Error 619 LAN to LAN

Two weeks after NT4 to W2003 upgrade. Still using NT4 RAS server. Everyone
except our TX office has had no problem VPNing in. TX users all have local
logon accounts in our AD domain (as well as their separate logon accounts in
the TX domain) and they use their local accounts here to dial in with. VPN
settings (IP, DNS, WINS, Domain, etc) are correct. Tried setting Type to
PPTP instead of Automatic, tried unchecking Require data encryption. Added
RAS server to RRAS and IAS Servers group in AD, even thouh VPN for everyone
else worked fine without the NT4 RAS server in the AD group.. Did not run
netsh cause KB said that was 2nd option and only applied to W2K (and assume
now W2003), so I assume not to run it for NT4.

I can VPN into TX office fine. TX users are getting the 619 error. Can't
determine on our end (NT Event Viewer) why.

Google search indicates related to PPTP handshake, but don't understand why
upgrade would break TX users and no one else, even though they are only ones
LAN to LAN. Any ideas on what may be causing problem?

Thanks,
Joan

In news:(E-Mail Removed),
Joan <(E-Mail Removed)> asked for help and I offered my
suggestions below:
> Two weeks after NT4 to W2003 upgrade. Still using NT4 RAS server.
> Everyone except our TX office has had no problem VPNing in. TX users
> all have local logon accounts in our AD domain (as well as their
> separate logon accounts in the TX domain) and they use their local
> accounts here to dial in with. VPN settings (IP, DNS, WINS, Domain,
> etc) are correct. Tried setting Type to PPTP instead of Automatic,
> tried unchecking Require data encryption. Added RAS server to RRAS
> and IAS Servers group in AD, even thouh VPN for everyone else worked
> fine without the NT4 RAS server in the AD group.. Did not run netsh
> cause KB said that was 2nd option and only applied to W2K (and assume
> now W2003), so I assume not to run it for NT4.
>
> I can VPN into TX office fine. TX users are getting the 619 error.
> Can't determine on our end (NT Event Viewer) why.
>
> Google search indicates related to PPTP handshake, but don't
> understand why upgrade would break TX users and no one else, even
> though they are only ones LAN to LAN. Any ideas on what may be
> causing problem?
>
> Thanks,
> Joan

See if this helps.

811497 - Error Message When Windows 95 or Windows NT 4.0 Client Logs On to
Windows Server 2003 Domain:
http://support.microsoft.com/?id=811497

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Active Directory

HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
--
=================================

Hi Ace,

I took a look at the KB, but clients are W2K and XP only.

I was able to VPN into TX and then use VNC to one of the TX clients (W2K) so
I could myself try to VPN in from there to here (I've done that before
successfully.) No luck, still get error 619, and in NT Event Viewer here, I
think the match-up message is "PPP not converging".

I tried changing all connectoid settings, one at a time, to see if one of
those the problem. Still same error. Also, one of the guys in the TX office
tried this weekend from home (using Linux) and he could VPN in to here fine.
So, it must be just office to office. But the router (Cisco) settings on
both ends have not changed. Interestingly, the TX office said one of their
vendors also recently upgraded to AD and they can't VPN into TX either,
office-to-office.

Regards,
Joan


"Ace Fekay [MVP]"
<PleaseSubstituteMyActualFirstName&LastNameHere@ho tmail.com> wrote in
message news:(E-Mail Removed)...
> In news:(E-Mail Removed),
> Joan <(E-Mail Removed)> asked for help and I offered my
> suggestions below:
> > Two weeks after NT4 to W2003 upgrade. Still using NT4 RAS server.
> > Everyone except our TX office has had no problem VPNing in. TX users
> > all have local logon accounts in our AD domain (as well as their
> > separate logon accounts in the TX domain) and they use their local
> > accounts here to dial in with. VPN settings (IP, DNS, WINS, Domain,
> > etc) are correct. Tried setting Type to PPTP instead of Automatic,
> > tried unchecking Require data encryption. Added RAS server to RRAS
> > and IAS Servers group in AD, even thouh VPN for everyone else worked
> > fine without the NT4 RAS server in the AD group.. Did not run netsh
> > cause KB said that was 2nd option and only applied to W2K (and assume
> > now W2003), so I assume not to run it for NT4.
> >
> > I can VPN into TX office fine. TX users are getting the 619 error.
> > Can't determine on our end (NT Event Viewer) why.
> >
> > Google search indicates related to PPTP handshake, but don't
> > understand why upgrade would break TX users and no one else, even
> > though they are only ones LAN to LAN. Any ideas on what may be
> > causing problem?
> >
> > Thanks,
> > Joan
>
> See if this helps.
>
> 811497 - Error Message When Windows 95 or Windows NT 4.0 Client Logs On to
> Windows Server 2003 Domain:
> http://support.microsoft.com/?id=811497
>
> --
> Regards,
> Ace
>
> Please direct all replies ONLY to the Microsoft public newsgroups
> so all can benefit.
>
> This posting is provided "AS-IS" with no warranties or guarantees
> and confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft Windows MVP - Active Directory
>
> HAM AND EGGS: A day's work for a chicken;
> A lifetime commitment for a pig.
> --
> =================================
>
>

