Vista: Cannot RDP over VPN

[Guest]

I work within a Windows 2003 domain and use ISA 2006. I often RDP to external
client sites. To do this I typically create a VPN from my PC to the external
client and then RDP across it.

This works fine on my Windows XP and 2003 machines but not Vista. I can
create the VPN ok but RDP always returns "This computer can't connect to the
remote computer".

Interestingly, if the client netnork has port 3389 open so I can RDP
directly, I do not have a problem. I only have a problem when I try to RDP
via a VPN.

My config on one Vista machine is as follows...

Windows IP Configuration

Host Name . . . . . . . . . . . . : Mike-PC
Primary Dns Suffix . . . . . . . : MyDomain.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MyDomain.local

PPP adapter My Client:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : My Client
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.3.37(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.3.2
Primary WINS Server . . . . . . . : 192.168.3.2
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : MyDomain.local
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-30-1B-B7-87-7A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::7c15:15a6:9a0d:daaa%8(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.22(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, 8 November 2007 12:56:37 PM
Lease Expires . . . . . . . . . . : Friday, 16 November 2007 2:43:48 PM
Default Gateway . . . . . . . . . : 192.168.1.249
DHCP Server . . . . . . . . . . . : 192.168.1.251
DHCPv6 IAID . . . . . . . . . . . : 201338907
DNS Servers . . . . . . . . . . . : 192.168.1.251
Primary WINS Server . . . . . . . : 192.168.1.251
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 23:

Connection-specific DNS Suffix . : MyDomain.local
Description . . . . . . . . . . . : isatap.MyDomain.local
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5efe:192.168.1.22%25(Preferred)
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.1.251
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 24:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #8
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5efe:192.168.3.37%32(Preferred)
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.3.2
NetBIOS over Tcpip. . . . . . . . : Disabled

 

[Andre Da Costa[ActiveWin]]

Check the third post and see if it offers any help:
http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=1195313&SiteID=17

 

[Guest]

Thanks for the reply.

No. It is not a firewall problem.

 

[Kerry Brown]

I think it may be an ISA 2006 problem. I just tested this on a SBS server
without ISA and one with ISA 2004. It worked fine on both. I was testing
from a Vista Business client on a domain without ISA to a SBS Server 2003
SP1 without ISA and a SBS Server 2003 R2 with ISA 2004. I connected with a
VPN then RDP'd to the other servers by using both their NETBIOS name and
internal IP. Other than ISA 2006 the only thing I can think of is a
credentials problem. Make sure you specify the user name in this format:
domain_name\user_name.

 

[Guest]

Thank you for the response.

On further investigation I think the problem is being caused by my old
nemesis MTU size as ...

ping -f -l 1500 myClientPC

fails on my Vistat machine but ...

ping -f -l 1372 myClientPC

works OK. My problem now is that changing registry settings as per
http://support.microsoft.com/default.aspx?scid=kb;en-us;826159 no longer
works on Vista.

How do I change MTU settings on Vista?

 

[Kerry Brown]

There's some hints here

http://smallvoid.com/article/vista-tcpip-mtu.html

http://tsudohnimh.com/blog/2007/10/solve-vista-mtu-problems.html

http://blogs.msdn.com/echarran/archive/2007/04/27/vista-rdp-vs-legacy-rdp-mtu-sizes.aspx

The last link mentions enabling fragmentation which I can't find anything
on.

 

[Kerry Brown]

There's some more info here

http://www.microsoft.com/downloads/...80-17B5-480C-AEF7-5C0BDE9060B0&displaylang=en