HELP!!! L2TP VPN W2K Pro -> W2K SVR RAS

[Herb Cumbie]

I am having problems making this work...

Scenerio:

Windows 2000 Server which is Domain Controller and Exchange Server,
RRAS configured to accept VPN connections using L2TP only. Server
certificate issued by Standalone CA installed on server with CA
certificate installed in Trusted Root on the server.

Windows 2000 Profesional which is NOT a member of the domain.
Requested certificate from same CA. Requested certificate using Form,
Advanced, selected type Other and specified EKU OID 1.3.6.1.5.5.7.3.2
for the certificate. Installed the certificate in the Current User
certificate store.

Client user account on domain has been granted right to dialin. RAS
Policy has been set to grant permission based on user account
settings. Additional RAS policy has been created to require
connections to be L2TP.

Attempts to establish the connection while both computers are on the
same local area network using connectoid configured for VPN / L2TP
seem to be hung in the "conection to hostname. portion of the process.
No error message but no connection. The server does not indicate a
connection.

Help!!! What am I missing??? Could it be the requirement that the UPN
of the user account is not listed inthe Subject Alternative Name
property of the user certificate on the W2KPro computer? If so, how
do you get a certificate with that data in place?

Thanks in advance for any and all help... I've got to make this work,
first on the LAN and then after that transition to Internet with
firewall on the RRAS Server's Internet connection...

Henry (Herb) Cumbie

 

[DJ]

Try to see if it works with PPTP. This could help you to
locate the problem.

 

[Herb Cumbie]

Testing with PPTP is successful in creating VPN connection over LAN.
What else can I do to determine what's causing the problem trying to
create VPN connection using L2TP / IPSEC?

Herb Cumbie

 

[Brandy Griffin [MSFT]]

If you wait a long enough time, the connection attempt should time out with
an error that can give you more input.

--
(e-mail address removed) [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.