Win2K3 VPN - WEIRD Connectivity Issues

I have a NY and NJ office. All servers are Win2K3 Ent or Std. Both have
Win2K3 Std DCs with a GC in each, running respective DHCP and DNS. Two
offices are connected via DS1. I have Internet T1 coming out of NY and I
have a 1MB burstable to 100 coming out of NJ. I have NO connectivity issues
between both offices over the DS1.

I have RRAS running VPNs (no IAS) in NY and NJ. They are not sitting in DMZ
or anything like that. For now they just sit behind firewall as part of
regular LAN. I can connect to NY VPN no problem. I can ping servers in both
NY and NJ offices over VPN. I can Remote Desktop into servers in both
locations over VPN as well.

HOWEVER, when I VPN into NJ office, I get weridest results. First
connection, I can't ping anything in NJ or NY by name or by IP. After a
couple of reconnection attempts I CAN then start pinging servers in NJ by IP
address but can only ping handful of servers by name. I still canNOT ping
anything in NY. I CAN ping some servers but canNOT Remote Desktop into some
of those. The others I can Remote Desktop into without a problem. There's
no rhyme or reason to the behavior.

I have on multiple occasions re-configured VPN on the NJ RRAS. I can't
figure it out. If I'm in NJ, I have no issues connecting or pinging NY. Over
the NJ VPN everything is crazy. Does anyone have any ideas?

we need more information to help. posting the reuslts of both sites' ipconig /all and routing table may help.
For more and other information, go to http://howtonetworking.com.

Don't send e-mail or reply to me except you need consulting services. Posting on MS newsgroup will benefit all readers and you may get more help.

Bob Lin, MS-MVP, MCSE & CNE
How to Setup Windows, Network, Remote Access on http://www.HowToNetworking.com
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
This posting is provided "AS IS" with no warranties.
I recommend Brinkster for web hosting!

"dimsum nyc" <dimsum (E-Mail Removed)> wrote in message news:A90E239B-7888-40E4-A233-(E-Mail Removed)...
I have a NY and NJ office. All servers are Win2K3 Ent or Std. Both have
Win2K3 Std DCs with a GC in each, running respective DHCP and DNS. Two
offices are connected via DS1. I have Internet T1 coming out of NY and I
have a 1MB burstable to 100 coming out of NJ. I have NO connectivity issues
between both offices over the DS1.

I have RRAS running VPNs (no IAS) in NY and NJ. They are not sitting in DMZ
or anything like that. For now they just sit behind firewall as part of
regular LAN. I can connect to NY VPN no problem. I can ping servers in both
NY and NJ offices over VPN. I can Remote Desktop into servers in both
locations over VPN as well.

HOWEVER, when I VPN into NJ office, I get weridest results. First
connection, I can't ping anything in NJ or NY by name or by IP. After a
couple of reconnection attempts I CAN then start pinging servers in NJ by IP
address but can only ping handful of servers by name. I still canNOT ping
anything in NY. I CAN ping some servers but canNOT Remote Desktop into some
of those. The others I can Remote Desktop into without a problem. There's
no rhyme or reason to the behavior.

I have on multiple occasions re-configured VPN on the NJ RRAS. I can't
figure it out. If I'm in NJ, I have no issues connecting or pinging NY. Over
the NJ VPN everything is crazy. Does anyone have any ideas?

I'm back in the office so I can't do a test as if I was coming in from the
outside, but to the best of my recollection, here is the type of results I
found:

From NYC to NJ over DS1: (From my WinXP wkstn)
ping njapps01.companyabc.com will get reply of 10.2.10.20
ping -a 10.2.10.20 will get reply of njapps01.companyabc.com
I can successfully Remote Desktop into NJApps01
EVERYTHING IS OK

From NJ to NYC over DS1: (Using WinXP wkstn)
ping nyad01.companyabc.com will get reply of 10.1.10.1
ping -a 10.1.10.1 will get reply of nyad01.companyabc.com
I can successfully Remote Desktop into NYAD01
EVERYTHING IS OK

