Solved

VPN connection fails

Posted on 2014-09-06
9
439 Views
Last Modified: 2014-09-19
Hi,
 
 I can't VPN into W2003 Server (running RRAS) on SBS2011 network. It used to work.
 When it failed to connect with Certificate related message, I discovered that SBS2011 self issued certificate has expired already on 5/31/2014. So I ran "Fix My Network" on SBS Console and it created a new certificate that expires 2019.
 I installed the newly issued certificate on both connecting PC and W2003 Server that is running RRAS and rebooted both computers, but I continue to see the errro "The Certificate's CN name does not match the passed value". The connection attempt fails at the tail end.

Thanks.
0
Comment
Question by:sglee
  • 5
  • 4
9 Comments
 
LVL 11

Expert Comment

by:Joseph O'Loughlin
ID: 40308202
In http:Q_27504876.html and similar the solution was checking the new certificate and using it's full cn, including ant trailing full stop.
0
 

Author Comment

by:sglee
ID: 40308208
I read the article,  but I still do not understand what the problem is and how to fix it.
0
 
LVL 11

Expert Comment

by:Joseph O'Loughlin
ID: 40308226
To view certificates
http://msdn.microsoft.com/en-us/library/ms788967(v=vs.110).aspx
In details examine the issuer and subject
Is that your domain's root certificate authority (or was it different for the 2003 server when it was set up)
A full set of cert requirements is at
http://technet.microsoft.com/en-gb/library/cc759575(v=ws.10).aspx#cert_req
If the root ca has changed, with the client on the domain lan
http://technet.microsoft.com/en-gb/library/cc757207(v=ws.10).aspx
howto update the certs on the client off the lan over http
http://www.isaserver.org/img/upl/vpnkitbeta2/vpnclienteap.htm
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:sglee
ID: 40308890
VPN on SBSConsoleI noticed that Virtual Private Network on SBS2011 Console/Connectivity. So I decided to activate that and changed port forwarding to the IP address of SBS2011 computer.
Now it works.

I thought you are not supposed to run RRAS on the domain controller. In fact I remember running into a big problem when trying to activate RRAS on Windows 2008 Domain Controller.  I had to call Microsoft Engineer to resolve/clean up the mess that I created. He told me not to activate RRAS on DCs.

Going back to yesterday, I tried another W2003 Server as VPN/RRAS, but to no avail.  All the PCs that I manage on the network are already joined the domain.
It has been working fine for years too.
The only thing that I can see different is that SBS Certificate has expired.

That said, is it ok to use SBS2011/DC as VPN server? If it is not a good idea, Microsoft would not have made it available on SBS Console ... but then I am not sure if it is such a good idea based on my experience in the past.
0
 
LVL 11

Expert Comment

by:Joseph O'Loughlin
ID: 40309344
It works.  SBS allows several things normally not recommended.
Sorting the expired certificate on the 2k3 machine remains painful to fix.  Review the system and application logs for related errors as (if that identifies the problem)with the given eventid we may be able to request a hotfix.  Have root cert updates been applied to the 2k3  machine ond were there errors importing the cert?
0
 

Author Comment

by:sglee
ID: 40309833
@Joseph
"Have root cert updates been applied to the 2k3  machine ond were there errors importing the cert? " --> Yes I ran new certificate (generated by SBS2011 Console) on W2003 VPN Server, but the same problem.

What I will do is set up W2003 server (Virtual Machine in VMWare host)  on a separate network with PUBLIC IP and VPN into it directly.  I will post the result.
0
 

Accepted Solution

by:
sglee earned 0 total points
ID: 40315439
I have decided to use SBS2011 as VPN server;  therefore I will not try to setup W2003 server as vpn server anymore.

Thanks for your help.
0
 
LVL 11

Expert Comment

by:Joseph O'Loughlin
ID: 40315646
Mark your own post as the solution, and keep the points.
0
 

Author Closing Comment

by:sglee
ID: 40332188
I discovered that I can turn SBS2011 server as a VPN server and it actually worked.
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We recently endured a series of broadcast storms that caused our ISP to shut us down for brief periods of time. After going through a multitude of tests, we determined that the issue was related to Intel NIC drivers on some new HP desktop computers …
I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question