Windows 2000 Server VPN issues

Hi everyone,

I have a number of issues with my Windows 2000 VPN server. First things
first. I have two servers, a Win2003 and a Win2000. I am using the Win2000
box for VPN because my Windows Mobile 2003 hand-helds cannot connect to a
Windows 2003 VPN server. I have no idea why. Windows Mobile 5 or 6 clients
have no problem with a Windows 2003 VPN server but I have a host of WM 2003
clients that require VPN access.

So first question: how can I get my Windows Mobile 2003 clients to connect
to a Windows 2003 VPN server?

Now I am also experiencing a number of problems. Most of the time the VPN
(this is PPTP by-the-way) works just fine. I can connect from a 2000
Professional, XP or Vista client and am able to ping all the machines on my
LAN. Works like a charm. Except once in a while I am only able to ping the
VPN server itself and then only by using the IP address assigned to the end
of my VPN connection, not the server's "regular" IP address. Disconnecting
and reconnecting normally resolves this problem.

Could this be a configuration issue? Seems strange that it works most of
the time. But it doesn't work often enough to be a real support headache
for me.

The other issue I am experiencing is sometimes RRAS just seems to "hang-up"
and stops answering any incoming connections. It doesn't matter if the
connections are VPN or dial-up modem connections (this server also handles
incoming phone connections). If I logon to the server's console I am also
unable to open the "Routing and Remote Access" management tool under
"Administrative tools". In ever other respect the server seems to work
fine. The only way to resolve this issue is to reboot the server. The RRAS
starts working again (for a while).

This machine is running SP4 and is fully patched and up-to-date. It is also
running Exchange 2003. It is behind an appliance-style firewall/router (a
SonicWALL SOHO2). The Internet connection is DLS (PPPoE) with a static IP
address.

Thanks,

The Fish.

Sounds like routing issue. Assuming this is not DC, posting the results of
routing table and ipconfig /all may help.

--
Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on
http://www.HowToNetworking.com
"Ken VdB" <(E-Mail Removed)> wrote in message
news:O$(E-Mail Removed)...
> Hi everyone,
>
> I have a number of issues with my Windows 2000 VPN server. First things
> first. I have two servers, a Win2003 and a Win2000. I am using the
> Win2000 box for VPN because my Windows Mobile 2003 hand-helds cannot
> connect to a Windows 2003 VPN server. I have no idea why. Windows Mobile
> 5 or 6 clients have no problem with a Windows 2003 VPN server but I have a
> host of WM 2003 clients that require VPN access.
>
> So first question: how can I get my Windows Mobile 2003 clients to connect
> to a Windows 2003 VPN server?
>
> Now I am also experiencing a number of problems. Most of the time the VPN
> (this is PPTP by-the-way) works just fine. I can connect from a 2000
> Professional, XP or Vista client and am able to ping all the machines on
> my LAN. Works like a charm. Except once in a while I am only able to
> ping the VPN server itself and then only by using the IP address assigned
> to the end of my VPN connection, not the server's "regular" IP address.
> Disconnecting and reconnecting normally resolves this problem.
>
> Could this be a configuration issue? Seems strange that it works most of
> the time. But it doesn't work often enough to be a real support headache
> for me.
>
> The other issue I am experiencing is sometimes RRAS just seems to
> "hang-up" and stops answering any incoming connections. It doesn't matter
> if the connections are VPN or dial-up modem connections (this server also
> handles incoming phone connections). If I logon to the server's console I
> am also unable to open the "Routing and Remote Access" management tool
> under "Administrative tools". In ever other respect the server seems to
> work fine. The only way to resolve this issue is to reboot the server.
> The RRAS starts working again (for a while).
>
> This machine is running SP4 and is fully patched and up-to-date. It is
> also running Exchange 2003. It is behind an appliance-style
> firewall/router (a SonicWALL SOHO2). The Internet connection is DLS
> (PPPoE) with a static IP address.
>
> Thanks,
>
> The Fish.

Thanks Robert. Do you think it could be a routing issue even though it
works fine most of the time?



Perhaps you can point me in the direction of some resources that would
describe the correct way to setup VPN. My configuration is pretty simple.



192.168.0.1 - Windows 2003, DC, DHCP, DNS

192.168.0.4 - Router (SonicWall)

192.168.0.5 - Windows 2000, DC, RRAS

192.168.0.x - all other workstations, printers, wireless devices, etc.



