Virtual Private Network Frequently Asked Questions

!±8± Virtual Private Network Frequently Asked Questions

1. Why do I get disconnected after 4 hours of use?

(a) You will get disconnected because of the limited number of ports and the fact that 90% of all users do not need to be connected more than 4 hours, all units have been set to a 4-hour time limit.

(b) If you require more time, you should disconnect gracefully before the time limit and reconnect so that you do not lose your work.

2. Why not use an 800 number all the time?

(a) Using an 800 number costs the corporation 5 cents a minute versus calling a local number when available that costs 5 to 7 cents one time charge to initiate the call with no per minute charges.

3. Do I have to be connected when Email comes in or to prepare Email?

(a) No, Email is stored in your server until you need to access it.

(b) The proper way to handle Email when working remotely is to make a connection periodically during the day pulling your mail down and then disconnecting.

(d) When you make your next connection to process incoming mail all prepared mail can be sent at this time.

4. What about reconnection issues?

(a) If you are running Windows 95, NT, 2000 or XP making re-connections should be as simple as clicking on the icon to reconnect.

5. How do I speed up my dial-in connection?

(a) Only install the necessary protocols.

(b) Usually IP is the only one needed unless you are accessing Novell Servers.

(d) A good practice, if only accessing Novell Servers occasionally, is to create two configurations, one with IP access only and one with both IP and IPX. Use the second configuration only when required.

6. Why can't I see all of the NT units in the Network Neighborhood?

(a) When you dial into the Network Access Gateway you are normally on a segment without a master browser, which is how units are displayed in the Network Neighborhood.

(b) This does not mean that you cannot access the unit however.

(c) If the unit you are trying to access is a member of the corporate WINS structure and you have configured your remote unit per the configuration instructions, WINS will automatically resolve the units IP address when you Map a drive in Explorer.

(d) The key to this is to know the computer name and share name that you require before starting the process.

7. Why does my Dial-Up Networking fail to work after loading AOL?

(a) AOL sometimes replaces the TCP/IP Winsock driver, causing your PC perform erratically or not at all.

Fix:

1. Delete all references to TCP/IP from the network neighborhood properties.

2. Reboot the system.

3. Add the Microsoft TCP/IP protocol back in.

This will automatically add TCP/IP to all adapters and you should be functional again.

8. Can I use Network Address Translation (NAT) to attach my home computers via VPN?

(a) In general NAT is not supported by the IPSEC VPN client.

(b) Routers such as the Linksys BEFSR11 and BEFSR41 do support VPN with a software workaround.

9. Why can't I get higher speed on my 56K v.90 modem into some NAG sites?

(a) A 56k v.90 modem is asymmetric by design, so download speed can be as much as 56k but upload speed will be only up to 33.6bps.

(b) For 56k to work, there must be only one analogue to digital (A/D) conversion in your local phone loop.

(c) Thus when modems at both ends are analogue, 56k speeds will never be achieved as most PSTN exchanges run digital routing.

(d) Some NAG sites use analogue phone lines with Cisco and standard 56k modems, while most PCs dialing up use a similar modem.

(e) Between both the modems, it limits the download speed to about 33.6kbps maximum.

(f) At the same time, many users might experience lower connection speeds due to other reasons, such as more poor line quality.

(g) These factors will also contribute to the quality and speed of the line.

10. When I load the Extranet Client on my PC and Winpoet is installed on my machine, it crashes or does not work properly.

(a) There are known issues running Winpoet software on the PC with the Nortel Extranet (VPN) Client.

(b) To repair your system, boot in safe mode and uninstall the Winpoet Software.

(d) It has a firmware PPPOE connector, which eliminates Winpoet from the PC and provides the added benefit a NAT firewall for the user with the ability to hook up to three other PCs.

(e) A second option is to find a PPPOE Client that does not interfere with VPN Clients.

(f) If you have WINPOET, please check with your local ISP to confirm it will work with the Nortel VPN client.

(g) If not, or if they are not sure, please do not install the new client, or ask your ISP to find an alternative PPPOE Client that does not interfere with the Nortel VPN Client.

(h) If you decide to use Winpoet with the new Nortel VPN client, Nortel strongly recommends using Winpoet 6.0 or higher.

(i) Earlier versions of the Winpoet software are known to cause conflicts with the Nortel VPN client.

(j) If you have Winpoet on your PC and experience problems (i.e. with an earlier version prior to 6.0) the following 8 steps will safely uninstall the Winpoet Software from your pc and repair your system to boot properly.

