I have an office LAN protected using a Zyxel Zywall USG 300. I've set up an L2TP/ipsec VPN on that which accepts connections using a shared secret and I've tested this from multiple clients.

I have a server offsite and want to set up RRAS to use a persistent connection to the VPN so that it can carry out network jobs even with no one logged in (I'm using it for Micorosft DPM secondary backup).

If I create a vpn as if I were setting up a users laptop it can dial in no problem but if I set up a demand dial interface in RRAS it errors.

  • I enable RRAS ticking only demand dial interface (branch office routing)
  • Select network interfaces, right click and choose new demand dial interface
  • Name the VPN ToCompany
  • Select connect using VPN
  • And then L2TP as the vpn type
  • enter the IP address (double-checked for typos!)
  • select Route IP packets on this interface
  • specify static route to remote network as with metric of 1
  • add dial out credentials (again double checked for typos and confirmed with other vpn connections
  • click finish
  • now I right-click on the new interface and choose properties and then the security tab
  • I change Data encryption to optional
  • select only PAP for Authentication (both as per manufacturer of Zywall)
  • click advanced settings against type of vpn and set shared secret
  • then I select the new interface, right-click and choose connect

this dials and then errors with either 720 or 811 as the error codes. However, if I create a VPN by going to Network & Sharing center and setting up as if I was creating a VPN from my laptop to the office (say) it dials successfully

so I know the VPN settings are correct and the machine can connect to the VPN.

Suggests very strongly the problem is how I'm setting up RRAS. Can anyone help?

  • On the USG the log item: "info IKE [COOKIE] Invalid cookie, no sa found se.rv.er.ip:500 fi.re.wa.ll:500 IKE_LOG" ties up with the error from RRAS – Paul D'Ambra Nov 1 '10 at 14:49

"On the USG the log item: "info IKE [COOKIE] Invalid cookie, no sa found se.rv.er.ip:500 fi.re.wa.ll:500 IKE_LOG" ties up with the error from RRAS"

You're failing on phase 1(IKE).

  1. "No SA found" normally points to a firewall issue. Is port 500 open on the RRAS server?
  2. "Invalid Cookie" could also mean a setting mismatch. Make sure your SA renegotiation time is the same on both ends.
  • I can connect to the VPN via the Network & Sharing Center but the same settings in RRAS fail... – Paul D'Ambra Nov 12 '10 at 8:19
  • Hmm, It has to be a conflicting setting somewhere... – JakeRobinson Dec 6 '10 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.