Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our L2TP server (running Windows 2008 RRAS) is behind a NAT firewall. I've already verified that it is passing NAT-T. The firewall rules are all set up correctly to pass GRE, IKE, L2TP and there are no custom IPSEC policies running on the server. L2TP is using a PSK instead of a certificate. Oddly, my Windows 7 and 8 desktops cannot make a successful connection, but my iPhone and iPad devices connect successfully. I can't think of anything else to check.

Also note that we can use PPTP and SSTP just fine.

I have firewall and netmon logs for both the failed and successful connections. I've seen a lot of cases where iOS devices cannot connect where full desktops can, but this is the opposite and I can find no clues on the interwebs.

Update: I've even replaced the server in question with a fresh Windows Server 2012 installation and it still has the same problem.

share|improve this question
    
That's because iThingies use a slightly different permutation of the IPSec protocols than Windows does. And they don't completely overlap. Unfortunately, I don't myself know where the overlap is. –  sysadmin1138 Mar 19 '13 at 18:37
    
Are your windows desktops sitting behind their own NATed firewall or do they have public IPs? With L2TP one end of the connection has to have an IP that isn't transformed, both ends cannot use NAT-T. –  Snowburnt Apr 10 '13 at 19:29
    
That makes sense, but even my iDevice can connect to the VPN from the same network that my windows computers are on. (from behind a NAT on the client end, and server end) –  Eric Falsken Apr 11 '13 at 16:01
add comment

1 Answer

up vote 0 down vote accepted

Did you make the registry changes to the Windows machines to make it behind NAT?

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent]
"AssumeUDPEncapsulationContextOnSendRule"=dword:00000002

The registry change is mentioned in this article : http://support.microsoft.com/kb/926179

share|improve this answer
    
The solution required a change of a default setting on every Windows client machine that wished to connect. This setting (for "security" reasons) is default on Windows, but unenforced on OSx, Linux, Android and iOS. To make matters worse, there is no way to change the setting except by registry changes to every client that wishes to connect. So, yes, this is an answer, but there is no way to change the settings on the server so that an unmodified client can connect with L2TP to a server behind a NAT. –  Eric Falsken Oct 9 '13 at 19:03
    
But thanks for posting the link. I had lost it long ago. Have a badge as your reward! –  Eric Falsken Oct 9 '13 at 19:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.