Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm building a new machine and everything is working correctly, except that I can't log on to my VPN. It hangs at the "Verifying username and password..." step, then returns after about 30 seconds claiming Error 721.

I have another machine sitting next to this one with the VPN connection configured exactly the same, connecting just fine over the same wifi network, so I'm convinced that there is no server or firewall problem. The VPN works fine. This machine simply can't connect to it given the correct credentials and configuration.

Any suggestions?

share|improve this question
    
What VPN client? –  Nicolas Webb Sep 22 '09 at 18:26
    
And what modem/router? Are you sure there's no port mapping for that other computer? Some implementations on cheap routers need incoming port 500 forwarded to the client computer. Or, if the modem/firewall/nat router supports UPnP for that, then maybe only a single computer can use VPN at a given time on such routers? –  Arjan Sep 22 '09 at 18:58
    
It's a ThinkPad X60, with the standard Intel networking stuff. Windows VPN client. The VPN is not set up to only allow certain machines to connect. I'm at a remote location now, and my main machine is connected just fine. It's only the new box that fails. –  user2791 Sep 22 '09 at 19:00
    
And if you disconnect that other machine? (Like I wrote: if UPnP initiates the port mapping, then only one client can be connected at a given time.) No details on the modem/router, right? (Maybe ipconfig will show you some internal IP address for some default gateway. Next, that IP address might reveal some brand/type info of the modem/router when pasting it in your browser.) –  Arjan Sep 22 '09 at 19:05
    
I mean: one client at the remote site. Or: the modem/router of the remote site needs to open port 500 (at least, in some implementations). There can only be one mapping for that port then, to a single IP-address/computer. –  Arjan Sep 22 '09 at 19:12
show 1 more comment

5 Answers

I had exact same problem, until I just deleted and recreated the connection. I hoped to find out what might be the reason for this here, and found your question.

share|improve this answer
add comment

Assuming this is a Windows XP SP2 or later client:

If the server uses NAT, then see Microsoft's KB 885407, "The default behavior of IPsec NAT traversal (NAT-T) is changed in Windows XP Service Pack 2".

According to Wikipedia:

NAT traversal and IPsec

In order for IPsec to work through a NAT, the following protocols need to be allowed on the firewall:

  • Internet Key Exchange (IKE) - User Datagram Protocol (UDP) port 500
  • Encapsulating Security Payload (ESP) - IP protocol number 50

or, in case of NAT-T:

  • IPsec NAT-T - UDP port 4500

Often this is accomplished on home routers by enabling "IPsec Passthrough".

The default behavior of Windows XP SP2 was changed to no longer have NAT-T enabled by default, because of a rare and controversial security issue. This prevents most home users from using IPsec without making adjustments to their computer configuration.

It is not clear to me if machines that have been upgraded to XP SP2 are also subject to the new default. I guess they are, and if NAT is indeed used in your situation then I assume the older machine is running 2000 or earlier? Or if upgraded machines are not subject to the new default, then maybe the older machine was installed with XP prior to SP2, and then upgraded to XP SP2 or later? (Please provide some details for later readers.)

(The required mappings from the first lines of the Wikipedia quote makes it impossible to have multiple VPN clients behind the same cheap home router that uses manual port mapping. The router can then only apply that mapping towards one of the clients. But I assume most modern home routers will support multiple clients nowadays.)

share|improve this answer
add comment

Not sure if this is an option or was only a co-incidence that my VPN issue resolved itself in a different way.

But I had an issue of my laptop just one day stopping to connect with no known changes on either end or on network hardware.

My solution was to physically connect the laptop to the network I was trying to VPN into, then subsequent hiberantes and fresh reboots via a VPN connection started to work again.

share|improve this answer
add comment

You might try reinstalling your VPN WAN miniports per this knowledge base article. It fixed a similar scenario for me this week.

share|improve this answer
add comment

On VPN server open port 1723 tcp

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.