Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running ISA 2006 with PPTP VPN for my AD-controlled network. DHCP is located on the ISA server itself and authentication is done by RADIUS (NPS) located on the DC.

Right now my VPN clients can connect, access local DNS, and can ping ISA, the DC, and other clients.

Here's where it gets weird. I noticed that despite all this, ipconfig shows the following:

PPP adapter North Horizon VPN:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : North Horizon VPN
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . :
   Subnet Mask . . . . . . . . . . . :
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Enabled

So I went over and checked my ISA logs for both DHCP requests and replies, only to find out that my VPN clients are being denied because ISA thinks its a spoof. Here's some relevant information from the log (the VPN subnet is

Client IP:
Client Username: (blank)
Protocol: DHCP (request)
Action: Denied Connection
Rule: (blank)
Source Network: VPN Clients
Destination Network: Local Host
Network Interface:
Original Client IP:
Client Username: (valid user)
Protocol: PING
Action: Initiated Connection
Rule: Allow PING to ISA
Source Network: VPN Clients
Destination Network: Local Host
Result Code: 0x0 ERROR_SUCCESS
Network Interface: (blank)

I wasn't sure what this network interface was - it certainly wasn't something I had setup - untill I saw it in Routing and Remote Access under IP Routing > General as an interface called "Internal" bound to the same IP address. I also noticed that since ISA takes blocks of 10 IP addresses from DHCP for VPN, it had reserved I'm not sure if it means anything, though.

Thanks for your help.

share|improve this question

My understanding is that it takes up to 5 seconds for the routing table to be updated with the IP address for the new VPN client so packets received within that time are dropped as spoofed. See this post.

The solution suggested there is to add this odd registry key:


I've disabled spoof detection in an ISA Server 2004 installation to get it working before.

share|improve this answer

I don't see anything wrong with your ipconfig, isa server uses dhcp to get ip internally for vpn clients then it creates connection internally and hands it over to vpn client. So dhcp is just for internal purpose. So even though ip for vpn client was generated through dhcp it will appear as non dhcp as thats how it was hand over.

I hope I have correct understanding-:)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.