RRAS dialup access for Mac O/S 10.1.5

[Eric]

I'm trying to provide dialup and VPN access to home Macintosh users. My
initial test was done w/ a G5 running O/S 10.2.8. All dialup and VPN access
worked great and the first time. Further testing with OS 10.1.5 (which is
what my clients have at home) and lower fails on all attempts. Most common
response is "Authentication Failed" but sometimes the client returns a PPP
negotiation error. Issue here is it's not consistent.

For monetary reasons, upgrading the home clients to 10.2.8 is not currently
an option.

Windows 2000 is NOT logging failed login attempts. I've enable full PPP
logging. I can sometimes see the login attempt in the RRAS logs, but not
seeing the reason for the failure. If I get the "Authentication Failed"
error, I do see an RRAS log, but nothing in the AD logs about an account
login failure.

Details of my Testing (for the curious or bored.)
My RRAS server is running Windows 2000 SP4. It is a member of an AD domain
and is using Windows authentication method, not RADIUS. It is hosting an
internal digi 8 port modem. All modem ports have been tested and have
worked from either a Win2K or WinXP dial up test. Dial up from OS 10.2.8
running on a G5 w/ an external USB Zoom modem was also successful.

Dialup test from OS 10.1.5 running on a G4 failed. Tested with same Zoom
modem. Borrowed G4 from home user which had an internal modem. Also
failed.

Added PAP authentication protocol both globally, and as part of the profile.
G4 dialup still failed.

I'm not currently requiring data encryption. Same phone line was used for
all test. Multiple G4's were used, and in one case, I even reinstalled OS X
and tried at various stages (base install, no patches and 10.1.2.) No luck.

During testing, I repeatedly went back to the G5. It always connected.

Any ideas are appreciated.

Thanks,

Eric Mims
Network Administrator
University of Houston-Victoria

If responding directly to me, remove the x's from address.

 

[Michael Johnston [MSFT]]

If you haven't already done this, on the RRAS server type "netsh ras set tracing * enable" at a command prompt. This will
enable all RAS logging on the box. Try to dial in again. Check the tracing logs in Winnt\tracing. Also, a PPP log from the mac
may also be helpful.

Thank you,
Mike Johnston
Microsoft Network Support
--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the
terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from
which they originated.

 

[Eric]

Thanks, Michael. I had not done this.

The PPP error log I got for 3 dial up attempts was:
"Auth Protocol c223 terminated with error 691"

I did not get a repeat of the PPP negotiation error. I might have solved
that without realizing it.

I don't know what the Auth Protocol c223 is (CHAP? It's listed above in the
log) but the error 691 is the username/password wrong or not found in domain
error.

I seem to recall needing to set the 'save with reversible encryption' for
users who connect with a Mac, but I didn't think it was an issue here. Am I
wrong?

Is it the way the username is written? I've tried:
domain\username
username@domain

My inexperience with OS X has left me scratching my head about were the PPP
log is stored. I'm still looking.

Thanks,

Eric

If you haven't already done this, on the RRAS server type "netsh ras set

tracing * enable" at a command prompt. This will

enable all RAS logging on the box. Try to dial in again. Check the

tracing logs in Winnt\tracing. Also, a PPP log from the mac

may also be helpful.

Thank you,
Mike Johnston
Microsoft Network Support

rights. Use of included script samples are subject to the

terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this

message are best directed to the newsgroup/thread from