windows2000 server VPN and Static Route

The settings shown (specifically your default gateway) should work. Adding a manual route to the same gateway should not make any difference.

From one of the clients can you post the output of the following commands :-

ipconfig /all
route print

Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0        10.10.40.1       10.10.40.1       20
         10.10.40.0        255.255.255.0        10.10.40.55       10.10.40.55       20
        10.10.40.0  255.255.255.255        127.0.0.1       127.0.0.1       20
   10.255.255.255  255.255.255.255        10.0.10.5       10.0.10.5       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        224.0.0.0        240.0.0.0        10.10.40.55       10.10.40.55      20
  255.255.255.255  255.255.255.255        10.10.40.55       10.10.40.55       1
Standardgateway:         10.10.40.1
==========================================================================


IP-Adresse. . . . . . . . . . . . :      10.10.40.51
Subnetzmaske. . . . . . . . . . . :   255.255.255.0
Standardgateway . . . . . . . . . : 10.10.40.1
DHCP-Server . . . . . . . . . . . :   10.10.40.20
DNS-Server. . . . . . . . . . . . :    10.10.40.20
                                              10.10.50.20

my default gateway for DHCP client i am using as my RAS and Routing PC which is normally work as VPN server.

sorry here is the Active route print

Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0        10.10.40.55       10.10.40.55       20
         10.10.40.0        255.255.255.0        10.10.40.55       10.10.40.55       20
        10.10.40.55  255.255.255.255        127.0.0.1       127.0.0.1       20
   10.255.255.255  255.255.255.255        10.10.40.55       10.10.40.55       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        224.0.0.0        240.0.0.0        10.10.40.55       10.10.40.55       20
  255.255.255.255  255.255.255.255        10.10.40.55     10.10.40.55       1
Standardgateway:         10.10.40.1

    Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0        10.10.40.55       10.10.40.55       20

I dont understand where this route comes from. What is 10.10.40.55?

sorry i am really sorry
it was 0.0.0.0          0.0.0.0        10.10.40.1       10.10.40.1       20

It looks fine. Adding a manual route should not make any difference.

So all route print entry is here

Netzwerkziel    Netzwerkmaske          Gateway        Schnittstelle  Anzahl
0.0.0.0              0.0.0.0                   10.10.40.1       10.10.40.55       20
10.10.40.0        255.255.255.0        10.10.40.55       10.10.40.55       20
10.10.40.55     255.255.255.255        127.0.0.1       127.0.0.1             20
   10.255.255.255  255.255.255.255        10.10.40.55       10.10.40.55       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        224.0.0.0        240.0.0.0        10.10.40.55       10.10.40.55       20
  255.255.255.255  255.255.255.255        10.10.40.55     10.10.40.55       1
Standardgateway:         10.10.40.1

yes problem is that it works when i add static route on cleint PC but that i don't want to do addoing static route on all PC always.
i want that when cleint logon the network he must get static route .
thanx

Yes my first option will be solution but if nobody has any idea about myproblem then i would like to closed the question and get my point back.

i don't mind 4 or 5 days you can take your time untill i hope somebody will answer.
thank you
amir

What is the route print from your VPN server on the USA side?  It should be the only one that needs the route added, and this would typically be added when it makes it's connection to the remote server.  If nothing else, you could add a static route from this computer to the UK office, then all machines that are using that computer as a gateway will route to the UK properly.

Hi bill

So here is the route print from my USA site

My usa network works with 10.0.0.0 255.0.0.0.0

and my UK network 10.10.70.0 255.255.255.0

and my France network works with 10.10.60.0 255.255.255.0

So the problem is only from USA site. it works only if i add static route to client pc. The standard gateway on all client is 10.0.0.15(VPN server).

And from UK and france they have access to USA without any problem (all 3 site has same settings for VPn,firewall,RAS & routing)

it's really interesting for me. i think problem is in the route some were but i can't find it.
-------------------------------------------------------------------------------------------------------------------------------------
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway   Schnittstelle  Anzahl
          0.0.0.0          0.0.0.0        10.0.0.14       10.0.0.15       1
         10.0.0.0        255.0.0.0        10.0.0.15       10.0.0.15       1
        10.0.0.15  255.255.255.255        127.0.0.1       127.0.0.1       1
        10.0.10.9  255.255.255.255     10.10.70.105    10.10.70.105       1
       10.0.10.16  255.255.255.255     10.10.60.116    10.10.60.116       1
       10.0.10.18  255.255.255.255        127.0.0.1       127.0.0.1       1
       10.10.60.0    255.255.255.0          0.0.0.0    10.10.60.116       1
       10.10.60.0    255.255.255.0       10.0.10.16    10.10.60.116       1
     10.10.60.116  255.255.255.255        127.0.0.1       127.0.0.1       1
       10.10.70.0    255.255.255.0        10.0.10.9    10.10.70.105       1
     10.10.70.105  255.255.255.255        127.0.0.1       127.0.0.1       1
       10.10.80.0    255.255.255.0         10.0.0.6       10.0.0.15       1
   10.255.255.255  255.255.255.255        10.0.0.15       10.0.0.15       1
   10.255.255.255  255.255.255.255     10.10.60.116    10.10.60.116       1
   10.255.255.255  255.255.255.255     10.10.70.105    10.10.70.105       1
    84.164.42.224  255.255.255.255        10.0.0.14       10.0.0.15       1
    84.164.52.171  255.255.255.255        10.0.0.14       10.0.0.15       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
        224.0.0.0        224.0.0.0        10.0.0.15       10.0.0.15       1
        224.0.0.0        224.0.0.0     10.10.60.116    10.10.60.116       1
        224.0.0.0        224.0.0.0     10.10.70.105    10.10.70.105       1
  255.255.255.255  255.255.255.255        10.0.0.15       10.0.0.15       1
Standardgateway:         10.0.0.14
===========================================================================
Ständige Routen:
  Keine


