Difficult network problem

Message

#1 Post by **jdhurst** » Wed Nov 21, 2007 6:52 pm

I have Access Connections 4.42 installed and working well on my T41. I also have the Juniper Netscreen client version 8.8.

Lately (for as long as a few months) I have problems with the Netscreen client.

On my Desktop, which is always on and has a wired connection, the Netscreen client always connects.

If I cold start my ThinkPad with a wired connection, the Netscreen client always connects.

If I cold start my ThinkPad with my home wireless (the only Active profile), the Netscreen client *usually* connects.

If I cold start my ThinkPad with no connection, and connect up manually by selecting the Access Connection wireless profile, then the Netscreen client will *not* connect.

If I use the manual connection, shutdown and then start up at home, the home automatic profile usually doesn't start - I have to select it and start it. Then, the Netscreen client does *not* connect. I have to restart.

Bottom line is that if Access Connections does not connect automatically, then the Netscreen client does *not* connect.

I have uninstalled both Access Connections and the Netscreen client, restarted, cleaned the registry, and re-installed. No luck.

It is one of the following:
1. The newest version of Access Connections (new since 7/25/07). I did not apparently have this problem earlier (say in 2006 and before).
2. The newest version of Netscreen Client (new since 5/9/2007). I did not apparently have this problem earlier.
3. My system is hosed is some subtle way that is not otherwise causing problem.
4. VMware is getting in the way. The Netscreen log shows copius NIC failures on every startup for the VMware virtual NIC. VMware 5.5.4 is new since April, 2007

It is hard to pin down because earlier this year (who know exactly when) and certainly in 2006, I did not have this problem.

Does anyone use VPN software (especially Juniper) and recognize the problem.

Please do NOT post here useless drivel about how YOU don't like Access Connections. This thread is for serious posts only.

Thanks, ... JDH

Wiz · #2 Post by **Wiz** » Wed Nov 21, 2007 9:00 pm

I used several VPN clients in the past to support customers and cannot remember which one of them, but it tried to connect automatically during reboot and if it failed it didn't try again. So when connected with wire it always worked ok. When using wireless it usually worked fine. Sometimes the wireless connection took a bit longer to connect during reboot and the VPN client didn't connect automatically. In this case i assume the reason is because the wireless connected slower then normal so the VPN connection started before the wireless were connected, failed and didn't try again.

When i reboot my computer usually AC connect automatically (i have auto location switching enabled), but sometimes it doesn't happen or take to long so i connect the profile manually. Not sure why this happen, but i got about 40 profiles so i just assume AC try each of them and sometime that can take some time to try each before the correct one is choosen. Not sure if AC is able to search for several wireless networks simultaneously or do it one by one.

I always seen what i descibe above, but if you never had any such issue before i guess there must be a new verson of something that behave a bit different that is causing the problem. I really have no idea if that could be the VPN client, AC or something else. Not sure about vmware though, but i been using vmware 5.x, 6.x and currently vmware not installed at all with the same behavior.

But earlier i used several VPN clients installed at the same time which gave me lot of strange issues so now i use the Cisco VPN client only on this computer and connect manually. Did you install something new before (hours, days or weeks) you saw this problem for the first time? My guess would be that AC might be the reason, but it's hard to tell.

#3 Post by **jdhurst** » Wed Nov 21, 2007 9:40 pm

Thank you for a most informative post.

I am leaning toward:
1. The Netscreen Client V8.8. Why? Because when it doesn't connect, it says in the log that it is sending but not receiving. Since traffic is flowing, it seems to be the VPN client itself having trouble. The Juniper forums have not shed much light on this.

2. I have a subtle OS problem. I install lots of software and upgrades, and it is entirely possible after 3 years of one build that something went awry.

I do not think it is Access Connections (which is otherwise working great), but I am not ruling it out either.

I do not think it is VMware. The Desktop gets the same errors about Virtual adapters in the Netscreen log on startup, but startup only occurs very infrequently since the machine runs 24x365 non-stop.

I even checked through the connectoids in the registry, and they all match the known adapters except that I have two instances of my Sony Ericsson card. I may try to delete one.

The other thing is that recently, I cannot tunnel in using the Sony Ericsson card where I could do so in the summer.

I'll keep looking. Other thoughts are welcome.
... JDH

Wiz · #4 Post by **Wiz** » Wed Nov 21, 2007 10:32 pm

jdhurst wrote:Thank you for a most informative post.
I am leaning toward:
1. The Netscreen Client V8.8. Why? Because when it doesn't connect, it says in the log that it is sending but not receiving. Since traffic is flowing, it seems to be the VPN client itself having trouble. The Juniper forums have not shed much light on this.

Could it be because it's trying to send, but the wireless connection is not yet established so that way nothing is received since there is no IP connectivity at this point? Do you have access to the other end of the VPN tunnel so see if the netscreen VPN device receive anything when you see that the client try to connect and transmit? Or another PC with a sniffer to see if those packets when trying to establish the VPN tunnel actually leave the PC.
I really don't have a lot of experience with the netscreen client so maybe you are right the problem is the client.

jdhurst wrote:2. I have a subtle OS problem. I install lots of software and upgrades, and it is entirely possible after 3 years of one build that something went awry.

Yeah sometimes a lot of upgrades cause strange problems that a OS reinstall might solve. If a lot of stuff been installed it's hard to pinpoint which one you installed when the problem started as well. It's a pain going try the reinstall process if you have lot of software installed

jdhurst wrote:I do not think it is Access Connections (which is otherwise working great), but I am not ruling it out either.

