2

I have a local domain (let's call it mycorp.local).

On one computer, I setup a VPN connexion to a remote domain (let's suppose it's DNS suffix is remote.local).

As soon as I establish the remote connection, the local domain authentication stop to works. For example, I try to connect to a SQL server using integrated authentication, but it fails with this error:

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. (Microsoft SQL Server, Error: 18452)

If I disconnect the VPN, I can login again to SQL.

Both domain has no trust relationship.

My first guess was that the VPN connection take precedence over local DNS. That's why I followed this answer : VPN Connection causes DNS to use wrong DNS server. Basically, the answer allowed to change the order of interface to try dns resolution.

I assume the DNS setup is correct, be cause I can ping both sql and ad computers when the VPN is established.

Is there any parameter/config to apply to ensure authentication occurs on the correct domain?


If it can help, here are some details on my setup:

  • 2 network cards
    • 1 that can access to the AD network
    • 1 with internet access
  • local subnet: 192.168.10.0/24. Metric set to 1
  • second card's subnet: 192.168.66.0/24. Metric set to 100
  • VPN's connection's subnet: 172.16.0.0/16. Metric set to 9999

In all cases, ping sql, ping sql.mycorp.local, ping ad and ping ad.mycorp.local are correctly resolving IP addresses (of course with some ipconfig /flushdns to be sure).

The complete output of ipconfig /all is:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : mycomputer
   Primary Dns Suffix  . . . . . . . : mycorp.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : mycorp.local
                                       remote.local

Ethernet adapter Local:

   Connection-specific DNS Suffix  . : mycorp.local
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #3
   Physical Address. . . . . . . . . : 00-15-5D-14-20-0D
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d117:9048:ce1c:1422%16(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.10.30(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 
   DHCPv6 IAID . . . . . . . . . . . : 385881437
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-8B-E5-3D-00-15-5D-14-20-0F
   DNS Servers . . . . . . . . . . . : fe80::80ce:dc9d:37c5:39f3%16
                                       192.168.10.10
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter RJ45:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #2
   Physical Address. . . . . . . . . : 00-15-5D-14-20-0E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2a01:e35:8a84:7240:c0eb:c8d1:9c3f:8fc0(Preferred) 
   Link-local IPv6 Address . . . . . : fe80::c0eb:c8d1:9c3f:8fc0%13(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.66.11(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : lundi 12 août 2013 13:06:28
   Lease Expires . . . . . . . . . . : jeudi 22 août 2013 13:06:28
   Default Gateway . . . . . . . . . : fe80::207:cbff:fe3c:5b7f%13
                                       192.168.66.254
   DHCP Server . . . . . . . . . . . : 192.168.66.254
   DNS Servers . . . . . . . . . . . : fe80::80ce:dc9d:37c5:39f3%13
                                       192.168.10.10
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Wifi:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
   Physical Address. . . . . . . . . : 00-15-5D-14-20-0F
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::c551:f03f:7557:9b17%11(Preferred) 
   Autoconfiguration IPv4 Address. . : 169.254.155.23(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 
   DHCPv6 IAID . . . . . . . . . . . : 234886493
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-8B-E5-3D-00-15-5D-14-20-0F
   DNS Servers . . . . . . . . . . . : fe80::80ce:dc9d:37c5:39f3%11
                                       192.168.10.10
   NetBIOS over Tcpip. . . . . . . . : Enabled

PPP adapter VPN remote:

   Connection-specific DNS Suffix  . : remote.local
   Description . . . . . . . . . . . : VPN remote
   Physical Address. . . . . . . . . : 
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 172.16.110.243(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . : 
   DNS Servers . . . . . . . . . . . : 172.16.100.47
                                       172.16.100.43
   Primary WINS Server . . . . . . . : 172.16.100.47
   Secondary WINS Server . . . . . . : 172.16.122.100
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{DEFE2CAC-D001-4E79-A33F-AD95A8106CA8}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{2AE1C64F-102F-48B4-A60A-AA28461A96EF}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.remote.local:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : remote.local
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.mycorp.local:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : mycorp.local
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

The complete route print command's output is:

