Problems with remote laptop using VPN

[mmorgensen]

Howdy all,

We issued a fresh XP build laptop to a remote user. The laptop had all the latest security patches and updates. this laptop is having issues with connecting to our corporate network via a VPN (MS-PPTP). The user can connect to the VPN with no problems, however he can access no resources on the remote side. When he accesses a remote resource (\\SERVER1\C$) he gets an "access denied" or a "No login servers are avail.". We confirmed he has the correct WINS entries and DNS for our AD. We also tried a LMHOSTS file..no luck. and YES our DC's are working

This laptop was built from am image, which has been successfuly deployed to other remote users with no problems.

The remote user in question is behind a 'firewall/router' using a Linksys(BEFSR41).

In the event viewer he noticed some errors occuting in pairs when connected to the VPN. These errors may or may not be associated with the problem @ hand. The Errors are below.

All communication to the internet and internal network in his home is working 100%.

any ideas folks?

thanks!

mm



===============EVENT LOG ERRORS==============
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 6/30/2003
Time: 2:31:48 PM
User: N/A
Computer: GFREMLT02
Description:
The Security System detected an attempted downgrade attack for server DNS/NAME2.xxx.com. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.
(0xc000005e)".

and...

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/30/2003
Time: 2:31:48 PM
User: N/A
Computer: GFREMLT02
Description:
The Security System could not establish a secured connection with the server DNS/NAME2.xxx.com. No authentication protocol was available.

 

[ReddLefty]

It's definatly a DNS issue. XP is much more dependant on DNS than Windows 2000.

Here is something I found on EventID.com about those two errors that might help:

"The fix was changing the DNS settings to point to a Win2k DNS which was tied into Active Directory. Apparently the workstation could no longer locate SVR records for the kerberos authentication server."

Hope this helps.




"In space, nobody can hear you click..."

 

[mmorgensen]

yep..tried this too. No go...made things slower and still did not work.

However thank you for the idea.

Blessings,

mm

 

[mmorgensen]

$250 call to MS and a drum roll please....

Here's the scoop: AD uses Kerberos for authentication, and by default Kerberos uses UDP up to 2000 bytes and TCP for larger. UDP packets can get dumped by some routers anywhere along the network path, if too large (e.g., 1500 bytes). If that happens, UDP doesn't go back to the source to tell it to break up and resend, so the communications fail. Changing the protocol to TCP by reducing tha MaxPacketSize to 1 resolves this. Here's how:

http://support.microsoft.com/default.aspx?scid=244474

hope it helps someone in the future!

 

[penauroth]

Maybe a workaround is to increase the MTU for the Linksys router.

P