VPN Setup: Server won't authenticate user

[qwkphkr]

Hello,
I'm attempting to set up VPN on SBS 2003. I have used the RRAS wizard to cinfigure RRAS for VPN. I have turned on the ports in the Firewall. The server is NAT'd, and the ports are mapped through the router.

When I set up my client, it connects to the remote end however when it attempts to authenticate my username it simply hangs there until it times out. It is never able to verify the user name.

I was doing this for a client and decided to set up a test lab and got the same result.

I see some information regarding the windows firewall, but can find nothing that details how to disable it, nor do I find anything that definitively states that is the problem.

Any help is appreciated, thank you!

 

[qweasdzxcqweasdzxc]

Check the security event log to see if the login request is even hitting the server....You can disable windows firewall through the control panel. Make sure you have the proper server addresses configured in your VPN concentrator. Make sure you are accessing the vpn through an outside network (a different subnet on the outside interface.)Try using the domain name befor the username....ie

whatever.com\administrator
password

 

[msworld]

Sounds liek GRE issue. This search result may help,

cannot establish VPN with error 721 and 800
Whenever he tries to establish the VPN, he receives Error 721 or 800. Troubleshooting: 1. Telnet port 1723 and get respond. ...

httP://www.chicagotech.net/cisco/vpngre1.htm

Bob Lin, MS-MVP, MCSE & CNE
How to Setup Windows, Network, VPN & Remote Access on

http://www.HowToNetworking.com

 

[qwkphkr]

Just an update. The company that manages the router for this client has attempted to open the correct ports. I worked with them for a little while. They have port 1723 and 47 open on both TCP and UDP as well as having GRE enabled. They have mapped the IP address to my internal server IP address. Nothing is working right now. I only have one nic in the server and am wondering if maybe that is causing some confusion in the system somewhere.

 

[msworld]

GRE is not TCP/UDP port. It is protocol IP port 47.

Bob Lin, MS-MVP, MCSE & CNE
How to Setup Windows, Network, VPN & Remote Access on

http://www.HowToNetworking.com

 

[qwkphkr]

Well it turns out that both the hosting company and I have a little to learn about networking. What they have is simply a Cisco 2600 Router which uses NAT translation for security on the internal LAN. They (the hosting company) were hesitant to do a direct mapping of one external IP address to the internal NAT address of the VPN server for security reasons. I was under the impression that they had a firewall in place, but there isn't. When i asked them to do the mapping to test, the VPN connection worked flawlessly.

My final question is: Are they correct in telling me that mapping the IP address will create a security vunerability?