OS X server: VPN setup

Hi,
   I am using OS X server (10.9.1).   I try to setup VPN service.    But, I do not know what went wrong.    Below is the log.    Any tips?
1st time:   I use wwmm.wwmmhome.private...
2013-12-31 14:23:19 SGT     Incoming call... Address given to client = 192.168.1.240Tue Dec 31 14:23:19 2013 : Directory Services Authentication plugin initialized
Tue Dec 31 14:23:19 2013 : Directory Services Authorization plugin initialized
Tue Dec 31 14:23:19 2013 : publish_entry SCDSet() failed: Success!
Tue Dec 31 14:23:19 2013 : publish_entry SCDSet() failed: Success!
Tue Dec 31 14:23:19 2013 : publish_entry SCDSet() failed: Success!
Tue Dec 31 14:23:19 2013 : PPTP incoming call in progress from '183.90.37.225'...
Tue Dec 31 14:23:19 2013 : PPTP connection established.
Tue Dec 31 14:23:19 2013 : using link 0
Tue Dec 31 14:23:19 2013 : Using interface ppp0
Tue Dec 31 14:23:19 2013 : Connect: ppp0 <--> socket[34:17]
Tue Dec 31 14:23:19 2013 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x729c77b1> <pcomp> <accomp>]
Tue Dec 31 14:23:19 2013 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x38d3186b> <pcomp> <accomp>]
Tue Dec 31 14:23:19 2013 : lcp_reqci: returning CONFACK.
Tue Dec 31 14:23:19 2013 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x38d3186b> <pcomp> <accomp>]
Tue Dec 31 14:23:22 2013 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x729c77b1> <pcomp> <accomp>]
Tue Dec 31 14:23:22 2013 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x38d3186b> <pcomp> <accomp>]
Tue Dec 31 14:23:22 2013 : lcp_reqci: returning CONFACK.
Tue Dec 31 14:23:22 2013 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x38d3186b> <pcomp> <accomp>]
Tue Dec 31 14:23:22 2013 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x729c77b1> <pcomp> <accomp>]
Tue Dec 31 14:23:22 2013 : sent [LCP EchoReq id=0x0 magic=0x729c77b1]
Tue Dec 31 14:23:22 2013 : sent [CHAP Challenge id=0xd5 <663e256443001f6c0163674232734908>, name = "wwmm.wwmmhome.private"]
Tue Dec 31 14:23:22 2013 : rcvd [LCP EchoReq id=0x0 magic=0x38d3186b]
Tue Dec 31 14:23:22 2013 : sent [LCP EchoRep id=0x0 magic=0x729c77b1]
Tue Dec 31 14:23:22 2013 : rcvd [LCP EchoRep id=0x0 magic=0x38d3186b]
Tue Dec 31 14:23:22 2013 : rcvd [CHAP Response id=0xd5 <63847a83bdb04f9fba56d82397d7213e00000000000000003d68f95fbd5d9f5e90ad10d4e8403c f53e5940402f913a6b00>, name = "test"]
Tue Dec 31 14:23:22 2013 : sent [CHAP Failure id=0xd5 ""]
Tue Dec 31 14:23:22 2013 : CHAP peer authentication failed for walter
Tue Dec 31 14:23:22 2013 : sent [LCP TermReq id=0x2 "Authentication failed"]
Tue Dec 31 14:23:22 2013 : Connection terminated.
Tue Dec 31 14:23:22 2013 : PPTP disconnecting...
Tue Dec 31 14:23:22 2013 : PPTP disconnected
2013-12-31 14:23:22 SGT       --> Client with address = 192.168.1.240 has hung up
2nd time, I use wwmm.dyndns.org
2013-12-31 14:38:38 SGT     Incoming call... Address given to client = 192.168.1.240Tue Dec 31 14:38:38 2013 : Directory Services Authentication plugin initialized
Tue Dec 31 14:38:38 2013 : Directory Services Authorization plugin initialized
Tue Dec 31 14:38:38 2013 : publish_entry SCDSet() failed: Success!
Tue Dec 31 14:38:38 2013 : publish_entry SCDSet() failed: Success!
Tue Dec 31 14:38:38 2013 : publish_entry SCDSet() failed: Success!
Tue Dec 31 14:38:38 2013 : PPTP incoming call in progress from '183.90.37.225'...
Tue Dec 31 14:38:39 2013 : PPTP connection established.
Tue Dec 31 14:38:39 2013 : using link 0
Tue Dec 31 14:38:39 2013 : Using interface ppp0
Tue Dec 31 14:38:39 2013 : Connect: ppp0 <--> socket[34:17]
Tue Dec 31 14:38:39 2013 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x5b1829ce> <pcomp> <accomp>]
Tue Dec 31 14:38:39 2013 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x3298b0f1> <pcomp> <accomp>]
Tue Dec 31 14:38:39 2013 : lcp_reqci: returning CONFACK.
Tue Dec 31 14:38:39 2013 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x3298b0f1> <pcomp> <accomp>]
Tue Dec 31 14:38:42 2013 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x5b1829ce> <pcomp> <accomp>]
Tue Dec 31 14:38:42 2013 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x3298b0f1> <pcomp> <accomp>]
Tue Dec 31 14:38:42 2013 : lcp_reqci: returning CONFACK.
Tue Dec 31 14:38:42 2013 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x3298b0f1> <pcomp> <accomp>]
Tue Dec 31 14:38:42 2013 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x5b1829ce> <pcomp> <accomp>]
Tue Dec 31 14:38:42 2013 : sent [LCP EchoReq id=0x0 magic=0x5b1829ce]
Tue Dec 31 14:38:42 2013 : sent [CHAP Challenge id=0x5a <4a753b2e091d155a1414337d40401750>, name = "wwmm.dyndns.org"]
Tue Dec 31 14:38:42 2013 : rcvd [LCP EchoReq id=0x0 magic=0x3298b0f1]
Tue Dec 31 14:38:42 2013 : sent [LCP EchoRep id=0x0 magic=0x5b1829ce]
Tue Dec 31 14:38:42 2013 : rcvd [LCP EchoRep id=0x0 magic=0x3298b0f1]
Tue Dec 31 14:38:42 2013 : rcvd [CHAP Response id=0x5a <2f54770187524125079b5d74e01b09e800000000000000004359e904d9814bc5e0eb4bb880e7e5 23181a0d22b9164e2400>, name = "test"]
Tue Dec 31 14:38:42 2013 : DSAuth plugin: unsupported authen authority: recved ShadowHash;HASHLIST:<SALTED-SHA512,SMB-NT,CRAM-MD5,RECOVERABLE,SALTED-SHA512-PB KDF2>, want ApplePasswordServer
Tue Dec 31 14:38:42 2013 : DSAuth plugin: MPPE key required, but its retrieval failed.
Tue Dec 31 14:38:42 2013 : sent [CHAP Failure id=0x5a "S=8DDCFFC7EA287D3A141E5594392BCBD87C35F76B M=Access granted"]
Tue Dec 31 14:38:42 2013 : CHAP peer authentication failed for walter
Tue Dec 31 14:38:42 2013 : sent [LCP TermReq id=0x2 "Authentication failed"]
Tue Dec 31 14:38:42 2013 : Connection terminated.
Tue Dec 31 14:38:42 2013 : PPTP disconnecting...
Tue Dec 31 14:38:42 2013 : PPTP disconnected
2013-12-31 14:38:42 SGT       --> Client with address = 192.168.1.240 has hungup

