DirectAccess enabled - client thinks it is externally connected

When DirectAccess is enabled and Group Policy is applied to a client computer, computer cannot ping or connect to any internal resources.
DirectAccess setup is very simple, not sure what could cause it.
Any ideas?
Thank you. Eric.

The thing that is both good and bad about DirectAccess is that there are so many different ways that it can be setup. Don't take this the wrong way, but it sounds like you have used the Getting Started Wizard to setup DA, the very easy method, and in my
opinion this is the very worst way to setup DA.
But, back to topic - An NLS website is just a website that you put inside your network. It must be an HTTPS site, so it does need a valid SSL certificate, though because the only computers who are going to be contacting this website are your domain joined
DA clients, you can utilize an internal CA server to issue that cert and save yourself some cost. Simply stand up a website, doesn't matter the content, I usually just create a Default.htm page that says something like "This is the NLS website for DirectAccess",
and then in your DirectAccess wizards (the real wizards, not the Getting Started Wizard), you will have a page to configure the NLS server address.
When you use the Getting Started Wizard, it assumes that you want to take the shortcut method to getting DA up and running, and so it stands up the NLS website on the DirectAccess server using a self-signed cert. That is likely the boat you are in at the
moment. NLS is a critical piece of the DirectAccess puzzle, it should really be on its own web server on a standardized name, like "nls.company.local". In a true best practices effort, the NLS website should even be redundant.

Similar Messages

FTP-client behind RRAS - unable to connect to external FTP servers

FTP-client behind RRAS - unable to connect to external FTP servers
A small network (10-20PCs) without any segmentation - one LAN with one Gateway.
1. If the Gateway is some small hardware device, there are not any problems to make FTP-connections from LAN to Internet FTP-servers
2. If the Gateway is Win2003+RRAS+NAT or Win2003+ISA2005, there are not any problems to make FTP-connections from LAN to Internet FTP-servers
3. But if the gateway is Win2008+RAS+NAT or Win2012+RRAS+NAT, the computers in the LAN are not able to connect to Internet FTP-servers
I made a few tests:
1. On Win2012+RRAS+NAT
TurnOff Windows Firewall for All profiles (Domain, Private, Public) - the problem disappears, it it possible to connect to external Internet FTP-servers.
2. On Win2012+RRAS+NAT
TurnOff Windows Firewall only for Domain profile - the problem disappears, it it possible to connect to Internet FTP-servers.
3. On Win2012+RRAS+NAT
TurnOn Windows Firewall for All profiles (Domain, Private, Public)
But I excluded the Internal NIC in this list
Windows Firewall / Properties / Domain Profile / Protected network connections
and the problem disappears again
My question is:
What new Firewall rule I have to make and where to place it (to be able to make FTP-connection from LAN to Internet FTP-servers)?
I made some attempts to allow port21, but any success.

Thank you, but did you try this ?
Can you describe in detail "exclusion rule for FTP traffic" ?!
In my previous post, I want to say that if you use Win 2008/2012 RAS+NAT as a network gateway, than it is not possible to make FTP-connections to external FTP servers from the computers behind that gateway.
And the standard attempts to make "Allow"-rules for port 21 in the gateway firewall (Win 2008/2012), do not solve the problem.
No matter which FTP-client you can try to use.
To see this problem, just make few simple tests:
">telnet <ftp-server> 21"
with firewall on/off and inbound/outbound "Allow port 21 rule (All/Domain/Private/Public)"
In my country, the Government Tax Department uses FTP-protocol to collect monthly data from companies.
And it is too stupid scenario (to be a small company and to) upgrade from Win 2003 to a newer 2008/2012 and than to not be able to make all your jobs.
-------EDIT---------
The same problem (and its solution) is described here:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/0c68aed6-e22b-4cd4-86bd-f3c767e88349/advanced-firewall-blocking-through-ftp-traffic-rras
The magic command:
">netsh routing ip nat delete ftp"
solved the problem for me.
And here is the description of this command - "Disables the FTP proxy on the NAT server."
http://technet.microsoft.com/en-us/library/cc754535(v=ws.10).aspx#BKMK_106

OAG - Kerberos Client (External connections)

Hi,
I am facing an issues with Kerberos client (under external connection) configuration. please suggest it's a product problem or else it's my installation problem.
While configuring Kerberos Client, i imported Keytab, once finished. I am trying to edit configured Kerberos client where imported Keytab is missing. any idea why this happens? how to avoid this problem.
I am using OAG 11.1.2 version in Linux X86.
Regards,
Ganesh

Hi Stefan,
Keytab getting saved but in edit the saved keytab is not shown. seems to be display issues.
Another bug is with kerberos client filter. in Kerberos Client Filter -- > Kerberos token profile tab --> choose XPATH location and click finish it ask for actor/role. and if you select current actor/role and then clikc finish. again edit Kerberos client filter --> XPATH Location option is deselected but inturn it stores the value in selected xpath during execution. it seems to be a display bug and it should not ask to select "current actor/role" if you select XPATH as option. please create/update support case along with this.
Regards,
Ganesh

RV320 and Shrew Soft vpn client - cannot get it to connect

Hi,
I have been trying to configure Shrew vpn client 2.2.2 to connect to the RV320 but i cant even get phase1 to work. I would be very grateful is someone has managed this and could post the configuration (tunnel, groupvpn or easyvpn). I use:
RV320 with fw 1.1.1.19
Windows 8.1 Pro x64
Shrew Soft vpn-client 2.2.2

Okay here you go please see attached images.
Please note the following:
In this example NAT Traversal is enabled if you're RV320 isn't setup behind another router i think you can disable it.
Under "Local Group Setup" enter the IP Address and Subnet Mask of the LAN you're RV320 is part of.
The preshared key you enter under IPSec setup is entered in Shrew in the "Authentication" --> "Credentials" tab.
We use Extended Authetication (Xauth+PSK in Shrew Soft) you need to have a user + password setup under "User Management" tab on the RV320. Once you connect with Shrew Soft it will prompt for a username + password that is setup on the RV320 under the User Management Tab
We're using "Mode Config" the IPSEC cliënt will be assigned a address from the Virtual IP Address range.
In this example DNS nor WINS Server have been configured.

Can external connection attempts be logged?

Once upon a time I had a Linksys BEFSR router. A very nice feature was that each
connection attempt was logged and the router also broadcast the connection attempt
info ie the evil IP.
It was very interesting to see all of the attempts by hackers to get into my network...
Does the dual band AEBS offer any way ( via SNMP trap?) to capture connection
attempt information?
Jerry

Yes, just make sure SNMP is enabled in the Advanced pane. And use a SNMP client to monitor the > base station. Any SNMP client that knows the Apple base station MIB should do. If not, you can
download it from here.
I use a utility called AirportMonitor
Hi, thanks for the reply...
I do have SNMP enabled and when I do a walk of the AEBS I don't see any signs of a foreign
(external) connection attempts.
I do something like:
snmpwalk -c public -v 2c router
I just tried increasing the syslog level, to information but nothing new has appeared.
I looked the the screens for airport monitor on the app site but did not see connection
attempts....
Jerry

Doubts concerning External Connection Pool

A few questions:
1. How can I set up an external connection pool with toplink? or in another words, assuming that I have successfully configured a connection pool (and a datasource) on my weblogic app-server, how do I configure Toplink to use the same?
2. I am trying to achieve the above (refer point 1), by defining my custom connector (by extending TOPLink.Public.Sessions.DefaultConnector). The custom connector provides connections using the dataSource.getConnection(). Now, the question is
- Where will the pooling happen in this case? i.e. Will Toplink use its own connection pool (populate its own connection pool with container managed data source), and issue connections (container managed) from there or will it make use of the container managed pooling (and ask for connections from the container managed pool, as and when required)? The subtle difference being, weblogic will not be able to validate a connection before issue in the former case.
3. This question is similar to point 2, but talks in terms of a practical example. Assuming that if I am using the custom connector successfully in my code, then if I pull out the network cord and reconnect again, I expect the container to provide me with a valid connection (as weblogic can be configured to perform a validity check on a connection before issuing). I am getting a 'connection reset by peer' error in my application (indicating that either the container fails to provide a valid connection, or toplink does not use the container managed pool effectively). I guess, Toplink still uses its own pool but this time it is pooling container managed dataSources. Since the connections are issued from Toplink and not container, here is no validation/reconnection happening for the connection, before issue. Please comment if I am thinking in the right direction or not. If not, how you can explain the above failure?
4. My aim is to utilise the container's connection pool, and Toplink's ability to perform the rest of the things (including transactions). Is that possible?

