Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Cannot Ping External Network Adapter After Configuring RRAS as a VPN Server

Cannot Ping External Network Adapter After Configuring RRAS as a VPN Server

Symptoms

After you configure the Routing and Remote Access Service (RRAS) as a virtual private network (VPN) server in Windows 2000 Server or Windows Server 2003 with two or more network adapters, pinging the external network adapter does not work. This behavior occurs only while RRAS is running. Pinging the external network adapter succeeds when RRAS is stopped.

↑ Back to the top

Cause

When you use the Routing and Remote Access Server Setup Wizard to configure RRAS as a VPN server. The wizard prompts you for the network adapter to be used for the Internet connection. Choosing an adapter on the Internet Connection page specifies the external adapter, which is the network adapter on which RRAS applies Input and Output filters similar to the following:

Src AddrSrc MaskDest AddrDest MaskProtocolSrc PortDest PortDescription
AnyAnyAnyAny47AnyAnyGRE
AnyAnyAnyAnyTCP1723AnyPPTP Inbound
AnyAnyAnyAnyTCPAny1723PPTP Outbound
AnyAnyAnyAnyUDP500500ISAKMP
AnyAnyAnyAnyUDP17011701L2TP


To see a which filters are defined for an adapter:
  1. Start the Routing and Remote Access snap-in in Microsoft Management Console (MMC).
  2. Expand the IP Routing node in the left pane.
  3. Click General in the left pane.
  4. Right-click the adapter listed in the right pane, and then click Properties.
  5. You can view and edit the Inbound and Outbound filters on the General tab.

↑ Back to the top

Resolution

To allow pinging to and from the external network adapter, add Inbound and Outbound filters to the adapter to allow Internet Control Message Protocol (ICMP) packets to be processed on the adapter.

Note The Windows Server 2003 implementation of the TCP/IP protocol supports ICMP router solicitations and the receipt of ICMP router advertisements, but they are disabled by default. Routing and Remote Access supports ICMP router advertisements. For more information about how to enable ICMP router solicitation, see the Windows Server 2003 "Routing and Remote Access" Help topic.

To enable ICMP router discovery:
  1. Start the Routing and Remote Access snap-in in MMC.
  2. In the left pane, click General under the IP Routing node.
  3. In the right pane, right-click the adapter that has been configured as the external adapter, and then click Properties.
  4. Click Input Filters.
  5. Click Add.
  6. In the Protocol box, click ICMP.
  7. Click OK, and then click OK.
  8. Click Output Filters, and then repeat the previous three steps.
For additional information about the changes made by the Routing and Remote Access Setup Wizard, click the following article number to view the article in the Microsoft Knowledge Base:
256644 Description of Remote Access Wizards

↑ Back to the top

Status

This behavior is by design to tighten security on the Internet VPN server.

↑ Back to the top

Keywords: kbbillprodsweep, kbwinnetswept, kbenv, kbprb, kb

↑ Back to the top

Article Info
Article ID : 258030
Revision : 3
Created on : 4/20/2018
Published on : 4/20/2018
Exists online : False
Views : 175