From home over NYC VPN: (Using WinXP Laptop)
ping njapps01.companyabc.com will get reply of 10.2.10.20
ping -a 10.2.10.20 will get reply of njapps01.companyabc.com
I can successfully Remote Desktop into NJApps01
ping nyad01.companyabc.com will get reply of 10.1.10.1
ping -a 10.1.10.1 will get reply of nyad01.companyabc.com
I can successfully Remote Desktop into NYAD01
EVERYTHING IS OK

From home over NJ VPN first attempt: (same WinXP laptop, ipconfig flush'd)
ping -a 10.1.10.1 - no response
ping -a 10.2.10.20 - no response
ping nyad01.companyabc.com - no response
ping njapps01.companyabc.com - no response
Unable to Remote Desktop into NYC or NJ

I'll disconnect and reconnect VPN into NJ (same WinXP laptop, ipconfig
flush'd)
ping -a 10.1.10.1 - no response
ping -a 10.2.10.20 - I get a CORRECT response of NJAPPS01
ping njapps01.companyabc.com - I get CORRECT response of 10.2.10.20
ping another NJ server - 10.2.10.21 I get a correct response of
NJSQL01.companyabc.com
ping NJSQ01.companyabc.com by name and I'll get no response
Unable to Remote Desktop into anything in NJ and still unable to ping
anything in NY

I'll disconnect and reconnect VPN into NJ a third time (ipconfig flush'd)
Same initial results as above
But this time around I am able to ping all NJ servers by IP and all but one
or two by name
This time around I am able to Remote Desktop into all but two of my NJ
servers by name
This time around I am able to Remote Desktop into all NJ servers by IP
This time around I STILL am UNABLE to ping or Remote Desktop into anything
in NYC

I'll disconnect and reconnect VPN into NJ a 4th time (ipconfig flush'd)
All of a sudden I'll be unable to ping anything in NY and NJ

I'll disconnect and reconnect VPN into NJ a 5th time (ipconfig flush'd)
Suddenly I'll be getting intermittent results again


AT home the laptop I am using, I've tried changing the network order to have
RAS devices be first in line and I've tried moving it down in the order as
well. I thought maybe wireless card was bad but if I reconnect to NY VPN,
there are again zero problems. For troubleshooting anyway, i switched to the
regular 10/100 wired NIC and still I have the same problems described above.

I've tried stopping and starting RRAS. I've tried multiple times to disable
and reconfigure RRAS. I even did a reboot. Still same issues.

HELP!!!!!!!!!!!!!



"Robert L [MS-MVP]" wrote:

> we need more information to help. posting the reuslts of both sites' ipconig /all and routing table may help.
> For more and other information, go to http://howtonetworking.com.
>
> Don't send e-mail or reply to me except you need consulting services. Posting on MS newsgroup will benefit all readers and you may get more help.
>
> Bob Lin, MS-MVP, MCSE & CNE
> How to Setup Windows, Network, Remote Access on http://www.HowToNetworking.com
> Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> This posting is provided "AS IS" with no warranties.
> I recommend Brinkster for web hosting!
>
> "dimsum nyc" <dimsum (E-Mail Removed)> wrote in message news:A90E239B-7888-40E4-A233-(E-Mail Removed)...
> I have a NY and NJ office. All servers are Win2K3 Ent or Std. Both have
> Win2K3 Std DCs with a GC in each, running respective DHCP and DNS. Two
> offices are connected via DS1. I have Internet T1 coming out of NY and I
> have a 1MB burstable to 100 coming out of NJ. I have NO connectivity issues
> between both offices over the DS1.
>
> I have RRAS running VPNs (no IAS) in NY and NJ. They are not sitting in DMZ
> or anything like that. For now they just sit behind firewall as part of
> regular LAN. I can connect to NY VPN no problem. I can ping servers in both
> NY and NJ offices over VPN. I can Remote Desktop into servers in both
> locations over VPN as well.
>
> HOWEVER, when I VPN into NJ office, I get weridest results. First
> connection, I can't ping anything in NJ or NY by name or by IP. After a
> couple of reconnection attempts I CAN then start pinging servers in NJ by IP
> address but can only ping handful of servers by name. I still canNOT ping
> anything in NY. I CAN ping some servers but canNOT Remote Desktop into some
> of those. The others I can Remote Desktop into without a problem. There's
> no rhyme or reason to the behavior.
>
> I have on multiple occasions re-configured VPN on the NJ RRAS. I can't
> figure it out. If I'm in NJ, I have no issues connecting or pinging NY. Over
> the NJ VPN everything is crazy. Does anyone have any ideas?
>
>

