DHCP assigning 169 series address

We have been having problems with our vpn connections at the office and away
where the vpn connections seem like they are connected though they are not.
This generally happens at random interval but sometimes can take up to 3hrs
before the address changes.

This is caused by the ip address of the vpn connection changing from a
10.xxx.xxx.xxx address to a 169.xxx.xxx.xxx address. The correct address
remains active for a few hours then the 169.xxx.xxx.xxx gets assigned and
connection to the network is no longer.

We run both windows xp and vista and the problem is on both operating
systems. The server on which the DHCP resides in is server 2003 sp1

Any help here would be good as information i have found doesn't seem to make
a difference

"bRad" <(E-Mail Removed)> wrote in message
news:538AF6EF-2A99-4132-8F48-(E-Mail Removed)...
> We have been having problems with our vpn connections at the office and
> away
> where the vpn connections seem like they are connected though they are
> not.
> This generally happens at random interval but sometimes can take up to
> 3hrs
> before the address changes.
>
> This is caused by the ip address of the vpn connection changing from a
> 10.xxx.xxx.xxx address to a 169.xxx.xxx.xxx address. The correct address
> remains active for a few hours then the 169.xxx.xxx.xxx gets assigned and
> connection to the network is no longer.
>
> We run both windows xp and vista and the problem is on both operating
> systems. The server on which the DHCP resides in is server 2003 sp1
>
> Any help here would be good as information i have found doesn't seem to
> make
> a difference

What are you using for a VPN server? Windows 2003 or a hardware device?

One thing I can suggest first off for starters is to install SP2 and all the
associated upgrades. You're a few years behind. I'm sure there are many
fixes and upgrades to DHCP as well as VPNs, if you are using the server for
VPNs.

Also, if you are using the server for VPNs, and assuming it has multiple
NICs, is it a DC? This can cause issues as well.

--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Infinite Diversities in Infinite Combinations

Yes it has has two NIC installed.One for internet and the other for the LAN.
The Server is a DC which we have planned on getting the SP2 applied to it but
haven't as of yet.

What was the issue with it being a DC?



"Ace Fekay [MVP Direcrtory Services]" wrote:

>
> "bRad" <(E-Mail Removed)> wrote in message
> news:538AF6EF-2A99-4132-8F48-(E-Mail Removed)...
> > We have been having problems with our vpn connections at the office and
> > away
> > where the vpn connections seem like they are connected though they are
> > not.
> > This generally happens at random interval but sometimes can take up to
> > 3hrs
> > before the address changes.
> >
> > This is caused by the ip address of the vpn connection changing from a
> > 10.xxx.xxx.xxx address to a 169.xxx.xxx.xxx address. The correct address
> > remains active for a few hours then the 169.xxx.xxx.xxx gets assigned and
> > connection to the network is no longer.
> >
> > We run both windows xp and vista and the problem is on both operating
> > systems. The server on which the DHCP resides in is server 2003 sp1
> >
> > Any help here would be good as information i have found doesn't seem to
> > make
> > a difference
>
> What are you using for a VPN server? Windows 2003 or a hardware device?
>
> One thing I can suggest first off for starters is to install SP2 and all the
> associated upgrades. You're a few years behind. I'm sure there are many
> fixes and upgrades to DHCP as well as VPNs, if you are using the server for
> VPNs.
>
> Also, if you are using the server for VPNs, and assuming it has multiple
> NICs, is it a DC? This can cause issues as well.
>
> --
> Regards,
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
> MVP Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Infinite Diversities in Infinite Combinations
>
>

