Send your Windows question to Mitch today! | See other Windows tips

If your enterprise has multiple small offices but only one domain controller at each office, how will users at one of your sites log on if their domain controller goes down? One common approach is to have users make a VPN connection to one of the other offices using PPPoE over DSL and authenticate with the domain controller there.

Unfortunately performing domain authentication over a VPN can sometimes be frustrating using the built-in remote access client in Windows XP. The reason for this is because the encryption header in a PPTP or L2TP packet takes up a lot of space in a PPP frame, which means there's less room for actual data in the frame. This can cause problems for authentication exchanges, and can sometimes also make transfers of large files unreliable.

A workaround for this problem is to lower the MTU for PPPoE on the client from its default size of 1480 bytes to around 1450 or even 1400 to reduce fragmentation by routers on the Internet. The less fragmentation that occurs, the less chance there is that domain authentication will fail. Start by lowering the MTU a small amount and see if the problem resolves itself. If not, lower it further, but you should generally not go too far below 1400 unless you need to.

Another thing you can try on the client is to ping the remote VPN server using the Set Don't Fragment flag (-f) while specifying successively smaller packet sizes using the buffer flag (-l). Start with ping -f -l 1480 and work down progressively until you no longer get "Packet needs to be fragmented but DF set" messages in response. Eventually you'll find the largest packet that won't fragment, and set the MTU to that.

On Windows XP, modifying the MTU can be accomplished using a simple registry hack described in KB 283165. You usually won't need to change this on your VPN server though, since Windows Server 2003 already uses a MTU of 1400 by default for all VPN connections, but even that may need to be lowered in some cases to ensure more reliable VPN connections.

ITworld.com

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine