Windows Forum

Ask something
Discussion Locked

How is it implemented?

0 helpful
12 replies

by netmom

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
NT 4.0 is set up with a two IP RAS pool, you dial in , and want to access another node on the network. When you try to connect, you receive access denied. The fix is to configure the all nodes you will access, with the exact same RAS pool as the one you dial in to. The other nodes check your IP address for authentification. This is for access to web services on the other node, or PCanywhere access to the node via network after connecting via RAS on another box. How is this implemented?

12 replies

by shmaltz

I do NOT fully understand your Question. But from what you are saying I understand the following.
1. You have 2 IP Subnets.
2. You want one RAS server to act as the RAS server for both subnets.
3. You get an access denied error.
4. The RAS server has access to both subnets.

The way to implement this is:
1. Set up the RAS server. Give it only one IP pool (the one that matches the network the RAS server is directly connected to), Since there is no way of telling RAS which client to give which IP address.
2. On the client side tell it to get an IP address from the RAS server. Configure routes on the clients IP routing table using the route add command, so the client can access the other subnet.
3. In user manager make sure that the users who will be connecting to the RAS server have Dial In Access enabled (the permissions is done on a user basis rather than by machine name). If you use Active Directory its in the Active Directory Users and Computers MMC Snap In.

by netmom

The question is not how to configure RAS. The question is what is configured on the other network nodes that causes them to use the RAS pool for network authentification for users accessing the node via browser or PCanywhere. The user desiring access has already connected to the network using the RAS server. The server is configured to allow access to the entire network. The other nodes on the network some how check the users IP address to see if it matches one of two RAS pool IP addresses, before allowing access. A re-read of the original question may clarify this a little.

by netmom

This question is still not answered, I added another thousand points, does anyone have any idea?

by maxwell edison

This article describes how to install and configure Windows NT 4.0 Dial- Up Networking (DUN) and the Remote Access Service (RAS) client for a connection to a Windows NT or third-party RAS Server. (Microsoft article Q171015.)

"How to Install and Configure Windows NT 4.0 Dial-Up Networking"

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q171015

(REMOVE SPACES from the pasted URL.)

To install DUN and RAS on your Windows NT 4.0-based computer, follow these steps:

Click Start, point to Programs, point to Accessories, and then click Dial-Up Networking.

Click Install. When you are prompted, type the location of the Windows NT 4.0 installation files.

NOTE: If you are not prompted to install Dial-Up Networking, DUN and RAS have already been installed. Skip to the "Configuring Dial-Up Networking" section in this article.

If you have not installed a RAS-capable device, the Remote Access Setup program prompts you to invoke the Modem installer.

In the list of RAS-capable devices, click the modem you just installed, and then click OK.

Click Configure, click Dial Out Only, and then click OK.

Click Network, click the check boxes of the protocols to use for your connection to select them, and then click OK.

NOTE: The protocols that are currently installed are selected by default. If you choose a protocol that is not currently installed, you must install that protocol using the Network tool in Control Panel.

Click Continue, and then click Restart to restart your computer and finish the installation.

(continued...)

by maxwell edison

.
.
To configure DUN to make a connection to a Windows NT or third-party RAS server, follow these steps:

Click Start, point to Programs, point to Accessories, and then click Dial-Up Networking.

By default, there are no entries in the phonebook. Click OK to add a new entry. If you are reinstalling DUN, there may be existing phone book entries. To create a new entry, click New.

Type a name for the phone book entry to identify your connection, and then click Next.

Click any of the check boxes that apply for this connection to select them, and then click Next. If you are unsure whether any of these check boxes apply, see the RAS server administrator.

Type the phone number for the RAS server, click Next, and then click Finish.

Click Dial to connect.

(continued...)

by maxwell edison

.
.
The Microsoft Windows NT 4.0 Remote Access Services (RAS) client may not succeed in being authenticated on a RAS server, and may return the following error message:

Error 5: Access is Denied

This behavior can occur in the following circumstances:

The client is running Windows NT 4.0 Service Pack 6 or later.

You enter a blank space in the Domain box when you log on.

The server that is authenticating the client does not make use of domain names for authentication.

RESOLUTION:

To resolve this issue, place the mouse pointer in the Domain box, and then press BACKSPACE all the way to the left to ensure that the box is cleared of blank spaces.

STATUS:
This behavior is by design.

MORE INFORMATION:

This behavior occurs starting with Service Pack 6 and is by design for security reasons. The Windows NT 4.0 RAS client passes authentication credentials differently in this circumstance starting with Service Pack 6. Before Service Pack 6, if a blank spaceis left in the Domain box, the domain name is ignored and only the user name is passed. With Service Pack 6 and later, the domain name is passed, even if a blank space exists in that box.

Some authentication methods do not use a domain name for authentication. This is typical in scenarios in which RAS users are validated by using a product such as Secure ID. When using such a security product, a user is typically not required to type a domain name but is validated by means of a user name and a number (or secure ID). In this scenario, a blank space in the Domain box may not be noticed. The credentials are passed with the blank space as the domain name, a backslash, and then a user name: domainname \ username . Authentication methods that do not make use of domain names in this way may not succeed in this circumstance.

(continued...)

by maxwell edison

The following sample information is from a sample Ppp.log file. This example shows how credentials are passed in Service Pack 6 and later when the Domain box contains a blank space. In this example, the user name is "Alfred":

See the link for the whole article and the example.

Good luck,

Maxwell

by netmom

Thank you for your comments, I do not believe I have stated the question clearly. Here is the picture. I have a box " A" with NT 4.0 installed, Ras is set up with a pool of 10.10.10.10 and 10.10.10.12 for simplicity. Allow access to network is selected. An account for the calling party is also set. I have another box "B" on the same network, set up identical to the first but of course it has a different IP address and RAS pool. 10.10.10.13 and 10.10.10.15. Both boxes have PC anywhere installed. When I launch PCanywhere on box "B" and try to network connect to Box "A", Box "A" checks to see if the RAS pool on box "B" is 10.10.10.10 and 10.10.10.12. If not, access is denied. If I dial in to box "B" via RAS, it will assign my connection to the RAS pool, so I can access the network. If I try to go to Box "A", I will receive access denied. If I change the RAS pool on box "B" to 10.10.10.10 and 10.10.10.12, I am allowed access. What I want to know is what is configured on box "A" that causes it to check the RAS pool on box "B" before allowing access? Access denied was implemented deliberatley, it is not an error condition. DUN is working fine, this happens whether I dial in or if I am physically at one of the boxes. I want to know how'd they do that? Another piece of information, If the static Ip address assigned to the box is sequencial to the RAS pool, the system will change video modes. This is programmed in, but where?

This discussion is closed to new replies.