The VPN server in Server.app is these days pretty feeble, it only does PPTP and L2TP and does not support using security certificates or VPN on demand. (Which requires security certificates.) As a result the security of Apples VPN server is only capable of functions which have all been successfully cracked. Now for most people that might not be too much of a concern but if your a law, health, finance, or government customer then it should be a concern.
However...
While the VPN server itself does not support clustering nor in fact do any of the services in Server.app there might be a way to achieve what you want. If you have a DNS load-balancer then you can point all the clients to the load-balancer and it will distribute the requests to two or more Apple VPN servers. You just need to make sure each Apple VPN server gives out a different range of IP addresses with no overlaps.

Similar Messages

Mountain Lion server vpn setup

I have OSX Mountain Lion with server. I use dynamic dns with dyndns.org. I have a Virgin Media Router in modem only mode connected to a Time Capsule that provides DHCP and NAT. I have all the correct ports open on the Time Capsule (500, 1701, 1723 and 4500).
I have set up the Server VPN but every time I try to connect wither from within my LAN or externally I get the message:
The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator.
I have tried everything I can think of (including trying VPN Configurator) but cannot get the VPN to work. Any advice welcome.

I had the same issue:
The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator.
PPTP was connecting from a PC without problem but trying to use L2TP (IPSec) from an iMac gave the above message. I resolved this by:
I went into Server > VPN and turned the service off for 30 seconds and turned it back on, all working.
The wonder of OSX Server. Lots of buggy problems.
Steve H

