VPN Connection Problem! Please help (Error 678)

[David]

Hey all, we're running a dedicated server on SBS2000 with all the
latest updates. Our clients are all running WinXP Pro. We have
successfully connected via VPN from inside the network, so i'm
assuming our problems come about in the router? We have a Linksys
BEFW11S4, the wireless/4port one, with the latest firmware. We've
configured the router for PPTP Passthrough and we've forwarded ports
1723 and 500, and even used triggering for protocol 47 (this config
was found at linksys.com). Still, to no avail, I cannot connect to the
network from my home. I can ping the server with no problem, but as
far as vpn goes, the connection box just sits there for a while and
returns Error 678: The remote computer did not respond.

We've scoured through all the related kb articles we could find and
even attempted to read every vpn related post here, and some of the
resolutions we found here helped us, but we're still missing
something. We're so confused as to why the router is still preventing
a connection. Ironically, from the office location, the local
computers there can at least establish a partial connection with the
server, but then return an error message on the Verifying
Username/Password step. I'm not sure why I would fail to connect at
all, and they can only partially connect.

If we can connect to the server's vpn internally with the 192.168.x.x
address and it works, does that 100% mean it's the router that's
causing the problem?

Any ideas would be gladly appreciated, we are getting desperate!

David

[Mike Chan [MSFT]]

Your problem is that on the linksys device, when you click "PPTP Passthrough"
that is only for the outbound direction. That would allow your SBS server and
all other clients behind the linksys box be able to dial out.

What you need to do is open up multiple ports 1723 + secondary ports on the
inbound direction and forward them to the SBS server. Another option is to put
the SBS server into the DMZ and have all traffic destined for the SBS Server
automatically sent to the SBS machine (less secure, easier to set up)

--
Mike Chan
Technical Product Manager (ISA Server/VPN)
Security Business Unit
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.
--
"David" <kswi...@yahoo.com> wrote in message
news:1e78b74e.03022...@posting.google.com...

[David]

Actually, the SBS Server is already set up as the DMZ. We did this for
initial testing in case we missed something like this.

Good news is we got it working today, we're able to connect and get
authenticated.. bad news is that once connected, we still dont see the
office workgroup in my network places. The sbs server works off a
domain, but even when we log on via vpn with user/pass AND domain,
still nothing except the local workgroup, nothing server oriented.
What could we be missing now?

David

"Mike Chan [MSFT]" <mc...@online.microsoft.com> wrote in message news:<Ow32JlU3...@TK2MSFTNGP12.phx.gbl>...

[Mike Chan [MSFT]]

Hrm - is DNS and WINS working throught the VPN connection? Do you have the home
machine join the domain if you have one?

Can you access the resouces through the IP?

The main reason why things like this don't work are that workgroup info is
usually due to broadcast information, but broadcast packets usually do not pass
through VPN tunnels. If you do not have a domain infrastructure to get that
information out, I'm not sure exactly how to fix this. Maybe someone has
suggestions on how to get this to work automatically =)

--
Mike Chan
Technical Product Manager (ISA Server/VPN)
Security Business Unit
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

--
"David" <kswi...@yahoo.com> wrote in message
news:1e78b74e.03022...@posting.google.com...

[David]

So you're saying that since i'm connecting to a domain environment
from a non-domain environment it might not be possible at all? My
computer name has been added to the server, and i'm using an
established user/pass that gives me access to files/printers when i'm
on site, so it should give me the same off-site, right?

I'm getting this notice when I connect, does this have anything to do
with it:

One or more requested network protocls did not connect successfully.

TCP/IP CP connected successfully.

IPX/SPX or compatible CP reported error 733: A connection to the
remote computer could not be completed. You might need to adjust the
protocols on this computer...

I didn't even have IPX/SPX installed on my machine, so I installed it
thinking maybe it was missing it.. same error.. but i can just discard
the error and allow the connection -- so it works.. just kind of.. is
this a problem I need to fix? or should I check the box that says "Do
not request the failed protocls next time"?

Thanks for your help, David

"Mike Chan [MSFT]" <mc...@online.microsoft.com> wrote in message news:<OuIgs9W3...@TK2MSFTNGP11.phx.gbl>...

[Mike Chan [MSFT]]

Don't confuse the username/password you supply for creating the VPN connection
and the domain credentials that are automatically sent around by kerberos. The
actual username/password may be the same, but the two mechanisms are different
and separate. If you can't browse, this can be caused by various things from
WINS to DNS not working.

You don't need IPX/SPX.

Have you tried accessing the fileshares by IP? You may want to make your servers
static and set up local hostnames.

--
Mike Chan
Technical Product Manager (ISA Server/VPN)
Security Business Unit
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

--
"David" <kswi...@yahoo.com> wrote in message
news:1e78b74e.03022...@posting.google.com...

[Nir Ben Zvi [MSFT]]

You need to have access to the WINS server in order to make this work.
You can specify to RRAS from which adapter it should obtain the WINS
addresses for dial up users
This is done in the "Routing and Remote Access" MMC snap in in the server
property pages "IP" tab

--
Nir [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.
--
"David" <kswi...@yahoo.com> wrote in message
news:1e78b74e.03022...@posting.google.com...