Hi Ace,

Problem resolved -- was Cisco router config (TX router) after all -- the
statements permit 1723 and gre to the TX LAN were missing. TX router must
not have had those written to startup and coincidentally at some point in
the week after our upgrade here, it rebooted. The TX users could get out but
the returning packets could not get back in. My router does have the
necessary statements, which is why I could VPN in to TX LAN-to-LAN.

Regards,
Joan


"Ace Fekay [MVP]"
<PleaseSubstituteMyActualFirstName&LastNameHere@ho tmail.com> wrote in
message news:(E-Mail Removed)...
> In news:(E-Mail Removed),
> Joan <(E-Mail Removed)> asked for help and I offered my
> suggestions below:
> > Two weeks after NT4 to W2003 upgrade. Still using NT4 RAS server.
> > Everyone except our TX office has had no problem VPNing in. TX users
> > all have local logon accounts in our AD domain (as well as their
> > separate logon accounts in the TX domain) and they use their local
> > accounts here to dial in with. VPN settings (IP, DNS, WINS, Domain,
> > etc) are correct. Tried setting Type to PPTP instead of Automatic,
> > tried unchecking Require data encryption. Added RAS server to RRAS
> > and IAS Servers group in AD, even thouh VPN for everyone else worked
> > fine without the NT4 RAS server in the AD group.. Did not run netsh
> > cause KB said that was 2nd option and only applied to W2K (and assume
> > now W2003), so I assume not to run it for NT4.
> >
> > I can VPN into TX office fine. TX users are getting the 619 error.
> > Can't determine on our end (NT Event Viewer) why.
> >
> > Google search indicates related to PPTP handshake, but don't
> > understand why upgrade would break TX users and no one else, even
> > though they are only ones LAN to LAN. Any ideas on what may be
> > causing problem?
> >
> > Thanks,
> > Joan
>
> See if this helps.
>
> 811497 - Error Message When Windows 95 or Windows NT 4.0 Client Logs On to
> Windows Server 2003 Domain:
> http://support.microsoft.com/?id=811497
>
> --
> Regards,
> Ace
>
> Please direct all replies ONLY to the Microsoft public newsgroups
> so all can benefit.
>
> This posting is provided "AS-IS" with no warranties or guarantees
> and confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
> Microsoft Windows MVP - Active Directory
>
> HAM AND EGGS: A day's work for a chicken;
> A lifetime commitment for a pig.
> --
> =================================
>
>

In news:(E-Mail Removed),
Joan <(E-Mail Removed)> asked for help and I offered my
suggestions below:
> Hi Ace,
>
> Problem resolved -- was Cisco router config (TX router) after all --
> the statements permit 1723 and gre to the TX LAN were missing. TX
> router must not have had those written to startup and coincidentally
> at some point in the week after our upgrade here, it rebooted. The TX
> users could get out but the returning packets could not get back in.
> My router does have the necessary statements, which is why I could
> VPN in to TX LAN-to-LAN.
>
> Regards,
> Joan
>

Glad to hear. I was going to ask if that router had an ip-access list and if
so, did the ip-access list allow PPTP (1723 GRE) and Protocol ID 47 (both
needed for PPTP).

Cheers!

--
Regards,
Ace

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.
--
=================================