Hi there! Welcome to my blog. My name is Ivan. I am a Dutch IT Professional working as Principal IT Consultant. I installed a Windows 2003 PPTP/L2TP VPN server. After the server installation I started testing the communication by creating a VPN connection. The first error I got while connecting was “Disconnected. Error 721: The remote computer did not respond“. The Windows XP client is running as a VMWare virtual machine and the VPN server is published behind a Cisco PIX 501 firewall.
I checked the VPN server and there I saw the error message below. I verified the NAT configuration and a static NAT rule was configured based on a private and public ip address translation. ACL was there for ‘any’ tcp communication and I added second ACL for IP Protocol 47 (GRE).
Event Source: Rasman
Event Category: None
Event ID: 20209
Date: 1/18/2008
Time: 4:59:22 PM
User: N/A
Computer: VPN-01
Description: A connection between the VPN server and the VPN client 0.0.0.0 has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that the firewalls and routers between your VPN server and the Internet allow GRE packets. Make sure the firewalls and routers on the user’s network are also configured to allow GRE packets. If the problem persists, have the user contact the Internet service provider (ISP) to determine whether the ISP might be blocking GRE packets.
I logged on my Windows Vista Enterprise client and recreated the same VPN connection. The Vista client was connected to my ADSL modem with a wireless connection and it had direct connection to the VPN server. The Windows XP virtual machine was sitting behind the Cisco PIX. I figured out something was missing on my firewall configuration.
How to allow PPTP protocol on a Cisco PIX firewall?
pixfirewall# conf t pixfirewall(config)#fixup protocol pptp 1723 pixfirewall# wr mem
Adding the “fixup protocol pptp 1723” to my configuration let the Cisco PIX firewall know how successfully setup a PPTP connection.
References
Uira Cocha
Thank You very much for your note, it was very useful for me in fixing a similar problem.
Rambie
Thank you my good sir! This was just the answer we needed to fix our VPN issues.