===========================================================================
Interface List
 16...00 15 5d 14 20 0d ......Microsoft Hyper-V Network Adapter #3
 13...00 15 5d 14 20 0e ......Microsoft Hyper-V Network Adapter #2
 11...00 15 5d 14 20 0f ......Microsoft Hyper-V Network Adapter
 28...........................VPN Remote
  1...........................Software Loopback Interface 1
 12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.66.254    192.168.66.11    100
    77.245.100.10  255.255.255.255   192.168.66.254    192.168.66.11    101
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link    169.254.155.23    261
   169.254.155.23  255.255.255.255         On-link    169.254.155.23    261
  169.254.255.255  255.255.255.255         On-link    169.254.155.23    261
       172.16.0.0      255.255.0.0   172.16.110.240   172.16.110.243  10000
   172.16.110.243  255.255.255.255         On-link    172.16.110.243  10255
     192.168.10.0    255.255.255.0         On-link     192.168.10.30    257
    192.168.10.30  255.255.255.255         On-link     192.168.10.30    257
   192.168.10.255  255.255.255.255         On-link     192.168.10.30    257
     192.168.66.0    255.255.255.0         On-link     192.168.66.11    356
    192.168.66.11  255.255.255.255         On-link     192.168.66.11    356
   192.168.66.255  255.255.255.255         On-link     192.168.66.11    356
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.10.30    257
        224.0.0.0        240.0.0.0         On-link     192.168.66.11    356
        224.0.0.0        240.0.0.0         On-link    169.254.155.23    261
        224.0.0.0        240.0.0.0         On-link    172.16.110.243  10255
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.10.30    257
  255.255.255.255  255.255.255.255         On-link     192.168.66.11    356
  255.255.255.255  255.255.255.255         On-link    169.254.155.23    261
  255.255.255.255  255.255.255.255         On-link    172.16.110.243  10255
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 13    356 ::/0                     fe80::207:cbff:fe3c:5b7f
  1    306 ::1/128                  On-link
 13    108 2a01:e35:8a84:7240::/64  On-link
 13    356 2a01:e35:8a84:7240:c0eb:c8d1:9c3f:8fc0/128
                                    On-link
 16    257 fe80::/64                On-link
 13    356 fe80::/64                On-link
 11    261 fe80::/64                On-link
 13    356 fe80::c0eb:c8d1:9c3f:8fc0/128
                                    On-link
 11    261 fe80::c551:f03f:7557:9b17/128
                                    On-link
 16    257 fe80::d117:9048:ce1c:1422/128
                                    On-link
  1    306 ff00::/8                 On-link
 16    257 ff00::/8                 On-link
 13    356 ff00::/8                 On-link
 11    261 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

[Edit] To follow up TheCleaner's comment.

klist purge
klist

outputs:

Current LogonId is 0:0x6a9a3
    Deleting all tickets:
    Ticket(s) purged!
Current LogonId is 0:0x6a9a3
Cached Tickets: (0)

Start the program and try to connect (Sql Management Studio). Success, then:

sqlcmd -S sql -E -Q "select getdate()"    
klist

outputs:

Current LogonId is 0:0x6a9a3
Cached Tickets: (0)

Established the VPN connection, then:

sqlcmd -S sql -E -Q "select getdate()"    
klist

outputs:

Sqlcmd: Error: Microsoft SQL Server Native Client 11.0 : Login failed. The login is from an untrusted domain and cannot be used with Windows authentication..    

Current LogonId is 0:0x6a9a3

Cached Tickets: (1)

#0>     Client: steve @ mycorp.LOCAL
    Server: krbtgt/mycorp.LOCAL @ mycorp.LOCAL
    KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
    Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent
    Start Time: 8/12/2013 15:14:22 (local)
    End Time:   8/13/2013 1:14:22 (local)
    Renew Time: 8/19/2013 15:14:22 (local)
    Session Key Type: RSADSI RC4-HMAC(NT)

[Edit 2] After activating the kerberos event logging, I get a specific event log:

A Kerberos Error Message was received:
 on logon session 
 Client Time: 
 Server Time: 19:18:33.0000 8/12/2013 Z
 Error Code: 0x7  KDC_ERR_S_PRINCIPAL_UNKNOWN
 Extended Error: 
 Client Realm: 
 Client Name: 
 Server Realm: remote.LOCAL
 Server Name: MSSQLSvc/sql:1433
 Target Name: MSSQLSvc/sql:[email protected]
 Error Text: 
 File: 9
 Line: f09
 Error Data is in record data.

