Archived from groups: microsoft.public.windowsxp.work_remotely (More info?)
Hello -
I have a user with Windows XP SP 2, connecting to a Windows Server 2003
Routing and Remote Access server, who is experiencing the following chain of
events:
1. The user is connected successfully, using a standard Windows VPN
connection. He is assigned an IP from the correct DHCP pool, and everything
looks fine. We can ping back and forth, he can get access to a share, etc.
He is correctly assigned DNS servers, subnet mask, etc.
2. After about 20-25 seconds, he received the following information in the
System Event log, and his DHCP-assigned IP address is dropped, leaving him
with no assigned network values except for the DNS servers, on the VPN
interface.
Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 1/24/2005
Time: 12:57:56 PM
User: N/A
Computer: *********
Description:
The IP address lease 192.168.254.17 for the Network Card with network
address 00534500000 has been denied by the DHCP server 192.168.254.160 (The
DHCP Server sent a DHCPNACK message).
4. Around the same time as above, the Windows Server 2003 server running
the RRAS server offers the following, which seems to contradict that the
client was able to negotiate ANYTHING at all:
Event Type: Error
Event Source: RemoteAccess
Event Category: None
Event ID: 20050
Date: 1/24/2005
Time: 12:57:54 PM
User: N/A
Computer: HALEY
Description:
The user X\X connected to port VPN4-2 has been disconnected because no
network protocols were successfully negotiated.
3. After a few more seconds, he receives the following in his System Event
log on the XP machine. Notice that the IP address that is listed as the
"already in use" address is NOT the same as that in the previous event.
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1005
Date: 1/24/2005
Time: 12:58:07 PM
User: N/A
Computer: DEMOOPER
Description:
Your computer has detected that the IP address 192.168.254.10 for the
Network Card with network address 00534500000 is already in use on the
network. Your computer will automatically attempt to obtain a different
address.
4. After about another 30 seconds, the following appears in the System
Event log on the client:
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1007
Date: 1/24/2005
Time: 12:58:48 PM
User: N/A
Computer: DEMOOPER
Description:
Your computer has automatically configured the IP address for the Network
Card with network address 005345000000. The IP address being used is
169.254.212.160.
Data:
0000: 00 00 00 00 ....
All, and I mean ALL, other users which connect to this SAME RRAS server are
able to negotiate all protocols properly, are assigned IP addresses, DNS
servers, etc., and are able to stay connected without issue for hours and
hours, so I'm inclined to think that this is a client-only issue.
I have already tried installing new drivers for the ethernet NIC which he
uses, reinstalling the interface completely. I am also going to have the
user reapply SP2, in hopes that any OS components which may be corrupt would
be replaced by that, but do not know when he will be able to comply. I find
no specific evidence that any network protocols have become corrupt on his
machine, either.
This happens whether the connection attempt is made through firewalls from a
remote location, or on the LAN. His XP SP2 firewall is also disabled for
these tests.
Please feel free to reply with any suggestions!
- Eric McWhorter
Hello -
I have a user with Windows XP SP 2, connecting to a Windows Server 2003
Routing and Remote Access server, who is experiencing the following chain of
events:
1. The user is connected successfully, using a standard Windows VPN
connection. He is assigned an IP from the correct DHCP pool, and everything
looks fine. We can ping back and forth, he can get access to a share, etc.
He is correctly assigned DNS servers, subnet mask, etc.
2. After about 20-25 seconds, he received the following information in the
System Event log, and his DHCP-assigned IP address is dropped, leaving him
with no assigned network values except for the DNS servers, on the VPN
interface.
Event Type: Error
Event Source: Dhcp
Event Category: None
Event ID: 1002
Date: 1/24/2005
Time: 12:57:56 PM
User: N/A
Computer: *********
Description:
The IP address lease 192.168.254.17 for the Network Card with network
address 00534500000 has been denied by the DHCP server 192.168.254.160 (The
DHCP Server sent a DHCPNACK message).
4. Around the same time as above, the Windows Server 2003 server running
the RRAS server offers the following, which seems to contradict that the
client was able to negotiate ANYTHING at all:
Event Type: Error
Event Source: RemoteAccess
Event Category: None
Event ID: 20050
Date: 1/24/2005
Time: 12:57:54 PM
User: N/A
Computer: HALEY
Description:
The user X\X connected to port VPN4-2 has been disconnected because no
network protocols were successfully negotiated.
3. After a few more seconds, he receives the following in his System Event
log on the XP machine. Notice that the IP address that is listed as the
"already in use" address is NOT the same as that in the previous event.
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1005
Date: 1/24/2005
Time: 12:58:07 PM
User: N/A
Computer: DEMOOPER
Description:
Your computer has detected that the IP address 192.168.254.10 for the
Network Card with network address 00534500000 is already in use on the
network. Your computer will automatically attempt to obtain a different
address.
4. After about another 30 seconds, the following appears in the System
Event log on the client:
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1007
Date: 1/24/2005
Time: 12:58:48 PM
User: N/A
Computer: DEMOOPER
Description:
Your computer has automatically configured the IP address for the Network
Card with network address 005345000000. The IP address being used is
169.254.212.160.
Data:
0000: 00 00 00 00 ....
All, and I mean ALL, other users which connect to this SAME RRAS server are
able to negotiate all protocols properly, are assigned IP addresses, DNS
servers, etc., and are able to stay connected without issue for hours and
hours, so I'm inclined to think that this is a client-only issue.
I have already tried installing new drivers for the ethernet NIC which he
uses, reinstalling the interface completely. I am also going to have the
user reapply SP2, in hopes that any OS components which may be corrupt would
be replaced by that, but do not know when he will be able to comply. I find
no specific evidence that any network protocols have become corrupt on his
machine, either.
This happens whether the connection attempt is made through firewalls from a
remote location, or on the LAN. His XP SP2 firewall is also disabled for
these tests.
Please feel free to reply with any suggestions!
- Eric McWhorter
Facebook
Twitter
Instagram