1. Login to Safe Mode.

2. Login under Admin profile.

3. Go to Add/Remove programs and uninstall Extranet Client. Do NOT reboot at the prompt.

4. Check to see if Winpoet adapter is installed. If so remove it.

5. Go to device manager/network adapters. Right click Winpoet or Winport adapter. Uninstall.

6. Go to Admin Tools./Services and disable Winpoet-over-ethernet.

7. Reboot PC.

8. Reinstall the extranet VPN client.

An alternative solution is to install the Linksys BEFSR41 hardware router. It has a firmware PPPOE connector, which eliminates the need of Winpoet from the PC.

11. My ISP remains connected and I have no known problem with my Internet Service Provider. The problem is intermittent.

(a) Check the version of your Contivity Extranet Access client.

(b) You should be using the current release of the client, 4.65 or higher. You can view the most current version by clicking on Current Version.

12. I am having problems with my VPN connection.

(a) Try isolating the problem by process of elimination.

1. Is your Internet connection to the public Internet working properly?

2. Do you have the most current version of the Contivity Extranet Access client?

3. Have you recently installed any new software or hardware?

4. Were any hardware or software changes made since your VPN connection was last working?

5. Have you scanned your computer for Viruses?

(b) If you are still experiencing problems, try uninstalling or removing the following items.

1. Disable your firewall, anti-virus software and any other maintenance or Security programs installed.

Try to connect.

2. Remove your router from your configuration.

Connect your PC directly to your Internet connection.

This is accomplished by connecting the cable coming out of your DSL/Cable modem, directly into your network card or USB connector.

If successful, the problem might be your router's setup or firmware.

Refer to your Manufacturer's website or documentation for troubleshooting your router or contact the Vendor directly for support. Cheat Note: Caution: use this idea at your own risk - usually there is a little hole in the back of the Router and you can stick a round toothpick into it and push the button inside and it will reset the Router to the Manufacturers settings, do this while the Router is unplugged from any electrical source. This should not upset any of your configurations but do not break the toothpick off inside. It may be best to use a bobby-pin.

You must upgrade your firmware.

Please beware even though you might have just recently purchased your router, it might have been packaged with an older version of the software.

3. Enable your router, firewall/internet security programs one at a time.

Cable/DSL users: If you have a dial-up modem installed on your PC, try to test using a dialup connection.

Either use dialup to an ISP and then use VPN or dialup directly into your Network.

13. The upgrade to release 4.6X of the VPN client failed.

(a) Refer to the list below and see if any of this applies:

Windows XP Disable the XP firewall.

VPN Software Most VPN clients cannot co-exist on the same machine.

Windows ME Remove and Add TCP/IP protocol.

Brother Multifunction Printer You may not be running the current Brother software for your printer.

Windows 2000. Users should download drivers/software from the Brother website.

14. How can I remove and re-install TCP/IP Protocol?

Below are instructions on how to remove and add TCP/IP for Windows 2000. (Refer to your operating system's help screens, web support and/or documentation for instructions, if you are not using Windows 2000.)

(a) Please be sure, no matter which operating system you use, that you elect to restart when finished (as prompted) or restart between each process.

(b) For Windows 2000 you must be logged on as an administrator or a member of the Administrators group in order to complete this procedure.

1. Open Network and Dial-up Connections, click Start, point to Settings, and then click Network and Dial-up Connections.

2. Right-click any network connection, and then click Properties.

3. On the General tab (for a local area connection) or the Networking tab (all other connections), click Internet Protocol (TCP/IP), and then click Uninstall.

4. In the Uninstall Internet Protocol (TCP/IP) dialog box, click Yes.

(d) Install TCP/IP

1. Open Network and Dial-up Connections. (Click Start, point to Settings, and then click Network and Dial-up Connections.)

2. Right-click the network connection for which you want to install and enable TCP/IP, and then click Properties.

3. On the General tab (for a local area connection) or the Networking tab (all other connections), if Internet Protocol (TCP/IP) is not in the list of installed components, then do the following:

A. Click Install.

B. Click Protocol and then click Add.

C. In the Select Network Protocol dialog box, click Internet Protocol (TCP/IP), and then click OK.

D. Verify that the Internet Protocol (TCP/IP) check box is selected, and then click OK.

TCP/IP is installed as the default network protocol if network adapter hardware was detected during Windows 2000 Setup. You only need to follow these instructions if the TCP/IP default selection was overridden during Setup.

15. I am using Windows XP Home or Professional and am unable to get to certain websites or resource servers when connected using VPN.

(a) There are some known issues when using the Contivity Nortel client 4.60 on a PC running Windows XP.

(b) The older version of the Nortel client (version 3.70) will fix the problem; however, the ultimate goal is to upgrade to the current version.