Solaris 10 VPN server/gateway setup

Hi all,
I have a V20z running Solaris 10 at home, and I would like to set it up as a VPN server. The Solaris 10 is behind a router with a reserved private IP assigned by DHCP and port forwarding set up for only SSH at the moment. The router has a static external IP.
I'm not exactly sure what the terms are for what I'm trying to do, but this is basically it:
When I am out of town or overseas, I want to be able to connect from my laptop running OS X or Linux to my Solaris 10 server at home, and have the S10 server act as a proxy(?) (gateway?) for all the traffic from my laptop; for example, if I was in a place where nytimes.com was blocked and wanted to be able to browse from my laptop by having the Solaris 10 server proxy (transparently) my requests and forward the responses back to me. I hope I'm explaining this ok...
I have searched a lot online for how to do this, and I have found a lot of info, but nothing that really ties it all together. I'm pretty comfortable working in the shell and doing config stuff, but it would be a huge help if anyone could explain all the pieces I need to snap together to get this working.
These are my questions:
1. What is what I have described called? Just "VPN" or "VPN router," or "VPN gateway"?
2. What software do I need on my Solaris 10 server to do this?
A lot of what I read pointed me to OpenVPN, but I am not clear if OpenVPN alone would enable me to use the public web via the VPN.
If not, then what would I need to have on the server to enable incoming requests over the VPN connection to be rerouted to the public internet?
3. I'm sure I can figure this out if I can just get the server VPN working, but if anyone happens to know, I'd appreciate it:
Built into OS X Networking Prefs I have the ability to add a VPN interface of either of these 2 types:
"PPTP"
"L2TP over IPsec"
From what I have read so far, it seems like IPsec is likely the only reasonable choice, but the option of "L2TP over IPsec" confuses me since I haven't read that they are required to be used together.
Will this option work for connecting to my Solaris VPN server or will I need a 3rd-party app?
Any guidance would be a tremendous help.
Thanks guys!
Jamie

Mobile IP???
Assuming that you had the right security in place you could have the "Home" box export it's display back to the "Roving" box and then just run a web browser over X. Something like SSH with X forwarding.
alan

I do not see where to enter IP addresses in the Open VPN setup. Also, how can I set it up so that I can choose different servers in the same way as I can currently choose them with my VPN app but for PPTP?

I think I have it working on my iPhone 5. But, I do not see how I can control the exit point that I would like for the VPN. Are all the exit points shown in the VPN setting now going to work with Open VPN, or do they remain PPTP? If I am reading correctly, they look like they remain PPTP. If I cannot control the exit point for open VPN, which exit point is the default in the profile you provided me?I note that Open VPN Connect does not work with any of the new 64 bit devices like the iPhone 5S, the iPad Air, and the new iPad MIni. Is there any chance that you guys will come up with an update for your app so that open VPN can be made to work on all iOS devices? That would be nice, particularly if the Open VPN Connect app does not give me a choice of exit points.Thanks,
I do not see where to enter IP addresses in the Open VPN setup. Also, how can I set it up so that I can choose different servers in the same way as I can currently choose them with my VPN app but for PPTP?
Just a quick note to tell you that Open VPN has updated their app so that it is compatible with 64 bit ARM devices like the iPhone 5S, the iPad Air, and the iPad Mini Retina.That does not resolve the problem of how to easily choose among the various possibilities for the exit server. We need to find an easy way to choose.

Thank you for trying the new Firefox. I'm sorry that you’re unhappy with the new design.
I understand your frustration and surprise at the removal of these features but I can't undo these changes. I'm just a support volunteer and I do not work for Mozilla. But you can send any feedback about these changes to http://input.mozilla.org/feedback. Firefox developers collect data submitted through there then present it at the weekly Firefox meeting
I recommend you try to adjust to 29 and see if you can't make it work for you before you downgrade to a less secure and soon outdated version of Firefox.
Here are a few suggestions for restoring the old design. I hope you’ll find one that works for you:
*Use the [https://addons.mozilla.org/en-US/firefox/addon/classicthemerestorer/ Classic Theme Restorer] to bring back the old design. Learn more here: [[How to make the new Firefox look like the old Firefox]]
*Use the [https://addons.mozilla.org/en-US/firefox/addon/the-addon-bar/ Add-on Bar Restored] to bring back the add-on bar. Learn more here: [[What happened to the Add-on Bar?]]

Can you help me solve my Leopard Server VPN madness?

