VPN connection issues

I recently made a post about trying to configure our firewall to allow two companies to access a program on out network. From the help I recieved I was able to get everything working just fine, but now one of the companies has emailed me saying they have the following problem when trying to connect to our VPN...

error message: Error 721, the remote computer did not respond.

However when I test it with a laptop hooked up to a outside network it seems to connect just fine and I do not recieve this error. What could be causing this? Is it a problem on the companies end or am I missing something? I was also asked by the other company is the connection traverses their NAT, but I am unsure. The second company connects just fine and I haven't heard any problems with them.

That sounds like a pptp vpn... right?
They're likely behind a firewall that does not do pptp-passthrough.


Ammo

Well my thoughts are always....

If I can confirm connections from at least 2 other locations....from various ISPs and configurations..such as you have done already......you have it working..they dont

its on their end.... ;)

Its the router or the ISP...or just a misconfiguration.....I have heard some isps may limit certain traffic smtp,vpns...cause they want you to use their services......Maybe something you want to look at...

Ensure they have they proper remote access and vpn permissions on your end

MHO as always

MLF

I was informed by the It guy at the company I am working with that he cannot connect from home either. Which is probably just some random ISP like comcast. I still cannot reproduce the problem and was wondering how I should proceed so as to help these people out in making the connection. Do I need to add any rules to our firewall to help the connection get made. Or do they need to set something up on their end so they can get through both their firewall and ours?

Thanks for the help so far it helps shed some light on this mystery.

While running some tests I got an email from the IT guy at the other company and he had this to say about not getting through and what may be causing this issue.

"We do not block any outbound connections. We do NAT, and I cannot change that for this location...curious if that's causing the problems."

Could this be the issue? Or should I have him look at something else that may be causing this connection rejection.

Hey Blunt, me again :)

Has this company been able to successfully connect to your firewall via the PPTP VPN recently? I know you just got all of this set up, but have they made any successful attempts yet?

Are your other partner companies that are using the connection able to connect without any issues?

With out specifics....cant help much

What routers..are you, and the other companies using....firewalls...OSes

Could be a limitation of the router and the amount of simultaneous VPN connections it allows??

MLF

Company A and company B are getting different results. One can connect just fine and their only complaint is that its not very fast, which I expected. The other company cannot get through and always gets an error that the remote computer is not responding and error code 721. Not sure why one works and the other doesn't, but the company that doesn't is a much bigger and therefore many more security rules and policies.

We have an old watchguard firewall III and are using cisco routers. The other company is a sonicwall firewall and it allows then to connect just fine. The bigger company has a number of offices and a number of firewalls and routers. I do not know all the specifics, but to me it seems that somewhere in their secuirty policy is a rule that denies clients in the network to create a VPN to anyone else. Other than that I thought our firewall might not be able to accept connections, but I continue to connect from random wireless networks around the neighborhood just fine with no problems and its fairly quick when connecting. I am pretty clueless as to what the issue is and continue to want to point my finger at the big company for having too tight of a policy when it comes to making outside connections.

The users allowed to connect to our network at PPTP users and I never can reproduce the problem they experiance.

Not knowing the specifics of the 'other' companys' networks, from what you say, it sounds as if the problem will be on their end. Several other companies are connecting through the PPTP VPN you have setup just fine, plus you are connecting just fine during your testing. For the company who is having issues, it's not that their policies are too tight; it appeas that they just need to allow outbound PPTP access for specific employees who have that need to connect back to your network.

Quote:

---

One can connect just fine and their only complaint is that its not very fast, which I expected.

---

This is expected, especially on that older Firebox III - the VPN throughput on those older WatchGuards isn't that great, resulting in a slow VPN connection. I've seen that many times...

Cisco VPN Client Error/Reason Messages:

Error 721: Remote PPP peer or computer is not responding. If you have tried many thing other people suggest like rebooting, reloading hardware and re-installing the VPN or dial in connection, you still get the same problem. I will suggest to check the router settings and make sure TCP Port 1723, IP Protocol 47 (GRE) are opened. Also make sure that the router has the PPTP enabled and not firewall block the traffic. On the RAS server, check the DHCP settings

Do you have enough IP's available/spare?


A guy in this thread was having a similar problem:
http://www.tek-tips.com/viewthread.c...1194013&page=1

He sorted it by upgrading his firmware.

GL

Thanks for the help and I was now wondering what is the best/easiest way to upgrade the firmware on our cisco router? I am willing to do this, but I am not the most confident when it comes to messing around with the router. Also where can I see if there is an update for my Cisco 2600 router?

Sounds Like someone needs to look into
Open VPN and www.ipcop.org as a firewall....

Cisco!!!! Sheee... To big and not customer responsive
and is very Draconia on what is in and out of warnity!!!

