VPN Connection Problem between 2003 Server & 2003 Server 1

[mossc001]

I have basically setup a site-to-site network but am unable to get the two servers to create a tunnel between each other.

Clients can connect fine to each server without any problems but when I try and connect the two servers together, it connects but hangs on verifying the username and password then eventually comes up with a general "unable to connect message".

The usernames and passwords used to connect the servers together work fine when connecting from an XP client to the 2003 Servers.

Site one
Server: 10.0.0.100
Allocation IP Range: 10.0.1.1 - 10.0.1.10

Site two
Server: 192.168.0.100
Allocation IP Range: 192.168.0.1 - 192.168.0.10

I don't quite understand why It can connect but not get past the verification of users when the usernames work fine for clients.

Any help would be much appriciated!

 

[pmf71]

Thre's a document in the MS knowledge base on how to establish an IPSec tunnel between two MS servers (2k or 2k3). Requires no authentication, only preshared keys on both sides.
It uses IPSec policies to create a tunnel whenever packets need to be routed to the other site. Works like a charm once you get it running, i've used it before.

This is the link:

http://support.microsoft.com/default.aspx?scid=kb;en-us;252735

 

[pmf71]

One more thing, you'll need to add appropriate static routes to your default gateway to ensure that packets to the other site are routed to your server and not over the internet gateway.

 

[pmf71]

And another interesting note: this can also be accomplished between two windows 2000 pro / XP pro machines. The server OS is not a requisite.

 

[mossc001]

Is it possible to set up a VPN with 4 servers in a similar way to setting up 2 servers on a site-to-site setup?

Ultimately this is what I will require in the future. Looks like I've still got a lot of things to learn!

 

[pmf71]

You mean linking up 4 sites to each other? yes, should be no problem. Things can get a bit complex in the configurations, but it's definately doable.

On a professional note: if you're ultimately going to build a WAN with multiple sites, and i assume you will be going to rely heavily on it, you will be much better off using hardware VPN routers. They are much more capable of doing this job. And even better, if one of your servers hangs or breaks down, you don't lose the VPN tunnels, as you would if the server were handling the vpn tunnels. This way another DC on the WAN can become BDC for the LAN where the server broke down. There's a good saying for this: Don't put all your eggs in one basket.
Zyxel has a good assortment of nicely priced routers with excellent VPN capability.