Setting up a VPN with ISA 2006

I am having real difficulties setting up a basic PPTP VPN connection through our ISA 2006 server. I wish to have external access to our network. Here is my configuration and what I have attempted. Sorry it's long.

Windows 2008 DC
Installed ISA 2006 Standard on Windows Server 2003 with all services packs , updates etc.

IP configuration on ISA:

IP -
<no gateway>
DNS - &

IP -
GATEWAY - (router)
DNS - & (external DNS for internet access)
DISABLED Client for Microsoft Networks and File and Print Sharing on this NIC

I have enabled VPN Client Access. I had to remove the external DNS entries from the WAN NIC as ISA popped up with a message stating that it could not add the ISA server to AD. Once these entries were removed, it registered OK. They are back on the NIC as I am unsure on how to set forwarders up correctly under DNS.
Address assignment method is DHCP
Authentication is MS-CHAPv2
No RADIUS server

I have created a VPN Users group in AD and added my user to this group.
Under VPN Client Properties I have set 10 VPN user limit. Added the VPN Users group. Enabled PPTP.

In the Firewall Policy, I have setup the following 2 rules:

DHCP Request (VPN to Local Host)
Protocols: DHCP (request)
From: VPN Clients
To: Local Host
All Users

DHCP Reply (Internal to VPN)
Protocols: DHCP (reply)
From: Internal
To: VPN Clients
All Users

In the Routing and Remote Access, I have setup a DHCP Relay Agent and set the IP address of our DHCP server.

I have opened port 1723 on our router and have pointed it to the external NIC IP.

I have checked to see if ISA is listening for port 1723 using netstat and it is.

When I try to connect to the VPN, ISA logs display that it sees the external connection using PPTP protocol and was successful. Then there is a DHCP request that is denied Default Rule (not sure if this is the VPN client attempting to request a DHCP address or not). At the client end I receive an Error: 721 message.

I have looked far and wide for a solution but I cannot. Can any VPN/ISA gurus help please?

Who is Participating?
Pete_ZedConnect With a Mentor Author Commented:
OK, I have found the answer to all my problems - well VPN problems anyway. I had a suspicion that our aging Nokia M1122 ADSl router was not allowing PPTP pass through and I was right! I have replaced the router with a Linksysy model and now I have VPN access. Yay!
I'd start by connecting another machine to the 192.168.1.x network, giving it an address and trying to VPN to I'm assuming that because of the double translation you're going through, between MTA limits and other issues it'll have some problems. Start to see if the ISA firewall even establishes a connection. If it's an IP issue, set a static IP for the VPN connection, and see if it connects. That's a start.
Pete_ZedAuthor Commented:
I connected a laptop up to the 192.168.1.x network and I could connect without a problem. I can't map network drives but that will be another problem which I will look at. I can ping the IP and FQDN of the internal servers OK.

So what can I do for my off-site computers that I want to connect to our network via a VPN connection? I'm not sure what my next troubleshooting step is.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.