Windows XP - VPN error 721 - TCP out of order errors

Asked By kelly mclaurin on 27-Jun-08 01:31 PM
Hello,
I have 10 computers that CAN connect to my SBS 2003 pptp VPN.
I have 1 user who cannot.  He is running XP sp2.  He gets 721 error.
I can run pptpclnt / pptpsrv successfully from this client to the
server, so GRE is not the issue.

(Dell server / 2 NICs; 1 NIC connected to local network; 1 NIC
connected to public network.
I have rerun CEICW, reinstalled RAS on the server.

I have msconfiged and booted very clean on his PC (no AV, firewall,
defender, etc)

I tried connecting to another company's SBS vpn on his PC and have
same issue.

I can connect to vpn  with his account on another computer.

It fails with any account I try on his computer.

So, problem has to be computer specific.

I wiresharked the communication between his PC and the server and received alot of TCP out of order errors (about 5 out of 50 packets.)  Can someone advise how to adjust XP's tcp settings to troubleshoot/fix this?

Although pptpclnt / pptpsrv worked, when I filtered the wireshark capture for proto GRE packets only, none were identified as GRE.

The fact the pptpclnt / pptpsrv succeeded really has me stumped.
Any ideas?  Are there any alternative vpn clients that run under xp
and connect to a sbs 2003 vpn?
thanks

VPN error 721 - TCP out of order errors - Swapnil Salunke replied to kelly mclaurin on 29-Jun-08 01:33 AM

Hello Kelly

This could be the Suggestion as I am not that much in to the subject as of you
But wish this can be solve your problem
To resolve this issue, configure the network firewall to permit GRE protocol 47. Also, make sure that the network firewall permits TCP traffic on port 1723. Both of these conditions must be met to establish VPN connectivity by using PPTP.

This information can be get from this site
http://support.microsoft.com/kb/888201

Happy Coding takecare

Thanks - kelly mclaurin replied to Swapnil Salunke on 29-Jun-08 01:43 AM

Thank you for your reply.  I know that the 721 error code suggests a GRE or 1723 problem.  However, I have already confirmed that those 2 conditions already exist.  I downloaded a tool called DRTCP and am going to play around with some MTUs, etc as soon as I can get on the user's PC.