Per your request:

IPCONFIG /ALL from NYC office - no VPN:
IP: 10.1.100.42 (regular workstation in NYC)
SM: 255.255.255.0
DG: 10.1.1.2
DHCP: 10.1.10.1 (nyad01.companyabc.com)
DNS1: 10.1.10.1 (nyad01.companyabc.com)
DNS2: 10.1.10.2 (nyad02.companyabc.com)

IPCONFIG /ALL from NJ office - no VPN:
IP: 10.2.100.32 (regular workstation in NJ)
SM: 255.255.255.0
DG: 10.2.1.2
DHCP: 10.2.10.1 (njad01.companyabc.com)
DNS1: 10.2.10.1 (njad01.companyabc.com)
DNS2: 10.1.10.1 (nyad01.companyabc.com)

IPCONFIG while VPN'd into NYC (PPP adapater portion only):
IP: 10.1.100.244
SM: 255.255.255.255
DG: 10.1.100.244
DNS1: 10.1.10.1 (nyad01.companyabc.com)
DNS2: 10.1.10.2 (nyad02.companyabc.com)

IPCONFIG /ALL while VPN'd into NJ (PPP adapter portion only):
IP 10.2.100.249
SM: 255.255.255.255
DG: 10.1.100.249
DNS1: 10.2.10.1 (njad01.companyabc.com)
DNS2: 10.1.10.1 (nyad01.companyabc.com)


By the way, below I describe in detail some of the results I get when I try
different tests. One thing to note is that when I VPN into NJ even though I
say that sometimes I can't ping anything that's not entirely true. I can
always ping the VPN server (both NICs) when connected from home.

"dimsum nyc" wrote:

> I'm back in the office so I can't do a test as if I was coming in from the
> outside, but to the best of my recollection, here is the type of results I
> found:
>
> From NYC to NJ over DS1: (From my WinXP wkstn)
> ping njapps01.companyabc.com will get reply of 10.2.10.20
> ping -a 10.2.10.20 will get reply of njapps01.companyabc.com
> I can successfully Remote Desktop into NJApps01
> EVERYTHING IS OK
>
> From NJ to NYC over DS1: (Using WinXP wkstn)
> ping nyad01.companyabc.com will get reply of 10.1.10.1
> ping -a 10.1.10.1 will get reply of nyad01.companyabc.com
> I can successfully Remote Desktop into NYAD01
> EVERYTHING IS OK
>
> From home over NYC VPN: (Using WinXP Laptop)
> ping njapps01.companyabc.com will get reply of 10.2.10.20
> ping -a 10.2.10.20 will get reply of njapps01.companyabc.com
> I can successfully Remote Desktop into NJApps01
> ping nyad01.companyabc.com will get reply of 10.1.10.1
> ping -a 10.1.10.1 will get reply of nyad01.companyabc.com
> I can successfully Remote Desktop into NYAD01
> EVERYTHING IS OK
>
> From home over NJ VPN first attempt: (same WinXP laptop, ipconfig flush'd)
> ping -a 10.1.10.1 - no response
> ping -a 10.2.10.20 - no response
> ping nyad01.companyabc.com - no response
> ping njapps01.companyabc.com - no response
> Unable to Remote Desktop into NYC or NJ
>
> I'll disconnect and reconnect VPN into NJ (same WinXP laptop, ipconfig
> flush'd)
> ping -a 10.1.10.1 - no response
> ping -a 10.2.10.20 - I get a CORRECT response of NJAPPS01
> ping njapps01.companyabc.com - I get CORRECT response of 10.2.10.20
> ping another NJ server - 10.2.10.21 I get a correct response of
> NJSQL01.companyabc.com
> ping NJSQ01.companyabc.com by name and I'll get no response
> Unable to Remote Desktop into anything in NJ and still unable to ping
> anything in NY
>
> I'll disconnect and reconnect VPN into NJ a third time (ipconfig flush'd)
> Same initial results as above
> But this time around I am able to ping all NJ servers by IP and all but one
> or two by name
> This time around I am able to Remote Desktop into all but two of my NJ
> servers by name
> This time around I am able to Remote Desktop into all NJ servers by IP
> This time around I STILL am UNABLE to ping or Remote Desktop into anything
> in NYC
>
> I'll disconnect and reconnect VPN into NJ a 4th time (ipconfig flush'd)
> All of a sudden I'll be unable to ping anything in NY and NJ
>
> I'll disconnect and reconnect VPN into NJ a 5th time (ipconfig flush'd)
> Suddenly I'll be getting intermittent results again
>
>
> AT home the laptop I am using, I've tried changing the network order to have
> RAS devices be first in line and I've tried moving it down in the order as
> well. I thought maybe wireless card was bad but if I reconnect to NY VPN,
> there are again zero problems. For troubleshooting anyway, i switched to the
> regular 10/100 wired NIC and still I have the same problems described above.
>
> I've tried stopping and starting RRAS. I've tried multiple times to disable
> and reconfigure RRAS. I even did a reboot. Still same issues.
>
> HELP!!!!!!!!!!!!!
>
>
>
> "Robert L [MS-MVP]" wrote:
>
> > we need more information to help. posting the reuslts of both sites' ipconig /all and routing table may help.
> > For more and other information, go to http://howtonetworking.com.
> >
> > Don't send e-mail or reply to me except you need consulting services. Posting on MS newsgroup will benefit all readers and you may get more help.
> >
> > Bob Lin, MS-MVP, MCSE & CNE
> > How to Setup Windows, Network, Remote Access on http://www.HowToNetworking.com
> > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> > This posting is provided "AS IS" with no warranties.
> > I recommend Brinkster for web hosting!
> >
> > "dimsum nyc" <dimsum (E-Mail Removed)> wrote in message news:A90E239B-7888-40E4-A233-(E-Mail Removed)...
> > I have a NY and NJ office. All servers are Win2K3 Ent or Std. Both have
> > Win2K3 Std DCs with a GC in each, running respective DHCP and DNS. Two
> > offices are connected via DS1. I have Internet T1 coming out of NY and I
> > have a 1MB burstable to 100 coming out of NJ. I have NO connectivity issues
> > between both offices over the DS1.
> >
> > I have RRAS running VPNs (no IAS) in NY and NJ. They are not sitting in DMZ
> > or anything like that. For now they just sit behind firewall as part of
> > regular LAN. I can connect to NY VPN no problem. I can ping servers in both
> > NY and NJ offices over VPN. I can Remote Desktop into servers in both
> > locations over VPN as well.
> >
> > HOWEVER, when I VPN into NJ office, I get weridest results. First
> > connection, I can't ping anything in NJ or NY by name or by IP. After a
> > couple of reconnection attempts I CAN then start pinging servers in NJ by IP
> > address but can only ping handful of servers by name. I still canNOT ping
> > anything in NY. I CAN ping some servers but canNOT Remote Desktop into some
> > of those. The others I can Remote Desktop into without a problem. There's
> > no rhyme or reason to the behavior.
> >
> > I have on multiple occasions re-configured VPN on the NJ RRAS. I can't
> > figure it out. If I'm in NJ, I have no issues connecting or pinging NY. Over
> > the NJ VPN everything is crazy. Does anyone have any ideas?
> >
> >

Correction:
default gateway for PPP adapter portion of ipconfig /all when VPN'd into NJ
is 10.2.100.249, not 10.1.100.249.