Vikas,
TopLink can easily be configured to use the external connection pool of an server. This can be accomplished with API but more commonly using the sessions.xml configuration file for the SessionManager. In the product we ship examples for WLS that make use of data sources configured in the server. The portion of the sessions.XML file in question is:
          <login>
               <user-name>weblogic</user-name>
               <password>weblogic</password>
               <datasource>java:comp/env/jdbc/ejbJTSDataSource</datasource>
               <non-jts-datasource>java:comp/env/jdbc/ejbNonJTSDataSource</non-jts-datasource>
               <uses-external-transaction-controller>true</uses-external-transaction-controller>
               <uses-external-connection-pool>true</uses-external-connection-pool>
          </login>
          <external-transaction-controller-class>oracle.toplink.jts.wls.WebLogicJTSExternalTransactionController</external-transaction-controller-class>
This sets TopLink up with both data source access to the JTA and non-JTA connection pools. The full example also includes a domain where the data source is configured.
When TopLink is using the connection pool of the server (external connection pooling) it will not pool its own connections. TopLink will request a connection from the pool each time one is required and release it back when done. This leaves the server responsible for the number of connections available and also for supporting database re-connection.
Doug

WiFi clients suddenly can no longer connect to WRT320N router

I have a WRT320N router that I have been using for about 3 months now. I have a mixture of B, G & N clients using Win 2000, Win XP, Win 7, Mac OS X and Linux OSs. This is my home network. Everything worked fine until yesterday when, suddenly, none of my wireless clients could connect to the router. Wired clients were fine. I tried rebooting machines, resetting the router etc... without success. I called Linksys tech support and had the tech troubleshoot it. He got it working again by changing the Wireless Channel Width setting from "Auto (20Mhz or 40Mhz)" to "20Mhz only". He also changed the channel setting from "Auto" to "9". This works fine except for my N client where before I was connecting to the router at 240-300Mbps, I am now connecting at 78-117Mbps, less then 1/2 the speed I was connecting at previously. I called tech support again today and discussed it with a diffrerent tech. He told me that if my N client was getting over 100Mbps that I was within the specs of the router and that no Linksys router could connect faster than 200Mbps. Huh?
My N adapter is a Netgear USB WN111. The Linksys tech says that maybe that adapter can "suck" (his technical term) more bandwidth from the router than the router should be capable of and suggested I call Netgear to verify that.
My point is that everything worked fine for the past 3 months at 240+Mbps and now suddenly it doesn't work. The tech says there must be some sort of interference which seems like a possibility but I live out in the country with no close neighbors and I haven't brought in anything new recently that would explain the sudden problem.
I think the router developed a hardware problem which is causing it to not perform as well as it did. Anybody got ant other ideas?

I would suggest you to reflash/upgrade the router's firmware,reset the router after that and reconfigure it from the scratch..You can download the firmware from www.linksysbycisco.com/downloads.On the linksys setup page,click on the Administration tab to upgrade the firmware.

External Connection Class

Hi,
Paul Buchkowski mentioned an External Connection Class in framework. Does
anyone know whether this class has been documented somewhere ?
Thanks,
Paolo
Paolo Sidoli
DS Data Systems
Parma, Italy
Tel. ++39 521 2781
Fax. ++39 521 272818
[email protected]

My understanding is that a virtual pipe is opened up between the two
hosts(client and server [server usually being Forte]), and that will
ensure separation of data that may be inbound to the server from
multiple hosts. I am not sure what happens if the one client makes
multiple connections to the host, perhaps a unique handle is created for
each connection and this will keep the data streams seperate.
Michael Strauss
Mazda Australia
-----Original Message-----
From: [email protected] [SMTP:[email protected]]
Sent: Tuesday, 21 April 1998 0:32
To: [email protected]
Subject: External Connection class Question
I have read where Forte suggests that for inbound external
connections, you
create a single listener task, and for each connection request it
returns a
new ExternalConnection to process. My question is fairly simple :
does
this mean that in Forte's infinite wisdom it can distinguish between
two
different read/write sequences happening at the same time and needing
processing differently? In essence, are we assured that two different
streams of data, writing to what they see as the same port, will be
going
to the correct processing thread? If so...Cool.
William Brian Hare
Sr. Software Developer
EXE Technologies
work phone : (972)419-0459
home phone : (972)625-2780
[email protected]

