Re: VPN

[Marina Roos [SBS-MVP]]

Hi Sujith,

Did you run the RRAS wizard? Are you using DHCP on the SBS? Please post the
ipconfig/all.

--
Regards,

Marina Roos
Microsoft SBS-MVP
One of the Magical M&M's
www.smallbizserver.net
Take part in SBS forum:
http://www.smallbizserver.net/Default.aspx?tabid=53

"sujith" <suj...@nospam.nospam> schreef in bericht
news:EC9253C1-C8B3-4427...@microsoft.com...
> In the loag file i got the rror as
> Unable to contact a DHCP server. The Automatic Private IP Address
> 169.254.233.150 will be assigned to dial-in clients. Clients may be unable
to
> access resources on the network.
>
> The user harish, attempting to connect on VPN4-3, was disconnected because
> of the following reason: A Remote Access Client attempted to connect over
a
> port that was reserved for Routers only.
>
>
> what can i do chage the port to connect
>
>

[Thomas H Clegg]

Hi,

I'm getting this error code when I try to connect to my SBS.

On-Error Event ErrorCode = 800 ErrorSource = RAS

I check and the code indicates my router is not set up correctly.

My router is a Linksys 54G with the latest software update. The settings on
the router allow vpn.

On the SBS I used the wizard to set up the VPN, and the users are set up for
RAS and all that stuff.

I'm not sure where to go next. Can anyone help?

Tom

[Oscar]

Thanks for this advice! Had a similar problem with with Connection Manager
(eg “Connect to Small Business Server”- icon) and forwarding port 1723 to the
server's outward NIC did it for me. Did not forward port 47, what is that for?

Got this error message: "Unable to establish the VPN connection. The VPN
server may be unreachable, or security parameters may not be configured
properly for this connection [Error 800]. For customized troubleshooting
information for this connection, click Help"

Thanks again, Oscar

"Leythos" wrote:

> In article <uMvg9aM...@TK2MSFTNGP15.phx.gbl>, thc...@thclegg.com
> says...

> Did you read the linksys document on their support site about setting up
> INBOUND PPTP VPN's?
>
> In short, you have to PORT FORWARD 1723 tcp/udp to the server and then
> you MAY have to also do PORT 47 TCP/UDP to the server.
>
> --
>
> spam9...@rrohio.com
> remove 999 in order to email me
>

[Edward Tian]

Dear Thomas:
Thank you for posting here. Hi Leythos and Oscar, thanks for your input.

Technically speaking, error 800 is caused by a router that has outdated
firmware or the GRE 47 packet can not be passed through the router. Please
refer to this article:

Error Message: VPN Connection Error 800: Unable to Establish Connection
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q319108

More information:
GRE Protocol 47 Packet Description and Use
http://support.microsoft.com/default.aspx?scid=KB;[LN];241251

As mentioned by Leythos, for some routers that do not fully support GRE 47
protocol, forwarding port 47 TCP/UDP to the server from the outside is a
workaround for some cases. You can take a try and see if this workaround
works.

Here, I would suggest you use the PPTP Ping utility to perform the test and
check if the GRE packet is allowed to pass through the router:

Basically, we will use PPTP Ping utility to determine whether any hardware
router or firewall is blocking GRE Protocol 47. The router must be able to
pass Generic Route Encapsulation (GRE) protocol 47 for PPTP traffic to
connect correctly to use VPN. When a cable/DSL router cannot map GRE
protocol 47 to the Routing and Remote Access server, you cannot connect to
the server from the Internet.

a. Please run Pptpsrv.exe on the server side.
b. Run Pptpclnt.exe [ServerNameorIPaddress] on remote client.
c. When prompted by Pptpclnt.exe, type some text to send to Pptpsrv.exe,
and then click Enter.
d. You will see the text received at the host running Pptpsrv.exe. Then you
will see five GRE packets sent from Pptpclnt.exe and received at
Pptpsrv.exe.
Provide me with the output for reference.

NOTE: PPTP Ping tools (Pptpclnt and Pptpsrv) exist in Windows XP support
tools.
For your convenience, I have attached the file within this reply.

NOTE: You should stop the Routing and Remote Access service on the RRAS
(VPN) server so that PPTPSRV can bind to port 1723.