My DHCP server is configured with the following settings



Address range: 192.168.0.1 - 192.168.0.254

Exclusion range: 192.168.0.1 - 192.168.0.10

Options:

003 Router: 192.168.0.4

006 DNS Servers: 192.168.0.1

015 Domain Name: mydomain.com (not literally)



My router is port forwarding/masquerading TCP port 1723 to 192.168.0.5
(which is my W2K RRAS server). My RRAS server is configured to use DHCP to
assign addresses to incoming connections.



Does anyone see any problems with this setup? Is there an article I can
consult on best practices or how to do this correctly?



Thanks,

The Fish



"Robert L. (MS-MVP)" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Sounds like routing issue. Assuming this is not DC, posting the results of
> routing table and ipconfig /all may help.
>
> --
> Bob Lin, MS-MVP, MCSE & CNE
> Networking, Internet, Routing, VPN Troubleshooting on
> http://www.ChicagoTech.net
> How to Setup Windows, Network, VPN & Remote Access on
> http://www.HowToNetworking.com
> "Ken VdB" <(E-Mail Removed)> wrote in message
> news:O$(E-Mail Removed)...
>> Hi everyone,
>>
>> I have a number of issues with my Windows 2000 VPN server. First things
>> first. I have two servers, a Win2003 and a Win2000. I am using the
>> Win2000 box for VPN because my Windows Mobile 2003 hand-helds cannot
>> connect to a Windows 2003 VPN server. I have no idea why. Windows
>> Mobile 5 or 6 clients have no problem with a Windows 2003 VPN server but
>> I have a host of WM 2003 clients that require VPN access.
>>
>> So first question: how can I get my Windows Mobile 2003 clients to
>> connect to a Windows 2003 VPN server?
>>
>> Now I am also experiencing a number of problems. Most of the time the
>> VPN (this is PPTP by-the-way) works just fine. I can connect from a 2000
>> Professional, XP or Vista client and am able to ping all the machines on
>> my LAN. Works like a charm. Except once in a while I am only able to
>> ping the VPN server itself and then only by using the IP address assigned
>> to the end of my VPN connection, not the server's "regular" IP address.
>> Disconnecting and reconnecting normally resolves this problem.
>>
>> Could this be a configuration issue? Seems strange that it works most of
>> the time. But it doesn't work often enough to be a real support headache
>> for me.
>>
>> The other issue I am experiencing is sometimes RRAS just seems to
>> "hang-up" and stops answering any incoming connections. It doesn't
>> matter if the connections are VPN or dial-up modem connections (this
>> server also handles incoming phone connections). If I logon to the
>> server's console I am also unable to open the "Routing and Remote Access"
>> management tool under "Administrative tools". In ever other respect the
>> server seems to work fine. The only way to resolve this issue is to
>> reboot the server. The RRAS starts working again (for a while).
>>
>> This machine is running SP4 and is fully patched and up-to-date. It is
>> also running Exchange 2003. It is behind an appliance-style
>> firewall/router (a SonicWALL SOHO2). The Internet connection is DLS
>> (PPPoE) with a static IP address.
>>
>> Thanks,
>>
>> The Fish.
>

It is not a good idea to run RRAS on a DC. As soon as a remote client
connects, your DC has two IP addresses (one for the NIC and one for the RRAS
internal interface). Multihomed DCs give you all sorts of problems.

See KB 292822.

