Clients receives error 691 trying to connect to ISA Server 2006 as VPN Server

[LEFT][CODE]http://blogs.technet.com/isablog/archive/2009/03/19/clients-receives-error-691-trying-to-connect-to-isa-server-2006-as-vpn-server.aspx[/CODE]

[B][SIZE=3][FONT=Calibri]1. Introduction[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]When ISA Server 2006 is configured to be a VPN Server there is always a doubt of what to do when something happens and data needs to be gathered since there are two major components in use: ISA Server and Windows RRAS. Depending on the error message you might be able to figure out which one is potentially causing the issue. In this particular scenario the description of the [/SIZE][/FONT][URL="http://support.microsoft.com/kb/q163111/"][FONT=Calibri][SIZE=3]691[/SIZE][/FONT][/URL][FONT=Calibri][SIZE=3] error is very tricky because it sounds like an authentication issue as you can see in Figure 1:[/SIZE][/FONT]

[IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3215409/original.aspx[/IMG]
[FONT=Calibri] [/FONT][FONT=Calibri][SIZE=3]Figure 1 - Error 691 leads you to believe that there is an authentication issue.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]By only reading this message the first reaction is to review the authentication repository that ISA Server 2006 is using to authenticate users. [/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[CODE]
[FONT=Calibri][I][SIZE=3]Note: A great start while troubleshooting VPN issues on ISA Server is to go through the article [/SIZE][/I][URL="http://technet.microsoft.com/en-us/library/cc302672.aspx"][I][SIZE=3]Troubleshooting Virtual Private Networking[/SIZE][/I][/URL][I][SIZE=3] to isolate where the issue might reside.[/SIZE][/I][/FONT]
[/CODE]

[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]In this particular case this troubleshooter didn’t help to fix the issue, however it did help to isolate and figure out which components were working properly. The next step in this type of case is to gather more data and analyzing it.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][B][SIZE=3]2. Gathering Data[/SIZE][/B][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]The data gathering in this type of scenario is much more on the Windows RRAS side rather than on ISA Server 2006 side. On ISA Server you just need to make sure that the VPN client access configuration is correctly done. To confirm that the configuration is correctly done you can use the article [/SIZE][URL="http://technet.microsoft.com/en-us/library/cc302647.aspx"][SIZE=3]Configuring the ISA Server 2004 Firewall as a VPN Server[/SIZE][/URL][SIZE=3] to review the main steps. Assuming that it is correctly, next step on ISA Server side is to monitoring the user attempt to connect using Monitoring/Logging. In this particular case, ISA Server Logging was showing that the connection was allowed and no major issues were detected:[/SIZE][/FONT]
[FONT=Calibri] [/FONT]
[FONT=Calibri][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3215410/original.aspx[/IMG] [/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT][FONT=Calibri][SIZE=3]Figure 2 – ISA Logging showing that the PPTP connections were all allowed.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]By isolating ISA Server from the scenario, next step is to get more data on the RRAS side. The best way to do that is by enabling RRAS Tracing Log. To do that open command prompt on ISA Server computer and type: [/SIZE][/FONT]
[FONT=Courier New][FONT=Calibri][SIZE=3]netsh ras set tracing * enable[/SIZE][/FONT][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT][FONT=Calibri][SIZE=3]By running this command on ISA Server a new set of logging will be created at [I]%systemroot%\tracing [/I]folderby Windows RRAS component. [/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[CODE]
[FONT=Calibri][SIZE=3][I]Note: For more information on Troubleshooting Tools for VPN access article [/I][URL="http://technet.microsoft.com/en-us/library/cc738259.aspx"][I]Troubleshooting[/I][/URL][I].[/I][/SIZE][/FONT]
[/CODE]

