Figure 1: Open the "Run" window to test the wired connection.
Troubleshooting VPN
Connections
Herb Poppe
hpoppe@ucar.edu
NCAR - SCD - DSG
(303) 497-1296
October 2003
Edition 1.0
Overview
While some network services at UCAR are made available to the public at large from external networks (the Internet), and some services (such as "internal" Web pages and the Time Card System) are available to staff from external networks through their UCAS login, many services (such as access to IMAP and POP e-mail servers) are restricted to access from internal UCAR networks only. The internal networks are separated from the external Internet by our security perimeter (firewall). While the security perimeter allows users on the internal networks to originate most protocol requests to, and receive replies from, the Internet, it blocks all protocol requests to protected hosts and most protocol requests to exposed hosts from the Internet. The security perimeter protects machines on the internal networks from malicious attack from external networks.
By accessing UCAR's VPN (Virtual Private Network) server (a Cisco
3000 Series) from your laptop, VPN allows you to securely access UCAR's
internal networks from an external network just as if you had an
Ethernet
connection inside our security perimeter (firewall). At UCAR, you use
VPN from our external conference room network (the .43 subnet) or
wireless
network. These networks are external because they are publicly
accessible.
At home, you use VPN in conjunction with your own ISP (Internet Service
Provider) to access UCAR via a dial-up or broadband (cable, DSL,
community
wireless or satellite) connection. When you travel, you use VPN from an
Ethernet or wireless connection at a company, university or hotel, or a
Global AT&T dial-up account, if you have one.
Note: if you dial-up (either local or long distance) to
UCAR's
RAS (Remote Access Server) then you have a connection to the internal
network and do not need to use VPN. (VPN could be used for security
reasons,
but the client configuration for an internal connection is different
than
an external connection and won't be discussed here.)
This troubleshooting guide is aimed at situations you may encounter
when you travel, where the networking infrastructure is not under your,
or UCAR's, control. It assumes that your Cisco VPN Client (called the
VPN
Dialer in Version 3) has been properly installed and configured (IP
address,
group authentication name and password) to access UCAR's VPN server.
Before
you travel, you should ensure that you can successfully access UCAR via
VPN.
Screenshots displayed below are from a system running the Cisco
Version 4 VPN Client on Windows XP and equivalent Version 3 Client
screenshots running on Windows 2000. You will see nearly the same
interface running on
other supported Windows operating systems. The user interface for the
Version
4 VPN Client running on Mac OS X is the same as that on Windows XP,
with
suitable allowances for the Aqua "look and feel".
Problem Areas
It is important that the Ethernet cable plug is properly seated in both the wallplate jack and the jack on your computer. Push the plug in until you hear or feel the latching lever click into place.
Some Ethernet cables have a vinyl sleeve that covers the plug; the sleeve is designed to prevent the latching lever from snagging on other cables when the cable is pulled across the floor. This sleeve may make it difficult to completely insert the plug into the jack. If you have this problem, just twist the sleeve back down the cable, away from the plug.
The network jack on your computer (or on the plug-in Ethernet card) may have lights that indicate an active Ethernet connection. Typically, when the Ethernet connection is active, one light will be lit continuously (usually green) to show the presence of carrier and another (usually yellow) will blink to show network activity. A red light usually indicates a serious problem. It would be a good idea to familiarize yourself with the behavior of these lights before you travel, so you will know what to expect on the road.
If these lights do not illuminate, you may have a bad cable or a bad card.
If you suspect a bad cable, ask for another. It is a good idea to carry your own network cable with you. This will be a lifesaver if the hotel supplied cable "walked off", and another cannot be immediately located.
If these lights do not illuminate, the wallplate jack may be
inactive. If you have arranged with the hotel for high-speed Internet
access (for a fee), the hotel may not have activated the port since you
registered,
or they may have activated a jack in the wrong room. If there is more
than
one jack, you may have plugged into the wrong one.
You can determine if your machine has an active Ethernet connection by typing the command "command /K ipconfig /all" in the "Run" window displayed when you select "Run..." from the "Start" menu. (See Figures 1 and 2.)
Figure 1: Open the "Run" window to test the
wired connection.
Figure 2: Enter the "ipconfig" command in the "Run" window to test the wired connection.
Figure 3: Result from running the "ipconfig"
command.
You do not have an active Ethernet connection if the line "Media
State: Media disconnected." (or similar) appears in the
"command.com" listing.
Type "exit" to close the window.
The company or institution you are visiting, or the hotel at which you are staying, should provide you with instructions for accessing their wireless network. Contact their staff if you are having problems setting up access.
