I'm trying to debug IPSec Main Mode / IKE issues using wfp tracing and/or debugging of the IKE IPSec service. I've got the ETL files and tracefmt from the DDK, but I don't have wfp.tmf for my platform so the formatted event output is just a bunch of "No Format Information found".
Server 2008 R2 doesn't have wfp.tmf in %windir%\system32. Why isn't available and where can I get it?
We have Microsoft's DirectAccess VPN set up on Server 2008 R2 with end-to-edge security, and we're having trouble with the manage-out tunnel.
The DirectAccess client has DC/DNS and intranet connectivity, it can ping/rdp/etc to intranet hosts. However connections originating from those same intranet hosts can only intermittently reach the client. At times it works fine, other times it doesn't.
When an inbound (intranet to client) connection is attempted there's an IPSec Main Mode failure logged: Event 4653 with a failure reason of "No Policy Configured".
I think that it may be related to the state of the intranet (corp) access tunnel, and an overlap in the configured subnets for those polices. I haven't figured out exactly what's different in the scenario where the connection works and where it does not.