Problem to call a procedure while using External connection pooling in TopL

HI all,
I have implemented external connection pooling in TopLink with JBoss 4.0.3SP1 and it is working fine. But after the connection pooling I am getting error while executing stored procedure with TopLink on Sybase. This is the error I am getting......
Stored procedure 'P_InsReleaseToManufact' may be run only in unchained transaction mode. The 'SET CHAINED OFF' command will cause the current session to use unchained transaction mode.
I got one solution to this problem as to set a tag in sybase-ds.xml file(which is used in JBoss to enable connection pooling) ..............
<connection-property name="SQLINITSTRING">set chained off</connection-property>
but still it is not working.
Can some one please tell me about the solution.

Try
session.getLogin().handleTransactionsManuallyForSybaseJConnect();

RE: (forte-users) Forte External Connection - PhysicalPort

Hi Ronald,
I think that ExternalConnection class is only aplicable for communication
using TCP, DECnet or Unix Domain Sockets, and is not applicable to work with
COM ports.
I think that to use COM port you must employ C with the Forté WRAPPER.
Daniel
-----Mensaje original-----
De: Ronald Celis <[email protected]>
Para: Daniel <[email protected]>; Ming Yan, Lam <[email protected]>
CC: Jose Ignacio <[email protected]>; Manuel_Fernández <[email protected]>;
Federico_Muñoz <[email protected]>; Lista_Forté <[email protected]>
Fecha: lunes 20 de diciembre de 1999 16:33
Asunto: RE: (forte-users) Forte External Connection - Physical Port
Did you try to use the ExternalConnection Class??????????????
it's documented in the "Integrating with External Systems" Forte Manualpage 228 )
>
Hope this help
--- Daniel <[email protected]> wrote:
Hello Lam,
I had some experience about this problem and first answer is that you
MUST
use the wrapper. You must realize that if you could develope Forté based
RS-232 functions they would't be portable to any other machines that have
not the same architecture than the one you use to develope.That's not the
philosophy of portability of Forté.
I suggest to create a few single task C programs,
1) Open serial port.
2) Close serial port.
3) Write to serial port.
4) Read from serial port.
5) Check if there is something in serial port.
and "put them into a library" to make them usable by TOOL via a portable
Forté class.
Best regards,
Daniel.
Daniel GonzáLucas
EAM Sistemas Informáticos S.L.
tel. + 34 983 35 29 22
fax.+ 34 983 35 21 15
e-mail:[email protected]
-----Mensaje original-----
De: Ming Yan, Lam <[email protected]>
Para: Forte Users Group <[email protected]>
Fecha: jueves 16 de diciembre de 1999 8:55
Asunto: (forte-users) Forte External Connection - Physical Port
Hi,
If anyone out there have tried to use Forte to communicate (transmit
data) to an external connection, which is a physical port such as Com 1,
Com 2, Xyplex. I would like to know how does Forte handle this type of
connection or does it have to use C program for this?
Thanks in advance
Ming Yan
BASS Consulting Sdn. Bhd.
For the archives, go to: http://lists.sageit.com/forte-users and use
the login: forte and the password: archive. To unsubscribe, send in a
new
email the word: 'Unsubscribe' to: [email protected]
For the archives, go to: http://lists.sageit.com/forte-users and use
the login: forte and the password: archive. To unsubscribe, send in a new
email the word: 'Unsubscribe' to: [email protected]
=====
Ronald Celis
[email protected]
Forte Consultant
International Business Corporation
http://www.ibcweb.com
Do You Yahoo!?
Thousands of Stores. Millions of Products. All in one place.
Yahoo! Shopping: http://shopping.yahoo.com
For the archives, go to: http://lists.sageit.com/forte-users and use
the login: forte and the password: archive. To unsubscribe, send in a new
email the word: 'Unsubscribe' to: [email protected]

