4

I'm building a new machine and everything is working correctly, except that I can't log on to my VPN. It hangs at the "Verifying username and password..." step, then returns after about 30 seconds claiming Error 721.

I have another machine sitting next to this one with the VPN connection configured exactly the same, connecting just fine over the same wifi network, so I'm convinced that there is no server or firewall problem. The VPN works fine. This machine simply can't connect to it given the correct credentials and configuration.

Any suggestions?

6
  • What VPN client? Sep 22, 2009 at 18:26
  • And what modem/router? Are you sure there's no port mapping for that other computer? Some implementations on cheap routers need incoming port 500 forwarded to the client computer. Or, if the modem/firewall/nat router supports UPnP for that, then maybe only a single computer can use VPN at a given time on such routers?
    – Arjan
    Sep 22, 2009 at 18:58
  • It's a ThinkPad X60, with the standard Intel networking stuff. Windows VPN client. The VPN is not set up to only allow certain machines to connect. I'm at a remote location now, and my main machine is connected just fine. It's only the new box that fails.
    – user2791
    Sep 22, 2009 at 19:00
  • And if you disconnect that other machine? (Like I wrote: if UPnP initiates the port mapping, then only one client can be connected at a given time.) No details on the modem/router, right? (Maybe ipconfig will show you some internal IP address for some default gateway. Next, that IP address might reveal some brand/type info of the modem/router when pasting it in your browser.)
    – Arjan
    Sep 22, 2009 at 19:05
  • I mean: one client at the remote site. Or: the modem/router of the remote site needs to open port 500 (at least, in some implementations). There can only be one mapping for that port then, to a single IP-address/computer.
    – Arjan
    Sep 22, 2009 at 19:12

6 Answers 6

2

I had exact same problem, until I just deleted and recreated the connection. I hoped to find out what might be the reason for this here, and found your question.

2

Assuming this is a Windows XP SP2 or later client:

If the server uses NAT, then see Microsoft's KB 885407, "The default behavior of IPsec NAT traversal (NAT-T) is changed in Windows XP Service Pack 2".

According to Wikipedia:

NAT traversal and IPsec

In order for IPsec to work through a NAT, the following protocols need to be allowed on the firewall:

  • Internet Key Exchange (IKE) - User Datagram Protocol (UDP) port 500
  • Encapsulating Security Payload (ESP) - IP protocol number 50

or, in case of NAT-T:

  • IPsec NAT-T - UDP port 4500

Often this is accomplished on home routers by enabling "IPsec Passthrough".

The default behavior of Windows XP SP2 was changed to no longer have NAT-T enabled by default, because of a rare and controversial security issue. This prevents most home users from using IPsec without making adjustments to their computer configuration.

It is not clear to me if machines that have been upgraded to XP SP2 are also subject to the new default. I guess they are, and if NAT is indeed used in your situation then I assume the older machine is running 2000 or earlier? Or if upgraded machines are not subject to the new default, then maybe the older machine was installed with XP prior to SP2, and then upgraded to XP SP2 or later? (Please provide some details for later readers.)

(The required mappings from the first lines of the Wikipedia quote makes it impossible to have multiple VPN clients behind the same cheap home router that uses manual port mapping. The router can then only apply that mapping towards one of the clients. But I assume most modern home routers will support multiple clients nowadays.)

1

Not sure if this is an option or was only a co-incidence that my VPN issue resolved itself in a different way.

But I had an issue of my laptop just one day stopping to connect with no known changes on either end or on network hardware.

My solution was to physically connect the laptop to the network I was trying to VPN into, then subsequent hiberantes and fresh reboots via a VPN connection started to work again.

0

You might try reinstalling your VPN WAN miniports per this knowledge base article. It fixed a similar scenario for me this week.

0

On VPN server open port 1723 tcp

0

I've run into this issue so many times that I felt the need to add this really old thread. If you are on wireless and using an older Intel chipset, check that Intel PROSet is not installed. If it is, uninstall it and use the drivers from Windows Update (right click on the device from Device Manager). Then try the VPN connection again.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .