Cisco 775M <---> Windows NT Domain Login

[lardum]

Hi,

Anyone ever seen this?

I'm using two Cisco 775M routers. When i try to login from the remote office, i enter my user id and password. The Windows NT workstation logons but i do get an error message claiming that a domain controller wasn't found. The line gets connected and if i log off and log on again everything works fine.

Anyone have any ideas?

Regards

Lars

 

[jeter]

not sure that this would be a router issue. The only thing your doing here is creating a connection from one site to another. As long as your ip route and your ip's are setup correctly all should be ok. Although one thought comes to mind, are the ISDN's always active? ( set 1 pe on and set 2 pe on ) also ( set timeouts off ). Type UPL at the command prompt to verify your programming. I hope my 2 cents of info help you out.
#-)

 

[lardum]

Hi jeter,

Thanks for your response. The ISDN line isnt always active. Since we pay per minute for the ISDN line, this should cost us to much.

The timeouts are set to 0=off. If i set 1 pe on the line will probably always be connected, so i rather don't want this one... The routes are good, can ping and so on...

Regards

Lars

 

[SirLee]

The Workstation tries to find its PDC via a broadcast. Use an LMHOSTS entry to identify the IP Address of your PDC.

 

[lardum]

Hi,

I've already have an entry for the PDC. They are configured right. The problem is that it doesn't connect the line.

If the line is connected, the logon process works fine. I've tried with both LMHOSTS and WINS... Both with same results...

Any more ideas?

 

[wybnormal]

As an experiment, you can try forwarding UDP packets.. just make sure you only forward ports 137 and 138...

!
ip helper-address xx.xx.xx.255 ( directed broadcast)
!

or

!
ip forward-protocol udp netbios-ns
!
ip forward-protocol udp netbios-dgm
!


If I remember my experiments correctly, you will need to enable this both directions for the WinNT login to function correct and for WINS to work correctly.

Here is the startup process for windows login:
:::snip::
The Startup Process
On startup, any networked system sends a series of packets to discover network addresses, register itself, authenticate itself, and discover services. Windows Networking systems that log into a Windows NT domain must contact a domain controller to authenticate. This process uses name resolution and browsing.

First the startup system must register a computer name (WORKSTATION<00>). If the LMAnnounce parameter is on (for compatibility with LAN Manager servers), then the system also registers DOMAIN<00>. Next the system locates a domain controller for the login domain by trying to resolve DOMAIN<1C>. Prior to Windows 2000, this worked only with broadcast, LMHOSTS, or WINS name resolution methods. With Windows 2000, DNS is tried first. Next, the system logs on to the domain controller using NetBIOS-based mailslot messages, which are sent on User Datagram Protocol (UDP) port 138. Finally, after login is successful, the system registers the user who logged on (USERNAME<03>) so the messenger service can find that user
::snip::

Here is the complete paper from cisco on this subject.

http://www.cisco.com/warp/public/473/winnt_dg.htm

MIke S

 

[lardum]

Hi Mike,

The 700-series routers from Cisco are not IOS based. Therefore i can't use the commands you recommended.

I want to thank you a lot for the paper you recommended. Tried to find such a paper on Ciscos web for days now...

The problem still persist. I don't think it's a problem with the router filtering. I have no access-lists on it. All log ons works fine when the line already is connected...

Regards

Lars

 

[wybnormal]

That is good to know about the 700 series. I had not known about the lack of IOS compatiblity. I'll take a look at the docs of the 700 and maybe something will ring a bell

Mike S

 

[mbhandari]

It seems clearly the issue of timeing out. As you have stated earlier you are using Dial-on Demand, so very time you instiate the LOGIN it first build the circuit, buy the time circuit build your login time-out. It seems you require some kind of parameter on WS to extend the time for the Domain Login.
-bhandari

 

[lardum]

Hi Bhandari,

I'm thinking of some solution in your way too...

The problem is how???

 

[mbhandari]

Hi Lardum,
can you try this stuff.

http://support.microsoft.com/suppor...rnk=31&amp;src=DHCS_MSPSS_gn_SRCH&amp;SPR=NTW

-bhanadari

 

[iarann]

Lars,

Did you resolve this issue, if so please detail what you did.

We are having a similar problem and are putting it down to the fact that a DNS REQUEST packed is not able to Bring up the line, if the line is up it works fine.

John