L2TP error 791 connecting from outside 3

[pfriedma]

We're trying to use L2TP/IPSec to get remote access for our users (it's more compatible with firewalls than PPTP seems to be), and are running to a bit of trouble connecting.

Our setup:
Win2003 server with RRAS configured to listen for L2TP connections (using SharedKey instead of certificates).

WinXP clients with L2TP and the secret configured in their VPN connector.

Firewall is a Linksys forwarding ports 500, 1701, 4500 (both TCP+UDP)

The VPN connection works fine when the client is on the lan, but when it's outside the firewall I get "Error 791: The L2TP connection attempt failed because security policy for the connection was not found".

From the logs, I can see that the IPSec tunnel is being created fine (the IKE works, etc.)

Anyone out there seen this before? (or have an idea which security policy is missing?)

Thanks greatly in advance.

---Paul

 

[LeDeau]

I'm having this same problem, did you ever find a solution for it?

 

[John Lewis]

The security policy that is missing is normally created automatically by RRAS and registered with Policy agent when the connection is negotiated. You can't manually create it, change it or even see it through normal channels.

Error could suggest that Policy agent is not running, or started after RRAS for some reason. Policy agent must start first.

 

[pfriedma]

From working through this with MS, it appears that the problem is with my router's NAT functionality. Using L2TP requires NAT-T (translation) functionality which mine doesn't support.

Ah, well... buying a new router today.

---Paul

 

[glaserud]

Just solved this problem on a similar setup. The problem (in my case) is that the 2000/XP-machines are not able to do the ipsec/l2tp-connection because either end is being NAT'ed. The solution is to download a patch from microsoft.

The KB article discussing the patch is on

http://support.microsoft.com/default.aspx?scid=kb;en-us;818043

Installed it on the XP/2000-clients and it works like a charm.