Tiger VPN won't connect, Panther VPN will

Question

Tiger VPN won't connect, Panther VPN will

I recently upgraded from Panther to Tiger. Using the VPN in Panther I was able to connect to my work VPN server using PPTP with no problem. Now with Tiger I can't. I enabled verbose logging and here is what I got:

Wed Oct 12 19:13:20 2005 : CHAP authentication succeeded
Wed Oct 12 19:13:20 2005 : Disabling 40-bit MPPE; MS-CHAP LM not supported
Wed Oct 12 19:13:20 2005 : sent [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
Wed Oct 12 19:13:20 2005 : rcvd [CCP ConfReq id=0x1 <mppe +H -M -S +L -D -C>]
Wed Oct 12 19:13:20 2005 : MPPE required but peer negotiation failed
Wed Oct 12 19:13:20 2005 : sent [LCP TermReq id=0x3 "MPPE required but peer nego
tiation failed"]
Wed Oct 12 19:13:20 2005 : sent [CCP ConfRej id=0x1 <mppe +H -M -S +L -D -C>]
Wed Oct 12 19:13:20 2005 : rcvd [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
Wed Oct 12 19:13:20 2005 : rcvd [LCP TermAck id=0x3]
Wed Oct 12 19:13:21 2005 : Connection terminated.
Wed Oct 12 19:13:21 2005 : PPTP disconnecting...
Wed Oct 12 19:13:21 2005 : PPTP disconnected

It seems that pppd is terminating the connection based on receiving a ConfReq from the peer that doesn't match it's own ConfReq. If it would have just waited for the peer to send the ConfAck that matched the ConfReq we sent, the connection probably would have succeeded. Anybody else having a similar problem, or have a solution other than downgrading to Panther?

Posted on Oct 12, 2005 8:21 PM

Reply

Answer 1

leigh-

Level 4

1,545 points

Oct 15, 2005 4:07 PM in response to Michael Clayville

Tiger does not support MS-CHAP LM.

Can you check with the VPN admin to reconfigure the VPN for MS-CHAPv2? It would be far more secure.

Reply

Answer 2

Oct 20, 2005 8:32 PM in response to leigh-

But the log indicates that CHAP has already succeeded. I think it's at the stage where it's trying to negotiate encryption for MPPE. And when it receives an encryption request lower than what it sent it pessimitically closes the connection rather than wait for the other side to ACK, which the other side did and agreed to the higher encryption request. The question is why is Tiger looking at the other side's request instead of it's ACK?

Reply