• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Desperate HELP: VPN Client cannot access internal network

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Firewall] >> VPN >> Desperate HELP: VPN Client cannot access internal network Page: [1]
Login
Message << Older Topic   Newer Topic >>
Desperate HELP: VPN Client cannot access internal network - 5.Apr.2006 3:47:43 AM   
brunovairo

 

Posts: 8
Joined: 5.Apr.2006
Status: offline
Hi Tom and everyone,
 
I'm with a very critical problem.
Recently I have to rebuild my ISA2004 SP2 server which is member of a domain. I decided not to export and import the old configuration, and otherwise, start it all over.  
 
Well, after setting up the rules, everythin is working fine, except for VPN client with PPTP. I can connect and authenticate VPN Clients with no problem. But now come my problem: when I have connected and been validated I can not access anything on the internal network (even using IP address). I've created rules there allow anything from ALL USERS from VPN Clients to the Internal network and Local host, but it seems like my traffic is disappearing. The users can get connected, get an IP-address (which is static), validate in AD, and, one thing important: THEY CAN ACCESS ISA SERVER (ping, RDP, etc), but not access internal servers and resources. When I get monitoring the trafic in ISA Server for VPN Clients, nothing is shown to Internal Network. YES, there's nothing in monitoring logging.
 
But here is the setup:
 
ISA 2004 with SP2 which is member of the domain.
Public interface is setup with public IP address and default gateway on the same subnet obviously
 
Internal interface:
IP                  192.168.0.1/24
 
VPN Clients Static Pool
192.168.100.10 to 192.168.100.20
 
The ISA server can ping and make nslookup on all the infrastructure internal servers.

If any one has a suggestion what I might need to set or how I can troubleshoot it, I would be very gratefull. 
 
I've been through the guides on this forum, the books, MS VPN deployment guide, and MS Premier Support Site. And I can't find the error.
Thanks in advance for any suggestion there can point me in the right direction.
If you miss any information about the setup, ask and I will try to give it. 
 
Best Regards, Bruno.
Post #: 1
RE: Desperate HELP: VPN Client cannot access internal n... - 6.Apr.2006 2:21:26 PM   
Zac

 

Posts: 44
Joined: 6.Oct.2005
From: Kuwait
Status: offline
Hi,


Try enabling DHCP in ISA. Also you have to make sure that dhcp relay agent is properly configured in isa. Try this linkhttp://www.isaserver.org/tutorials/2004dhcprelay.html


HTH


Zac.

(in reply to brunovairo)
Post #: 2
RE: Desperate HELP: VPN Client cannot access internal n... - 7.Apr.2006 10:11:40 PM   
brunovairo

 

Posts: 8
Joined: 5.Apr.2006
Status: offline
Hi Zac,

Thanks for you reply.

I made the DHCP configuration listed on that article, but the problem persists.
DHCP relay agent works properly, but the problem was the same.

Any sugestions?

Best regards, Bruno.

(in reply to Zac)
Post #: 3
RE: Desperate HELP: VPN Client cannot access internal n... - 7.Apr.2006 10:32:10 PM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
 
Did u assign ur VPN clients with DNS Server and Wins server ?

what about ur Network Interfaces configuration , can u provide us with information about ur external nic and ur internal nic.

one last thing , establish a vpn connection and paste for us the result of  ipconfig /all

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to brunovairo)
Post #: 4
RE: Desperate HELP: VPN Client cannot access internal n... - 7.Apr.2006 10:43:31 PM   
brunovairo

 

Posts: 8
Joined: 5.Apr.2006
Status: offline
Yes. I don't think it's a name resolution problem, because I can't access anything in internal network even with IP address.

Here's the IPCONFIG result on vpn client connection:
Thanks another time for the attention.

Windows IP Configuration
       Host Name . . . . . . . . . . . . : brunovairo
       Primary Dns Suffix  . . . . . . . :
       Node Type . . . . . . . . . . . . : Hybrid
       IP Routing Enabled. . . . . . . . : No
       WINS Proxy Enabled. . . . . . . . : No
       DNS Suffix Search List. . . . . . : santonio.com.br
Ethernet adapter Local Area Connection:
       Media State . . . . . . . . . . . : Media disconnected
       Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Cont
roller
       Physical Address. . . . . . . . . : 00-12-3F-18-07-C0
Ethernet adapter Wireless Network Connection:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2200BG Network
Connection
       Physical Address. . . . . . . . . : 00-12-F0-97-C6-2E
       Dhcp Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       IP Address. . . . . . . . . . . . : 135.153.2.216
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 135.153.2.254
       DHCP Server . . . . . . . . . . . : 135.153.2.254
       DNS Servers . . . . . . . . . . . : 135.153.2.254
       Lease Obtained. . . . . . . . . . : sexta-feira, 7 de abril de 2006 17:3
8:28
       Lease Expires . . . . . . . . . . : sexta-feira, 7 de abril de 2006 17:4
8:28
PPP adapter Santo Antonio:
       Connection-specific DNS Suffix  . : santonio.com.br
       Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
       Physical Address. . . . . . . . . : 00-53-45-00-00-00
       Dhcp Enabled. . . . . . . . . . . : No
       IP Address. . . . . . . . . . . . : 192.168.0.120
       Subnet Mask . . . . . . . . . . . : 255.255.255.255
       Default Gateway . . . . . . . . . : 192.168.0.120
       DNS Servers . . . . . . . . . . . : 192.168.0.1
                                           192.168.1.1
       Primary WINS Server . . . . . . . : 192.168.0.1
       Secondary WINS Server . . . . . . : 192.168.1.1