If you look at the realm, you will see that the realm is no mycorp.local but remote.local.

2
  • 1) can you authenticate by putting in mycorp\username? Or does it not even prompt? 2)if you run klist from a command prompt does it list a kerberos ticket for the SQL server with the right KDC? 3) Run the SQL program you are trying (management gui, program, whatever) using RUN AS and input your mycorp.local credentials.
    – TheCleaner
    Aug 12, 2013 at 13:04
  • @TheCleaner: 1. it does not prompt, but the tool (Sql Management Studio) does not offer to ask for credential. 2. I'll update my question in few seconds. 3. While the VPN is established, I "right click"/"run as different user" and write my current user login. And this works. I can log in to SQL Server.
    – Steve B
    Aug 12, 2013 at 13:10

3 Answers 3

2

I finally found an easy way to solve the issue.

The solution is taken from this technet thread.

Setting the UseRasCredentials parameter to 0 in the VPN connection file (.pbk) solved the issue.

I deduct this parameter tells windows not to use the credentials of the VPN connection. I then have to input my login/password each time I connect to something in the remote network, but I'm ok with that.

As the post said, beware that editing the connection with the GUI reset this parameter to 1.

1

Your hints got us to a solution: CMDKEY /del /ras

On SQL SRV PC with VPN connected via Clavister OneConnect, the SQL Server was inaccessible to any other PC on same domain (same auth error as you). Disconnect the VPN (on the SQL SRV PC) and its accessible again immediately. However, as Clavister OneConnect doesn't use rasdial/rasphone / *.rpb we had to use CMDKEY based solution.

0

It's the VPN credentials that are being passed to the SQL server instead of your mycorp.local original credentials (since Run As works).

But no idea if you can force it to keep and pass the original set of credentials first instead of the newly acquired integrated auth tokens...I don't think so though, since that's really what Run As is, the workaround to pass another set of credentials.

Personally, creating a Run As shortcut to use while you are on the VPN should handle the issue, but maybe other experts have a better idea.

5
  • TheCleaner: unfortunately, the sql connection is only the visible par of the issue. Actually, I have a SharePoint running on the computer. And SharePoint is exploding because no more Sql query can be made. I also have management tools that cannot works, and probably other future issues that I have not yet discovered.
    – Steve B
    Aug 12, 2013 at 13:30
  • Looking it over again, you are running Sharepoint/etc. on Hyper-V vm's on the machine you are then VPNing from? And it kills Sharepoint on the VM it is running under? Or just sql queries from the host? I'm trying to understand why Sharepoint and other tools don't work. Is the VPN a simple Windows VPN or Cisco or other? I'm not sure I have a great final answer, but I'll try.
    – TheCleaner
    Aug 12, 2013 at 15:34
  • I'm trying to open a vpn connection, on the box where SharePoint runs. SP is not instantaneously killed, but when a service restart, or a new job is spawned, having the VPN connection opened will make this spawning fail. The purpose of the VPN connection is to access external data from a distinct domain (SOAP service). The VPN connection is a VPN published by ISA server (don't have details, but I may have the info). I can't request a change at the external domain or vpn server, but I have control over the local domain if it can help
    – Steve B
    Aug 12, 2013 at 15:44
  • As an example, if I start a new PowerShell session, I got The local farm is not accessible. Cmdlets with FeatureDependencyId are not registered error. This is because the Powershell's process does not have access to the SQL server. I guess I should setup kerberos somewhere to stick it's ticket validation on my local subnet, but it's far from my current skills.
    – Steve B
    Aug 12, 2013 at 15:46
  • don't know if it can help, but I edited my question, with a kerberos event log.
    – Steve B
    Aug 12, 2013 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .