error 721 - when trying to vpn

  • Thread starter Thread starter melu
  • Start date Start date
M

melu

Hi,

We are running ISA Server 2004 Pack 3 on windows 2003 sp2.

One of the users when they try to VPN in get the following error:


Event ID: 20209 [logged on the ISA2004 server]
Source: RasMan

"A connection between the VPN server and the VPN client w.x.y.z has been
established, but the VPN connection cannot be completed. The most common
cause for this is that a firewall or router between the VPN server and the
VPN client is not configured to allow Generic Routing Encapsulation (GRE)
packets (protocol 47). Verify that the firewalls and routers between your VPN
server and the Internet allow GRE packets. Make sure the firewalls and
routers on the user's network are also configured to allow GRE packets. If
the problem persists, have the user contact the Internet service provider
(ISP) to determine whether the ISP might be blocking GRE packets."


The user gets error message 721 at home.

Can anyone suggest a resolution?

Thankx
 
We followed this steps to solve the problem...
Could you please check if this helps you...

- Used PPTP-ping.exe on Client and server to verify the block.
- Found GRE-47 protocol blocked on the Linksys firewall.
- Checked router configuration found Linksys WRT54G wireless router.
- Searched if WRT54G is GRE 47 enabled.
- Found Linksys Form:
http://www.linksysinfo.org/forums/showthread.php?p=303679
- As per the Form this router has a specific problem with GRE 47 protocol
Suggestion:
- Try to reset the firewall since it was working earlier.
- Else replace the Firewall that allows GRE 47 protocol.

Best of luck
--
Mir Sajjad Mehdi
Microsoft XP Platform Support


"melu" wrote:

> Hi,
>
> We are running ISA Server 2004 Pack 3 on windows 2003 sp2.
>
> One of the users when they try to VPN in get the following error:
>
>
> Event ID: 20209 [logged on the ISA2004 server]
> Source: RasMan
>
> "A connection between the VPN server and the VPN client w.x.y.z has been
> established, but the VPN connection cannot be completed. The most common
> cause for this is that a firewall or router between the VPN server and the
> VPN client is not configured to allow Generic Routing Encapsulation (GRE)
> packets (protocol 47). Verify that the firewalls and routers between your VPN
> server and the Internet allow GRE packets. Make sure the firewalls and
> routers on the user's network are also configured to allow GRE packets. If
> the problem persists, have the user contact the Internet service provider
> (ISP) to determine whether the ISP might be blocking GRE packets."
>
>
> The user gets error message 721 at home.
>
> Can anyone suggest a resolution?
>
> Thankx
>
>
 
Hi,

The user has informed me that they don't have a Linksys router?

Any other ideas?

Thanks
 
In article <227AB835-ECC6-46BA-AD44-115985C58B70@microsoft.com>,
melu@discussions.microsoft.com says...
>
> Hi,
>
> The user has informed me that they don't have a Linksys router?
>
> Any other ideas?
>
> Thanks
>


Error 721 is almost always GRE or that the users have more than the
supported number of VPN tunnels in operation than the device supports.

Most residential devices support a max of 2 PPTP tunnels.

Many cheap residential devices do not properly handle PPTP Pass-Through.

If you have a firewall application (other than Windows Firewall) on the
computer it could also cause improper GRE resolution.

Many routers (cheap residential stuff) required several firmware updates
to fix GRE issues - check the vendors site for a firmware update.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)
 
I am writing this letter to ALL Wireless Router manufacturers.
I have a Linksys Wireless Router Model:BEFW11S4. It is 7 years (yes, count
them, all of seven little years) old. I have visited the Linksys website
numerous times trying to set up the WEP/WPA security on that wireless router
(as all responsible wireless router owners should!). I found that there are
no links to any wireless router setting websites that are congruent with the
screen shots from Linksys' own self help technical support site. I have had
to call Linksys several times to resolve this issue only to be placed on hold
for lengthy times (sometimes my call was dropped and I had to start over ....
how sad for such a large company to have such poorly trained phone
receptionists!), then be transferred (see previous comment about the phone
receptionists) to a supposed supervisor, only to finally be transferred to
someone who tells me that the warranty has expired and wants me to pay $40.00
for the technical support to do the right thing that I want and need to do.
First, the device works fine (as evidenced by this e-mail that you have
just received)!
Second, why should I have to pay for doing the right thing?
Third, if I am going to be EXTORTED into buying a new wireless router so
that I can do the right thing and set up an encryption key for a secure
network, what on Gods' Green Earth makes anyone think that I would CHOOSE to
buy another Linksys product when ALL that I have ever received from them is a
functional wireless router (yes, even after seven whole years) and the
crappiest Customer Service/Technical Support I have ever had the displeasure
to encounter!
I shall copy this letter and try to find as many Chat Rooms as possible in
order to spread the word of ALL that I have gone through with the Chain of
Command at the Linksys phone center, well above and beyond what any
reasonable person should expect to go through, and still have NO RELIEF
concerning my singular issue with their product and its capabilities that I
SHOULD be able to enjoy as the owner of said product! What has happend to
"The Customer Is Always Right" Customer Service mantra (I can't say "In
America" because the call was handled in India)? Is the Customer, the ones
that makes the company what it is through the purchase of products, so
worthless to the company that they can just be treated with abject contempt
and scorn? Is the Customer to thus be trampled underfoot? Are we paying to
be so abused? I, for one (yes, one, the beginning of all), shall NOT be
treated in such manner, and CERTAINLY shall NOT PAY to be treated as such!
In this world of expanding technologies, it shall be those with the
GREATEST Customer Appeal that shall continue to be found worthwile in the
publics' eyes (and pocketbooks) and shall grow to meet the demands of a
growing world - ESPECIALLY in the Electronics Department!
It is now my strongest desire that the Linksys Corporation suffers
irreparable damage and goes out of business for their Crappy Customer
Service! I can only hope that I reach enough people around the world to bring
this desire true!

"Leythos" wrote:

> In article <227AB835-ECC6-46BA-AD44-115985C58B70@microsoft.com>,
> melu@discussions.microsoft.com says...
> >
> > Hi,
> >
> > The user has informed me that they don't have a Linksys router?
> >
> > Any other ideas?
> >
> > Thanks
> >

>
> Error 721 is almost always GRE or that the users have more than the
> supported number of VPN tunnels in operation than the device supports.
>
> Most residential devices support a max of 2 PPTP tunnels.
>
> Many cheap residential devices do not properly handle PPTP Pass-Through.
>
> If you have a firewall application (other than Windows Firewall) on the
> computer it could also cause improper GRE resolution.
>
> Many routers (cheap residential stuff) required several firmware updates
> to fix GRE issues - check the vendors site for a firmware update.
>
> --
> - Igitur qui desiderat pacem, praeparet bellum.
> - Calling an illegal alien an "undocumented worker" is like calling a
> drug dealer an "unlicensed pharmacist"
> spam999free@rrohio.com (remove 999 for proper email address)
>
 
I am writing this letter to ALL Wireless Router manufacturers.
I have a Linksys Wireless Router Model:BEFW11S4. It is 7 years (yes, count
them, all of seven little years) old. I have visited the Linksys website
numerous times trying to set up the WEP/WPA security on that wireless router
(as all responsible wireless router owners should!). I found that there are
no links to any wireless router setting websites that are congruent with the
screen shots from Linksys' own self help technical support site. I have had
to call Linksys several times to resolve this issue only to be placed on hold
for lengthy times (sometimes my call was dropped and I had to start over ....
how sad for such a large company to have such poorly trained phone
receptionists!), then be transferred (see previous comment about the phone
receptionists) to a supposed supervisor, only to finally be transferred to
someone who tells me that the warranty has expired and wants me to pay $40.00
for the technical support to do the right thing that I want and need to do.
First, the device works fine (as evidenced by this e-mail that you have
just received)!
Second, why should I have to pay for doing the right thing?
Third, if I am going to be EXTORTED into buying a new wireless router so
that I can do the right thing and set up an encryption key for a secure
network, what on Gods' Green Earth makes anyone think that I would CHOOSE to
buy another Linksys product when ALL that I have ever received from them is a
functional wireless router (yes, even after seven whole years) and the
crappiest Customer Service/Technical Support I have ever had the displeasure
to encounter!
I shall copy this letter and try to find as many Chat Rooms as possible in
order to spread the word of ALL that I have gone through with the Chain of
Command at the Linksys phone center, well above and beyond what any
reasonable person should expect to go through, and still have NO RELIEF
concerning my singular issue with their product and its capabilities that I
SHOULD be able to enjoy as the owner of said product! What has happend to
"The Customer Is Always Right" Customer Service mantra (I can't say "In
America" because the call was handled in India)? Is the Customer, the ones
that makes the company what it is through the purchase of products, so
worthless to the company that they can just be treated with abject contempt
and scorn? Is the Customer to thus be trampled underfoot? Are we paying to
be so abused? I, for one (yes, one, the beginning of all), shall NOT be
treated in such manner, and CERTAINLY shall NOT PAY to be treated as such!
In this world of expanding technologies, it shall be those with the
GREATEST Customer Appeal that shall continue to be found worthwile in the
publics' eyes (and pocketbooks) and shall grow to meet the demands of a
growing world - ESPECIALLY in the Electronics Department!
It is now my strongest desire that the Linksys Corporation suffers
irreparable damage and goes out of business for their Crappy Customer
Service! I can only hope that I reach enough people around the world to bring
this desire true!

"melu" wrote:

> Hi,
>
> We are running ISA Server 2004 Pack 3 on windows 2003 sp2.
>
> One of the users when they try to VPN in get the following error:
>
>
> Event ID: 20209 [logged on the ISA2004 server]
> Source: RasMan
>
> "A connection between the VPN server and the VPN client w.x.y.z has been
> established, but the VPN connection cannot be completed. The most common
> cause for this is that a firewall or router between the VPN server and the
> VPN client is not configured to allow Generic Routing Encapsulation (GRE)
> packets (protocol 47). Verify that the firewalls and routers between your VPN
> server and the Internet allow GRE packets. Make sure the firewalls and
> routers on the user's network are also configured to allow GRE packets. If
> the problem persists, have the user contact the Internet service provider
> (ISP) to determine whether the ISP might be blocking GRE packets."
>
>
> The user gets error message 721 at home.
>
> Can anyone suggest a resolution?
>
> Thankx
>
>
 
Back
Top