Hello all,
I've been having a devil of a time getting Leopard Server's VPN service to work "properly". None of this is mission critical, as it's simply on a home system I'm using as a nat/dns/dhcp/firewall/mail/web server for my Comcast line (with a static IP). But, it is frustrating, because I currently have a 10.4.11 Server fulfilling the same roll. So it seems like Leopard should be able to be made to work. I'm gonna go step by step here with my install process in the hopes that if I'm doing something wrong someone will be kind enough to catch it. Thanks for bearing with me.
I've installed Leopard Server 10.5 (Mirror door G4, FYI) with the built-in ethernet connected to my Comcast router (with a static external IP). Immediately after 10.5 installs I restart and update everything to 10.5.2, then I install a Sonnet Gigabit NIC, it's drivers, and assign it 192.168.3.1, where it will live as my internal router, server, etc. I turn on DNS and setup an internal ".lan" zone that resolves to 192.168.3.1. Pop into Terminal and confirm that rDNS is in fact working, it is. And check that "changeip -checkhostname" resolves itself correctly (to the external IP).
Next, turn on the NAT service and run the gateway setup assistant. After a reboot I quickly check that my internal clients with static IPs (192.168.3.10, .20, etc) are working and pulling DNS OK, they are. Jump into the Firewall, and for the moment just open it wide up by accepting all connections. At various times during testing I've configured the firewall to exactly match my 10.4 Server firewall, but for the time being I can just leave it open. I create a Firewall group to cover my 192.168.3.x internal network, and another to handle 192.168.3.60/29 to handle the VPN service I'll setup in a sec. Jump over to the DHCP service where by default gateway setup creates a 192.168.1.x DHCP zone. I delete that and create a new 192.168.3.x zone covering .50-.59. Turn DHCP on and confirm it's working, good, it is.
Now, here is where the VPN fun begins. The last service I turn on is the VPN service (I've alternatively tried letting Gateway Setup activate it, and just doing it myself, with this same result). I configure it to accept L2TP at 192.168.3.60 - .63. Like I said this is a home server, so I don't need a lot of VPN connections. Finally, when I test the VPN from a 10.5.2 Client (MacBook coming in off a neighbors open wireless network with a 10.0.0.x string) I am able to connect, and I can see/ping/mount/share screen on the server. I can also ping the attached VPN client at 192.168.3.60 from the server. However, I cannot ping or see (In ARD) any other machines on the internal network from the attached VPN client. Likewise from one of the internal systems, say my Mac mini at 192.168.3.10 I cannot ping the attached VPN client at 192.168.3.60. Out of curiosity I've tried doing a rDNS lookup while attached to the VPN and the client isn't able to resolve any of the internal DNS entries.
So, what gives? As I've mentioned I have exactly this same setup working just fine with Tiger Server. Same NAT, same Firewall, same DNS, and same L2TP VPN setup. For the life of me though, I cannot get attached VPN clients to see the internal network when I put Leopard Server in place. Clearly the internal DNS isn't working for attached VPN clients, although I'm not certain if that is a cause or a symptom. I've setup a network routing definition for the internal private network, which didn't help. I also tried setting up PPTP instead of L2TP, and had the same problem.
Is anyone having similar problems with Leopard Server's VPN service? If not, could someone hit me with the clue stick and set me right? As I said, in the grand scheme of things this isn't a big deal for me. But, it's just frustrating that I can get so close to updating my home server and just fall short.
Thanks!

Your post actually contains the Key to solve the problem and there is not really a big need for going all the way to use the Property List Editor to fork around /etc/ipfilter/ipaddressgroups.plist.
There has been much written on this problem but basically you see that most is trial and error and this does include myself and my findings in this post, too, but I think I can further narrow down on what CAUSES this problem and how to fix it.
First off, we are talking a combination of using NAT (Network Address Translation - bridging an Internet connection on an external network card over to an internal network card), Firewall (which is needed in OS X to be have NAT working because the Firewall "helps" NAT by doing its job, DHCP (for providing dynamic IP addresses to clients on the internal network, don't confuse, DHCP is not providing this service to the VPN clients, that is done by the VPN server), and - last but not least - VPN to provide access to not only to the server but to any machine on the internal network over the outside network card (aka, giving remote clients a chance to connect to the local network over the public Internet in a save and nice way).
OK. The short story: you can do it ALL in Mac OS X 10.5's Server Admin tool. If it fails it is nearly always the Firewall!
You can check if this is the case for your setup by temporarily opening the Firewall up to not block any traffic: in Server Admin, click on Firewall -> Settings -> Services -> Edit Service for: any and click "Allow all trafic from "any"", save it (and to be 100% sure, stop and restart the firewall. If your clients can NOW connect at least to the server, it was the firewall. Now don't forget to switch off allowing all traffic from any, or you will be left with an open doors server ready for anybody to explore
Now what goes wrong in the first place? It appears that the GSA (Gateway Setup Assistant) that is "hidden away" in the NAT settings does something awfully wrong. It will set up all the address groups in the firewall: the any group will remain as it is usually, another one defining the internal network, and a one called VPN-net for VPN.
What it DOES do wrong here (I am no firewall expert, this is purely trial and error, so please anybody do explain!) is to give the VPN-net exactly the same address range as the internal network. And here seems to be the overall problem.
When Twintails wrote to add 192.168.3.60/27 as address range for VPN, I realized what he/she did. Writing 192.168.3.60/27 effectively narrows down the address range starting at 192.168.3.33 up to 192.168.3.62. There are millions of subnetmask calculators out on the net, give it a try e.g. here: http://www.subnet-calculator.com/
So, I looked for what range of address will actually be given out by the VPN server to VPN clients upon connections. Of course you need to make sure that this address range is NOT given out by your DHCP server.
In my setup, the server is 192.168.1.1, the DHCP server provides addresses from 192.168.1.10 up to 192.168.1.127 (I start with 10 because I have some static addresses for special purposes from 192.168.1.2 to 192.168.1.9. So, this means, anything above 192.168.1.127 is potentially "free" for my VPN connections.
Next I used the subnetmask calculator to find a narrow address group that matched my purposes. I found 192.168.1.192/26 which effectively gives me a range from 192.168.1.192 to 192.168.1.255 (which is in fact more then I have clients connecting from externally!).
I went to the Server Admin Tool, and clicked Firewall -> Settings -> Address Group and edited the VPN-net one. First I deleted what was in "Addresses in group" and entered from scratch 192.168.1.192/26. Next - just to make certain because basically this is what Twintails had in his/her post by saying to add a name String with exactly the same information - I overwrote VPN-net by 192.168.1.192/26 and saved. (I THINK that this last step might not really be needed, but I haven't tried).
Next click Save (basically it should already work, but I always want to be extra sure, so I stoped and immediately thereafter started the firewall again to be 100% certain all new rules are now active.
And now: it works! Clients can access the server AND the entire local network from remote using VPN.
One last comment: I have the feeling that (although less safe and less advanced technologicall) PPTP works much better for us then L2TP. So I have switched off L2TP support altogether because it simply NEVER really worked. We are using Mac OS X 10.4 and 10.5 to connect to the 10.5 server using this setup.

