Windows Xp Problem With Cisco Ipsec Vpn Tunnel

[EtcMarco]

I'll try to be clear.

They are 2 office connected By an DSL line and cisco 837.

They are connected to each other by a VPN tunnel (ipsec).

The remote office as a Intranet Web page + a Terminal server

If i use windows 2000 everything is ok .. The page goes up quickly and the terminal is working. If I use the windows Xp .. I can only see the title and the page expired .. The Terminal is also not working .. I looked everywhere .. Didn't find anything that could help ..

Any ideas ?

Thx

Marco

[email protected]

[Agent Smith]

Hello EtcMarco, wellcome to the Forum.

The first obvious place I would look, is the damn built in XP firewall. Turn it off, the thing is as good as useless and I have found it to be the cause of most networking issues with XP.

The next thing is a question. What version of XP are you using? Home or Professional? The home version has very little in the way of built in networking support other than DUN. This could also be your problem. I am pretty sure you will have a lot of trouble getting the home version to use a VPN.

Another thing to check, without being rude to you, have you ensured that everything is configured correctly on the XP machine. Pay attention to the rights and permissions of the logged in user.

Hope this is useful, if not post back and I shall do some more checking tomorrow. Regards. Mr. Mouse.

[EtcMarco]

Thx for the anwser .. But the firewall Is disable ..

The version of Xp is Professional ..

They are no authentification because it's not the client that connects to the VPN ..

The routers are configured to do the Tunnel + the encryption.

This problem is weird because the windows is supposed to have no effect on the VPN.

It's either a Packet size problem because of the encryption or a Web server error ..

With the same username password in the same domain .. i'm able to access the web page from a win 2000 station and not from a window XP PRO.

My config in my routers are OK .. Cisco's engenieers tried to help me out but where enable to gave me an explication.

It's not an explorer or netscape error ..

One more thing .. If I set up A normal GRE tunnel ( no encryption) both windows XP + windows 2000 are ok ..

ANy ideas ?

[EtcMarco]

I forgot .. They is no link with the domain, Anonymous access on the web page is enable.

SO that's not a permission problem .. With the windows 2000 I can access the page from a computer into the domain or not.

With the XP Either in the domain or not .. I can't access the damn page.

The page start to load up .. The title come up .. I see the documents he's trying to reach .. but .. never load up .. and then expire ..

:blink:

[Agent Smith]

Hello again EtcMarco, I am going to have to do some research on this, time to dust of the cisco books!

Please forgive me, but I have to go out for an appointment right now, so I will give this some time when I return later. I shall probably do some reading when I go to bed, so I will try and reply tomorrow.

Just for reference, can you tell me what version IOS the router is using? And to confirm, are the two os's on different machines (or a dual boot), and if so what is the network layout in that office.

See you soon. Mr. M.

[EtcMarco]

Hello Mr. M. ,

Thanx for trying to help me ..

as for the version of the cisco's .. The remote office is (12.2-15t2) and the main office is an older version (12.2-17) that i'll try to update tonigth.

But like I said .. 7 enginners of cisco double checked the routers .. the case is there since 3-4 weeks. And no enginners where able to get an anwser

The web page is hosted on a NT4 PDC.

Thx !

Marco

[Agent Smith]

Hi again EtcMarco, I have to admit you have got me a bit stumped! <_< Mind you if 7 Cisco engineers couldn't solve the problem I'm going to be well happy if I can help.

Forgive me if some of the following questions are things which are irrelevant or you have already covered, but obviously I do not know the whole scenario, so I shall ask away. :D

When you get the page expired notice from the server, do you lose the whole connection or just fail to load the page? ie can you ping the server immediately after a page expired notice?

Have you tried using the tunnel to connect directly to the server and log on to the domain, without trying to connect to the web site? If so what happens?

I assume that you are writing your own config's, if so have you applied any ACL's (Access Control List)? Could it be possible that an ACL is causing the problem. As these are notoriously difficult to get right, I guess the only way to check this, would be to temporarily remove them. Alternately, if you have none, perhaps you could try to write one to permit the connection.

I understand that you have the routers configured to establish the tunnel, but my understanding of Ipsec, is that it is usually used in conjunction with ISAKMP (Internet Security Association and Key Management Protocol). Now according to the Cisco website, Cisco routers do not create the required certificates for this. However both Win2000 and XP both have support for ISAKMP built in, I am wondering if the default configuration on the XP machine needs to be tweaked. I'm afraid I do not have an XP machine to hand, so I cannot have a look at this at the moment. You may wish to have a look at this page on the Cisco site Configuring and Troubleshooting Cisco Network-Layer Encryption:

Have you considered putting the VPN client on to the XP machines and have them create their own tunnel?

Finally for tonight, you may be onto something with the packet size comment. The mtu size can be changed in the registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Ndiswan\Parameters\

Protocols but before you set a value try the following procedure. From a command prompt try

ping -f -l 1500 [server address]

keep lowering the size of the units (1500) until the returns are un-fragmented. I would then drop the mtu size by another 100 to allow for the encryption and set that in the registry.

I hope that some of this is of use, please reply with any comments, and I shall carry on researching. Regards. Mr. M.

[Agent Smith]

Just to prove that I have not forgotten this one, I ran the problem past some of the guys at work. The general consensus of opinion here, is that this is a certificate issue. It would appear that XP requires authentication from the host.

I don't know if these links help Basic L2TP/IPSec Troubleshooting in Windows XP and Protocol Connections in Windows XP

Please let me know if you sort this, and how.

Thanks. Mr. M.

[EtcMarco]

Thanx for Your time,

I'll try to lower the packet size into the registery of windows.

As for the IPSEC + windows It's shouldn't have any effect because both routers are configured for this.

Windows as nothing to do with that. Every every traffic that's goes to the 172.16.128.0 range is Crypted even a simple PING. Any other traffic will follow the normal route without behing crypted.

The #1 routers engage the VPN Connection to the other .. the both confirm their pre-shared key and then start encrypting and decrypting the traffic.

I'm able to log a Session into the Domain, i'm able to ping every server. It's not a dns error also ..

The only 2 things I see rigth now is either a packet size because of the encryption and by that "Timeout" or either ..well .. my other idea was not good so nevermind.

I'll try to lower the packet size + i'll try to use the gateway adress of the remote office to see if it could be working that way .. but normaly it's it same thing .

This is a little example of the setup Normal " - " as not crypted and " = " is crypted

Legend

- > non crypted

= > Crypted

X > Remote machine

Y > Remote server

OOO > internet cloud

CI > Cisco

X ------ CI =====OOO===== CI --------- Y

The traffic is only crypted when passing into the internet cloud .. from on router to the other .. so the Remote machine don't even know .. as for the server it's the same thing.

This is working damn fine with windows 2000 .. the Page goes up in 2 seconds .. And As i said before .. WIN XP = nothing !

Thx again

Marco