May 14, 2001, 11:06 AM — We have a Windows 2000 VPN for remote users. We authenticate them with Radius to our NT 4.0 primary domain controller and assign 192.168.X.X addresses through Dynamic Host Configuration Protocol (DHCP). It is not in production for two reasons.
- Remote users connect to their ISP, use the VPN adapter, and are given a full complement of DHCP-provided information, including the addresses of our DNS servers. The problem is that the clients keep flapping between the internal DNS server and the ISP-provided DNS server. This makes the mail server available, unavailable and available again. Successive pings to the DNS name of the mail server return the external address, then the internal, then the external, and so on.
- We also have problems passing the subnet mask to dial-up clients.
Turning off the use of the ISP-provided DNS server on the dial-up clients will force VPN-connected sessions to use your internal DNS servers. This may require a separate connection setup configured with the IP address of your VPN gateway so the client can find the VPN server without using DNS.
The subnet mask trouble may be related to the DNS flapping between two network adapters, but see if there are conflicts in your dial-up DHCP server configuration and interface settings.
