- This topic has 2 replies, 1 voice, and was last updated 21 years, 6 months ago by
.
-
Posts
-
A couple of weeks ago there was some dialog about this issue, but it appears to have stalled. I’d like to light a fire under it again…
Does anyone have a suggestion on how to repair this issue?
Windows XP (home, pro and tablet) users using built-in Windows vpn client who are behind a Linksys router (models WRT54G, WRT54GS and BEFSR41 or a NetGear — I just tried it!) can not authenticate to OS X (10.3.8 build 7U16) IPsec L2TP vpn server.
Scenerio:
We have an OS X server acting as our vpn server. Machines using Mac OS X and Windows XP (home, pro and tablet) native vpn client software can access the vpn server when directly connected to the Internet. After opening up UDP port 4500 on the OS X server Mac OS X clients can connect to the OS X vpn server when behind a Linksys router (models noted above).
Windows XP clients can not authenticate to the vpn server. A connection is made and the server responds, starts an ESP conversation and it appears that the phase 1 authentication times out.
On the (Windows XP) client side of the connection it appears that the vpn software is connecting, but after about a minute an error comes back saying:
“Error 800: Unable to establish the VPN connection. The VPN server may be unreachable, or security parameters may not be configured properly for this connection.”
I have also followed this article:
http://support.microsoft.com/default.aspx?scid=kb%3Benus%3B818043
and have applied the value of “2” to the “AssumeUDPEncapsulationContextOnSendRule”.
I believe the problem lies with the router’s implementation of NAT-T and how it may change the ESP packet headers (or infomation) when attempting to authenticate with the OS X server.
When speaking with the Linksys support I did the following:
1. Upgraded the router firmware to the most current version.
2. Turned on IPsec, PPTP and L2TP passthrough.
3. Made the client machine (XP) static IP address not in DHCP range.
4. Put client machine in the Linksys router’s DMZ (supposedly opening all ports to the Internet).
5. Put client machine back in the Linksys routers LAN and use port
forwarding for IP ports 47,50,51,500,1701,1723 and 4500.
6. Repeated step 6 with step 5 applied (client machine in DMZ and forwarding ports).
7. Disable the Linksys router’s firewall.
8. Disable the client’s firewall.
9 Repeat steps 7 and 8 together (both firewall’s turned off)
10. Downgraded Linksys firmware to next-most-recent version and repeated steps 2-9.
11. Downgraded Linksys firmware to second-most-recent version and repeated steps 2-9.I have also installed Sveasoft’s Talisman Basic 1.0.1 firmware to a WRT54GS router hoping that their implementation of NAT was different than Linksys’ but even after repeating steps 2-9 I ended up with the same results.
Thanks in advance for the help!
this may sound somewhat basic but have you checked the built-in firewall settings on the Windows Clients ? Windows XP Sr2 automatically starts the built-in firewall w/ no execptions. check the built-in firewall settings on the vpn adapter itself….
hope this helps…… 😀
Thanks kevster, I’ve tried connecting with the fw turned on and off on the XP box. I’ve also allowed ports 50,500,1701and 4500 on the server side. IPSec and L2TP passthrough have been enabled on the Linksys router.
I’ve also tried with the fw off and on on the Linksys router, with the XP client in the DMZ and with port forwarding (the above ports) to a static non-DHCP address. All of these options have been tried in every combination and unfortunately no success so far…
- You must be logged in to reply to this topic.