(in reply to elmajdal)
Post #: 5
RE: Desperate HELP: VPN Client cannot access internal n... - 8.Apr.2006 12:34:37 AM   
elmajdal

 

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
u didnt tell us how is the configuration of the NICs on ISA itself.

is there a ROUTE relationship between VPN clients and Internal Network ?

u can check this under Configuration > Networks > Network rules

< Message edited by elmajdal -- 8.Apr.2006 12:36:30 AM >


_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to brunovairo)
Post #: 6
RE: Desperate HELP: VPN Client cannot access internal n... - 8.Apr.2006 1:40:04 AM   
brunovairo

 

Posts: 8
Joined: 5.Apr.2006
Status: offline
Hi friend,

Yes, there's a route relationship between this 2 networks.

Heres the IP configuration:
PPP adapter RAS Server (Dial In) Interface:
  Connection-specific DNS Suffix  . :
  Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
  Physical Address. . . . . . . . . : 00-53-45-00-00-00
  DHCP Enabled. . . . . . . . . . . : No
  IP Address. . . . . . . . . . . . : 192.168.0.123
  Subnet Mask . . . . . . . . . . . : 255.255.255.255
  Default Gateway . . . . . . . . . :
Ethernet adapter Internet:
  Connection-specific DNS Suffix  . :
  Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
  Physical Address. . . . . . . . . : 00-09-6B-8F-00-0A
  DHCP Enabled. . . . . . . . . . . : No
  IP Address. . . . . . . . . . . . : PUBLIC IP ADDRESS
  Subnet Mask . . . . . . . . . . . : 255.255.255.192
  Default Gateway . . . . . . . . . : PUBLIC IP ADDRESS
  DNS Servers . . . . . . . . . . . : 192.168.0.1
                                      
  NetBIOS over Tcpip. . . . . . . . : Disabled
Ethernet adapter LAN:
  Connection-specific DNS Suffix  . :
  Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet #2
  Physical Address. . . . . . . . . : 00-10-18-03-56-3C
  DHCP Enabled. . . . . . . . . . . : No
  IP Address. . . . . . . . . . . . : 192.168.0.10
  Subnet Mask . . . . . . . . . . . : 255.255.255.0
  Default Gateway . . . . . . . . . :
  DNS Servers . . . . . . . . . . . : 192.168.0.1
                                      192.168.1.1
  Primary WINS Server . . . . . . . : 192.168.0.1
  Secondary WINS Server . . . . . . : 192.168.1.1

Thanks another time

(in reply to elmajdal)
Post #: 7
RE: Desperate HELP: VPN Client cannot access internal n... - 8.Apr.2006 9:50:57 AM   
Zac

 

Posts: 44
Joined: 6.Oct.2005
From: Kuwait
Status: offline
Hi,

Check out whether you can ping to your DHCP from ISA. You have to make it timeless for a few minutes. Use this command from the Dos. Ping (name of the DHCP server) /t. See whether the pinging breaks in between. Create a computer object for your DHCP server in the Computer list. Edit the the system policy DHCP and make sure that it is enabled. Add the DHCP server to From option tab of the DHCP system rule.

HTH

Zac.

(in reply to brunovairo)
Post #: 8
RE: Desperate HELP: VPN Client cannot access internal n... - 8.Apr.2006 9:57:03 AM   
Zac

 

Posts: 44
Joined: 6.Oct.2005
From: Kuwait
Status: offline
Hi,


Forgot to add this. Once you make the VPN connection see what you get in the event viewer (in ISA Box). check out whether you get anything related to the VPN and post it too.

HTH

Zac.

(in reply to Zac)
Post #: 9
RE: Desperate HELP: VPN Client cannot access internal n... - 10.Apr.2006 8:30:28 AM   
bendji

 

Posts: 56
Joined: 18.Sep.2005
From: Denmark
Status: offline
Hi Bruno,

Is the ISA server the default gateway for your lan network?

You could try and change the relationship between the VPN and Internal network to NAT instead of route and see if that solve any thing. If it works it's proberly because your internal network dont know that the ISA server should be default gateway for the VPN network .

Yours Sincerely,
Benjamin

(in reply to brunovairo)
Post #: 10
RE: Desperate HELP: VPN Client cannot access internal n... - 10.Apr.2006 10:26:31 PM   
brunovairo

 

Posts: 8
Joined: 5.Apr.2006
Status: offline
Hi Benjamin,

Yes, ISA Server is the default gateway for all computers (including servers) on my network.

I already tried to change de relatioship to NAT, but it didn't fix de problem.

Additional ideas are very welcome.

I strongly think this is a RRAS internal routing problem.

At this point I'm very close to open a ticket at Microsoft.

Best regards, Bruno.

(in reply to bendji)
Post #: 11
RE: Desperate HELP: VPN Client cannot access internal n... - 3.May2006 1:44:16 AM   
brunovairo

 

Posts: 8
Joined: 5.Apr.2006
Status: offline
Dear friends,

Problem solved.

Althought Trend Micro Office Scan was removed from the server before ISA was installed, for some reason a DLL that enables the firewall feature still was active in Kernel Mode, and this was preventing any conection from external world to the internal network, including conections that was made by vpn clients.

After killing this DLL, everything started to work fine.

Thanks everyone for the attention.
Best regards, Bruno.

(in reply to brunovairo)
Post #: 12

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Firewall] >> VPN >> Desperate HELP: VPN Client cannot access internal network Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts