Solving general problems | Nortel Networks NN46110-602 specification

92 Chapter 4 Troubleshooting

•How to Troubleshoot TCP/IP Connectivity with Windows NT

•Remote Access Service (RAS) Error Code List for Windows NT 4.0

•RAS Error 720 When Dialing Out

•Troubleshooting PPTP Connectivity Issues in Windows NT 4.0

•PPTP Registry Entries

•Connecting to Network Resources from Multihomed Computer

•How to Force 128-bit Data Encryption for RAS

•Login Validation Fails Using Domain Name Server

Solving general problems

This section contains general recommendations and explains some common problems that can occur with common Web browsers, the Nortel VPN Router Web Manager, and the VPN Router.

Web browser problems and the VPN Client Manager

If you have a problem browsing the Nortel VPN Client Manager, start by checking the following recommendations to ensure that you are using the correct Web browser version and settings. For additional troubleshooting, check the described Web browser problems and solutions, error messages, and tips described later in this section.

Nortel VPN Client Manager uses Java* and HTML features. For the management interface to function properly, verify that your Web browser meets the following minimum requirements:

•Platforms supported include Windows 95, Windows 98, Windows NT, or Macintosh*.

•Display setting of 256 colors or greater.

•Browser versions supported include Microsoft Internet Explorer, Version 4.0 or later and Netscape Communicator*,Version 4.0 or later. Not using a recent version of Internet Explorer causes the upper-left corners of the management windows to remain gray rather than displaying the navigational menu and the current menu selection, respectively.

NN46110-602

Image 92

Nortel Networks NN46110-602 manual Solving general problems, Web browser problems and the VPN Client Manager