"bRad" <(E-Mail Removed)> wrote in message
news:920E7FE5-F9F1-4839-931E-(E-Mail Removed)...
> Yes it has has two NIC installed.One for internet and the other for the
> LAN.
> The Server is a DC which we have planned on getting the SP2 applied to it
> but
> haven't as of yet.
>
> What was the issue with it being a DC?
>
>
>
> "Ace Fekay [MVP Direcrtory Services]" wrote:
>
>>
>> "bRad" <(E-Mail Removed)> wrote in message
>> news:538AF6EF-2A99-4132-8F48-(E-Mail Removed)...
>> > We have been having problems with our vpn connections at the office and
>> > away
>> > where the vpn connections seem like they are connected though they are
>> > not.
>> > This generally happens at random interval but sometimes can take up to
>> > 3hrs
>> > before the address changes.
>> >
>> > This is caused by the ip address of the vpn connection changing from a
>> > 10.xxx.xxx.xxx address to a 169.xxx.xxx.xxx address. The correct
>> > address
>> > remains active for a few hours then the 169.xxx.xxx.xxx gets assigned
>> > and
>> > connection to the network is no longer.
>> >
>> > We run both windows xp and vista and the problem is on both operating
>> > systems. The server on which the DHCP resides in is server 2003 sp1
>> >
>> > Any help here would be good as information i have found doesn't seem to
>> > make
>> > a difference
>>
>> What are you using for a VPN server? Windows 2003 or a hardware device?
>>
>> One thing I can suggest first off for starters is to install SP2 and all
>> the
>> associated upgrades. You're a few years behind. I'm sure there are many
>> fixes and upgrades to DHCP as well as VPNs, if you are using the server
>> for
>> VPNs.
>>
>> Also, if you are using the server for VPNs, and assuming it has multiple
>> NICs, is it a DC? This can cause issues as well.
>>
>> --
>> Regards,
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and
>> confers no rights.
>>
>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
>> MVP Microsoft MVP - Directory Services
>> Microsoft Certified Trainer
>>
>> For urgent issues, you may want to contact Microsoft PSS directly. Please
>> check http://support.microsoft.com for regional support phone numbers.
>>
>> Infinite Diversities in Infinite Combinations
>>
>>

Running a DC/DNS server as a router or remote access server is always a
bad idea. There are things you can do to improve the situation (see KB292822
for example) but it is better to avoid it if you can.

RRAS uses a pool of addresses to allocate to remote clients. If the
server is set to use DHCP it leases these from DHCP. If the DHCP server is
unavailable for any reason, it will uses APIPA addresses (169.254.x.y).

My guess is that the RRAS server can't DHCP (probably because of the
multihomed DNS server) and is forced to use APIPA addresses. One solution
would be to use a static address pool for remote access rather than using
DHCP.

Agree. We have seen many cases like this one.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"Bill Grant" <not.available@online> wrote in message
news:eRsnYR3%(E-Mail Removed)...
>
>
> "bRad" <(E-Mail Removed)> wrote in message
> news:920E7FE5-F9F1-4839-931E-(E-Mail Removed)...
>> Yes it has has two NIC installed.One for internet and the other for the
>> LAN.
>> The Server is a DC which we have planned on getting the SP2 applied to it
>> but
>> haven't as of yet.
>>
>> What was the issue with it being a DC?
>>
>>
>>
>> "Ace Fekay [MVP Direcrtory Services]" wrote:
>>
>>>
>>> "bRad" <(E-Mail Removed)> wrote in message
>>> news:538AF6EF-2A99-4132-8F48-(E-Mail Removed)...
>>> > We have been having problems with our vpn connections at the office
>>> > and
>>> > away
>>> > where the vpn connections seem like they are connected though they are
>>> > not.
>>> > This generally happens at random interval but sometimes can take up to
>>> > 3hrs
>>> > before the address changes.
>>> >
>>> > This is caused by the ip address of the vpn connection changing from a
>>> > 10.xxx.xxx.xxx address to a 169.xxx.xxx.xxx address. The correct
>>> > address
>>> > remains active for a few hours then the 169.xxx.xxx.xxx gets assigned
>>> > and
>>> > connection to the network is no longer.
>>> >
>>> > We run both windows xp and vista and the problem is on both operating
>>> > systems. The server on which the DHCP resides in is server 2003 sp1
>>> >
>>> > Any help here would be good as information i have found doesn't seem
>>> > to
>>> > make
>>> > a difference
>>>
>>> What are you using for a VPN server? Windows 2003 or a hardware device?
>>>
>>> One thing I can suggest first off for starters is to install SP2 and all
>>> the
>>> associated upgrades. You're a few years behind. I'm sure there are many
>>> fixes and upgrades to DHCP as well as VPNs, if you are using the server
>>> for
>>> VPNs.
>>>
>>> Also, if you are using the server for VPNs, and assuming it has multiple
>>> NICs, is it a DC? This can cause issues as well.
>>>
>>> --
>>> Regards,
>>> Ace
>>>
>>> This posting is provided "AS-IS" with no warranties or guarantees and
>>> confers no rights.
>>>
>>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
>>> MVP Microsoft MVP - Directory Services
>>> Microsoft Certified Trainer
>>>
>>> For urgent issues, you may want to contact Microsoft PSS directly.
>>> Please
>>> check http://support.microsoft.com for regional support phone numbers.
>>>
>>> Infinite Diversities in Infinite Combinations
>>>
>>>
>
> Running a DC/DNS server as a router or remote access server is always a
> bad idea. There are things you can do to improve the situation (see
> KB292822 for example) but it is better to avoid it if you can.
>
> RRAS uses a pool of addresses to allocate to remote clients. If the
> server is set to use DHCP it leases these from DHCP. If the DHCP server is
> unavailable for any reason, it will uses APIPA addresses (169.254.x.y).
>
> My guess is that the RRAS server can't DHCP (probably because of the
> multihomed DNS server) and is forced to use APIPA addresses. One solution
> would be to use a static address pool for remote access rather than using
> DHCP.
>
>