[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Besides this logging, you also can use the following tools to assist you on gathering even more details to better understand what is happening under the hood:[/SIZE][/FONT]
[FONT=Symbol][FONT=Calibri][SIZE=3]·[FONT=Times New Roman] [/FONT][/SIZE][/FONT][/FONT][FONT=Calibri][SIZE=3][URL="http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=f4db40af-1e08-4a21-a26b-ec2f4dc4190d"]Network Monitor[/URL]: by binding netmon to the internal NIC of ISA you can see the network communication from ISA to any internal server that can be related to this VPN access attempt.[/SIZE][/FONT]
[FONT=Symbol][FONT=Calibri][SIZE=3]·[FONT=Times New Roman] [/FONT][/SIZE][/FONT][/FONT][FONT=Calibri][SIZE=3][URL="http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx"]Process Explorer[/URL]: RRAS runs under svchost process (svchost.exe –k netsvcs) and with Process Explorer you can verify deeply what this process is doing.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]After setup all these tools, repro the [/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][B]3. Analyzing[/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]When start analyzing the whole set of data is better to start looking to log files created in [I]%systemroot%\tracing [/I]folder. In this particular case the only log file that was showing something that could be related to the issue was the file IASACCT.LOG with the following errors:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[CODE]
[FONT=Courier New][FONT=Calibri][SIZE=3][844] 03-05 17:32:33:422: IDBInitialize::Initialize failed; return value = 0x80004005[/SIZE][/FONT][/FONT]
[COLOR=red][FONT=Courier New][FONT=Calibri][SIZE=3][844] 03-05 17:32:33:422: Description: [DBNETLIB][ConnectionOpen (Connect()).]SQL Server does not exist or access denied.[/SIZE][/FONT][/FONT][/COLOR]
[FONT=Courier New][FONT=Calibri][SIZE=3][844] 03-05 17:32:33:422: Record 0: hrError = 0x80004005; dwMinor = 0x00000011[/SIZE][/FONT][/FONT]
[FONT=Courier New][FONT=Calibri][SIZE=3][844] 03-05 17:32:56:484: IDBInitialize::Initialize failed; return value = 0x80004005[/SIZE][/FONT][/FONT]
[COLOR=red][FONT=Courier New][FONT=Calibri][SIZE=3][844] 03-05 17:32:56:484: Description: [DBNETLIB][ConnectionOpen (Connect()).]SQL Server does not exist or access denied.[/SIZE][/FONT][/FONT][/COLOR][/CODE]

[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]You might be thinking that ISA Server is logging on a SQL database and this database is somehow not accessible. However you need to remember that those logs are not related to ISA component, they are all related to Windows RRAS Component. [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]To confirm that this error was consistently happening, we asked to try to connect again and at this time we used Process Explorer to view more information about the SVCHOST Process as shown in Figure 3:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3215411/original.aspx[/IMG] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Figure 3 - Using Process Explorer you also can see that the SVCHOST process is accessing the IASACCT tracing key.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]To see more details about this process you need right click on it and choose properties. For this particular case one thing that I want to see was the TCP/IP tab since the error message in the log file says that the server does not exist and my question at that point was: which server? Let’s see in Figure 4 what process explorer says:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3215412/original.aspx[/IMG] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Figure 4 – Svchost was trying to establish a connection with 192.168.5.80.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Great, now we know that the SVCHOST process was trying to connect (TCP SYN was sent) to 192.168.5.80. By talking with the system administrator he was able to determine that 192.168.5.80 was an old SQL Server that they used to have, even he didn’t know why and who was using this server.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]At this point we already know that ISA Server was not involved as the culprit for this issue and that all evidences points to an issue on Windows RRAS component. In this type of scenario where you need to review RRAS configuration, nothing better than do a quick review on RRAS Management Console to see if everything looks fine. At this point in time in a real troubleshooting scenario within Microsoft CSS, we already have Networking team engaged and working with us to identify what is happening. After reviewing the logs our Networking team was able to conclude that the SQL Server which the logging is complaining about could be hosting the RRAS Logging….bingo!!! Figure 5 shows exactly that:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3215413/original.aspx[/IMG] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Figure 5 – RRAS was using a SQL Server that didn’t exist anymore.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]This makes perfect sense since in compliance with RADIUS RFC if the logging cannot be reached, all requests should be rejected.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][B]4. Conclusion[/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]This was a typical example of an issue that started with ISA Server as culprit and required hours of troubleshooting to finally understand what the real issue was. This also helps you to understand that ISA Server VPN component uses Windows RRAS component and that when the ISA is isolated from the main problem, the troubleshooting line needs to follow RRAS tools and techniques.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][B][U]Author[/U][/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Yuri Diogenes[/SIZE][/FONT][FONT=Times New Roman][/FONT]
[FONT=Calibri][SIZE=3]Security Support Engineer [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Microsoft CSS Forefront Edge Team[/SIZE][/FONT][FONT=Times New Roman][/FONT]
[FONT=Times New Roman][FONT=Calibri][SIZE=3] [/SIZE][/FONT][/FONT]
[FONT=Calibri][SIZE=3][B][U]Technical Reviewers[/U][/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Clay Seymour[/SIZE][/FONT][FONT=Times New Roman][/FONT]
[FONT=Calibri][SIZE=3]Sr. Support Escalation Engineer[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Microsoft Networking Team[/SIZE][/FONT][FONT=Times New Roman][/FONT]
[FONT=Times New Roman][FONT=Calibri][SIZE=3] [/SIZE][/FONT][/FONT]
[FONT=Calibri][SIZE=3]Vic Singh Shahid[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Escalation Engineer [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Microsoft CSS Forefront Edge Team[/SIZE][/FONT][FONT=Times New Roman][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3][I]Special thanks to Daniel Pires (MS Vendor in Brazil) that worked in an issue like that and inspired me to reproduce this behavior in lab[/I][/SIZE][/FONT]
[/LEFT]