I have a Windows 2003 SBS R2 SP2 with ISA 2004 SP2 installed at my main office and I have a Linksys RV042 VPN router installed at my branch office. As a test, at the brach office I have just a single Windows 2003 SP2 stand alone server connected to the RV042 router.
I have set up IPSec tunnel mode as per Tom Shinders article and I the RV042 connects fine and without error.
From the branch office W2K3 box, I can ping the main office SBS and workstaiton. I can map to shares on the SBS box and I can remote desktop to workstations in the main office.
The problem is that I can not ping or really do anything from the main office SBS box to the branch office W2K3 box. I even temporarily disabled the firewall on the RV042 and it didn't make a difference.
When I did a ping from the main office SBS Box to the branch office W2K3 box I got following message...
request timed out
Negotiating IP Security
Negotiating IP Security
Negotiating IP Security
I took a look at the security event log on the SBS box and I found the event listed below that happened when I did the ping.
--------------------------
----Start Event Log Post----------------------
----
IKE security association negotiation failed.
Mode:
Data Protection Mode (Quick Mode)
Filter:
Source IP Address 70.63.55.42
Source IP Address Mask 255.255.255.255
Destination IP Address 192.168.3.0
Destination IP Address Mask 255.255.255.0
Protocol 0
Source Port 0
Destination Port 0
IKE Local Addr 70.63.55.42
IKE Peer Addr 12.109.87.87
IKE Source Port 500
IKE Destination Port 500
Peer Private Addr
Peer Identity:
Preshared key ID.
Peer IP Address: 12.109.87.87
Failure Point:
Me
Failure Reason:
Negotiation timed out
Extra Status:
Processed third (ID) payload
Initiator. Delta Time 63
0x0 0x0
--------------------------
----End Event Log Post----------------------
----
I loaded the IP Security Monitor in an MMC and noticed that there are Quick Mode generic and specific filters for the
Source 192.168.2.0 to Destination 192.168.3.0
Source 192.168.3.0 to Destination 192.168.2.0
Source 70.63.55.42 to Destination 192.168.3.0
Source 192.168.3.0 to Destination 70.63.55.42
Along with others to the gateway endpoints. The Security Association node had the following single association listed.
192.168.2.0(255.255.255.0)
Properties
Me: 192.168.2.0(255.255.255.0)
Peer: 192.168.3.0(255.255.255.0)
My Port: Any
Peer Port: Any
Protocol: Any
My tunnel endpoint: 70.63.55.42
Peer tunnel endpoint: 12.709.87.87
Policy name: ISA Server Callahan IPSec Tunnel QM Policy <--(The name for the branch office VPN remote site, minus the words QM Policy)
AH integrity: <none>
ESP confidentiality: 3DES
ESP integrity: HMAC-SHA1
Key lifetimes (KB/Sec): 100000/3600
PFS Eabled: Yes
PFS DH Group: Medium (2)
All of this was created by ISA Server, I believe. It seems to be correct but I am no expert on this.
Please remember that I can connect and png from the branch to the main office. I can map drives and to remote desktop connecitons. I just cant go from the main office to the branch because it appears that the negotiation times out.
Any other ideas?
Thanks,
Dave
Start Free Trial
