Event ID 1 — RRAS Secure Socket Tunneling Protocol

Event ID 1 — RRAS Secure Socket Tunneling Protocol

Updated: November 29, 2007
Applies To: Windows Server 2008
Secure Socket Tunneling Protocol (SSTP) is a new form of virtual private networking (VPN) tunnel with features that allow traffic to pass through firewalls that block PPTP and L2TP/IPsec traffic. SSTP provides a mechanism to encapsulate Point-to-Point (PPP) traffic over the Secure Sockets Layer (SSL) channel of the HTTPS protocol. The use of HTTPS means traffic will flow through TCP port 443, a port commonly used for Web access.

Event Details

Product:	Windows Operating System
ID:	1
Source:	Microsoft-Windows-RasSstp
Version:	6.0
Symbolic Name:	SSTPSVC_LOG_CLIENT_REQUEST_FAIL
Message:	The initial Secure Socket Tunneling Protocol request could not be successfully sent to the server. This can be due to network connectivity issues or certificate (trust) issues. The detailed error message is provided below. Correct the problem and try again. %1

Resolve

Fix the network connectivity or certificate issue

Fix the network connectivity or certificate-related issue and try the connection again.
Note:  The following procedures include steps for using the ping command to perform troubleshooting. Before you perform these steps, check whether the firewall or Internet Protocol security (IPsec) settings on your network allow Internet Control Message Protocol (ICMP) traffic. ICMP is the TCP/IP protocol that is used by the ping command.
To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.
Follow the procedures in the order in which they appear until the problem is resolved.

Determine if there is a network connectivity problem

To determine if there is a network connectivity problem between the remote access server and the domain controller:

1. On the remote access server, click Start, click Run, type cmd, and then click OK.
2. At the command prompt, type ping server_FQDN, where server_FQDN is the fully qualified domain name (FQDN) of the domain controller (for example, server1.contoso.com), and then press ENTER. If the ping was successful, you will receive a reply similar to the following:
   Reply from IP_address: bytes=32 time=3ms TTL=59
Reply from IP_address: bytes=32 time=20ms TTL=59
Reply from IP_address: bytes=32 time=3ms TTL=59
Reply from IP_address: bytes=32 time=6ms TTL=59
3. At the command prompt, type ping IP_address, where IP_address is the IP address of the domain controller, and then press ENTER.

If you can successfully ping the domain controller by IP address, but not by FQDN, this indicates a possible issue with DNS host name resolution.
If you cannot successfully ping the domain controller by IP address, this indicates a possible issue with network connectivity, firewall configuration, or Internet Protocol security (IPsec) configuration.

Perform additional troubleshooting steps

The following are some additional troubleshooting steps that you can perform to help identify the root cause of the problem:

• Ping other computers on the network to help determine the extent of the network connectivity issue.
• If you can ping other servers but not the domain controller, try to ping the domain controller from another computer. If you cannot ping the domain controller from any computer, first ensure that the domain controller is running. If the domain controller is running, check the network settings on the domain controller.
• Check the TCP/IP settings on the local computer by doing the following:
  1. Click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type ipconfig /all, and then press ENTER. Make sure that the information listed is correct.
  3. Type ping localhost to verify that TCP/IP is installed and correctly configured on the local computer. If the ping is unsuccessful, this might indicate the TCP/IP stack is corrupted or that there is a problem with your network adapter.
  4. Type ping IP_address, where IP_address is the IP address assigned to the computer. If you can ping the localhost address but not the local address, there might be an issue with the routing table or the network adapter driver.
  5. Type ping DNS_server, where DNS_server is the IP address assigned to the DNS server. If there is more than one DNS server on your network, you should ping each one. If you cannot ping the DNS servers, this indicates a potential problem with the DNS servers, or with the network between the computer and the DNS servers.
  6. If the domain controller is on a different subnet, try to ping the default gateway. If you cannot ping the default gateway, this might indicate a problem with the network adapter, the router or gateway device, cabling, or other connectivity hardware.
• In Device Manager, check the status of the network adapter. To open Device Manager, click Start, click Run, type devmgmt.msc, and then click OK.
• Check network connectivity indicator lights on the computer and at the hub or router. Check network cabling.
• Check firewall settings by using the Windows Firewall with Advanced Security snap-in.
• Check IPsec settings by using the IP Security Policy Management snap-in.

Verify

To verify that the remote access server can accept connections, establish a remote access connection from a client computer.
To create a VPN connection:

1. Click Start, and then click Control Panel.
2. Click Network and Internet, click Network and Sharing Center, and then click Set up a connection or network.
3. Click Connect to a workplace, and then click Next.
4. Complete the steps in the Connect to a Workplace wizard.

To connect to a remote access server:

1. In Network and Sharing Center, click Manage network connections.
2. Double-click the VPN connection, and then click Connect.
3. Verify that the connection was established successfully.