"Robert L. (MS-MVP)" <(E-Mail Removed)> wrote in message
news:OYQFf58%(E-Mail Removed)...
> Agree. We have seen many cases like this one.


Agreed as well. For the original poster, there are a complicated set of
steps to control registration and other DC features that a DC needs but
multihoming negates and may cause unwanted results. If interested, I can
post them, but I would go with the suggestions of not multhoming a DC. You
can also search Google for "multihomed DC" for more info as well.

Ace

The problem with the 169.xxx.xxx.xxx address disappears when the address
comes from RRAS server, but the connection drops out after around an hour. Is
the multihoming of the dc likely to be affecting the connection of vpn's?




"Bill Grant" wrote:

>
>
> "bRad" <(E-Mail Removed)> wrote in message
> news:920E7FE5-F9F1-4839-931E-(E-Mail Removed)...
> > Yes it has has two NIC installed.One for internet and the other for the
> > LAN.
> > The Server is a DC which we have planned on getting the SP2 applied to it
> > but
> > haven't as of yet.
> >
> > What was the issue with it being a DC?
> >
> >
> >
> > "Ace Fekay [MVP Direcrtory Services]" wrote:
> >
> >>
> >> "bRad" <(E-Mail Removed)> wrote in message
> >> news:538AF6EF-2A99-4132-8F48-(E-Mail Removed)...
> >> > We have been having problems with our vpn connections at the office and
> >> > away
> >> > where the vpn connections seem like they are connected though they are
> >> > not.
> >> > This generally happens at random interval but sometimes can take up to
> >> > 3hrs
> >> > before the address changes.
> >> >
> >> > This is caused by the ip address of the vpn connection changing from a
> >> > 10.xxx.xxx.xxx address to a 169.xxx.xxx.xxx address. The correct
> >> > address
> >> > remains active for a few hours then the 169.xxx.xxx.xxx gets assigned
> >> > and
> >> > connection to the network is no longer.
> >> >
> >> > We run both windows xp and vista and the problem is on both operating
> >> > systems. The server on which the DHCP resides in is server 2003 sp1
> >> >
> >> > Any help here would be good as information i have found doesn't seem to
> >> > make
> >> > a difference
> >>
> >> What are you using for a VPN server? Windows 2003 or a hardware device?
> >>
> >> One thing I can suggest first off for starters is to install SP2 and all
> >> the
> >> associated upgrades. You're a few years behind. I'm sure there are many
> >> fixes and upgrades to DHCP as well as VPNs, if you are using the server
> >> for
> >> VPNs.
> >>
> >> Also, if you are using the server for VPNs, and assuming it has multiple
> >> NICs, is it a DC? This can cause issues as well.
> >>
> >> --
> >> Regards,
> >> Ace
> >>
> >> This posting is provided "AS-IS" with no warranties or guarantees and
> >> confers no rights.
> >>
> >> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
> >> MVP Microsoft MVP - Directory Services
> >> Microsoft Certified Trainer
> >>
> >> For urgent issues, you may want to contact Microsoft PSS directly. Please
> >> check http://support.microsoft.com for regional support phone numbers.
> >>
> >> Infinite Diversities in Infinite Combinations
> >>
> >>
>
> Running a DC/DNS server as a router or remote access server is always a
> bad idea. There are things you can do to improve the situation (see KB292822
> for example) but it is better to avoid it if you can.
>
> RRAS uses a pool of addresses to allocate to remote clients. If the
> server is set to use DHCP it leases these from DHCP. If the DHCP server is
> unavailable for any reason, it will uses APIPA addresses (169.254.x.y).
>
> My guess is that the RRAS server can't DHCP (probably because of the
> multihomed DNS server) and is forced to use APIPA addresses. One solution
> would be to use a static address pool for remote access rather than using
> DHCP.
>
>
>

"bRad" <(E-Mail Removed)> wrote in message
news:3BB3F35A-11F1-4AD5-AF9E-(E-Mail Removed)...
>
> The problem with the 169.xxx.xxx.xxx address disappears when the address
> comes from RRAS server, but the connection drops out after around an hour.
> Is
> the multihoming of the dc likely to be affecting the connection of vpn's?