16. My ISP provider requires the installation of WinPoET. Can I use it with the latest release of the client?

(a) If you are using WinPoET, it must be version 6.0 or higher of WinPoET.

(b) Check with your ISP and request v6.0 or higher of WinPoET.

17. After installing v8.0 of AOL, I've experienced problems with my connections to my Network.

(a) Users may experience problems with Windows Outlook email.

(b) You must create two separate profiles; one profile as a Remote Connection (POP3) account for your AOL Internet email and another profile for a local LAN connection to your corporate Network email.

Here's how to do it:

1. Go to Start, Control Panel, Mail, Services, Show Profiles and Add the second profile.

2. Make sure the button "Prompt for a profile to be used" under General tab of MS Outlook properties is selected.

3. Disable the ATWPKT2 driver. (The files ATKPKT2.SYS and ATKPKT2.VXD are located in the AOL directory under PROGRAM_FILESCOMMON_FILES.)

18. I'm Unable to obtain an IP address while "Hotelling".

(a) When working remotely from a Hotel (Hotelling), you must launch your Internet explorer first and try to obtain an IP address.

(b) If you just launch VPN, you won't have obtained an IP address, and VPN may fail.

19. Why do I get No Domain Available when dialing my ISP?

(a) On your Internet Service Providers (ISP) dial connection, right click the mouse and select the properties button.

(b) Click on the Server Type tab and make sure that the "Log On To Network" box is unchecked, otherwise you will hang trying to log into the Network when trying to connect.

20. Why do I run so slowly when using my VPN connection?

(a) On your Internet Service Providers (ISP) dial connection.

(b) Right click the mouse & select the properties button.

(c) Click on the Server Type tab and make sure that the NetBEUI and IPX/SPX boxes are unchecked; otherwise you will see delays while the system tries the unsupported protocols.

(d) VPN only supports the TCP/IP protocol so checking these boxes will only slow you down.

21. Why can't I access my NT resources when using VPN?

(a)Windows 95 users should make sure that they have the "Log On To the Network Box" checked in the Extranet Client per the instructions for the Extranet Client Install to use NT resources such as Exchange and file shares.

22. Why do I seem to be running slowly through my VPN connection?

(a)Try turning off the Software Compression option on your Internet Service Providers (ISP) dial connection as the VPN client has it's own compression. Right click the mouse & select the properties button.

(b)Click on the Server Type tab and uncheck the "Software Compression" setting.

23. Why can't I get to my Novell Servers when using VPN?

(a)VPN only supports the TCP/IP Protocol & most Novell Servers require that you use IPX/SPX to access them.

(b)Work with your Novell Administrators to change to NT or use a Version of Novell that supports IP traffic.

24. Cannot VPN Web Servers on the Internet after Establishing a Contivity VPN Client Connection.

(a) Cause:

1. This is normal and occurs as a result of having all network traffic passed through the corporate network.

2. Typically, firewalls and other security measures on the corporate network will limit your VPN to the Internet.

(b) Action:

1. The Contivity VPN Switch administrator can set up a default route on the Switch to forward traffic to the Internet.

2. If this default route is not configured, you will need to disconnect the Contivity connection to web browse the Internet through your ISP connection.

25. Cannot VPN Network Shares After establishing a Contivity VPN Connection.

(a) Causes:

1. WINS Server may not be configured for IPsec connections on the Contivity VPN Switch.

2. Your system may be setup for a different domain than the one on the remote network.

(b) Actions:

For the first problem, validate that the Contivity VPN Client has been configured with a WINS Server.

1. Follow the steps outlined above under "Problems with Name Resolution using DNS Services" to run IPCONFIG at a Command Prompt on NT 4.0 and to run WINIPCFG on Windows 95.

2. Verify that a Primary WINS Server is listed under the section for the adapter named IPSecShm on NT 4.0 and on Windows 95.

3. Verify that a Primary WINS Server is listed in WINIPCFG for the Contivity VPN Client adapter.

4. If there is no Primary WINS Server listed, notify the Network Administrator that the Contivity VPN Switch may not be properly configured.

(c) For the second problem, skip the initial domain logon when Windows 95 starts and select "Log on to the Remote Domain" under the Options menu of the Contivity VPN Client dialog box.

1. You will then be prompted to log onto the domain of the remote network after the Contivity VPN connection is made.

2. This is the recommended method for users with Docking Station configurations.

(d) Alternatively on both NT 4.0 and Windows 95, change your workstation to be a member of a Workgroup instead of a Domain.

1. From the Start Menu select Settings then Control Panel.

2. In the Control Panel, double-click on the Icon labeled "Network". The Network Control Panel applet will open. Select the Identification tab.

