Hello friends,

     We get questions,queries,feedback and clarifications from many people about their VPN connections through e-mail. I felt some of these Q&A might help people who face similar issues. So here it goes, the list posted as a Q&A.

Query:1: IPv6 not supported on XP; Use Vista client

Customer:

Requirement: Access the machines in the Private Network (the other side of the VPN Server) from a VPN Client using both IPv4 and IPv6 addresses

Current Implementation:

· I have setup the same using the Routing and Remote Access Feature of the Windows Server 2008.

· I have enabled the machine as both IPv4 Router and IPv6 Router and it acts both IPv4 Remote Access Server and IPv6 Remote Access Server.

· I have assigned the range of IPv4 addresses for the respective network adaptor.

· I have also specified the IPv6 prefix assignment value (2001:db8:0:1::1)

Problem: Only the IPv4 address communication is possible, IPv6 address is not assigned to the VPN Client by the VPN Server.

Kindly help me with this.

rrasblog:

1) The IPv6 prefix assigned on RAS server should be /64 - can you change it to 2001:db8:0:1:: and see if it works

2) I presume your VPN client is running Vista. Please confirm

3) Can you send the "route print" output of both VPN client and VPN server - after the VPN connection is established

Customer:

The VPN Client I'm using is Windows XP and the VPN Server is Windows Server 2008.

rrasblog:

Windows XP based VPN client doesn’t support IPv6. IPv6 is only available in Vista. Please try Vista as VPN client

Query:2:Get VPN client's remote IP

Customer:

I'm wondering if you can cover on the RRAS blog how an admin like me running RRAS on 2k3 can determine easily the public IP addresses of my clients attached to my server?

rrasblog:

Unfortunately we don't have mechanism to display public IP address of client on RRAS MMC or netsh.

But you can find it indirectly on RRAS server by running netstat command

Netstat -aon | findstr 1723

(assuming clients are connecting with PPTP i.e. using port 1723; if l2tp - change the port to 500).

We will try to post something on this in the blog soon.

Query:3: Managing Windows Server 2003 RRAS from Vista

Customer:

Hello all I have a question and I thought this might be the best place to ask. How does a Admin run the RRAS tool on Vista to manage a W2K3 box without TS in?

rrasblog:

Currently there is no other way other than TS in. The RSAT package for remote administration of Vista does not have a tool to manage remote RRAS servers.

Query:4: Vista VPN disconnection issue

 

Customer:

I am using a default VPN connection from my Vista Premium SP1 to a Windows Server 2003. Everything works fine when connecting and working online via the VPN connection (file access, file replication, Exchange mail etc.), except when I disconnet the VPN connection. When I try to diconnect, Vista seems to have problem closing the connection, the system slows down and after a while all network related services (seemingly) start hanging. Ultimately I need to restart the computer, and often I need to perform a "hard" boot because Vista can't close down.

rrasblog:

I am not sure if we can track down the issue from the NETSH Logs this time, can you try couple of steps out please:

Disable IPV6 :

To disable IPv6 components in Windows Vista, follow these steps:

1.         Click Start , type regedit in the Start Search box, and then click regedit.exe in the Programs list.

2.         In the User Account Control dialog box, click Continue.

3.         In Registry Editor, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\

4.         Double-click DisabledComponents to modify the DisabledComponents entry.

Note: If the DisabledComponents entry is unavailable, you must create it. To do this, follow these steps:

a.         In the Edit menu, point to New, and then click DWORD (32-bit) Value.

b.         Type DisabledComponents, and then press ENTER.

c.         Double-click DisabledComponents.

d.         Type any one of the following values to configure the IPv6 protocol, and then click OK:

e.         Type 0xffffffff to disable all IPv6 components, except the IPv6 loopback interface. This value also configures Windows Vista to use Internet Protocol version 4 (IPv4) instead of

IPv6 in prefix policies.

Disable Autotuning:

1.         Click Start , click All Programs, click Accessories, and then click Command Prompt.

2.         At the command prompt, type the following command, and then press ENTER:

netsh interface tcp set global autotuninglevel=disabled

Note: You must restart your computer for these changes to take effect.

Uninstall third party firewall software

Uninstall any third party firewall software you have. Just disabling will not help, you will need to uninstall and check.

Customer:

Thanks for your advice. The first two measures did not help. But after uninstalling Symantec Endpoint Protection, this seems to solve the problem.

Query:5: VPN disconnects after some time

Customer:

I have a VPN connection to my company which I created under vista.  It seems to be working properly but it has one odd behavior.  After 5 minutes or so  the connection will disappear from both the “Network and Sharing Center” and from the list of active connections popped up under the taskbar network connection icon.  This makes it harder to tell when I’m connected to the VPN and I sometimes may forget to disconnect it as a result.  Other than the fact that it has disappeared it still seems to work properly – I can access my company network and the internet just fine.

rrasblog:

If you have Vista do you have Service Pack 1 installed on this Client?

If not , can you please check if this happens also when you have service pack 1 installed also.

Windows Vista Service Pack 1 Five Language Standalone (KB936330)

http://www.microsoft.com/downloads/details.aspx?displaylang=de&FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674

Customer:

Thanks for the suggestion of SP1.  After installing it the VPN connection has remained up for 4 hours without disappearing from the network and sharing center and the ipv4 connectivity remains as ‘Internet’.

Query:6: Internal interface question

Customer:

On the Ras, after a reboot should the internal adapter card get an IP address with no one connected. Or does it only get an IP address when someone VPN's in.

rrasblog:

The internal interface is created (and gets an IP address) when the first VPN client connects. So after the reboot, you'd not see the internal interface IP address.

Query:7: Unable to load RAS adminisration DLL

Customer:

I'm tying to restrict one connection per user folowing your post http://blogs.technet.com/rrasblog/archive/2007/12/20/steps-to-develop-a-ras-administration-dll-using-visual-studio.aspx, but the RRAS service fails to start, the errors are the follows:

ID:32

No se encontró el ensamblaje dependiente Microsoft.VC80.DebugCRT y el error final fue El ensamblaje referido no está instalado en su sistema.

ID:20113

No se puede cargar el componente DLL del host de administración RAS de terceros. Error: No se pudo iniciar la aplicación porque su configuración es incorrecta. Reinstalar la aplicación puede solucionar el problema.

rrasblog:

Mauro, From the error messages, it looks like some .NET issue. Have you verified that the .NET framework on which you are building this DLL is the same (or compatible) with that on the RRAS server? Or try copying the Microsoft.VC80.DebugCRT dll from the machine where you build this to the server and check.

Basically RRAS server when it started tries to load this DLL but due to a dependency missing,  the DLL cannot be loaded. So RRAS fails to start.

Customer:

It's working, I've forgot to copy .lib file to RRAS server.

So that is it for now. We will keep posting these as a series.

Janani Vasudevan
Software Design Engineer/Test
RRAS, Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]