If the test is successful, it appears that the router is not the root
cause. To narrow down the issue, please help me confirm the following
information:
1. Can you VPN to the SBS Server from the internal computer? This will help
us confirm if the RRAS component is corrupted.

2. If the remote client resides in the network that is protected by the ISA
Server, please refer to this article:

You receive an "Unable to establish the VPN connection" error message when
your Windows Small Business Server 2003-based client computer try to make
an outgoing PPTP connection
http://support.microsoft.com/?id=886621

3. Please re-run the CEICW Wizard in order to make sure the internet
connection is properly configured. Please refer to this KB article:

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

Then run the Configure Remote Access Wizard, follow the instructions and
finish the wizard.

3. Do you have ISA Server installed? If so, what is the version of the ISA?

4. Was the VPN connection once being established successfully last days?

Hope the information helps. Please feel free to let me know if you have any
questions or concerns.

I look forward to your update! Thank you.
Have a nice weekend, Thomas! :)

Best Regards
Edward Tian(MSFT)
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: "Thomas H Clegg" <thc...@thclegg.com>
| Subject: VPN
| Date: Thu, 8 Sep 2005 18:43:30 -0400
| Lines: 19
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
| X-RFC2646: Format=Flowed; Original
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
| Message-ID: <uMvg9aM...@TK2MSFTNGP15.phx.gbl>
| Newsgroups: microsoft.public.windows.server.sbs
| NNTP-Posting-Host: cpe-24-169-152-58.rochester.res.rr.com 24.169.152.58
| Path:
TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP1
5.phx.gbl
| Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:203380
| X-Tomcat-NG: microsoft.public.windows.server.sbs

[Steven Wang [MSFT]]

Hello,

Thank you for posting.

From your post, my understanding of this issue is: When you try to connect
to the VPN server, you get an error message: "Error 778, it was not
possible to verify the identity of the server". If this is not correct,
please feel free to let me know.

Based on my research, this error message may occur only in the environment
in which the RADIUS Authentication is used. To use the RADIUS
Authentication, the Internet Authentication Service (IAS) need to be
installed and configured first. If the IAS is not installed or there is
something wrong with it, the Error 778 may occur.

I suggest you first verify the Routing and Remote Access Service (RRAS)
configuration to verify which authentication method is used. If there is
no IAS server on the network, please choose the Windows Authentication. To
do this, please refer to the following steps:

1. On the VPN server, click Start, click Run, type rrasmgmt.msc, and then
click OK.
2. Right click on the server name and then click Properties.
3. Click on Security tab, under Authentication Provider, click to select
Windows Authentication, under Accounting Provider, click to select Windows
Accounting.
4. Click Authentication Methods button, make sure that only the (MS-CHAP
V2) and (MS-CHAP) are selected.

If the Windows Authentication is used and the issue persists, please refer
to the following steps to re-configure VPN:

1. Open Server Management, click Internet and Email.
2. Click Configure Remote Access and complete the Remove Access Wizard.

If the issue still exists, please help me to collect some information so
that I can perform further research on this issue:

1. Please let me know some detailed information about how you setup the VPN
connection and your network environment.
2. Please compress and send the whole "C:\Program Files\Microsoft Windows
Small business Server\Support" folder to me at v-st...@microsoft.com.
3. Run "Netsh ras set tracing * enable" (without quotation marks) command
on SBS Server, repro the issue, and then compress and send the
"C:\Windows\Tracing" folder to me.

For more information about the IAS and RADIUS Authentication, please refer
to the following links:

Internet Authentication Service Technology Center
<http://www.microsoft.com/windowsserver2003/technologies/ias/default.mspx>

Windows Server 2003 Internet Authentication Service (IAS) Operations Guide
<http://www.microsoft.com/downloads/details.aspx?FamilyID=27c432bf-5ed0-4763
-8909-36e7c310ae3c&displaylang=en>

Internet Authentication Service
<http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Serv
erHelp/d98eb914-258c-4f0b-ad04-dc4db9e4ee63.mspx>

For more information about VPN for Windows Server 2003, please refer to the
following links:

Virtual Private Networks Technology Center
<http://www.microsoft.com/windowsserver2003/technologies/networking/vpn/defa
ult.mspx>

VPN Product Documentation
<http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Serv
erHelp/a08da8ea-a616-4422-bbd7-9cb8de066b29.mspx>

Use Virtual Private Networks for Secure Internet Data Transfer for Windows
XP
<http://www.microsoft.com/windowsxp/using/mobility/expert/vpns.mspx>

Hope the above information helps. If anything is unclear or you have any
concerns, please feel free to let me know. Thanks for your time and I look
forward to hearing from you.