Contents

Nortel VPN Router Troubleshooting Copyright 2007 Nortel Networks. All rights reserved TrademarksRestricted rights legend Statement of conditions Nortel VPN Router Troubleshooting Nortel Networks Inc. software license agreement General Contents Chapter Status and logging Chapter Troubleshooting Chapter Packet capture Appendix a MIB support Appendix B Using serial PPP Index Contents NN46110-602 Figures Figures NN46110-602 Tables Tables NN46110-602 Before you begin Text conventions Italic text Acronyms L2TP Related publications Hard-copy technical manuals How to get help Finding the latest updates on the Nortel Web site Getting help over the phone from a Nortel Solutions Center Getting help from the Nortel Web site Getting help through a Nortel distributor or reseller Features New in this release Snmp interface index enhancement Automatic backupsPcap enhancements Chapter VPN Router administration Administrator settings VPN Router administration Dynamic password Tools System configuration File management Simple Network Management Protocol Snmp VPN Router administration Click Enable for User IP Address Pool Admin Snmp Traps window To configure the amount Chapter Status and logging Sessions Reports Statistics SystemHealth check Accounting Accounting records Radius accounting Data collection task Timestamp Logs Event log Select Status Event Log Event logs Capture and display filters Configure Display Entity System log Security log Configuration log Chapter Administrative tasks Shutdown Using the recovery diskette RecoveryAccessing the diskette drive Recovery Diskette window Software/backup/v101/SN01001 Administrative tasks Automatic backups Using the GUI for automatic backup Transferring backup files through SftpTriggering a backup when a file or directory changes Select Admin Auto Backup Automatic Backup window appears. Figure Click Configure Specific Backup Specific Automatic Backup window To overwrite a file, click Overwrite files at destination Using the CLI for automatic backup Backing up changes to specific files or directories Stopping the backup of specific files and directoriesBacking up specific files and directories Using Sftp to transfer backup files Stopping the transfer of backup files using Sftp Upgrading the software Disabling new loginsSelect Admin Shutdown Click Disable new logins. Figure Select Admin File System Checking available disk space Creating a control tunnel to upgrade from a remote location Backing up system files Creating a recovery disketteSelect Admin Recovery and click Create Diskette Select Admin Upgrades Retrieving the new software FTP menu example Before completing the upgrade Internal Radius Accounting Interim Radius Accounting Record Applying the software After you upgrade the softwareSelect Admin Shutdown and deselect Disable new logins Administrative tasks Chapter Troubleshooting Troubleshooting tools Client-based tools System-based tools Other tools Solving connectivity problems Diagnosing client connectivity problems Common client connectivity problems Login not allowed at this time Authentication failedRemote host not responding Maximum number of sessions reached Extranet connection lost Other IPsec errorsNo proposal chosen Problems with name resolution using DNS services Network browsing problems Cannot browse the network with NetBEUI Troubleshooting Diagnosing WAN link problems Check the T1/V.35 interface Check the Hdlc framing Check the PPP layer Solving performance problems Performance tips for configuring Microsoft networkingEliminating modem errors Hardware encryption accelerator connectivity What should be configured on the Pptp or IPsec client? Why should Wins settings be different for extranet access? What Wins settings are recommended? What can you try on the Wins server when it is not working? Can I control which machine is the master browser? Why are subnet masks important? What should I do about subnets? Why cant I browse another client in a different tunnel? Troubleshooting Additional information Solving general problems Web browser problems and the VPN Client Manager Improving performance with Internet Explorer Long delays when Web browsingEnabling Web browser options Web browser error messages Clearing your Web browser cache when upgradingInternal error message Clearing cache New administrator login ignored Excess resource consumption using Internet ExplorerDocument not found message Internet Explorer 4.0 multiple help windows Reporting a problem with a Web browser System problemsPower failure Distorted background images Group and user profile settings not saved Select Servers Ldap Click Stop Server Solving routing problems Client address redistribution problems Solving firewall problems An error occurred while parsing the policyAn error occurred while communicating with the VPN Router Action Close the Stateful Firewall Manager Unable to communicate with the VPN Router Authorization failed. Please try againContents of the database may have changed Deselect Cache JARs in Memory System files were not loaded properlyAction Troubleshooting NN46110-602 Chapter Packet capture Pcap features Security features File format Tunnel captures Capture typesPhysical interface captures Global IP captures Triggers Filters and triggersCapture filters Saving captured data Memory considerations Performance considerations Enabling packet capture on a VPN Router Enter Privileged Exec mode Serial main menu appears Setting the Pcap file path Capturing packets to disk file Setting the maximum number of disk capture files Setting the size of the RAM bufferSetting the size of a disk capture file Creating a capture object Configuring and running packet capture objectsSaving captured data Configuring a capture object CES#capture ether0 Tunnel capture parameters Using the show capture command to display capture status Starting, stopping, and