Re: Windows 2003 Server RRAS and IPSEC
From: Janani V[MSFT] (jananiv_at_online.microsoft.com)
Date: 07/29/04
- Next message: Janani V[MSFT]: "Re: Win2K --> Win2K3 hosed RRAS..."
- Previous message: Priya Raghavan [MSFT]: "Re: Event ID 547 in Security log"
- In reply to: huskyphan: "Windows 2003 Server RRAS and IPSEC"
- Messages sorted by: [ date ] [ thread ]
Date: Thu, 29 Jul 2004 20:56:43 +0530
You can check out the following link for info regarding the ports to be
opened for IPSEC traffic:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/enterprise/proddocs/en-us/sag_VPN_und13.asp
Thanks,
Janani
"huskyphan" <huskyphan@discussions.microsoft.com> wrote in message
news:627AC9C5-15E4-4255-9D64-F8E844D7F79E@microsoft.com...
> I work at a university whose central computing network doles out live IP
address to all the campus buildings. To top it off we cannot utilize true
firewall or NAT boxes to secure the buildings, as the central comput network
support needs to manage each port. So what we have to do is install
parallel firewalls or utilize filters like IPSEC to protect our servers (we
use client firewalls for the desktops).
>
> With that being the case, our Windows 2003 and 2000 servers have IPSEC
with rules restricting access to just our subnet, access to the port 80,
443, our campus DNS servers, and campus time servers. Everything else is
blocked. As it stands, we haven't had any major problems, and it is the
best (and cheapest route). I want to add RRAS to one of our Windows 2003
servers for VPN access and followed the knowledge base article 323381 that
shows how to do so. Just to be sure, I added permission filters in IPSEC
that allows access to/from port 1723 and 47.
>
> After doing so, I tested the vpn connection. I dialed up from a laptop to
our campus dialup service then dialed the vpn connection to the new RRAS
server. after a fashion, I get "connecting" dialing box, then " verifying
username/password" dialog box, then error dialog box indicating that the
remote computer did not respond (and will redial in xx seconds). Just as a
test, I un-assigned the IPSEC filters, dialup the RRAS server again, and am
connected no problem. So I'm assuming my IPSEC filters are blocking, but I
am allowing ports 1723 and 47 (to/from). Is there other ports I'm missing,
and if so, are they dynamic ( ie, will they be different each time)? Or is
there another solution?
>
> thanks!
>
- Next message: Janani V[MSFT]: "Re: Win2K --> Win2K3 hosed RRAS..."
- Previous message: Priya Raghavan [MSFT]: "Re: Event ID 547 in Security log"
- In reply to: huskyphan: "Windows 2003 Server RRAS and IPSEC"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
