Cannot access file share over VPN

[cc900630]

Hi I have a PPTP VPN Tunnel Setup between ISA2K on Windows 2003 Server
and ISA 2K24 on Win 2K3 Server.

Behind the ISA 2K4 server I have an Intranet/IIS Server and a File
Share on the same machine.

Behind the ISA2K server I have my win 2000 and win xp clients.


The xp Clients can all access the Intranet OK but not the file share.
Although if I log on directly to the ISA2K I can access thefile share.

Other remote clients using Winxp L2TP VPN and Win2K PPTP VPN can access
both the Intranet and Fileshare OK. So this leads me to belive the
problem is not on the ISA 2K4 VPN Server but on the ISA 2K Network.

The file share is accessed by mapping a drive to the Local IP
192.168.XXX.XXX Address of the Server and logging on to Windows. Remote
users already have the VPN running to the pulic IP which i presume
builds the route on the local machine.

Users behind the the ISA2K Server cannot find the server when mapping
the drive. But when they type http://192.168.XXX.XXX they get to the
Intranet OK.

I'm no network person, I have to go on the advice that I'm given and
that has been to install a hotfix on my ISA2K4 server because it has
both Win 2K3 SP1 and Security Update MS05-019, and there a bug that
needs fixing.

I'm reluctant to do any patches on the VPN server beccause other users
can acess the service OK but I dont know what else to do.

I dont have the knowledge, skills or tools to even begin to
troubleshoot this and dont know where to find someone who can as theres
so many systems involved.

Can any one please advise where to start or possible causes of the
problem. Please request further info if needed.

Any advice greatly appreciated

Thanks.
hals_left

 

[Phillip Windell]

The file share is accessed by mapping a drive to the Local IP
192.168.XXX.XXX Address of the Server and logging on to Windows. Remote
users already have the VPN running to the pulic IP which i presume
builds the route on the local machine.

No. There is no "route" built on the local machine. The local machine simply
sends anything not in its own subnet to its Default Gateway,...it is the
device used as the Default Gateway that is responsible to know what to do
with the packets from there.

Users behind the the ISA2K Server cannot find the server when mapping
the drive. But when they type http://192.168.XXX.XXX they get to the
Intranet OK.

VPN does not provide for "Naming". WINS is required for Netbios Naming to
work,...and DNS is required for FQDNs to work. Hence, using the IP#
works,...using the Name does not.

BTW - you need to get away from that "mapping a drive" thing and start using
UNC Paths (Network Paths).

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------

 

[cc900630]

Philip, Thanks for the reply.

VPN does not provide for "Naming". WINS is required for Netbios Naming
to
work,...and DNS is required for FQDNs to work. Hence, using the IP#
works,...using the Name does not.

I dont understand this reponse as I dont use names I only use IP
Address for all connectivity.

http://192.168.XXX.XXX - Intranet. Works for for site-site and remote
clients
\\192.168.XXX.XXX\MyShare$ - FileShare. Works for remote clients but
not site-site


Well today I have been told that a site-site tunnel is crap compared to
the built in client-server vpn with XP and will need many more
protocols enabling to work properly for a simple file share, and
require much more support costs to maintain and keep it up over time
than simple client vpn. Great. Anyone reccomend me a book?

 

[Phillip Windell]

Well today I have been told that a site-site tunnel is crap compared to
the built in client-server vpn with XP and

I would say the opposite is true. The Remote Access VPN is crap compared to
the transparency of the Site-to-Site VPN. I don't know what they are
talking about with "enabling protocols",...both sides of a Site-to-Site VPN
are *local* and *trusted*,...there isn't supposed to be any
"filtering",...it works just the same as if you ran and additional subnet
within your own local LAN over a LAN Router. A Site-to-Site VPN is just a
cheaper replacement for connecting two LAN Segments over a private leased
line.


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------