--------------------------------------------------------------------------------------------------------------------------------------

Your problem is with your USA subnet.  You need to change it to 10.10.40.0 and 255.255.255.0, then all will be well.  This is why nothing is being routed through your gateway automatically, because it will look for anything that is 10.x.x.x on the local network.  Change your subnet mask and I'll bet you it works flawlessly.

Yes but in ras and routing
i have add static route

like this

 10.10.70.0   255.255.255.0    none     UKvpn

i mean i have add static route in RAS and Routing software then also it won't work.

in my network all server use 10.0.0.X 255.0.0.0. and client use 10.0.10.X 255.0.0.0

thanx

Hi bill

if i ping or access UK network from my USA (VPN server ) it works perfect. only the problem is client (works only with static IP address)

Hi bill Me again

is there any solution without changing USA subnet. bcz we have lot of services and Server are running here all what we can do is that try to change in UK . But in usa it will be a big problem.

thanx

It never should have been set up as a class A network in the first place, changing the subnet mask shouldn't be that big of a job typically and shouldn't interupt anything else.  I would just do one machine as a test machine, and see if everything routes properly on it.

Hi bill

one more question

how about my Uk side why they have access to our network without adding static route (on client network)??
And DO i have to change WHole Ip addres range in my USA net or only subnet mask or anything else ?

just the subnet mask, nothing else.  The UK side has access without adding a static route because they are subnetted properly, although I find it a little puzzling that they actually received correct responses from the machines running on the improper subnet.

i will tell you why they recive bcz on the server in USA and on some administration Workstations i have installed static route that's why In UK all server and Client can access (only some machine in usa were static routes are installed).

Ok i will try to change the subnet mask.

thanx

So in the Uk routing and ras server i have add a static route

10.0.0.0 255.0.0.0   vpnUSA

do i have to change here also something. ?

I would leave everything in the UK alone, and just change one of the machines in the USA to see if this subnet thing works, should take you only a few minutes to test out.

yes i have test it works

in usa i have put one machine with static IP addrss 10.0.0.111 subnetmask 255.255.0.0 gateway VPn machine

it worked.

255.255.0.0 shouldn't work, 255.255.255.0 should.  Are you running DHCP on your network? Now you can just change the subnet option in your scope and it should fix the problem with the entire network.

Yes 255.255.0.0 has worked also.

So In uSA office now i am gonna make new DHCp scope from client something like this

10.0.10.1 to 10.0.10.255 subnetmask 255.255.255.0 for clients

and for server i always use static Ip address range will be something like this 10.0.0.1 to 10.0.0.200 and subnetmask will be 255.255.255.0

In USA network i am having running VPn and it use static route to UK something like this 10.10.70.0 mask 255.255.255.0

so wthat was all in USA network

and now about UK

in UK VPN machine i nees to modify the Static route now it has 10.0.0.0 255.0.0.0 and i will modify to 10.0.0.0 255.255.255.0 it it ok

And i hopw nothing will happen bcz i need to change subnetmak in all server also in USA network.

thanx

You should be able to remove the static route you had set up in the UK seeing as the routing issues will be resolved with the proper subnets set.

hi bill
So here i come with my problem again

 I am using right now class A subnet in USA network but if i use Subnet 255.255.255.0 then i will be in trouble then my Network in USA will nothave Ip address more then 255(i think so)

10.0.0.1
255.255.255.0

do you have any idea what to do ?

how many addresses do you need on your USA network?

I think more then 255 (round about 500 iPs)

This should have been looked at during the planning phase of the network.  From how I understand your network is working now, you have:

10.0.70.X = UK
10.0.60.X = FRANCE
10.0.0.X and 10.0.40.X = USA?

I am not sure what addresses you are currently using in the USA, perhaps an easier solution would be to switch the USA network over to a 192.168.X.X network scheme, with 255.255.0.0 for a subnet.  If you have 500 computers, there is no doubtedly a router or two on your network that you can set up routes between your different subnets you would be using on your network.