Have a nice weekend!

Steven Wang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
=====================================================

This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
>Thread-Topic: VPN
>thread-index: AcW0PF3dxOao15XmR9yqyiWwB5wp1A==
>X-WBNR-Posting-Host: 202.83.44.234
>From: =?Utf-8?B?c3VqaXRo?= <suj...@nospam.nospam>
>Subject: VPN
>Date: Wed, 7 Sep 2005 23:13:01 -0700
>Lines: 6
>Message-ID: <137434C2-F9FE-46AC...@microsoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:203130
>X-Tomcat-NG: microsoft.public.windows.server.sbs
>
>I looked vpn client properties. in its dial in properties i allowed dial
in.
>but now also when i dial after comin verifying user name and password. the
>following error come
>Error 778, it was not possible to verify the idendity of the server.
>i am a begginer and try to study ,myself active directory thats y i dodnt
>know whether i miss some basics to configure vpn. please help me.
>

[marlin]

I can VPN to my server from a remote location just fine when my computer is
hooked directly to my cabel modem. But when i go through my wireless router
and try ,I can dail in just fine but cant pull up my comanys home page. Is
this a router issuie?? Like I said when hooked straight to the modem I can
VPN just fine.

[Jenny wu [MSFT]]

Hi Marlin,

Thanks for posting here!

For your description, I understand that the issue is that you can not open
Companyweb site successfully when you connect to a router and access the
site remotely by VPN. If I am off base, please don't hesitate to let me
know.

For you can access the site successfully when you directly connect to
internet by VPN, the issue should lie in the client workstation's router
configurations.

Please ensure you open the inbound and outbound 444 port and 443 port
redirection on the hardware router. If you are not sure how the
configuration is done to the router, please consult to your router vendor.

In addition, I would like to mention that the following ports should be
opened on the hardware router/firewall if you want to use follow
applications:
TCP 25 This port is used for incoming SMTP traffic. If you are using POP3
connector, there is no need to open this port.
TCP 110 This port is used for POP3 mail clients.
TCP 443 SSL
TCP 444 Companyweb SSL
TCP 4125 Remote Web Workplace
TCP 3389 Terminal services

Try to test, does the issue be fixed?

For your reference:

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

If the issue persists, please help me collect some information to further
analyze:

1. Can you access shared resources in the SBS LAN?
2. Please give the IP report for analyze by running command "ipconfig /all"
in server side and client side before the VPN setup and after the VPN setup.
3. What is the error message you got when you open the Companyweb? Can you
get the screen shot when the issue happened and send to me?
4. Can you get any error event log in Event Viewer in the client side and
the server side? Please paste the detail error information in the
newsgroup.
Please add all files to a zip file and send to my mailbox:
v-ya...@microsoft.com

I appreciate your time and efforts to the issue. I am looking forward to
your reply!

Have a nice day!

Best Regards,

Jenny Wu

Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security

======================================================

This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

======================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
>Thread-Topic: VPN
>thread-index: AcW3A9mwJ1IJeaeuQgmpvrIjFulpLQ==
>X-WBNR-Posting-Host: 69.250.154.81
>From: =?Utf-8?B?bWFybGlu?= <mar...@discussions.microsoft.com>
>Subject: VPN
>Date: Sun, 11 Sep 2005 12:06:01 -0700
>Lines: 5
>Message-ID: <CFA95921-70E8-4214...@microsoft.com>

>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250

>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:152395
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[marlin]

I have all these ports open. When i VPN from home to work I can successfully
connect and browse computers .I can do this only when my home computer is
pluged in directly to the cabel modem. However when I plug my home computer
into my router I can dail up by VPN to my work and it connects successfully
However I can not connect to my companys website by using my web browser.

When pluged into home router i can not connect to companys website
ie(http://xyxyxyxy.local) When at home and plug home computer directly to
cabel modem everything works fine.

Hope I explained this a little better.

[Jenny wu [MSFT]]

Hi Marlin,

Thanks for your update!