You can verify that you have "associated" (established a radio link)
with a wireless access point and that the signal strength and quality
are
adequate. On Windows XP, select "Wireless Network Connection" from
the "Connect to" menu item from the "Start" menu. (See
Figure 4.) (Windows XP is used
here as an example because it has a consistent wireless user interface,
regardless of the wireless card installed. For other Windows systems,
the
software, and user interface, varies by vendor.)
Figure 4: Select "Wireless Network Connection" from the "Start" menu to display the "Wireless Network Connection Status" dialog box.
If the "Connect to" menu item is not shown in your "Start" menu, select "Control Panel" and navigate to, and select, "Network Connections". In the "Network Connections" window, open the "Wireless Network Connection" icon.
(You can customize the "Start" menu to display the "Connect
to" menu item: Right-click on the "Start" menu and select
"Properties"; in the "Start Menu" tab of the "Taskbar
and Start Menu Properties" dialog box, click on "Customize...";
in the "Advanced " tab of the "Customize Start Menu" dialog
box, scroll down through the "Start menu items:" pane and select the
"Display as Connect to menu" radiobutton for "Network
Connections".)
If a wireless connection is not active, the "Wireless Network
Connection" dialog box is
displayed, showing available networks (if any). Consult Windows XP Help
or the
documentation supplied by the wireless site (hotel, conference, etc.)
to learn
how to establish a connection.
If you fail to associate, or the signal strength and quality are such that you cannot maintain a link, try moving closer to the access point. You must be within a few hundred feet of an access point for successful communication. Be sure there are no large metal objects between your computer and the access point.
IP address
problems
In order to access Internet services, your machine must obtain a
unique IP address, that is compatible with the Ethernet segment or
wireless
link that you have connected to. Hopefully, the local site will provide
you with the range of IP addresses that are appropriate for a
connection
to their network.
To discover the IP address assigned to your machine, type "command
/K ipconfig /all" in the "Run" window displayed when you select
"Run..." from the "Start" menu. (See Figures 1 and 2.)
(In Windows XP this
information can easily be obtained
by looking in the "Networks Connections" Control Panel, clicking on the
"Wireless
Network Connection" icon, and looking at "Details" in the left-hand
pane.)
Figure 6: Result from running the "ipconfig"
command to list the IP address.
Here, the example system obtained the IP address "128.117.43.28"
for the wired Ethernet port. If you see more than one adapter in the
listing (wireless, for example), be sure to recognize the one
associated with your type of connection.
Type "exit" to close the window.
If you obtain a IP address in the range 169.254.XXX.XXX you probably
did not receive an address from a DHCP server. Addresses in this range
are
so-called "auto-configuration addresses" and are usually the result of
connecting to a network with no DHCP server (see below).
When all computers were big and heavy, it was unlikely that they
would be moved around and connected to different networks. They were
configured with a static IP address. Laptops, on the other hand, are
quintessentially portable, and with the popularity of built-in
Ethernet and wireless networking, they may be easily connected to many
different networks. Laptops should be configured to obtain their IP
address dynamically, typically
from a server. If your laptop has been configured with a static IP
address
for a UCAR network, or for a company or institution you previously
visited,
it is imperative that it be reconfigured for dynamic addressing in
order
to work with most sites.
For Windows NT, 2000 and XP systems, you must have administrator
access to your laptop in order to reconfigure the TCP/IP settings.
Typical users do not, so if your division still uses static addresses
on laptops, your machine must be reconfigured by your administrator
before you leave on a
trip. It is a good idea if your machine has a local account that is a
member
of the local Administrators group, but that is not the normal
Administrator
account. There are other situations, besides reconfiguring TCP/IP
settings
(such as installing certain software) that require Administrator access
to
your machine. If this account is available, your systems admin could,
by
phone, walk you through TCP/IP reconfiguration, software installation,
etc.
that may be critical to the mission of your trip.
You can tell if TCP/IP is configured to obtain its address
dynamically if the line "DHCP Enabled: Yes" (or similar)
appears in the "ipconfig" listing; the line will read "DHCP
Enabled: No" for a static configuration. You can see in Figure 6
that the example system obtained its address dynamically.
If you have trouble obtaining an appropriate dynamic address for your machine (and it is not configured for static addressing), you may find it useful to reboot. Alternatively, you can type "ipconfig /release" (followed by the "Enter" key) and then "ipconfig /renew" (followed by the "Enter" key) in the "command.com" window (Figure 6).
Problems accessing an external network
Once you have a valid IP address, you should attempt to connect to a site on the Internet. Be aware, however, that the company, institution, or hotel you are connecting from may have their own firewall, and may be blocking the protocols of certain network services. If they aren't blocking all outgoing protocols, the one protocol that should be permitted is HTTP, the protocol of the World Wide Web. To test your ability to reach the Internet, try opening www.google.com from your Web browser.
If you were successful in reaching a Web site on the Internet, your
local firewall might still block the protocols that the VPN client uses
to access its server.