"dimsum nyc" wrote:

> Per your request:
>
> IPCONFIG /ALL from NYC office - no VPN:
> IP: 10.1.100.42 (regular workstation in NYC)
> SM: 255.255.255.0
> DG: 10.1.1.2
> DHCP: 10.1.10.1 (nyad01.companyabc.com)
> DNS1: 10.1.10.1 (nyad01.companyabc.com)
> DNS2: 10.1.10.2 (nyad02.companyabc.com)
>
> IPCONFIG /ALL from NJ office - no VPN:
> IP: 10.2.100.32 (regular workstation in NJ)
> SM: 255.255.255.0
> DG: 10.2.1.2
> DHCP: 10.2.10.1 (njad01.companyabc.com)
> DNS1: 10.2.10.1 (njad01.companyabc.com)
> DNS2: 10.1.10.1 (nyad01.companyabc.com)
>
> IPCONFIG while VPN'd into NYC (PPP adapater portion only):
> IP: 10.1.100.244
> SM: 255.255.255.255
> DG: 10.1.100.244
> DNS1: 10.1.10.1 (nyad01.companyabc.com)
> DNS2: 10.1.10.2 (nyad02.companyabc.com)
>
> IPCONFIG /ALL while VPN'd into NJ (PPP adapter portion only):
> IP 10.2.100.249
> SM: 255.255.255.255
> DG: 10.1.100.249
> DNS1: 10.2.10.1 (njad01.companyabc.com)
> DNS2: 10.1.10.1 (nyad01.companyabc.com)
>
>
> By the way, below I describe in detail some of the results I get when I try
> different tests. One thing to note is that when I VPN into NJ even though I
> say that sometimes I can't ping anything that's not entirely true. I can
> always ping the VPN server (both NICs) when connected from home.
>
> "dimsum nyc" wrote:
>
> > I'm back in the office so I can't do a test as if I was coming in from the
> > outside, but to the best of my recollection, here is the type of results I
> > found:
> >
> > From NYC to NJ over DS1: (From my WinXP wkstn)
> > ping njapps01.companyabc.com will get reply of 10.2.10.20
> > ping -a 10.2.10.20 will get reply of njapps01.companyabc.com
> > I can successfully Remote Desktop into NJApps01
> > EVERYTHING IS OK
> >
> > From NJ to NYC over DS1: (Using WinXP wkstn)
> > ping nyad01.companyabc.com will get reply of 10.1.10.1
> > ping -a 10.1.10.1 will get reply of nyad01.companyabc.com
> > I can successfully Remote Desktop into NYAD01
> > EVERYTHING IS OK
> >
> > From home over NYC VPN: (Using WinXP Laptop)
> > ping njapps01.companyabc.com will get reply of 10.2.10.20
> > ping -a 10.2.10.20 will get reply of njapps01.companyabc.com
> > I can successfully Remote Desktop into NJApps01
> > ping nyad01.companyabc.com will get reply of 10.1.10.1
> > ping -a 10.1.10.1 will get reply of nyad01.companyabc.com
> > I can successfully Remote Desktop into NYAD01
> > EVERYTHING IS OK
> >
> > From home over NJ VPN first attempt: (same WinXP laptop, ipconfig flush'd)
> > ping -a 10.1.10.1 - no response
> > ping -a 10.2.10.20 - no response
> > ping nyad01.companyabc.com - no response
> > ping njapps01.companyabc.com - no response
> > Unable to Remote Desktop into NYC or NJ
> >
> > I'll disconnect and reconnect VPN into NJ (same WinXP laptop, ipconfig
> > flush'd)
> > ping -a 10.1.10.1 - no response
> > ping -a 10.2.10.20 - I get a CORRECT response of NJAPPS01
> > ping njapps01.companyabc.com - I get CORRECT response of 10.2.10.20
> > ping another NJ server - 10.2.10.21 I get a correct response of
> > NJSQL01.companyabc.com
> > ping NJSQ01.companyabc.com by name and I'll get no response
> > Unable to Remote Desktop into anything in NJ and still unable to ping
> > anything in NY
> >
> > I'll disconnect and reconnect VPN into NJ a third time (ipconfig flush'd)
> > Same initial results as above
> > But this time around I am able to ping all NJ servers by IP and all but one
> > or two by name
