error 721 - when trying to vpn

July 22, 2008

Hi,

We are running ISA Server 2004 Pack 3 on windows 2003 sp2.

One of the users when they try to VPN in get the following error:

Event ID: 20209 [logged on the ISA2004 server]

Source: RasMan

"A connection between the VPN server and the VPN client w.x.y.z has been

established, but the VPN connection cannot be completed. The most common

cause for this is that a firewall or router between the VPN server and the

VPN client is not configured to allow Generic Routing Encapsulation (GRE)

packets (protocol 47). Verify that the firewalls and routers between your VPN

server and the Internet allow GRE packets. Make sure the firewalls and

routers on the user's network are also configured to allow GRE packets. If

the problem persists, have the user contact the Internet service provider

(ISP) to determine whether the ISP might be blocking GRE packets."

The user gets error message 721 at home.

Can anyone suggest a resolution?

Thankx

July 22, 2008

RE: error 721 - when trying to vpn

We followed this steps to solve the problem...

Could you please check if this helps you...

- Used PPTP-ping.exe on Client and server to verify the block.

- Found GRE-47 protocol blocked on the Linksys firewall.

- Checked router configuration found Linksys WRT54G wireless router.

- Searched if WRT54G is GRE 47 enabled.

- Found Linksys Form:

http://www.linksysinfo.org/forums/showthread.php?p=303679

- As per the Form this router has a specific problem with GRE 47 protocol

Suggestion:

- Try to reset the firewall since it was working earlier.

- Else replace the Firewall that allows GRE 47 protocol.

Best of luck

--

Mir Sajjad Mehdi

Microsoft XP Platform Support

"melu" wrote:

> Hi,

>

> We are running ISA Server 2004 Pack 3 on windows 2003 sp2.

>

> One of the users when they try to VPN in get the following error:

>

> Event ID: 20209 [logged on the ISA2004 server]

> Source: RasMan

>

> "A connection between the VPN server and the VPN client w.x.y.z has been

> established, but the VPN connection cannot be completed. The most common

> cause for this is that a firewall or router between the VPN server and the

> VPN client is not configured to allow Generic Routing Encapsulation (GRE)

> packets (protocol 47). Verify that the firewalls and routers between your VPN

> server and the Internet allow GRE packets. Make sure the firewalls and

> routers on the user's network are also configured to allow GRE packets. If

> the problem persists, have the user contact the Internet service provider

> (ISP) to determine whether the ISP might be blocking GRE packets."

>

> The user gets error message 721 at home.

>

> Can anyone suggest a resolution?

>

> Thankx

>

July 22, 2008

RE: error 721 - when trying to vpn

Hi,

The user has informed me that they don't have a Linksys router?

Any other ideas?

Thanks

July 22, 2008

RE: error 721 - when trying to vpn

In article <227AB835-ECC6-46BA-AD44-115985C58B70@microsoft.com>,

melu@discussions.microsoft.com says...

>

> Hi,

>

> The user has informed me that they don't have a Linksys router?

>

> Any other ideas?

>

> Thanks

>

Error 721 is almost always GRE or that the users have more than the

supported number of VPN tunnels in operation than the device supports.

Most residential devices support a max of 2 PPTP tunnels.

Many cheap residential devices do not properly handle PPTP Pass-Through.

If you have a firewall application (other than Windows Firewall) on the

computer it could also cause improper GRE resolution.

Many routers (cheap residential stuff) required several firmware updates

to fix GRE issues - check the vendors site for a firmware update.

--

- Igitur qui desiderat pacem, praeparet bellum.

- Calling an illegal alien an "undocumented worker" is like calling a

drug dealer an "unlicensed pharmacist"

spam999free@rrohio.com (remove 999 for proper email address)

October 18, 2008

RE: error 721 - when trying to vpn

I am writing this letter to ALL Wireless Router manufacturers.

I have a Linksys Wireless Router Model:BEFW11S4. It is 7 years (yes, count

them, all of seven little years) old. I have visited the Linksys website

numerous times trying to set up the WEP/WPA security on that wireless router

(as all responsible wireless router owners should!). I found that there are

no links to any wireless router setting websites that are congruent with the

screen shots from Linksys' own self help technical support site. I have had

to call Linksys several times to resolve this issue only to be placed on hold

for lengthy times (sometimes my call was dropped and I had to start over ....

how sad for such a large company to have such poorly trained phone

receptionists!), then be transferred (see previous comment about the phone

receptionists) to a supposed supervisor, only to finally be transferred to

someone who tells me that the warranty has expired and wants me to pay $40.00

for the technical support to do the right thing that I want and need to do.

First, the device works fine (as evidenced by this e-mail that you have

just received)!

Second, why should I have to pay for doing the right thing?

Third, if I am going to be EXTORTED into buying a new wireless router so

that I can do the right thing and set up an encryption key for a secure

network, what on Gods' Green Earth makes anyone think that I would CHOOSE to

buy another Linksys product when ALL that I have ever received from them is a

functional wireless router (yes, even after seven whole years) and the

crappiest Customer Service/Technical Support I have ever had the displeasure

to encounter!

I shall copy this letter and try to find as many Chat Rooms as possible in

order to spread the word of ALL that I have gone through with the Chain of

Command at the Linksys phone center, well above and beyond what any

reasonable person should expect to go through, and still have NO RELIEF

concerning my singular issue with their product and its capabilities that I

SHOULD be able to enjoy as the owner of said product! What has happend to

"The Customer Is Always Right" Customer Service mantra (I can't say "In

America" because the call was handled in India)? Is the Customer, the ones

that makes the company what it is through the purchase of products, so

worthless to the company that they can just be treated with abject contempt

and scorn? Is the Customer to thus be trampled underfoot? Are we paying to

be so abused? I, for one (yes, one, the beginning of all), shall NOT be

treated in such manner, and CERTAINLY shall NOT PAY to be treated as such!

In this world of expanding technologies, it shall be those with the

GREATEST Customer Appeal that shall continue to be found worthwile in the

publics' eyes (and pocketbooks) and shall grow to meet the demands of a

growing world - ESPECIALLY in the Electronics Department!

It is now my strongest desire that the Linksys Corporation suffers

irreparable damage and goes out of business for their Crappy Customer

Service! I can only hope that I reach enough people around the world to bring

this desire true!

"Leythos" wrote:

> In article <227AB835-ECC6-46BA-AD44-115985C58B70@microsoft.com>,

> melu@discussions.microsoft.com says...

> >

> > Hi,

> >

> > The user has informed me that they don't have a Linksys router?

> >

> > Any other ideas?

> >

> > Thanks

> >

>

> Error 721 is almost always GRE or that the users have more than the

> supported number of VPN tunnels in operation than the device supports.

>

> Most residential devices support a max of 2 PPTP tunnels.

>

> Many cheap residential devices do not properly handle PPTP Pass-Through.

>

> If you have a firewall application (other than Windows Firewall) on the

> computer it could also cause improper GRE resolution.

>

> Many routers (cheap residential stuff) required several firmware updates

> to fix GRE issues - check the vendors site for a firmware update.

>

> --

> - Igitur qui desiderat pacem, praeparet bellum.

> - Calling an illegal alien an "undocumented worker" is like calling a

> drug dealer an "unlicensed pharmacist"

> spam999free@rrohio.com (remove 999 for proper email address)

>

October 18, 2008