Did you try to use the ExternalConnection Class??????????????
it's documented in the "Integrating with External Systems" Forte Manual ( page 228 )
Hope this help
--- Daniel <[email protected]> wrote:
Hello Lam,
I had some experience about this problem and first answer is that you MUST
use the wrapper. You must realize that if you could develope Forté based
RS-232 functions they would't be portable to any other machines that have
not the same architecture than the one you use to develope.That's not the
philosophy of portability of Forté.
I suggest to create a few single task C programs,
1) Open serial port.
2) Close serial port.
3) Write to serial port.
4) Read from serial port.
5) Check if there is something in serial port.
and "put them into a library" to make them usable by TOOL via a portable
Forté class.
Best regards,
Daniel.
Daniel González de Lucas
EAM Sistemas Informáticos S.L.
tel. + 34 983 35 29 22
fax.+ 34 983 35 21 15
e-mail:[email protected]
-----Mensaje original-----
De: Ming Yan, Lam <[email protected]>
Para: Forte Users Group <[email protected]>
Fecha: jueves 16 de diciembre de 1999 8:55
Asunto: (forte-users) Forte External Connection - Physical Port
Hi,
If anyone out there have tried to use Forte to communicate (transmit
data) to an external connection, which is a physical port such as Com 1,
Com 2, Xyplex. I would like to know how does Forte handle this type of
connection or does it have to use C program for this?
Thanks in advance
Ming Yan
BASS Consulting Sdn. Bhd.
For the archives, go to: http://lists.sageit.com/forte-users and use
the login: forte and the password: archive. To unsubscribe, send in a new
email the word: 'Unsubscribe' to: [email protected]
For the archives, go to: http://lists.sageit.com/forte-users and use
the login: forte and the password: archive. To unsubscribe, send in a new
email the word: 'Unsubscribe' to: [email protected]
=====
Ronald Celis
[email protected]
Forte Consultant
International Business Corporation
http://www.ibcweb.com
Do You Yahoo!?
Thousands of Stores. Millions of Products. All in one place.
Yahoo! Shopping: http://shopping.yahoo.com

HT4260 Can i control which wireless clients i like to betrol which wireless clients i like to be connected on my airport base station?

Can i control which wireless clients i like to betrol which wireless clients i like to be connected on my airport base station?

Yes. Use AirPort Utility's MAC Address Access Control.
AirPort Utility > select your base station > Edit button > Network tab > "Enable Access Control" > click the Timed Access Control button.
You need to specify the clients you want to control by their MAC address, which is usually printed on the device's exterior case.

How to map the client PID:TID to db connection on the database?

Hi,
We have a multithreaded application and each thread connects to database using the same userID.
How do I identify on the dtabase side which DB connection belongs to which client thread?
I need to uniquely map the client processID:Thread ID to a DB connection.
On Unix I do not see the processID:Thread ID pair in the v$session table process column.
It is only showing the PID.
Any other ways to map the client PID:TID to db connection?
Thanks

sb92075 wrote:
Unix does not have threads.It does. See POSIX Threads. But it is seldom used (in my experience) - likely legacy reasons as the fork() model works well and the Linux/Unix kernel does not suffer from the same problems that the Win32/64 kernel does when faced with a large number of executable process images to manage.
May be mistaken, but I think Ingres added PThreads support to their database some years ago. My guess it won't be that difficult for Oracle to follow suit as they have a process/thread abstraction layer (using the fork() model on Linux/Unix and CreateThread() on Windows).
Question though is what will using PThreads buy ito resource footprint and robustness and management on a Linux/Unix kernel? From personal experience, writing code on Unix is safer as a forked child process cannot "damage" the parent (separate data segment). On Win32 a poorly behaved client thread can cause a failure in the parent process and crash it. But then Win32 API also supports fibres and one can design and code sophisticated multi-thread processes.

