ISA 2006 problems with OWA and VPN

OK I'm sure this is linked:

OWA Cannot login to OWA 2007 externally - each time I get stuck in a login loop with the error

Quote:

---

Originally Posted by OWA 2007

You could not be logged on to ISA Server. Make sure that your domain name, user name, and password are correct, and then try again.

---

I have tried domain\username, username@dnsdomain.com, and username - all loop back to above error..

Works perfectly internally..

VPN

When I try to connect to the VPN, it says "verifying username and password" then "connecting to <ip>" and then "verifying username and password" again before it errors with

Quote:

---

Originally Posted by VPN

error 718: The connection was terminated because the remote computer did not respond in a timely manner

---

I have a feeling both are linked - possibly to AD but not sure what...

Interestingly, Moodle (same ISA server) allows me to login using same AD server

:(

Is this a new setup or has it just decided to die?

It's a new setup - freshly installed last week - and again today....

What ports are you forwarding for the VPN?

Also is the client Vista?

On the ISA Server try ticking only MS-CHAP for the Auth

@ Gatt

You know on your rules, are you using the Name? if so are you using the FQDN?

Have you tried using the Servers IP in the Rules instead?

It sounds like it's having problems passing through the authentication

James.

Quote:

---

Originally Posted by EduTech

@ Gatt

You know on your rules, are you using the Name? if so are you using the FQDN?

Have you tried using the Servers IP in the Rules instead?

It sounds like it's having problems passing through the authentication

James.

---

The Firewall rules shouldn't cause this problem. Even if you have no rules setup it will still connect.

I have had problems connecting from Vista machines but when using XP its perfect.

I'm talking more from this error:

Quote:

---

You could not be logged on to ISA Server. Make sure that your domain name, user name, and password are correct, and then try again.

---

I have had this happen to me, and it was because the ISA box could not talk to the DC so it could not autenticate.

James.

Quote:

---

Originally Posted by EduTech

I'm talking more from this error:



I have had this happen to me, and it was because the ISA box could not talk to the DC so it could not autenticate.

James.

---

Sorry i forgot about the exchange bit. :doh:

@edutech - here is how my OWA rule is setup:

To: mail.moorsidehigh.com / <internal ip of owa> / Fwd original Host header / Requests appear from ISA
Traffic - HTTPS
Listener - See below
Public Name - mail.moorsidehigh.com
Auth Delegation - Basic

OWA Listener:
Conntions - SSL Port 443
certifcates - mail.moorsidehigh.com
sso - no
Auth - HTML FOrm Auth - LDAP (AD) - LDAP Server set - DC / <DC IP> - Login Expression = MYDOMAIN\* / DC

1 down (OWA)... 1 to go (VPN)...

Do you have a direct unfiltered connection from your ISA box to the net and is your ISA box acting as your VPN gateway?

This sounds like not all of the ports are avalible and/or the GRE protocol is not being fowarded. This could possibly be being held up in your router or by an upstream provider assuming your router supports GRE passthrough (protocol 47).

Routing and Remote Access Blog : Which ports to unblock for VPN traffic to pass-through?

@SYNACK - yep thats how its configured..
I have seen reference to GRE in the event logs but nothing on how to resolve it - will
check that link though :)

What ports are you forwarding for the VPN?

Also is the client Vista?

On the ISA Server try ticking only MS-CHAP for the Auth

Glad to hear your got OWA working ;)

I'll keep out of the VPN, because i couldn't set it up on ours due to our LA blocking the ports :(

James.

OK this VPN error is really getting on my t1ts..
I have done everything that I know of to create the VPN on the ISA box and in RRAS
I have a rule for PPTP connections, and RRAS configured for Dial-in/VPN

But whenever I try to connect I get an error 718

Someone mentioned GRE - but despite scouring Google I have yet to fathom how to get ISA to work

Its not my Router as we have had VPN working all last year with no issues.