Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20049 Source: RemoteAccess

Source
Level
Description
The user connected to port VPN3-4 has been disconnected because the authentication process did not complete within the required amount of time.
Comments
 
My system was a Windows 2000 Advanced Server with 2 Linksys NIC cards, one in the DMZ (Linksys BEFSX42 Ver. 2) the other in LAN. MS VPN client was unable to connect to RRAS server (Error: 800). RRAS worked when the client was on same network as the DMZ NIC but not when passing thru BEFAX42. I resolved this issue by changing the IP on the LAN NIC from DHCP assigned address to a static address.
I have also run into this problem. It turned out to be a client situation where the laptop was running with a wireless adapter that was too far from the wireless router. This caused the authentication process to timeout. Moving the laptop closer to the router or switching back to Cat5e cabling made the problem disappear.
As per Microsoft: "The connection attempt failed because the authentication process timed out and the user was automatically disconnected. The delay in the authentication process could be caused by network problems". See MSW2KDB for more information.
From a newsgroup post: "I had the same trouble and found that it was because of the default
gateway. It happens because the default route becames the default gateway of my internal card. Force a permanent route so that your default route is the default gateway of
your external card."
From another post: "You may get this message if your server is behind a firewall. Make sure the firewall allows VPN traffic to go through".
The ME191854 says that this was a problem that was corrected with Windows NT Service Pack 4.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...