To test a VPN connection, launch the Cisco VPN Client (also called
the "VPN Dialer") and attempt a connection to the UCAR VPN server
(click on
the "Connect" button).
Figure 7a: Click "Connect" to attempt a connection
to the UCAR VPN server (Version 4 client).
Figure 7b: Click "Connect" to attempt a connection
to the UCAR VPN server (Version 3 client).
If you fail to connect, it may be because the local firewall is
blocking the protocol that the VPN client is currently using to reach
the server.
You can reconfigure transparent tunneling to try different protocols;
hopefully, one of the three possibilities will work.
Reconfiguring Transparent Tunneling
In order to reconfigure your VPN client, you need to disconnect the client from UCAR, if connected; restart the client.
In Version 4 (Figure 7a), click on the "Modify" button; in Version 3 (Figure 7b), click on the "Options" button and select "Properties..." from the pop-up menu (Figure 8b).
Figure 8b: Select "Properties" (Version 3 client).
The "Properties for UCAR" dialog box opens (Figures 9a or 9b).
Select the "Transport" tab (V4) or the "General" tab (V3), if not already selected.
IPSec over TCP
Click the "Enable Transparent Tunneling" checkbox, if not already
checked.
Click on the "Use IPSec over TCP (NAT/PAT/Firewall)" radiobutton.
Be sure that "TCP port:" is set to "10000".
Figure 9a: Check "Enable Transparent Tunneling" and select "Use IPSec over TCP" (Version 4 client).
Figure 9b: Check "Enable Transparent Tunneling" and select "Use IPSec over TCP" (Version 3 client).
Click on the "Save" or "OK" button at the bottom of the dialog box.
From the main VPN client window, try to make your connection.
IPSec over UDP
If you can't connect with "IPSec over TCP", try "IPSec over UDP".
Click the "Enable Transparent Tunneling" checkbox, if not already
checked.
Click on the "Use IPSec over UDP (NAT/PAT)" radiobutton.
Figure 10a: Check "Enable Transparent Tunneling" and select "Use IPSec over UDP" (Version 4 client).
Figure 10b: Check "Enable Transparent Tunneling" and select "Use IPSec over UDP" (Version 3 client).
Click on the "Save" or "OK" button at the bottom of the dialog box.
From the main VPN client window, try to make your connection.
Disable Transparent Tunneling
If you can't connect with "IPSec over UDP", try disabling
transparent
tunneling.
Click the "Enable Transparent Tunneling" checkbox, if checked.
Figure 11a: Uncheck "Enable Transparent Tunneling" (Version 4 client).
Figure 11b: Uncheck "Enable Transparent Tunneling" (Version 3 client).
Click on the "Save" or "OK" button at the bottom of the dialog box.
From the main VPN client window, try to make your connection.
If, after trying the three different transparent tunneling
configurations, you still fail to connect to UCAR's VPN server, you may
want to contact
personnel at the local site and ask them about their firewall and its
interaction
with VPN. If you learn that your hotel does not support VPN, you may
wish
to express an opinion that their management is "business user hostile".
Note: When connected to UCAR's Conference Room subnet (.43), any of the three tunneling methods will work. When connected to UCAR's wireless subnet (.228), only the third tunneling method (Disable Transparent Tunneling) works reliably.
Problems while
logging into the VPN server
If you can connect to UCAR's VPN server, but the server rejects your login name or password, remember that the correct username and password is your UCAS (Time Card) username and your Cryptocard.
The VPN server is reliable, and it also has a "automatic hot spare".
It should seldom fail but it may be inaccessible because of scheduled
maintenance. Prior to departure on your trip,
it would be a good idea to check if maintenance on the VPN server has
been
scheduled. Scheduled maintenance of the VPN server is announced in the Daily Bulletin,
which
can be read online at http://www.scd.ucar.edu/cpg/dailyb/todays.html.
Also, the
VPN server may be working but may not be accessible because of other
UCAR network
infrastructure problems. You can call the SCD Computer Room Operations
Staff at
(303) 497-1200 to inquire about the status of the VPN server.
Or is it?
If you cannot reach important network services in your division after successfully connecting to the UCAR VPN server, it may not be a problem with the VPN server. Those systems may be down or are inaccessible because of other UCAR network infrastructure problems.
Usually, e-mail is the most important service for which VPN is required: you need it if you access your e-mail via a POP or IMAP client like Netscape, Eudora, Outlook or Outlook Express. Your division may support Web access to e-mail, which doesn't require VPN, only the HTTP protocol, which most firewalls pass. You can also use this method to read e-mail when you don't have access to your laptop, but can find an Internet cafe. You may wish to try Web access to e-mail before your trip, and bookmark the URL, just in case.