3. On Windows 95, the entries on the Identification page can be modified directly, while on NT 4.0 it is necessary to click the Change button to change the entries.

4. Change to use a Workgroup and verify that the "Computer name" does not match one that may be on the remote network.

5. The name for the Workgroup is not important, so enter anything. Click OK to save the changes and reboot the machine.

When accessing a resource on the remote Domain, if you are prompted for a username and password, you will need to have a Domain name precede your user ID.

For example, if your user ID is JoeS and you are accessing a machine on the remote Domain named CORP, you would enter your username as CORPJoeS.

26. When trying to load the VPN Client on a Dual Processor unit you get an error message.

(a) The Nortel VPN Client currently does not support Dual Processor units.

27. When I set up my home network, I installed Microsoft Internet Connection Sharing (ICS) so that all of my systems can reach the Internet. Now my VPN client no longer works.

(a) The reason for this is that the Microsoft ICS uses Network Address Translation (NAT) to get the Internet connection, and NAT, which may not support IPSec connections.

(b) The only way around this currently, is to make the unit running the ICS be the one you run your VPN connection from. Any downstream unit will not be functional for VPN.

28. Can Cisco or other IPSEC VPN Client software exist on the same box with Nortel Extranet Access Client? Is this supported?

(a) They cannot coexist, and it is not supported.

(b) The two virtual adapters installed with each client will conflict with each other.

(c) There is a utility on the new Cisco clients that will uninstall a Nortel client if found by the Cisco VPN Unity Client install program.

(d) All other VPN Clients require manual removal of the Nortel client or any other client.

29. I am having problems with my VPN connection not already discussed.

(a) Try isolating the problem by process of elimination.

1. Is your Internet connection to the public Internet working properly?

2. Do you have the most current version of the Contivity Extranet Access client?

3. Have you recently installed any new software or hardware?

4. Were any hardware or software changes made since your VPN connection was last working?

5. Have you scanned your computer for viruses?

(b) If you are still experiencing problems, try uninstalling/removing the following items.

1. Disable your firewall, anti-virus software and any other maintenance or Security programs installed. Try to connect.

2. Remove your router (Linksys, D-link, Cisco, Netgear, etc.) from your configuration.

Connect your PC directly to your Internet connection.

This is accomplished by connecting the cable coming out of your DSL/Cable modem, directly into your network card or USB connector.

If successful, the problem might be your router's setup or firmware.

Refer to your manufacturer's website or documentation for troubleshooting your router or contact the Vendor directly for support.

You must upgrade your firmware.

Please beware even though you might have just recently purchased your router, it might have been packaged with an older version of the software.

3. Enable your router, firewall/internet security programs one at a time.

Cable/DSL users: If you have a dial-up modem installed on your PC, try to test using a dialup connection. Either use dialup to an ISP and then use VPN.

30. VPN Problems with Name Resolution using DNS services.

Cause 1:

A DNS server may not be configured for IPsec connections on the Contivity VPN Switch.

Action 1:

Validate that the Contivity VPN client has been configured with a DNS entry.

For NT 4.0, open a Command Prompt and enter IPCONFIG /ALL.

Verify that a DNS server entry is listed.

For Windows 95, from the Start menu on the taskbar, select Run and enter WINIPCFG.

Select "Contivity VPN Adapter" from the pull down list of Adapters, then click More Info.

Record the information displayed under DNS Server entry and verify it with the network administrator.

Cause 2:

The hostname being resolved has both a public and a private IP address. This is commonly referred to as a Split-Horizon DNS.

Action 2:

Open a Command Prompt and ping the host you are trying to reach with a fully-qualified hostname (for example, [http://www.vpnclient.com]).

If you receive a response, verify that the IP address returned on the first line (for example, www.vpnclient.com [207.78.33.329] is an IP address from the remote corporate network.

If it is not, notify your network administrator that the internal hostname should be modified so that it is not the same as the external hostname.

Cause 3:

The retail release (a.k.a. "release 1") of Windows 95 contained a bug that prevented use of more than one DNS server. This problem was fixed in OS Release2.

Action 3:

If you are using a release of Windows earlier than Release 2 of Windows 95, then you need to upgrade.

31. I am having problems mapping drives using the latest VPN client.

(a) This is a known issue due to Microsoft that can occur when using cached credentials behind a NAT firewall.

(b) The problem will occur for some users, but not others.

(d) Some users may only experience this problem after upgrading to a new VPN client, but restoring the old client does not necessarily fix the problem.

(e)You may try uninstalling the VPN Client and then reinstalling.