[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

VPN SBS 2008 Not Working

Posted on 2011-05-06
20
Medium Priority
?
883 Views
Last Modified: 2012-05-11
I am trying to connect to an sbs server via vpn but every time i try & connect it fails on the user name & password.

I have opened ports 1723 & 47 on my router & have also enabled vpn access for the user in question via the sbs console.
0
Comment
Question by:Daniel Bertolone
  • 10
  • 7
  • 3
20 Comments
 
LVL 15

Expert Comment

by:Juan Ocasio
ID: 35705467
Is routing and remote access enabled on the SBS server?
0
 

Author Comment

by:Daniel Bertolone
ID: 35705488
Where do i look to check?
0
 
LVL 78

Expert Comment

by:Rob Williams
ID: 35705511
If it does the initial connection and fails on the password do you get a 721 or 691 error? I suspect you have forwarded port 1723 correctly but not GRE. GRE is protocol 47 not port 47. To allow GRE there are different methods on different routers but generally you cannot do this with a forwarding rule. On some routers you enable "PPTP pass-through", on others you forward the built-in PPTP service, not port 1723 and it does both for you, yet on others it requires a command to enable GRE pass-through. If you can provide the make and model of the router we may be able to provide specifics.

I assume you enabled the VPN using the wizard from the SBS console under network | connectivity?
0
New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

 
LVL 15

Expert Comment

by:Juan Ocasio
ID: 35705578
Go to Start->Administrative Tools->Routing and remote access.  Check to see if it's enabled.  Expand your server

Right-click ports -> Properties
click Wan Miniport (PPTP) and press configure
Make sure 'Remote access connections (inbound only)' is checked
configure maximum ports to allow for as many concurent vpn connections (mine is set up for 5)
0
 

Author Comment

by:Daniel Bertolone
ID: 35705586
I always get the following error.

Router is a draytek 2820
vpn.png
0
 
LVL 78

Expert Comment

by:Rob Williams
ID: 35705616
That is not a GRE error then. That is prior to where GRE would fail.
Does the user have permission to use the VPN?
They need to be granted access in the SBS control panel under users | properties of the user | remote access | "user can access virtual private network"
0
 

Author Comment

by:Daniel Bertolone
ID: 35705620
User has been granted vpn access via the sbs console
0
 
LVL 78

Expert Comment

by:Rob Williams
ID: 35705636
As a test try connecting from the LAN using the LAN IP of the server not the public address and see if you can connect with that user name and password.

Also in Active Directory make sure under the Dial-in tab of the user's profile they are not set to deny access.
0
 

Author Comment

by:Daniel Bertolone
ID: 35705680
Checked routing & remote access and is configured as you mentioned
0
 
LVL 15

Expert Comment

by:Juan Ocasio
ID: 35705702
Have your forwarded port 1723 to your SBS server?
0
 

Author Comment

by:Daniel Bertolone
ID: 35705709
Checked in AD & the users remote dial in tab is set to "control access through NPS network policy"
I tried changing to allow but it made no difference
0
 

Author Comment

by:Daniel Bertolone
ID: 35705718
Port 1723 has been forwaded to the servers internal ip on the router
0
 

Author Comment

by:Daniel Bertolone
ID: 35705789
VPN Connection internally works with the same credentials
0
 
LVL 78

Expert Comment

by:Rob Williams
ID: 35705814
NPS is correct.
If works internally it may then be a GRE error. Initial handshaking is dine via port 1723, but GRE is required for authentication.
What make and model router?
0
 

Author Comment

by:Daniel Bertolone
ID: 35705824
Draytek 2820
0
 
LVL 78

Accepted Solution

by:
Rob Williams earned 2000 total points
ID: 35705851
On the Draytek have you disabled it's own VPN service?
It should automatically enable GRE.
Please see:  http://www.draytek.co.uk/support/kb_vigor_passthrough.html

Also the Draytek must be assigned a public IP. In other works you can only have 1 NAT device between the Internet and the SBS. In some cases people have a modem that acts as a combined modem and router and then another router on the LAN side of the modem. In these situations the modem needs to be in Bridge mode.
0
 

Author Comment

by:Daniel Bertolone
ID: 35705928
Mate you are a star, that sorted it!

If i wanted to use the routers own vpn service aswell is this possible?
0
 
LVL 78

Expert Comment

by:Rob Williams
ID: 35705971
Glad to hear.

You can use a different service on the Draytek for VPN but not the same.
For example you can enable the IPSec VPN on the Draytek, which is more secure, and still use the SBS PPTP VPN, but you cannot use PPTP on both.
0
 

Author Comment

by:Daniel Bertolone
ID: 35706037
Thanks Rob!
0
 
LVL 78

Expert Comment

by:Rob Williams
ID: 35706064
You are very welcome. Thank you Dantech-IT-Solutions.
Cheers!
--Rob
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
Let’s list some of the technologies that enable smooth teleworking. 
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Course of the Month19 days, 11 hours left to enroll

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question