Difficult to tell, but a multihoming causes issues.

Can you post an ipconfig /all of the DC please?
Post any errors that show up in any of the Event logs.
Also, look in Network Properties, Advanced menu, Advanced settings, which
NIC is at the top of the binding order?

Have you tried configuring RRAS to give out from a static pool? Keep in
mind, RRAS will take a block of 10 IPs at a time. If the block runs out and
there are any issues with contacting DHCP, even if it is on the same server,
(can be due to binding order, and other issues), it may not get a new block.

Ace

"bRad" <(E-Mail Removed)> wrote in message
news:3BB3F35A-11F1-4AD5-AF9E-(E-Mail Removed)...
>
> The problem with the 169.xxx.xxx.xxx address disappears when the address
> comes from RRAS server, but the connection drops out after around an hour.
> Is
> the multihoming of the dc likely to be affecting the connection of vpn's?
>

Oh, by the way, DHCP doesn't assign the 169.254.x.x APIPA (Automatic Private
IP Address) number. That is a number a client will give to itself if DHCP is
not available either at configuration time (boot or connecting to a VPN), or
a renewal.

Also, in DNS under the zone, do you see any APIPA numbers?

Maybe simply updating to the newest pack will alleviate the issue.

Ace

I tried not using the DHCP to give out the addresses and use the RRAS but the
problem still exists whereby the vpn connection drops though it looks
connected, but the 169 series address didn't appear. The following is the
ipconfig from the DC

Windows IP Configuration

Host Name . . . . . . . . . . . . : MAST
Primary Dns Suffix . . . . . . . : matricon.lan
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes
DNS Suffix Search List. . . . . . : matricon.lan

Ethernet adapter Internet Gateway:

Connection-specific DNS Suffix . : matricon.lan
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Dual Port Netwo
nnection
Physical Address. . . . . . . . . : 00-07-E9-2F-D1-D3
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
IP Address. . . . . . . . . . . . : fe80::207:e9ff:fe2f:d1d3%4
Default Gateway . . . . . . . . . : 192.168.1.20
DNS Servers . . . . . . . . . . . : 10.0.0.2
10.0.0.3
fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
Primary WINS Server . . . . . . . : 10.0.0.2

Ethernet adapter Server Local Area Connection:

Connection-specific DNS Suffix . : matricon.lan
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Dual Port Netwo
nnection #2
Physical Address. . . . . . . . . : 00-07-E9-2F-D1-D2
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.2
Subnet Mask . . . . . . . . . . . : 255.0.0.0
IP Address. . . . . . . . . . . . : fe80::207:e9ff:fe2f:d1d2%5
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 10.0.0.2
10.0.0.3
fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
Primary WINS Server . . . . . . . : 10.0.0.3
Secondary WINS Server . . . . . . : 10.0.0.2

PPP adapter RAS Server (Dial In) Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-00
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.26
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Automatic Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Automatic Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 0A-00-00-1A
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : fe80::5efe:10.0.0.26%2
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Automatic Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . : matricon.lan
Description . . . . . . . . . . . : Automatic Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : C0-A8-01-02
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : fe80::5efe:192.168.1.2%2
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Automatic Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . : matricon.lan
Description . . . . . . . . . . . : Automatic Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 0A-00-00-02
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : fe80::5efe:10.0.0.2%2
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Disabled

"Ace Fekay [MVP Direcrtory Services]" wrote:

>
> "bRad" <(E-Mail Removed)> wrote in message
> news:3BB3F35A-11F1-4AD5-AF9E-(E-Mail Removed)...
> >
> > The problem with the 169.xxx.xxx.xxx address disappears when the address
> > comes from RRAS server, but the connection drops out after around an hour.
> > Is
> > the multihoming of the dc likely to be affecting the connection of vpn's?
>
> Difficult to tell, but a multihoming causes issues.
>
> Can you post an ipconfig /all of the DC please?
> Post any errors that show up in any of the Event logs.
> Also, look in Network Properties, Advanced menu, Advanced settings, which
> NIC is at the top of the binding order?
>
> Have you tried configuring RRAS to give out from a static pool? Keep in
> mind, RRAS will take a block of 10 IPs at a time. If the block runs out and
> there are any issues with contacting DHCP, even if it is on the same server,
> (can be due to binding order, and other issues), it may not get a new block.
>
> Ace
>