For your test, we can isolate the cause to the router. I suggest that you
contact your router vendor to confirm router configuration.

What is more, please help me collect some information to further analyze
the issue:

1. Please give me the IP reports by running command "ipconfig /all"
respectively before and after you connect the home box to router to setup
VPN and directly connect to internet to setup VPN.

2. What is the error message you got when you open the Companyweb when the
issue happened? Can you get the screen shot when the issue happened and
send to me?

3. Can you get any error event log in Event Viewer in the client side and

the server side? Please paste the detail error information in the
newsgroup.

Or please add all files to a zip file and send to my mailbox:
v-ya...@microsoft.com

Have a nice day!

Best Regards,

--------------------
>Thread-Topic: VPN
>thread-index: AcW4Z/Rwf2X2CftSTAi8zhFFJeJkYQ==
>X-WBNR-Posting-Host: 69.250.181.240
>From: =?Utf-8?B?bWFybGlu?= <mar...@discussions.microsoft.com>
>References: <CFA95921-70E8-4214...@microsoft.com>
<jzZ0nh3...@TK2MSFTNGXA01.phx.gbl>
>Subject: RE: VPN
>Date: Tue, 13 Sep 2005 06:35:07 -0700
>Lines: 132
>Message-ID: <9B17E6F3-C71C-432E...@microsoft.com>

>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl

>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:152917
>X-Tomcat-NG: microsoft.public.windows.server.sbs

[Robbie Niblock]

Hi guys. I need a little bit of advice on VPN.

Let me explain our setup first.

1 x SBS2003 Prem (SP1). IBM machine, loads of RAM, Xeon CPUs, RAID etc etc,
spec isnt an issue here though. The machine is running in 2 x NIC mode. LAN
NIC is 10.3.0.2, other NIC is 192.168.1.10. The second NIC is connected to a
Draytek ADSL router, which has an IP address of 192.168.1.1. Everything is
running pretty well. ISA 2004 looks a lot different, but I think I'm getting
to grips with it now.

Anyway, on to my query. I can set up a very simple pptp VPN connection on
our server to serve remote clients. All I do is forward port 1723 from the
router to the servers IP (192.168.1.10) and everything works fine. One major
problem though - you have to actually establish the connection on the remote
machine i.e. you have to doubleclick the VPN connection and then click
Connect. I would like this to be automated if possible? - that is my first
query.

Now - as an alternative, I can set the remote clients up with another
Draytek router at their end. I can then set up router to router VPN. This
works perfectly fine in that the remote client can connect to the draytek at
the head office, but of course the ISA firewall is stopping them from
connecting to the server correctly. Am I barking up the wrong tree by
attempting this, or are there a set of rules in ISA that would suit this
configuration? The clients need to connect to Exchange using Outlook (OWA is
not an option) and also need to connect to a shared folder on the server.

Thanks in advance.

Robbie Niblock

[Jerry Zhao (MSFT)]

Hi Robbie,

Thanks for your post.

As for your first question about establishing a VPN connection
automatically, based on my knowledge, that is no native way to achieve this.
If you really need this function, you may need to write your own code/
script. If you have problem with coding related issue. You can post this in
the Developer newsgroups. I have provided the link below:

http://msdn.microsoft.com/newsgroups/default.asp

Or

you may ask for developer support:

http://support.microsoft.com/directory/directory/phonepro.asp?sd=msdn

As for the second question, since you have ISA installed, the outside site
to site VPN cannot access the SBS internal network because the VPN network
is still an external network to the SBS server. That is expected behavior.

So, to achieve your goal, you may need to create a site to site VPN from the
remote server to your SBS server. Or you can create a site to site VPN from
the remote router to your SBS server directly (this could be more
complicated for configuration then the forenamed choose.)

For your information:

Step-by-Step Guide to Building a Site-to-Site Virtual Private Network
Connection

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/vpnconn.mspx

Site-to-Site VPN in ISA Server 2004

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/sitetositevpn.mspx

If you have any questions please do not hesitate to let me know. I am glad
to be of assistance.

Best regards,

Jerry Zhao (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

======================================================

This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

======================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

"Robbie Niblock" <rob...@nospam.com> wrote in message
news:uFkzdld...@tk2msftngp13.phx.gbl...