Windows 7 - Domain Users and VPN connectivity

Asked By Sea

19-Jul-07 10:56 AM

I'm hoping this is something simple, which I think it is, but I am at my wits
end here.

We are running LCS 2005 on a domain environment.  I have a branch office in
another state with a VPN tunnel to our main facility here.

At the moment I have a single LCS server, and I'm trying to connect the
remote office to LCS over the VPN.

Now I know Kerberos is working, as I can read the security logs and see
Kerberos traffic being approved.  However, LCS does not connect at all.
Doing the LCS diag, it fails on the Kerberos authentication (by time out
usually).

Since this is a domain, I cannot just disable Kerberos authentication, as it
will simply prompt me to login.

I'm guessing what I need is an access proxy.  Reading through these forums,
however, people have stated that access proxies are sort of legacy,
pertaining only to LCS 2003.

Hoping someone can help me out here, it's getting frustrating.

19-Jul-07 12:35 PM

Access Proxies are still used for external connection (without VPN) and
federation.

One issue you can have with Kerberos authentication is if the date/time on
the clients is too far off from the value on the Kerberos server.  If the
difference is too large, then the auth will fail.

The other option you have, since your users are connected to your network
using a VPN, you could configure the LCS server to only use NTLM to
authenticate.

Another thing to check is that some VPN appliances apparently have issues
with the SIP traffic between Communicator and LCS.  I'm not sure which ones
have the problem, but someone else in the newsgroup might have that
information cached somewhere.


--

Oscar Newkerk
Unified Communications Group
---------------------------------------------------------------
This posting is provided "AS IS" with no warranties, and confers no rights.

19-Jul-07 01:44 PM

Well I'm leaning on it being something with the firewall, just not sure what
exactly.

We run Juniper firewalls, which can be overly sensative at times.  Our VPN
policy though allows all traffic exclusively on the VPN to pass through.

With just NTLM on the LCS server, I get "the service is temporarily shut
down", typical errors of it timing out.

LCSDiag indicates all traffic is working as intended and shows I connect
just fine, however Communicator does not sign in.

26-Jul-07 10:48 AM

I'm still having issues.

With just NTLM authentication configured, the communicator program does not
login at all.

However, LCSDiag shows that connectivity is established and returns

So the Diagnostic is signing in fine, but the Communicator is not.  Is there
a time out feature in the Communicator program that needs to be adjusted?

27-Jul-07 10:12 AM

Okay resolved it with Juniper.

Similar to the Cisco issue with SIP traffic, the Juniper Layer 3 filtering
was interfering with the communicator SIP traffic.

In order to disable this, go into your Juniper webGUI, and go to
Configuration > Advanced > ALG.

Disable the SIP Application Layer Gateway filter, and save your settings.
Everything should be good to go from there