Problem: how to reset clients so that they re-connect to a OD Server

I have a problem with our Open Directory clients (running 10.5.x and 10.6.x)
Due to a hardware failure I needed to re-install our MacOSX Server system. I decided to start over with a fresh installation of OSX 10.6 Server and completely new settings, since I wanted to migrate our server from 10.5 to 10.6 anyway.
The 10.6 server installation seems to be fine, but I am running into one problem:
Our client computers were set up to connect to the 10.5 server via the "Directory Services" app. The clients were set to have some managed preferences, like using the Software Update server on the OSX server system; this worked fine with our 10.5 server, and when I initially set up the client systems to access the 10.5 OD server via Directory Services, an auto-configuration started on the client systems, setting up e.g. iChat and Software update to communicate with the server.
Now in my new installation, this does not happen anymore on our existing systems. To me it looks like the clients still think that they are configured correctly by the server (the IP address and the name of the server did not change). But even when removing the server from Directory Services app on the clients and setting it up again the screen asking if the system should be set up to use the services does not come up again.
Is there a way to reset the client computers into a state where they think they were never connected to a Open Directory server, so that they re-launch the auto configuration when connecting to our server system? Or is there something I am missing on our server that needs to be configured to set up clients to e.g. use the Software Update server? The Software Update server is running on the server, and the users are set up to use the SU server, but the info seems not to move over to the client systems…
Thanks a lot,
Floh

Maybe you can try this.
Here is a workaround:
1) In the Utilities folder, open Keychain Access. In the System keychain, find and delete the three com.apple.kerberos.kdc entries - a certificate and a public/private key pair generated from that certificate.
2) In Terminal, run 'sudo rm -fr /var/db/krb5kdc' - this will destroy the local KDC database.
3) In Terminal, run 'sudo /usr/libexec/configureLocalKDC' - this will regenerate the local KDC database, including a new certificate and SHA1 hash.
4) Bind the machine to OD.
I use this when i install an new image on an new Mac and have to bind it to our OD server (in our new image this not necessary anymore)

Exception in the main client program: java.rmi.ConnectException: Connection

Hi
I have written a program in Java using RMI and it runs perfectly fine on my pc(localhost). But when I run it on the LAN in my office, the client program stucks and I get an exception
***Exception in the main client program: java.rmi.ConnectException: Connection refused to host***
***java.net.ConnectException: Connection timed out: connect***
Do we need to make some settings in the RMI server...or some firewall issue is there...By default port is 1099 as used by RMI registry server
Please help me TIA
vnx_in

Hi, i am having the same java.rmi.ConnectException, but the problem is that i can't even run it on localhost. I simply can't start my server, and i am getting a problem on Naming.rebind, however i think it could be because i am using an static ip to connect to internet in the LAN of my town. Does it matter in this case. I would be so thankful, because i am not able to solve it after many efforts.
Thanks in Advance :)

External Connections StartListening method

In the Forte ONLINE help, the StartListening method states, "The
StartListening method performs initial set up for the specified port number,
and then waits for connections".
What suggestions does anyone have for working with connection-less messages
(i.e. UDP, datagrams) that are configured to be sent to a specific port
number for an IP address.
Thanks
-Jay
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Folks,
I solved the problem. It looks like a socket implementation difference
between 16 bit and 32 bit versions of Microsoft OS.
I was expecting a 1Meg Binary Data and so I was trying to read 1 Meg at
one shot. It seems like, since the buffer some where along the line (
may be at the server) can handle only a max of 14K of data, the reader
on the PC closed the connection when it didn't recieve all the 1Meg of
data at 1 shot.
When I changed the length I was expecting to 14K or less, it started
working.
Enjoy!!!
Venkat J Kodumudi
Price Waterhouse LLP
Internet: [email protected]
Internet2: [email protected]
-----Original Message-----
From: Venkat Kodumudi
Sent: Tuesday, February 03, 1998 8:02 AM
To: '[email protected]'
Subject: External Connections
Hi Forte users,
I am trying to use the External Connections class on a Win 95 and a
Win 3.11 environment. I am running Forte 2.0.F.4 client and 2.0.H.11
server. I am trying to connect from the client to a C program through
a Socket connection.
Ironically, on a Win 95 and 3.11 machine, the client connection seems
to close itself if there is nothing to read on the pipe. Has any one
noticed this?
Do we have to keep doing conn.open every time we try to use the
connection? What else can we do?
Thanks in Advance.
Venkat J Kodumudi
Price Waterhouse LLP
Internet: [email protected]
Internet2: [email protected]

DirectAccess enabled - client thinks it is externally connected

Similar Messages

Maybe you are looking for