Quote:

---

Originally posted here by Blunted One
Thanks for the help and I was now wondering what is the best/easiest way to upgrade the firmware on our cisco router? I am willing to do this, but I am not the most confident when it comes to messing around with the router. Also where can I see if there is an update for my Cisco 2600 router?

---

Log into the router and run the show version command (sh ver). Note the version and download the most compatible version from CISCO . The included doc will help you with the install. If this is your first upgrade do it after hours.

I now have run into the minor issue of not being able to download the software from the Cisco site. Is there another website I can easily download this software from for our 2600 router?

Also is there anything else I should check to see if the connection from the other company is even reaching our network. So I might be able to tell if the problem is on my side or theirs. Even though I am pretty sure it isn't on my side since I have multiple people using the VPN with there PPTP user account. Once again you guys have been quite helpful. I just wish I could get this one all figured out better.

To answer a question you asked earlier...
Since you were able to setup the VPN from different wireless networks I don't think that NAT would be the problem. I wouldn't expect every open wireless network to have a routed subnet, so you had it working from a NAT environment.

I don't think you'll be able to download Cisco IOS upgrades from anywhere but Cisco (legally anyway). I'm sure I'll be told if I'm wrong about this ;)

To upgrade the IOS on the router setup up a TFTP server on a pc you can reach from the router (you can download one from anywhere). Make sure you set up an ethernet connection to the router.
Log on to the router and go into enable mode. Type: copy TFTP Flash <enter>
The router will ask you some questions like filename and IP adres to copy from and will start copying the software from your TFTP server to the router. Reload en see it boot with the new version :)

Make sure the IOS version you use is supported by the router and obviosly backup the old IOS version and config before upgrading.

GL.

Morvai.

Here is a real Dumb Question....
Did you try www.ipcop.org ???

I use it and it has everything in it you need....
and VPN is one of them.....

I use the OpenVPN client myself....

It also has Snort and several other utilities I like....
And best of all it is Open Source and no M$ fingers in the pie...

This is the current message our firewall is giving out when the company that cannot connect tries to connect. Not exactly sure what it means, but I seem to see their address, but on their end it hangs for about 30 seconds and then they get the 721 error message. Does anyone have any new ideas what is going on? I am still on the hunt for a solution to our VPN problem.

04/19/06 13:00 pptpd[29069]: Watchguard pptpd 2.2.0 started
04/19/06 13:00 pptpd[29069]: Using interface pptp1
04/19/06 13:00 kernel: pptp1: daemon attached.
04/19/06 13:00 pptpd[29069]: Connect: pptp1 [1] <--> **.**.**.**

04/19/06 13:04 pptpd[29311]: Terminating on signal 2.
04/19/06 13:04 pptpd[29311]: Connection terminated.
04/19/06 13:04 pptpd[29311]: Persist flag not set, so we are exiting.
04/19/06 13:04 kernel: pptp1: pptp_sock_close

Every other message on the traffic monitor is a deny this is the only one that seems to show that our firewall recieves a message for PPTP connection and then after a few minutes just closes it off. Any help is greatly appreciated.

You didn't post the whole log. So everyone will be guessing. Check here:

http://seclists.org/lists/bugtraq/2001/Feb/0123.html

If your log looks the same download the patch. If not my next educated guess is an IP address conflict.

Are you at least getting the user loged in message in the log? That would be the first thing to look for. Can you be more clear on what the denies are?

Download Netcat or Use Telnet or Nmap

nc -v -n xx.xx.xx.xx 1723
is it open?

Telnet
open
to xx.xx.xx.xx. 1723

Use pptpping to test and see if the GRE packets are goign through the firewall.
WHat kind of firewall do you use? Does it support pptp passthrough? some dont


Do you want to use L2TP / IPSEC?

did you tes to see if

UDP port 1701, 4500, 500 are open?

Are you going to use RRAS for you VPN server?
DId you enable pptp or l2tp ports?
You using DHCP or going to create a STATIC pool?

Port 1723 is open and I have other people using the PPTP and are able to get through just fine. Only this one other company (which is much bigger and has a lot more security policies) cannot get through the VPN. I have been told it simply sits there and hangs and then after it tries to verify username/password it returns the error of 721. PPTP is enabled we have a pool of address for those who log in. Only one company out of three is having problems, but I am still unsure as to why they cannot make it through and always get the error 721 even thought I can see a connection attempt being made in the firewall's traffic monitor. Strange.

Is company X blocking any outbound traffic? Has the firewall config been reviewed along with all logfiles for traces of VPN traffic?

Have you checked the configs on the clients setting from the site that are trying to connect?

is negotiate multi link on single link connections enabled or disbaled? you might wanna look into this i have seen issues with this. try both settings and post log files.

is LCP extensions enabled?