked flawlessly when I had the client select "Type of VPN: Automatic". However, when I manually changed the type to L2TP over IPsec, entered a PSK (This is using the built in Vista VPN CLient), then in the Routing and Remote Access configuation, I right click my server name, go to properties, then the security tab, and check "Allow custom IPsec policy for L2TP connections" and enter the same PSK, attempting to connect to the server generates the following client error: "Error 732: Your computer and the remote computer could not agree on PPP control protocols."

One the server in Event Viewer I get: "Unable to add the interface {FE282F3E-B086-43D9-8AD5-AFC281B11CB0} with the Router Manager for the IP protocol. The following error occurred: Cannot complete this function."

Any suggestions as to what I can do to solve this would be greatly appreciated. Thanks

Sorry to cross-post, but I also posted about this in the MS forum, but wasn't able to get a solution. However, I put up a bunch of screenshots here:

»[2K3] Cannot connect to VPN via L2TP over IPsec: "could not

Reboot your RRAS server or disable RRAS, reboot your server, then configure RRAS again.

I had the same issue a week ago.]]> http://www.dslreports.com/forum/remark,20450608 Thu, 08 May 2008 10:01:54 EDT Server 2k3 cannot connect to VPN via L2TP over IPsec http://www.dslreports.com/forum/remark,20450497 johnpsph : I recently set up a VPN server on a 2k3 machine, and it worked flawlessly when I had the client select "Type of VPN: Automatic". However, when I manually changed the type to L2TP over IPsec, entered a PSK (This is using the built in Vista VPN CLient), then in the Routing and Remote Access configuation, I right click my server name, go to properties, then the security tab, and check "Allow custom IPsec policy for L2TP connections" and enter the same PSK, attempting to connect to the server generates the following client error: "Error 732: Your computer and the remote computer could not agree on PPP control protocols."

One the server in Event Viewer I get: "Unable to add the interface {FE282F3E-B086-43D9-8AD5-AFC281B11CB0} with the Router Manager for the IP protocol. The following error occurred: Cannot complete this function."

Any suggestions as to what I can do to solve this would be greatly appreciated. Thanks

Sorry to cross-post, but I also posted about this in the MS forum, but wasn't able to get a solution. However, I put up a bunch of screenshots here:

»[2K3] Cannot connect to VPN via L2TP over IPsec: "could not]]> http://www.dslreports.com/forum/remark,20450497 Thu, 08 May 2008 09:34:36 EDT