Lion server VPN not working away from network

Hey everyone,
So I have a mac mini setup with lion server, and setup a VPN, however after I setup the profile and installed it on my iphone and ipad, it worked great wile I was connected to the same network, but once I connect to either 3G or to a different network (than the server is based) it says,
"The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your administrator."
I have check the port mapping settings, as I have a airport extreme and have the VPN setting checked for the extreme from the server app. I have also disabled mobileme "back to my mac" on the computer, and also on the airport extreme just to make sure that wasn't causing the issue. I'm out of ideas, I know it has to do with the incoming connection, and I have setup a dyndns for the ip address. Any ideas would be really appriciated.

I also had the same issues but managed to fix it.
My airport extreme DHCP settings were conflicting with the VPN servers assigned addresses.
For example, the DHCP on the extreme was set to the range 10.0.1.200 - 10.0.1.254
And the VPN was set to the same range of 10.0.1.200 - 10.0.1.254
I then changed the DHCP range on the extreme to 10.0.1.100 - 10.0.1.229
and i set the VPN to give out IP addresses between 10.0.1.230 - 10.0.1.254
Reset both the extreme and VPN server, then boom. It started working, internally and externally.

Mac Mini Server VPN-Window 7 client

Hi,
The VPN connection from MacBookPro to Mac Mini Server (2011 with Mountain Lion 10.8.2) VPN works like magic. But, I never had any luck with any of Windows 7 laptops. Could any one take me to a good link to the Windows 7 VPN setup instruction?
Thank you so much in advance for your time reading this.
Best,
Michael

Heh Michael
I got this working using the settings in the screenshots below. I know I had a heck of a time trying to make it work but it does using these for me. Sometimes on the first connection it rejects the credentials, but on the second time it connects - no idea why. Hope this helps:

Snow Leopard Server VPN and other Servers

I am thinking of deploying Snow Leopard Server at work using the Mac MiniServer option. We have a few Macs that we would like to manage their settings with. We also have Active Directory. I plan to use Open Directory with the Mac then use kerbos for logins.
My question is if I use the Snow Leopard Server VPN with the Macs, will the users be able to access other resources on the LAN like Active Directory Shares, Exchange, and internal Intranets? Or only the Snow Leopard Server?
Thanks,
WillGonz

It sounds like you will have 2 different kerberos realms, one in OD and one in AD.
If you want them to use the same realm (the AD one) you need to look at a "golden triangle" setup.
If you want to authenticate the VPN connection using Kerberos I suspect you need to be able to reach the KDC server from Internet before the VPN is up. That would mean it needs to have a public IP and same name as on the LAN(?).
As an alternative a Radius connection for the VPN authentication from the Mac to an AD/Radius server might be possible.

Mavericks Server VPN client connection won't work

I have read many of the problems regarding remote clients not being able to connect to Mavericks Server 3.0 via L2TP outside of the network.
My understanding that Apple has fixed this with 3.02 update.
Since the update, I tried to setup my first time VPN connection and am having similar problems to the noted prior issues.
Mavericks Server has DNS, OD, and VPN setup and running with most current update as of 2/4/14.
My Airport Extreme router is managed via Server App and has VPN ports opened. Have shutoff Back to My Mac and Find my Mac also on the server. I have also put in my hostname miniserver."example".com into the DNS on my Fatcow registrar pointing to my public IP address. "example" obviously being my domain name.
My Mavericks Macbook Pro has been setup with VPN client/shared secret and the public ip address of my router. The Macbook will connect to the VPN inside the network, but will not connect outside of the local network. Have tried setting up my home Mavericks iMac with the same result.
Have read other discussions regarding copying the old racoon vpn from mountain lion server, but understand that shouldn't be necessary as Apple has allegedly fixed the problem. Also do not want to have to redo everytime Apple pushes out a Server update.
First time I have ever setup VPN and seems close, but not quite, to working.
Thanks.....

Select the Network tab in AirPort Utility and click Network Options. In the sheet that opens, check the box marked
Allow incoming IPSec authentication
if it's not already checked, and save the change.

How to import Lion Server VPN Configuration Profile into Profile Manager

Greetings All,
I'm working on configuring a Lion Server VPN (10.7.2) and I hit the following road block. I succesfully started the VPN server and profile manager. In fact, if I download the built-in "everyone" profile that has the pre-configured VPN to device such as an iPad things work just fine. However, I'd like to create other profiles with the same VPN configuration info so I can delegate more specifically to different groups and users. I was hoping I could simply import the VPN configuration profile that I saved in the Server dashboard when I setup the VPN service into profile manager somehow. The reason I'm going this route is because every time I try to just re-make the VPN profile it doesn't want to work. I'm not sure why, but I figure why re-invent the wheel if I don't have too. Any suggestions?

After a lot of investigating I haven't found a way to do this, I'm assuming it cannot be done.

\\SERVER\Clients\Setup\setup.exe with Windows Vista Error

I added the first Vista client to an SBS 2003, SP1 domain. Until now, all clients were WinXP, SP2. Office 2003 is installed on the XP clients, and the Vista client, which may not be pertinent to this problem.
As is normal, "\\SERVER\Clients\Setup\setup.exe /s SERVER" is executed when a user logs on to any domain client. On the Vista client, I always get the dialog -- regardless of the account privilege -- asking for permission to run Setup.exe. It is annoying. Occasionally, the Program Compatiblity Assistant will appear and advise there's a known compatiblity issue with Setup.exe. It points to KB article 926505 for resolution. The title of the KB is, "Windows Small Business Server 2003: Windows Vista and Outlook 2007 compatibility update."
When I run the SBS2003SP1-KB926505-X86-ENU.EXE fix, I get the error: "This update cannot be installed. Either it is already installed as part of an existing service pack, or it requires a more recent service pack. For more information, see the systems requirements on the download page."
I installed Windows Server 2003 SP2 and run the KB926505 fix, but I get the same error "This update cannot be installed. Either it is already installed as part of an existing service pack" After a reboot of te SBS server the same problem on the Vista client, I always get the dialog -- regardless of the account privilege -- asking for permission to run Setup.exe. It is annoying. Occasionally, the Program Compatiblity Assistant will appear and advise there's a known compatiblity issue with Setup.exe. It points to KB article 926505 for resolution.
The problem is Windows Vista Business, because all windows XP clients have no problem at all.

PNP,
You do not say whether if you accept the permission dialog whether the setup continues or not, but the short answer to the question revolves around UAC.
Remember that EVERY user (except the actual Administrator account) has only Standard user rights regardless of group. When a task that requires Admin rights is executed, one of three things will happen: 1) If you are THE Administrator, then your task will continue. 2) If you have Admin rights, you will be prompted that a process is trying to use elevated rights and ask for permission, or 3) If you are a Standard user, you will either be denied flatly or prompted to supply credentials. Which of these happen depend on GPO settings, but the default is to prompt.
In any event, I believe that this is what you are running into, and is one of the big feature improvements in Vista. Yes, it can be a bit annoying (Try deleting an "All Users" icon from the Start Menu!) but is there to place one more barrier between virus and malware writers and your OS.
If it's TOO annoying to bear, you can turn off UAC by going into your profile and disabling it. (It requires Admin rights, of course. ) It is not recommended as you do a very effective job or nutering the Vista Security Model by doing so.
If it, of course, your choice. we IT Admins have a lot more issues with this than the standard user, but for me, I gladly take the tradeoff because I worry a lot less about those few I HAVE to give Admin rights to.
Good luck!

