Remote browsing

[Ed Russell]

Hello RRAS gurus. I have recently setup a PPTP VPN using one of my windows
2003 servers as an endpoint. So far so good. The only issue so far is that
the remote computers do not show up in the browse list. All other
connectivity is fine. From the remote side the browse list populates, speed
is very good (much better than when using the Cisco VPN client to our PIX).
I have been tasked with trying a direct PPTP connection as opposed to
connecting with the Cisco VPN client to the egress PIX firewall. Normally I
would not care about this, but my client has a server side application which
depends on the browse list to function. When using the Cisco VPN client the
remote systems do appear. I have found article
http://support.microsoft.com/default.aspx?scid=kb;en-us;243188, which
indicates this is an expected behavior. However, this article seems dated
to me. Obviouslly installing Netbeui is not what I want to do. To compound
matters my RRAS endpoint is a DC which runs WINS/DNS. I have also read that
this might cause me troubles. I have found
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q292822 which
explains some solutions. I think I should introduce the modifications this
articule suggests since moving my endpoint is not an option. My only
concern is the last part of the article which references adding
DisableNetbiosOverTcpip. It seems to me that entering this will leave me no
hope of getting my first issue resolved. To summarize:

1. Is is possible to have the remote systems show up in the browse list?
2. Should I implement all of 292822?
3. What are the implications of the last piece of the article?

I hope someone can provide me with some feedback as my head is spinning
right now. Thanks so much.

 

[Bill Grant]

1. With W2k it is not really possible to have a "dialup" type client appear
in the browse list. The link does not carry broadcasts, so there is no way
for the browse master to know about the remote client. In server 2003 you
can enable broadcasts. I have never done it, so I can't say how well it
works. Browsing will work for remote sites connected by VPN (as long as you
have WINS). The remote site runs its local browse master which can
communicate across the link with other master browsers (using WINS to
resolve names to IP addresses, just like browsing across a router).

2. KB 292822 is often required when running remote access on a DC. This is
really just a new version of the old multihomed DC problem from NT. The
problems with DNS can usually be prevented by setting DNS to listen on the
"local" subnet only.

3. The end of the article discusses disabling Netbios over TCP/IP on the
RRAS internal interface. The reason for this is to prevent the server
becoming multihomed (as far as Netbios over TCP/IP is concerned). This is
aimed at preventing browsing problems on the LAN due to a multihomed browse
master.

Note that there is an alternative stategy discussed in KB 830063 (again
near the end of the article). This involves leaving Netbios over TCP/IP
enabled, but putting the remote users in their own subnet. This would
require enabling IP routing on the server and ensuring that the LAN
router(s) could route traffic for the remote subnet through the VPN server.