FUNDAMENTAL DESCRIPTION OF LINKSYS BEFVP41-BASED VPN SETUP/OPERATION WITH NOTES ON THE CONFIGURATION OF A PAIR OF BEFVP41s CONNECTING A WIN_NT WORKGROUP AND AN UNRELATED W2K DOMAIN
Greetings,
Thanks to this forum, I was helped in forming a fundamental insight into the working of the BEFVP41 and VPNs configured with it. Based on that insight, and some other important tips I found here (like the need to update the flash prom), I was able to setup an impressive VPN capability for very little money and with very little technical skill on my part.
To return the favor, I will document the important and fundamental -- yet simple -- insight here, and provide a few tips of my own. I'm doing this in part because this thread is way too long, useful as it is. Why? The information I'll provide in this post was not (but should have been) presented in the Linksys documentation AT ALL. Nor have I seen a clear description on any internet thread, including this one. This has wasted countless manhours by Linksys, their customers, and the helpful experts here on this thread and similar ones elsewhere on the internet.
One other thing -- a caveat: I myself am a total novice in Windows networking, forced by the failure of our technical people as well as economic hard times to fend for myself in setting up a VPN. So if this stuff seems elementary, it is!
SO WHO SHOULD KEEP READING?
Linksys newbies, people like me, Linksys technical support people, and netizen experts alike, please read the next paragraph carefully. Understand it (or use similar simple language in communications) before you attempt to setup a VPN or give your customers advice concerning same! And Linksys, you would be well advised to include something along these lines at the VERY BEGINNING of your user manual in the future, given that the BEFVP41 is meant to be a consumer item and is sold over-the-counter in Comp USA!
<<A home-BEFVP41 to BEFVP41-office VPN setup, where "home" is a laptop that is configured to be a part of the "office" W2K domain but is now connected to the office remotely via the BEFVP41s, PRODUCES A COMPLETELY TRANSPARENT REMOTE VPN CONNECTION to the office, almost INDISTINGUISHABLE FROM A LOCAL ETHERNET CONNECTION. THIS SETUP DOES NOT REQUIRE ANY WINDOWS OS CONFIGURATION AT EITHER END, except possibly IP addresses and/or DHCP settings in some cases. IT specifically DOES NOT REQUIRE ANY IPSec POLICIES or VPN OR RAS SETTINGS of ANY KIND IN WINDOWS, as it is the task of the Linksys box to make the remote workstation appear to be directly connected to the LAN.>>
OKAY!!!???
Of course, you old timers and networking experts will readily see that the setup described above represents only a fraction of the possible setups that will be needed by the people who bought in to the BEFVP41 VPN. What if if the user wants to use a BEFVP41 on only the server side? What if BEFVP41s are on both ends, but the connection is between a W2K domain and a remote workstation that's not part of the domain (this is the wrinkle discussed in the balance of this post...)? We have three very different setups, and within each, many variations. Yet the Linksys documentation (and many posts on the various technical support threads here and elsewhere on the internet) fail to distinguish among them!
Well, for those of you interested in a 2-Linksys configuration connecting a WinNT workgroup to an unrelated W2K domain server, read on...
MY LINKSYS SETUP - OVERVIEW
I was able to configure a passable VPN connection between my office and my home (configuration is from office to home, left to right, as follows: <w2k server and lan><BEFVP41 (fixed WAN/LAN addresses)><DSL modem><verizon ISP><cloud><cox cable isp><cable modem>><BEFVP41 (DHCP WAN/LAN addresses)><WinNT4WS>. In the process, I discovered a few tips and tricks for setting up a BEFVP41 VPN, and also ran in to some currently unsolved problems of my own. In the account that follows, the TIPS, TRICKS, and UNSOLVED PROBLEMS are all set off by the upper case strings "TIP" or "UNSOLVED". The assistance of contributors here on the unsolved problems will be much appreciated!
DETAILS OF THIS BEFVP41 -- BEFVP41 Configuration
Per suggestions found here in this thread, both BEFVP41s were upgraded to the latest flash prom release. Their configurations included enablement of NETBIOS broadcasts on the advanced configuration page. All other details of the configuration follow the successful configurations found in this thread.
The home WinNT is a workstation, not a server, and it is not part of the office W2K domain. The home workgroup incorporates two WinNT workstations. The office domain incorporates several W2K and Linux servers with 1 PDC, fixed external IP address (assumed now by the Linksys), and fixed internal IP addresses (several wll-known TCP/IP ports are routed to specific internal computers for handling).
The "passable" presently realized VPN capabilities are as follows:
1. No office computers appeared on the home WinNT explorer initially. [TIP #1] However, I was able to "explorer>tools>find computer" several office lan computers. [TIP #2] Most of those I could not find using the explorer command I was able to connect to using "net use" from the command prompt and my office domain user id.
2. [TIP #3] I was able to map drives from all computers I was able to connect to via the "net use", provided I left the "connect as" blank. Once the office drives were mapped, my WinNT explorer incorporated them, providing full "virtual drive" capability across the WAN. I was also able to print documents on the office lan printers with no problems.
3. I was unable to connect to the office PDC, which apparently has an IP configuration problem. Despite that problem, office-based workstations are able to see the PDC. [UNSOLVED #1] It is possible I can't see the PDC from home because I'm not logged on to the domain controlled by the PDC. DOES ANYBODY HERE KNOW IF THIS IS TRUE?
4. The home WinNT workgroup name did appear in the explorers of the office computers (but not the computer name). [UNSOLVED #2] The home computers that are part of the workgroup were not visible to the office and could not be browsed. The alternative "find computer" and "net use" methods outlined earlier were then used to connect to the home workgroup computers, and these failed as well. I plan to turn my home workgroup into a W2K server domain to see if this clears up the problem --- ANY SUGGESTIONS ON THIS?
Anyhow, I am deeply indebted to the people here who put so much time in to helping others. I hope that the foregoing will help repay some of that debt, but more, I hope to see alot more home offices and opportunities to work at home offered by employers. The BEFVP41 eliminates, for somewhere in between US$0 and $150, broad categories of employer excuses not to implement reasonable telecommuting programs.
Regards,
Patrick (azureson)