[Error] Microsoft SQL Server 2008 Setup. Error reading from file msdbdata.mdf

Hi all
I'm trying to install SQL 2008 Express on my Computer: Hp compact DX7300 Slim tower.
and get this error:
TITLE: Microsoft SQL Server 2008 Setup
The following error has occurred:Error reading from file d:\8268cd7b247d294de359c9\x86\setup\sql_engine_core_inst_msi\PFiles\SqlServr\MSSQL.X\MSSQL\Binn\Template\msdbdata.mdf. Verify that the file exists and that you can access it.
Click 'Retry' to retry the failed action, or click 'Cancel' to cancel this action and continue setup.
For help, click: http://go.microsoft.com/fwlink?LinkID=20476&ProdName=Microsoft+SQL+Server&EvtSrc=setup.rll&EvtID=50000&ProdVer=10.0.1823.0&EvtType=0xF45F6601%25401201%25401
Log file
Overall summary:
Final result: SQL Server installation failed. To continue, investigate the reason for the failure, correct the problem, uninstall SQL Server, and then rerun SQL Server Setup.
Exit code (Decimal): -2068643839
Exit facility code: 1203
Exit error code: 1
Exit message: SQL Server installation failed. To continue, investigate the reason for the failure, correct the problem, uninstall SQL Server, and then rerun SQL Server Setup.
Start time: 2014-12-09 23:22:03
End time: 2014-12-09 23:40:28
Requested action: Install
Log with failure: C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20141209_232121\sql_engine_core_inst_Cpu32_1.log
Exception help link: http://go.microsoft.com/fwlink?LinkId=20476&ProdName=Microsoft+SQL+Server&EvtSrc=setup.rll&EvtID=50000&ProdVer=10.0.1823.0
Machine Properties:
Machine name: VISTA-PC
Machine processor count: 2
OS version: Windows Vista
OS service pack: Service Pack 1
OS region: United States
OS language: English (United States)
OS architecture: x86
Process architecture: 32 Bit
OS clustered: No
Product features discovered:
Product Instance Instance ID Feature
Language Edition Version Clustered
Package properties:
Description: SQL Server Database Services 2008
SQLProductFamilyCode: {628F8F38-600E-493D-9946-F4178F20A8A9}
ProductName: SQL2008
Type: RTM
Version: 10
SPLevel: 0
Installation location: d:\8268cd7b247d294de359c9\x86\setup\
Installation edition: EXPRESS
User Input Settings:
ACTION: Install
ADDCURRENTUSERASSQLADMIN: False
AGTSVCACCOUNT: NT AUTHORITY\NETWORK SERVICE
AGTSVCPASSWORD: *****
AGTSVCSTARTUPTYPE: Disabled
ASBACKUPDIR: Backup
ASCOLLATION: Latin1_General_CI_AS
ASCONFIGDIR: Config
ASDATADIR: Data
ASDOMAINGROUP: <empty>
ASLOGDIR: Log
ASPROVIDERMSOLAP: 1
ASSVCACCOUNT: <empty>
ASSVCPASSWORD: *****
ASSVCSTARTUPTYPE: Automatic
ASSYSADMINACCOUNTS: <empty>
ASTEMPDIR: Temp
BROWSERSVCSTARTUPTYPE: Disabled
CONFIGURATIONFILE: C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20141209_232121\ConfigurationFile.ini
ENABLERANU: True
ERRORREPORTING: False
FEATURES: SQLENGINE,REPLICATION
FILESTREAMLEVEL: 0
FILESTREAMSHARENAME: <empty>
FTSVCACCOUNT: <empty>
FTSVCPASSWORD: *****
HELP: False
INDICATEPROGRESS: False
INSTALLSHAREDDIR: C:\Program Files\Microsoft SQL Server\
INSTALLSHAREDWOWDIR: C:\Program Files\Microsoft SQL Server\
INSTALLSQLDATADIR: <empty>
INSTANCEDIR: C:\Program Files\Microsoft SQL Server\
INSTANCEID: SQLExpress
INSTANCENAME: SQLEXPRESS
ISSVCACCOUNT: NT AUTHORITY\NetworkService
ISSVCPASSWORD: *****
ISSVCSTARTUPTYPE: Automatic
MEDIASOURCE: d:\8268cd7b247d294de359c9\
NPENABLED: 0
PID: *****
QUIET: False
QUIETSIMPLE: False
RSINSTALLMODE: FilesOnlyMode
RSSVCACCOUNT: <empty>
RSSVCPASSWORD: *****
RSSVCSTARTUPTYPE: Automatic
SAPWD: *****
SECURITYMODE: <empty>
SQLBACKUPDIR: <empty>
SQLCOLLATION: SQL_Latin1_General_CP1_CI_AS
SQLSVCACCOUNT: NT AUTHORITY\NETWORK SERVICE
SQLSVCPASSWORD: *****
SQLSVCSTARTUPTYPE: Automatic
SQLSYSADMINACCOUNTS: VISTA-PC\VISTA
SQLTEMPDBDIR: <empty>
SQLTEMPDBLOGDIR: <empty>
SQLUSERDBDIR: <empty>
SQLUSERDBLOGDIR: <empty>
SQMREPORTING: False
TCPENABLED: 0
X86: False
Configuration file: C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20141209_232121\ConfigurationFile.ini
Detailed results:
Feature: Database Engine Services
Status: Failed: see logs for details
MSI status: Passed
Configuration status: Passed
Feature: SQL Server Replication
Status: Failed: see logs for details
MSI status: Passed
Configuration status: Passed
Rules with failures:
Global rules:
Scenario specific rules:
Rules report file: C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20141209_232121\SystemConfigurationCheck_Report.htm
I will very appriciate if someone can help me solve it. I was trying to set Full control for my account in Properties/Security of root folder and try again but error is still.
Many thanks

