I'm running ISA 2006 with PPTP VPN for my AD-controlled network. DHCP is located on the ISA server itself and authentication is done by RADIUS (NPS) located on the DC.

Right now my VPN clients can connect, access local DNS, and can ping ISA, the DC, and other clients.

Here's where it gets weird. I noticed that despite all this, ipconfig shows the following:

PPP adapter North Horizon VPN:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : North Horizon VPN
   Physical Address. . . . . . . . . :
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . :
   Subnet Mask . . . . . . . . . . . :
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Enabled

So I went over and checked my ISA logs for both DHCP requests and replies, only to find out that my VPN clients are being denied because ISA thinks its a spoof. Here's some relevant information from the log (the VPN subnet is

Client IP:
Client Username: (blank)
Protocol: DHCP (request)
Action: Denied Connection
Rule: (blank)
Source Network: VPN Clients
Destination Network: Local Host
Network Interface:
Original Client IP:
Client Username: (valid user)
Protocol: PING
Action: Initiated Connection
Rule: Allow PING to ISA
Source Network: VPN Clients
Destination Network: Local Host
Result Code: 0x0 ERROR_SUCCESS
Network Interface: (blank)

I wasn't sure what this network interface was - it certainly wasn't something I had setup - untill I saw it in Routing and Remote Access under IP Routing > General as an interface called "Internal" bound to the same IP address. I also noticed that since ISA takes blocks of 10 IP addresses from DHCP for VPN, it had reserved I'm not sure if it means anything, though.

Thanks for your help.


My understanding is that it takes up to 5 seconds for the routing table to be updated with the IP address for the new VPN client so packets received within that time are dropped as spoofed. See this forums.isaserver.org post.

The solution suggested there is to add this odd registry key:


I've disabled spoof detection in an ISA Server 2004 installation to get it working before.


I don't see anything wrong with your ipconfig, isa server uses dhcp to get ip internally for vpn clients then it creates connection internally and hands it over to vpn client. So dhcp is just for internal purpose. So even though ip for vpn client was generated through dhcp it will appear as non dhcp as thats how it was hand over.

I hope I have correct understanding-:)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.