Windows Forum

Ask something
Discussion Locked

Win2000 VPN and DHCP

0 helpful
6 replies

by bowieb 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Win NT 4.0 network with a Win2000 Advanced Server system set up as a domain client offering VPN access. VPN users are assigned an IP via our network DHCP server.

First Question: The IP address is assigned correctly, but the subnet mask is wrong. I know the DHCP server is set correctly, because all of the inhouse machines are correct. This also happens if I try to have the VPN server assign from a pool. I'm using 172.16.1.0 and I need a 255.255.255.0 netmask.

Second question: My VPN clients are logging into our domain, but they don't seem to be able to access any of the domain resources. Also, they can get to the individual Win98 machines, but the system complains about the workgroups. None of the workgroups or the domain itself show up in the network neighborhood on the VPN client system.

Any suggestions?

Bowie

6 replies

by bill_beach

The first octect (172) of the IP address you listed indicates that you are using class B addressing, but the subnet mask of 255.255.255.0 is for class C. Class C IP addresses start at 191 for the first octet. In order for everyone to play nice, theyall need to have the same IP and subnet scheme.

by bowieb

The 172.16 class B is being subnetted on our network, so I need a class C subnet address. Unfortunately, the subnet address isn't being propogated correctly across the VPN link even though it does work correctly on the internal network.

by rkelly

To make this work correctly you will need to install a DHCP relay agent on your VPN server. There is a know problem with the setup that you have.
When you startup the VPN server it will request 11 IP Addresses from your DHCP Server (one for it's wan wrapper and 10 for Clients), it does not request subnet masks, default gateways etc - just IP Addresses. To make ut work with your non-standard subnet mask you have to use a relay agent, then it will actually forward your requests to the DHCP server rather than just passing an IP Address and default subnet mask.

PS - you add DHCP Relay Agent as a new routing interface below RRAS in Windows 2000.

Richard Kelly
MCSE, Brainbench MVP Windows 2000 Migration
www.brainbench.com

by bowieb

The DHCP relay agent doesn't seem to help, but your answer did point me in the right direction. I found some documentation that indicated that my setup would not work correctly and suggested using a separate static pool. Since there is only one router involved, I'm going to do that and add a path to that subnet in the router.

I will repost my second question separately with more details.

by bowieb

The DHCP Relay Agent is already set up for both the LAN and internal interfaces. The properties for the Relay Agent show the proper IP address for the DHCP server. The IP properties for the server under Routing and Remote Access show that it is assigning IPs via DHCP.
Also, I noticed that the lease is given out to the VPN server's MAC address. Is this normal?

This discussion is closed to new replies.