My networks are like this now  at the moment

10.10.70.X  255.255.255.0(for client & server)        Uk
10.10.60.X  255.255.255.0(for client & server)        France
10.0.0.X     255.0.0.0(for server)                           USA
10.0.10.X   255.0.0.0(for client)                             USA

I would suggest either moving your servers to the 10.0.10.X or installing a router between the clients and servers so you can set routes up on them.

so as you said my network will look like

10.10.70.X  255.255.255.0(for client & server)        Uk
10.10.60.X  255.255.255.0(for client & server)        France
10.0.0.X     255.0.0.0(for client & server)               USA

No, do NOT use 255.0.0.0 ANYWHERE on your network. 10.0.0.X and 255.255.255.0 for your servers, on one side of a router, and 10.0.10.X for your clients.

How are you making out on this one?

Hi Bill

just give me a bit of time bcz i need time to make all on paper and need to explain to my boss if he says yes then only i can chnage whole network etc..
i will get back to you i just need few days...

thank you very much

regards
amir

Hi bill just one question

I don't know this problem is related with my Routing problem or not

In my USA,UK and france all Network there are one domain Controller (but all have same domain name) So my problem is that i can't see in my NetworkNeighbourhood the PC from other site. FOr eg
if i am usa i see only the PC from USA not from Uk and france. If i am in Uk i see only the PC from Uk . All DNS ,DHCp settins are fine and working well.

don't know it's diff problem or related with routing isssue.

Thanx

well, from the looks of your set up, UK and France should be able to see each other right now, as long as your domain controllers are all part of the SAME DOMAIN and not just domains that are named the same.  Your domain controllers should be syncing with each other and be part of the same Active Directory domain as each other, which it doesn't sound like you have set up.

Hehe, if your boss will foot the bill I'll fly out there and see what's up!

So First about I talked with my collegues and boss about this routing problem and explained them. They don't want in USA to have a router between client and server(In usa network).

And second my all Domain controllers are sync with each other but my pros beedn started since i had one domain conroller was crashed and since all other domain search him as PDC.

SO i think i will use Windows 2003 DHCP server which has option for Static routes for DHCP Clients(now i am using windows 2000 DHCP server).

What do you think Bill ?
amir

If they don't want a router between the client and server, then you will need to change the network address of all USA machines over, I would suggest to 192.168.X.X and 255.255.0.0 .  THIS IS THE ONLY OTHER WAY, more care should have been taken during the planning phase of this network and they wouldn't be running into this problem.

As far as your DC's, Windows 2000 no longer uses the PDC BDC architecture, if all was set up redundantly throughout your network the failure of a single server would still allow for authentication on the domain.

Using the static routes option is just going to leave yourself open for bigger and badder headaches in the future.  You should be attempting to bring your network into line with actual proper standards, instead of just jury rigging it.  Your static route doesn't solve the problem, it solves the symptoms.  

Really I think you should convince your boss he needs to hire an actual IT person to look after their network because it really looks like whoever they got in to set it up in the first place botched it up baaad.  I know, they're usually really tight with their money, but it will save them in the long run to get their network actually functioning like a network should!

and I just read up top, can't believe this was just a 400 point question, lol.

Hi Bill
yes it was 400 Point Question Bcz nobody except you  had an idea what's going on in my server.The way you have suggested was also good but my company don't want router inside between server and client. So  i had no other option to go for windows 2003 DHCP server. But you will get your Marks for your efforts definatly let me make everything run with my domain and i will give you also points.

regards
amir

Your boss's can't possibly understand the implications of running everything over static routes in a helter skelter sort of environment, but we have to keep the bosses happy.  And I wasn't really worried about the points, I just had a good chuckle when I saw that, because 500 is supposed to be for hard questions so I was laughing to myself thinking if this is an easy one I'd hate to see what you would ask for a hard question!! lol.

Ok so it sounds for you it was easy question for you.The network in USA was not setup by me i just setup in UK and france and ther ei use 10.10.70.X or 60 .X that was good decision i think bcz there we don't have computer more then 50.

I will try to explain my all boss about situation and force them to use 192.168.x.x and try to make them agree.

regards
amir

yep, that's if you need more than 253 IP addresses of course, which it sounds like you do as you said you needed about 500 IP's.

Thank you Computer101, it is great to see the administration of this board is so fair and thorough with their reviews.  As far as the 500 points is concerned, I answered this question as a 400 point question so I do not believe another 100 would be warranted.

Thank you very much!

OK here i goes
I think there was miss understanding everybody was thinking that i am just reducing points like that but as i thought it was easy Question for BIll(as he mentioned may be i understood wrong) so that was only reason why i wanted to reduce points as i got some suggestions form bill but i have find my way also to solve it(using windows 2003 DHCP server).

For me it doesn't matter now were goes point but i appreciate and respect Bills Effort which he did for me(i just miss understood him that it was easy question for him that was all ).

thank you very much Bill and Admin

Thank you Amiruddin, I wish you all the best with your network, and hope that you will find a way to convince your boss of changing IP's rather than using static routes all over the place to save you problems in the future.