Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a windows 2008 r2 server that needs to establish a VPN connection to a remote VPN server.

We're using the L2TP protocol with a pre-shared key.

I initially used the New Demand Dial interface wizard. Then I went into properties on the interface and set the type of VPn to L2TP/IPSec and put the key under the advanced settings.

The error I received when attempting to connect is:

An error occured during connection of the interface. A Demand Dial Router attempted to connect over a port that was reserved for Remote Access Clients only.

share|improve this question

You don't have any certificates setup for RRAS.

share|improve this answer
How do I add a certificate? thanks – NotMe Jun 7 '12 at 20:57
here is a win2k8 walk through… the major point in the last comment is that you need a certificate from someone (generated by the local machine/network, a trusted 3rd party or the remote side) that both sides trust so that it can build the bridge (as only public keys/hashes are exchanged in the open). – jfalcon Jun 7 '12 at 21:20
So, just to be clear: Even though we're using a preshared key there has to be a certificate that both sides trust? That doesn't sound right. – NotMe Jun 8 '12 at 2:42
Sorry, was getting a little of this security course that I'm taking running through my head when writing the last comment. The problem you have is that you are missing a local self-signed cert for RRAS. Why RRAS needs it seems like bad design but it's obviously demanding it. As for the actual tunnel between you and the remote, you can use certs or pre-shared keys which you've already done. Right now you're fighting the idiosyncrasies of Windows software. – jfalcon Jun 8 '12 at 4:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.