Hi Foreverduy,
Before you run SQL Server 2008 express setup, make sure that you have installed Windows installer 4.5 and.NET Framework 3.5 SP1 manually. For more information about the process, please refer to the article:
http://msdn.microsoft.com/en-us/library/ms143506(v=sql.100).aspx. Moreover, please turn off all the third-party softwares which could prohibit the installation process.
According to your error message, the issue could be due to that your account has no rights to install SQL Server, or the corruption on the media.
Firstly, please ensure that your account has admin rights. Also make sure that you right-click the setup.exe and choose “Run as administrator” to complete the installation.
Secondly, please check if "msdbdata.mdf" file exists at d:\8268cd7b247d294de359c9\x86\setup\sql_engine_core_inst_msi\PFiles\SqlServr\MSSQL.X\MSSQL\Binn\Template. If it exists, please make sure that your account has read permission to the extracted
folder.
However, if the file doesn't exist in the extraction, the media could be corrupt. Please download the
media
again and check if the issue still occurs.
Regards,
Michelle Li

Remote Access VPN Setup

Hello Support,
I have a question regarding a remote access VPN setup with the following. I have a Cisco 6500 with multiple VLANs, and an FWSM setup in mutliple context mode. Each of our clients sits behind their own context, and has their own associated VLANs. Each context has a shared interface, so that one network (our management network) can see all of the networks. We are using a Cisco ASA to terminate P2P VPNs as the FWSms cannot do so, but I would like to setup a remote access VPN from the ASA, but I will need to connect in and have access to all networks. Currently the ASA has an outside interface for internet, two client inside interfaces, and one interface on the shared network.
If I setup a remote access VPN from the ASA with a separate scope will I be able to see all the networks that I setup routes and nonats for or is there more to it?
I provided a brief diagram showing all the vlans, I will need to be able to access all of the 6500s vlans when connected using the VPN.
Thanks in advance for all ideas, suggestions, and assistance.

Hello John,
You will need to configure the respective IP Address pool for the Anyconnect users,
Then create the no_nat rules from all of the internal subnets to the Anyconnect Pool.
That should do it bud . I mean just make sure the internal network (core) knows that in order to reach the anyconnect pool must send the traffic to the ASA.
Rate all of the helpful posts!!!
Regards,
Jcarvaja
Follow me on http://laguiadelnetworking.com

Lion Server VPN error

I am trying to use the Lion Server VPN function and have all the firewall port opens (500, 1701, 1723, 4500) and cannot get anything to connect either inside or outside of the network. I keep getting "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your admin". I checked the log on the server and here is what I find under system log
Oct 27 21:03:56 www racoon[3529]: Connecting.
Oct 27 21:03:56 www racoon[3529]: IPSec Phase1 started (Initiated by peer).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: receive success. (Responder, Main-Mode message 1).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: transmit success. (Responder, Main-Mode message 2).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: receive success. (Responder, Main-Mode message 3).
Oct 27 21:03:56 www racoon[3529]: IKE Packet: transmit success. (Responder, Main-Mode message 4).
Oct 27 21:03:59 www racoon[3529]: IKE Packet: transmit success. (Phase1 Retransmit).
Oct 27 21:04:29: --- last message repeated 3 times ---
Oct 27 21:04:32 www racoon[3529]: IKE Packet: transmit success. (Phase1 Retransmit).
Then I get the error on the other machine (i.e. iPhone 4S, IMac)
Have I done searches on google for everything I can think of and can not find a answer, or at least not one that helps me.
Any help would be greatly appreciated
Sodak

If you are using iCloud "Back to my mac", then disable it.
These services are incompatible.

Lion Server VPN Service/Class C IPs/Bonjour

In order to deploy Lion Server's VPN service, you obviously are required to enter an IP range to assign. We are running a standard class C network here, with systems running on 192.168.1.x. The problem is that if a user is accessing the VPN from a remote location that also uses the same IP scheme, then they won't be able to connect. Is there a simple way to deal with this? Is the only way to fix the problem to re-assign every IP address on our network a more unique address scheme? We have a large network and that would be unwieldy.
Also, will it be possible to use Bonjour over the VPN? We want to be able to share network resources as if the user was physically connected to our LAN.
Thanks in advance for your answers!

Linc Davis wrote:
Also, will it be possible to use Bonjour over the VPN?
Bonjour doesn't work over a routed connection. You would need to use something like this:
Slinkware
Thanks for this link Linc. From descriptions and reviews it sounds like exactly what I was looking for to propagate Bonjour service discovery to a remote Mac. Being a little naive I had set up an OS X Server VPN expecting Bonjour to "just work" once a remote Mac connected!
In particular the Slinkware web site has a detailed description on how to set up certificate authentication which improves security (geeky but very well detailed).

OS X server: VPN setup

Similar Messages

Maybe you are looking for