"Ken VdB" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks Robert. Do you think it could be a routing issue even though it
> works fine most of the time?
>
>
>
> Perhaps you can point me in the direction of some resources that would
> describe the correct way to setup VPN. My configuration is pretty simple.
>
>
>
> 192.168.0.1 - Windows 2003, DC, DHCP, DNS
>
> 192.168.0.4 - Router (SonicWall)
>
> 192.168.0.5 - Windows 2000, DC, RRAS
>
> 192.168.0.x - all other workstations, printers, wireless devices, etc.
>
>
>
> My DHCP server is configured with the following settings
>
>
>
> Address range: 192.168.0.1 - 192.168.0.254
>
> Exclusion range: 192.168.0.1 - 192.168.0.10
>
> Options:
>
> 003 Router: 192.168.0.4
>
> 006 DNS Servers: 192.168.0.1
>
> 015 Domain Name: mydomain.com (not literally)
>
>
>
> My router is port forwarding/masquerading TCP port 1723 to 192.168.0.5
> (which is my W2K RRAS server). My RRAS server is configured to use DHCP
> to assign addresses to incoming connections.
>
>
>
> Does anyone see any problems with this setup? Is there an article I can
> consult on best practices or how to do this correctly?
>
>
>
> Thanks,
>
> The Fish
>
>
>
> "Robert L. (MS-MVP)" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Sounds like routing issue. Assuming this is not DC, posting the results
>> of routing table and ipconfig /all may help.
>>
>> --
>> Bob Lin, MS-MVP, MCSE & CNE
>> Networking, Internet, Routing, VPN Troubleshooting on
>> http://www.ChicagoTech.net
>> How to Setup Windows, Network, VPN & Remote Access on
>> http://www.HowToNetworking.com
>> "Ken VdB" <(E-Mail Removed)> wrote in message
>> news:O$(E-Mail Removed)...
>>> Hi everyone,
>>>
>>> I have a number of issues with my Windows 2000 VPN server. First things
>>> first. I have two servers, a Win2003 and a Win2000. I am using the
>>> Win2000 box for VPN because my Windows Mobile 2003 hand-helds cannot
>>> connect to a Windows 2003 VPN server. I have no idea why. Windows
>>> Mobile 5 or 6 clients have no problem with a Windows 2003 VPN server but
>>> I have a host of WM 2003 clients that require VPN access.
>>>
>>> So first question: how can I get my Windows Mobile 2003 clients to
>>> connect to a Windows 2003 VPN server?
>>>
>>> Now I am also experiencing a number of problems. Most of the time the
>>> VPN (this is PPTP by-the-way) works just fine. I can connect from a
>>> 2000 Professional, XP or Vista client and am able to ping all the
>>> machines on my LAN. Works like a charm. Except once in a while I am
>>> only able to ping the VPN server itself and then only by using the IP
>>> address assigned to the end of my VPN connection, not the server's
>>> "regular" IP address. Disconnecting and reconnecting normally resolves
>>> this problem.
>>>
>>> Could this be a configuration issue? Seems strange that it works most
>>> of the time. But it doesn't work often enough to be a real support
>>> headache for me.
>>>
>>> The other issue I am experiencing is sometimes RRAS just seems to
>>> "hang-up" and stops answering any incoming connections. It doesn't
>>> matter if the connections are VPN or dial-up modem connections (this
>>> server also handles incoming phone connections). If I logon to the
>>> server's console I am also unable to open the "Routing and Remote
>>> Access" management tool under "Administrative tools". In ever other
>>> respect the server seems to work fine. The only way to resolve this
>>> issue is to reboot the server. The RRAS starts working again (for a
>>> while).
>>>
>>> This machine is running SP4 and is fully patched and up-to-date. It is
>>> also running Exchange 2003. It is behind an appliance-style
>>> firewall/router (a SonicWALL SOHO2). The Internet connection is DLS
>>> (PPPoE) with a static IP address.
>>>
>>> Thanks,
>>>
>>> The Fish.
>>
>
>

OK, thanks for that info. I have setup another computer with a copy of W2K
that I just got off eBay. It is not a domain controller.



Beyond that fact (that my RRAS server was also a DC) can you see anything
else wrong with the setup I described?



What would you recommend in a single server environment? I have setup a lot
of small-business networks with a single server recently.



Thanks,

The Fish.