Maybe you are right, but i was thinking if AC doesn't connect or connect slower then is used to that might cause the VPN problem if the client try to establish the VPN tunnel before wireless connection is established and that's the reason why you see that it's sending, but not receiving.

jdhurst wrote:I even checked through the connectoids in the registry, and they all match the known adapters except that I have two instances of my Sony Ericsson card. I may try to delete one.
The other thing is that recently, I cannot tunnel in using the Sony Ericsson card where I could do so in the summer.

I also remember a problem at a customer site using the Cisco VPN client and a Nokia adapter. The problem in that case was because the cisco VPN client installed the "Deterministic Network Enhancer" and so did the Nokia software, but obviously different versions. So they managed to either get the cisco vpn client or the Nokia adapter to work correctly, but not both at the same time. Not sure if this is relevant since you use another VPN client and another adapter and for all i know it could have been a bug in the vpn client or nokia software at that time. They gave up on the nokia adapter anyway so we never really solved the problem.

Wiz

#5 Post by **jdhurst** » Thu Nov 22, 2007 9:21 am

Hey Wiz - Thanks for all your posts.

I think I have made some progress!

I am currently at a client with a wired connection. I can VPN out with no problem as I noted. I also have wireless at this client via an HP Wireless Access Point 420 that I installed.

I went into Access Connections and did the following:
1. In Global Settings, I enabled (checked the box) to "Close all wireless connections when user logs off"

2. In Location Switching, I enabled (checked the box) for "Preferred WLAN" and selected my Home network. That is new, I think, in V4.42 or thereabouts. It also took my home profile out of the priority list in the same window.

2a. Still in Location Switching, I reordered the priorities to reflect my most used profiles at the top with wired at the very top.

2b. Still in Location Switching, I went into Saved Ports and deleted **dozens** of saved ports. I even think I saw a duplicate, but I cannot be sure. There were literally 3 years of saved ports.

I then elected to shut down and restart.

I restarted wired. No problems.

Now, here is the good news. Without shutting down, without logging off, I disconnected the wire and manually connected the to the client's wireless access point. The VPN works! That was NOT true this past Monday.

So while I still have more testing to do, and I do not consider that I am out of the woods yet, I have some of my old functionality back.

Most pleased!

Thank you again for the information you posted. It helped me, and it may help others.

... JDH

#6 Post by **jdhurst** » Thu Nov 22, 2007 12:09 pm

I think checking the box that says "Close all wireless connections when user logs off" was important. I can now use my Sony Ericsson card and get a VPN tunnel. That was not true even first thing this morning before I made the changes.

So it now appears to be Access Connections Settings (not an Access Connections bug). The settings were changed in 4.42 and I guess I just did not pay attention. The upgrade to 4.42 is roughly the time when I had the first problems and it was later that I started using client wireless, so that just exacerbated the issue in terms of the recent time frame.

At this point, I appear to be back together, although I will continue to test, evaluate and monitor my progress. ... JDH

Wiz · #7 Post by **Wiz** » Thu Nov 22, 2007 12:41 pm

Glad to hear you solved the problem and hopefully it's solved permanently.

Cheers
Wiz

#8 Post by **jdhurst** » Thu Nov 22, 2007 5:24 pm

I was *really* surprised when I got home today, and after a cold start on my home network, could *not* get a tunnel. So this is the obverse of where I was yesterday: yesterday works at home, not elsewhere; today works elsewher, not a home.

So I removed the preferrential WLAN setting, and set it as a network to connect to alongside all the other profiles. After a restart all was well.

I will know next week how all this works, but generally I am making progress, and obviously Access Connections settings play into the VPN software in subtle ways. ... JDH

#9 Post by **jdhurst** » Thu Nov 22, 2007 7:16 pm

Well, I am still working on this and had another surprise.

Although I have made progress, I do not have perfection. I need to be able to start my machine, use any connectivity method I have, and tunnel into clients to support them.

So I uninstalled Access Connections and the profiles (after I backed up a good copy).

After a re-start, I was blown away by the fact that my wireless connection started up without any AC profile. And the Windows wireless application is disabled. This is essentially impossible because the wireless is heavily secured.

This means (from my original post), that there is a subtle OS problem that is in the way.

After searching through the registry for anything with my SSID in it, I found two keys in the Control Set area that were configuration keys with configuration subkeys. I looked carefully, crossed my fingers and deleted all such subkeys and configurations. They looked like Access Connections remains.

I have just re-started and my ThinkPad is running. This time, the wireless is not connected (which is how it should be).

There is still work to do, but while I am pleased my three-year old build continues to run crash-free and reliably, this one case of troubleshooting is particulary intricate.

It will take a couple of days with different clients but I will post the results next week. ... JDH

#10 Post by **jdhurst** » Sat Mar 01, 2008 8:23 pm

I still have not achieved perfection on this issue. I suspect (but I do not know) that multiple changes (version upgrades and additions) of things that affect TCP/IP have screwed something up somewhere.

I have, however, found a workaround. I created a batch file to stop, pause and then start the Safenet services. No matter what method of connection I use, if I run the batch file, I can connect my VPN. No more restarts.

This will work until I move to Vista sometime soon now.
... JDH

#11 Post by **bill bolton** » Sat Mar 01, 2008 9:01 pm

jdhurst wrote:until I move to Vista sometime soon now.

I think I felt the earth move!

Cheers,

Bill B.

Difficult network problem

Difficult network problem

Who is online