Strange VPN Isuues

[Nakedboy]

I have been having trouble with our VPN server here at work. I can't connect from home, all I get is the Verfying Password and then it tells me that the server is not responding. But if I unplug my laptop from my router at home and dial out to the internet using AOL or MSN, I can connect.

I thought is was my router, but nothing has changed since it stopped working. Other people are having the same issue from their homes. But they can connect using dialup. The other person having the problem can't connect from home using broadband or from the hotel wireless connection he was styaing in. But if he dials out using a modem, it will work.

Anyone have any ideas?

[gizmo1_1]

But if I unplug my laptop from my router at home and dial out to the internet using AOL or MSN, I can connect.


Anyone have any ideas?

Sounds to me like a TCP Port issue. But need more information

• What type of router are you using at home?
• What TCP port does the VPN use?
• Try making your machine at home a DMZ host (NOT A PERMANENT SOLUTION)

If it works With the router at home with your laptop's IP DMZ then you need to look further in the routers port forwarding.

Hope this helps

[CeeBee]

Just installed XP SP2 by any chance???

[thirdfey]

Have you recently added a couple more IP's to your firewall's external adapter? If this was an ISA server I would say you need to configure your external adapter to set up individual listeners per IP address.

I say this because almost everyone on broadband is going to have sometype of router/firewall in between them and the internet so if they send a request out and one IP on your firewall recieves it, it may reply back on a different IP address. Your router/firewall on your side sees this as someone else accessing your network and denies it access.

Dialup does not have this problem because most dialup connections are not protected.

[Sunshine]

Just installed XP SP2 by any chance???

Is there a problem with XP SP2? I have two users who can't connect to our Exchange Server (although VPN seems to work ok). Think it may be a SP2 issue?

[RejectionMan]

have you tryed using a direct high speed conneciton (sans router just hang hte pc out there?) you say nothing has changed since it stoped working.. did it work before from behind your router?

what kind of router do you have, older link sys modles (2-3 years) may have problems correctly passing IPSEC traffic commonly used by VPN connections (lacks Network Address Translation - Traversal NAT-T)

Firewall devices that are doing the same thing?

It sounds like your IPSEC session is inilializing but retur traffic is blocked. why? my guess is NAT. NAT works by replacing the source/destination address to pass the traffic from a private network to the internet (internal ip 192.168.x.x get swaped out for something else from your ISP). problem is that IPSEC uses a hash based on these addresses so changeing them results in an invalid hash and the packet gets dropped (no communicaitons or reply) NAT-T repackages the entire contents of the IP packet in another IP packed to preserve the original addressing and still forward the communication.

[CeeBee]

Is there a problem with XP SP2? I have two users who can't connect to our Exchange Server (although VPN seems to work ok). Think it may be a SP2 issue?

IPSEC NAT-T has been changed in SP2. Can't M$ *NOT* screw something with a SP??? See the M$ KB885407