| Event Id | 20048 |
| Source | RemoteAccess |
| Description | The user DOMAIN\USERNAME connected on port VPN4-127 on MM/DD/YYYY at HH:MM and disconnected on MM/DD/YYYY at HH:MM. The user was active for 1 minutes 32 seconds. 749 bytes were sent and 10349 bytes were received. The port speed was 10000000. The reason for disconnecting was user request. |
| Event Information | According to Microsoft: CAUSE: This problem may occur if the VPN servers have been configured to use two PPTP tunnels, and if the end that initiates that the PPTP control channel is running Network Address Translation (NAT). NAT may be active if it has been configured in Routing and Remote Access or if the Internet Security and Acceleration (ISA) Server Firewall service is started. Two PPTP tunnels may be established if the user name of the calling server does not match the remote servers demand-dial interface. Routing and Remote Access uses the user name to see if a local demand-dial interface should be associated with the tunnel. If a match is found, the two interfaces are associated, and both enter a connected state. Traffic can then be tunneled in both directions over one PPTP tunnel. If the user name does not match, two PPTP tunnels are established over the same PPTP control channel (TCP connection); one PPTP call in each direction. RFC 2637 states that only one PPTP control channel should be established between a PPTP Access Concentrator (PAC) and a PPTP Network Server (PNS). When NAT is running on a Routing and Remote Access VPN Server, all outbound connections are subject to NAT. Routing and Remote Access uses a NAT editor to translate the PPTP packets and make sure that packets received on the public side of NAT is delivered to the correct port on the private side. To do this the PPTP NAT Editor creates a mapping to keep track of each PPTP session. The mapping uses the IP addresses and the PPTP Call IDs to translate the packets correctly. The PPTP Call ID and the PPTP Peers Call ID are negotiated during the PPTP Call Request and the PPTP Call Reply. When the second PPTP tunnel is created the PPTP Call Request is received on the already existing PPTP Control Channel but in the opposite direction. However a new mapping in the PPTP NAT Editor is not created and the PPTP packets are dropped. RESOLUTION: To work around this pro |
| Reference Links | A demand-dial PPTP connection may disconnect every 1 minute and 30 seconds |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.