"Bill Grant" <not.available@online> wrote in message
news:enH$Y$(E-Mail Removed)...
> It is not a good idea to run RRAS on a DC. As soon as a remote client
> connects, your DC has two IP addresses (one for the NIC and one for the
> RRAS internal interface). Multihomed DCs give you all sorts of problems.
>
> See KB 292822.
>
> "Ken VdB" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Thanks Robert. Do you think it could be a routing issue even though it
>> works fine most of the time?
>>
>>
>>
>> Perhaps you can point me in the direction of some resources that would
>> describe the correct way to setup VPN. My configuration is pretty
>> simple.
>>
>>
>>
>> 192.168.0.1 - Windows 2003, DC, DHCP, DNS
>>
>> 192.168.0.4 - Router (SonicWall)
>>
>> 192.168.0.5 - Windows 2000, DC, RRAS
>>
>> 192.168.0.x - all other workstations, printers, wireless devices, etc.
>>
>>
>>
>> My DHCP server is configured with the following settings
>>
>>
>>
>> Address range: 192.168.0.1 - 192.168.0.254
>>
>> Exclusion range: 192.168.0.1 - 192.168.0.10
>>
>> Options:
>>
>> 003 Router: 192.168.0.4
>>
>> 006 DNS Servers: 192.168.0.1
>>
>> 015 Domain Name: mydomain.com (not literally)
>>
>>
>>
>> My router is port forwarding/masquerading TCP port 1723 to 192.168.0.5
>> (which is my W2K RRAS server). My RRAS server is configured to use DHCP
>> to assign addresses to incoming connections.
>>
>>
>>
>> Does anyone see any problems with this setup? Is there an article I can
>> consult on best practices or how to do this correctly?
>>
>>
>>
>> Thanks,
>>
>> The Fish
>>
>>
>>
>> "Robert L. (MS-MVP)" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> Sounds like routing issue. Assuming this is not DC, posting the results
>>> of routing table and ipconfig /all may help.
>>>
>>> --
>>> Bob Lin, MS-MVP, MCSE & CNE
>>> Networking, Internet, Routing, VPN Troubleshooting on
>>> http://www.ChicagoTech.net
>>> How to Setup Windows, Network, VPN & Remote Access on
>>> http://www.HowToNetworking.com
>>> "Ken VdB" <(E-Mail Removed)> wrote in message
>>> news:O$(E-Mail Removed)...
>>>> Hi everyone,
>>>>
>>>> I have a number of issues with my Windows 2000 VPN server. First
>>>> things first. I have two servers, a Win2003 and a Win2000. I am using
>>>> the Win2000 box for VPN because my Windows Mobile 2003 hand-helds
>>>> cannot connect to a Windows 2003 VPN server. I have no idea why.
>>>> Windows Mobile 5 or 6 clients have no problem with a Windows 2003 VPN
>>>> server but I have a host of WM 2003 clients that require VPN access.
>>>>
>>>> So first question: how can I get my Windows Mobile 2003 clients to
>>>> connect to a Windows 2003 VPN server?
>>>>
>>>> Now I am also experiencing a number of problems. Most of the time the
>>>> VPN (this is PPTP by-the-way) works just fine. I can connect from a
>>>> 2000 Professional, XP or Vista client and am able to ping all the
>>>> machines on my LAN. Works like a charm. Except once in a while I am
>>>> only able to ping the VPN server itself and then only by using the IP
>>>> address assigned to the end of my VPN connection, not the server's
>>>> "regular" IP address. Disconnecting and reconnecting normally resolves
>>>> this problem.
>>>>
>>>> Could this be a configuration issue? Seems strange that it works most
>>>> of the time. But it doesn't work often enough to be a real support
>>>> headache for me.
>>>>
>>>> The other issue I am experiencing is sometimes RRAS just seems to
>>>> "hang-up" and stops answering any incoming connections. It doesn't
>>>> matter if the connections are VPN or dial-up modem connections (this
>>>> server also handles incoming phone connections). If I logon to the
>>>> server's console I am also unable to open the "Routing and Remote
>>>> Access" management tool under "Administrative tools". In ever other
>>>> respect the server seems to work fine. The only way to resolve this
>>>> issue is to reboot the server. The RRAS starts working again (for a
>>>> while).
>>>>
>>>> This machine is running SP4 and is fully patched and up-to-date. It is
>>>> also running Exchange 2003. It is behind an appliance-style
>>>> firewall/router (a SonicWALL SOHO2). The Internet connection is DLS
>>>> (PPPoE) with a static IP address.
>>>>
>>>> Thanks,
>>>>
>>>> The Fish.
>>>
>>
>>

"Ken VdB" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> OK, thanks for that info. I have setup another computer with a copy of
> W2K that I just got off eBay. It is not a domain controller.
>
>
>
> Beyond that fact (that my RRAS server was also a DC) can you see anything
> else wrong with the setup I described?
>
>
>
> What would you recommend in a single server environment? I have setup a
> lot of small-business networks with a single server recently.
>
>
>
> Thanks,
>
> The Fish.
>
>
Have you looked at Small Business Server?

"Boomer24" <boomer24 at floridus spam sucks dot com> wrote in message
news:(E-Mail Removed)...
> Yes, I am very familiar with SBS and have installed it in a number of
> environments. I am not entirely sure why you are mentioning it however.
>
>
>
> I am looking for information on:
>
>
>
> a) Why PocketPC 2003 devices cannot VPN into a Windows 2003 server
> while Windows Mobile 5 and higher can
>
>
>
> b) If I am setting up VPN correctly. Perhaps there is a "how to" on
> how to do this the right way? I always just assumed I was doing it right.
>
>
>
> Best regards,
>
>
>
> Boomer24 (formerly KenVdB) :-)
>
>
>
>
>
> "Bill Grant" <not.available@online> wrote in message
> news:(E-Mail Removed)...
>> > Have you looked at Small Business Server?
>>
>
>

That is probably a matter of the authentication they use. Server 2003
RRAS uses a minimum of MS-Chap v2 by default. I think 2000 RRAS had Chap as
the default minimum. To allow clients which do not support the minimum set
on the server you need to enable less secure methods in RRAS on the server.