> > This time around I am able to Remote Desktop into all but two of my NJ
> > servers by name
> > This time around I am able to Remote Desktop into all NJ servers by IP
> > This time around I STILL am UNABLE to ping or Remote Desktop into anything
> > in NYC
> >
> > I'll disconnect and reconnect VPN into NJ a 4th time (ipconfig flush'd)
> > All of a sudden I'll be unable to ping anything in NY and NJ
> >
> > I'll disconnect and reconnect VPN into NJ a 5th time (ipconfig flush'd)
> > Suddenly I'll be getting intermittent results again
> >
> >
> > AT home the laptop I am using, I've tried changing the network order to have
> > RAS devices be first in line and I've tried moving it down in the order as
> > well. I thought maybe wireless card was bad but if I reconnect to NY VPN,
> > there are again zero problems. For troubleshooting anyway, i switched to the
> > regular 10/100 wired NIC and still I have the same problems described above.
> >
> > I've tried stopping and starting RRAS. I've tried multiple times to disable
> > and reconfigure RRAS. I even did a reboot. Still same issues.
> >
> > HELP!!!!!!!!!!!!!
> >
> >
> >
> > "Robert L [MS-MVP]" wrote:
> >
> > > we need more information to help. posting the reuslts of both sites' ipconig /all and routing table may help.
> > > For more and other information, go to http://howtonetworking.com.
> > >
> > > Don't send e-mail or reply to me except you need consulting services. Posting on MS newsgroup will benefit all readers and you may get more help.
> > >
> > > Bob Lin, MS-MVP, MCSE & CNE
> > > How to Setup Windows, Network, Remote Access on http://www.HowToNetworking.com
> > > Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
> > > This posting is provided "AS IS" with no warranties.
> > > I recommend Brinkster for web hosting!
> > >
> > > "dimsum nyc" <dimsum (E-Mail Removed)> wrote in message news:A90E239B-7888-40E4-A233-(E-Mail Removed)...
> > > I have a NY and NJ office. All servers are Win2K3 Ent or Std. Both have
> > > Win2K3 Std DCs with a GC in each, running respective DHCP and DNS. Two
> > > offices are connected via DS1. I have Internet T1 coming out of NY and I
> > > have a 1MB burstable to 100 coming out of NJ. I have NO connectivity issues
> > > between both offices over the DS1.
> > >
> > > I have RRAS running VPNs (no IAS) in NY and NJ. They are not sitting in DMZ
> > > or anything like that. For now they just sit behind firewall as part of
> > > regular LAN. I can connect to NY VPN no problem. I can ping servers in both
> > > NY and NJ offices over VPN. I can Remote Desktop into servers in both
> > > locations over VPN as well.
> > >
> > > HOWEVER, when I VPN into NJ office, I get weridest results. First
> > > connection, I can't ping anything in NJ or NY by name or by IP. After a
> > > couple of reconnection attempts I CAN then start pinging servers in NJ by IP
> > > address but can only ping handful of servers by name. I still canNOT ping
> > > anything in NY. I CAN ping some servers but canNOT Remote Desktop into some
> > > of those. The others I can Remote Desktop into without a problem. There's
> > > no rhyme or reason to the behavior.
> > >
> > > I have on multiple occasions re-configured VPN on the NJ RRAS. I can't
> > > figure it out. If I'm in NJ, I have no issues connecting or pinging NY. Over
> > > the NJ VPN everything is crazy. Does anyone have any ideas?
> > >
> > >