saving capture objects CES# show capture Exit Capture Configuration mode Sample packet capture configurationsInterface capture object using a filter and direction Interface capture object using triggers CES#show capture test-filter-in CES#capture test-trigger start Tunnel capture object using a remote IP address CES#show capture test-trigger Capture state Stopped by stop Locate the Microsoft Windows row and click local archive Installing Ethereal softwareViewing a packet capture output file on a PC Click ethereal-setup-n.nn.n.exe Saving, downloading, and viewing Pcap files Viewing a Pcap file with Sniffer Pro Global IP capture Deleting capture objects and disabling packet capture Click Tools Options Protocol Forcing CES# no capture test-trigger Packet capture NN46110-602 Snmp RFC support Novell IPX MIBNovell RIP-SAP MIB RFC 1850-OSPF Version 2 Management Information Base RFC 2667-IP Tunnel MIB RFC 1724-RIP Version 2 MIB ExtensionRFC 1213-Network Management of TCP/IP-Based Internets RFC 2787-VRRP MIB RFC 2737-Entity MIB RFC 1573-IanaIfType MIB RFC 2233-If MIBRFC 2571-Snmp-Framework MIB RFC2790-Host Resources MIB RFC2495-DS1 MIB RFC2863 Interface MIB 64 bit counters support VPN Router MIB Cestraps.mib-Nortel proprietary MIB TRAP-TYPE Variables Newoak.mib Hardware-related traps Appendix a MIB support Appendix a MIB support Appendix a MIB support Server-related traps Appendix a MIB support Login-related traps Software-related traps Intrusion-related traps System-related traps Information passed with every trap Provides trap categories and explanations Provides descriptions for the VPN Router traps Appendix a MIB support VPN Router traps MIB descriptions Appendix a MIB support VPN Router traps MIB descriptions Attached Failed Please note that X corresponds to Is not reachable and at least one Appendix a MIB support Appendix a MIB support VPN Router traps MIB descriptions IfReasonForStatus-ces-reason for the change in status Appendix a MIB support VPN Router traps MIB descriptions That triggered this event Appendix a MIB support VPN Router traps MIB descriptions Appendix a MIB support VPN Router traps MIB descriptions That triggered this event Appendix B Using serial PPP Establishing a serial PPP connection Setting up a Dial-Up Networking connection Double-click the Microsoft Dial-Up Networking icon Select System Settings Setting up the VPN RouterSetting up the modem Appendix B Using serial PPP Troubleshooting Serial PPP Dialing in to the VPN RouterCause Actions Action PPP option settings Appendix B Using serial PPP NN46110-602 Certificate messages Error removing CA certificate fileInstalled new CA certificate from file TCert task creation failed TCert X.509 certificates disabled in flash memoryTCert Shutdown complete Isakmp messages Isakmp 13 No proposal chosen in message from xxx a.b.c.d Isakmp 13 Authentication failure in message from xxx a.b.c.d Isakmp 13 xxx a.b.c.d has exceeded idle timeout-logging out No response from client-logging out Couldnt install route for remxxx@xxx Branch office messages SSL messages Checking chain invalid parent certChecking chain invalid child cert Child cert xxx not valid signature by xxx Configuration file xxx does not exist Database messagesNo matching trusted CA certs Failed to start Ldif file could not restore Security messagesAccount xxxxxx uid xxx not found in account AuthServer ldap inconsistent no server type in entry Security store new system name xxx failed-xxx Conn backlog reached, possible SYN attackSecurity store new system IP address xxx failed-xxx Error copying entry xxx to Error copying subentries of xxx toError copying tree xxx to Security store new system subnet mask xxx failed-xxx Error deleting entry Error deleting treeSchemaCls Database schema not available LocalAuthServer failed remove-xxx Session xxx uid invalid-authentication failed Session xxxxxx invalid uid-authentication failedXxx xxx being referenced by Session xxxxxx session rejected-system is initializing Session xxxxxxxxx xxx auth method not allowed Session xxxxxxxxx AddLink failed xxx current links Session xxxxxxxxx L2TP host xxx account misconfigured Session xxxxxxxxx account is disabledSession xxxxxxxxx IP address assignment failed Session xxxxxxxxx account has max links Session xxxxxxxxx connect Qos level xxx full Session xxxxxxxxx authentication failed usingSession xxxxxxxxx account not allowed now Session xxxxxxxxx login rejected new logins disabled Disable logins after restart checkbox is selectedSession xxxxxxxxx no memory free xxx threshold Session xxxxxxxxx only one session/static address allowed Session xxxxxxxxx pool address xxx already in use Session xxxxxxxxx session directed to use serverSession xxxxxxxxx static address xxx already in use Session xxxxxxxxx system has max sessions Radius server-name server timed out Radius accounting messagesRadius no reply from server server-nameport number Non-matching ID in server response Radius server-name server failedIndicated packet length too large Unsupported response type number received from server Received bad attribute type from serverResponse OK Radius user-name accounting record sent to server-name OK Radius no reply from Radius server server-nameport number Radius authentication messagesLogin failure due to Server network connection failure Radius server-name server timed out authenticating user-name Non-matching id in server response Radius server returned access challenge Radius access challenge receivedRadius server rejected access Radius server-name sent challenge for user-name Radius user-name access Denied by server server-name Radius user-name access OK by server server-nameOspf Disabled Routing messages Opened OSPF-RTM connection Ospf EnabledClosing OSPF-RTM connection Can not accept x.x.x.x as router id LoadOspfAreas FailedLoadOspfIntf Failed VR xxx Starting xxx as Master for VR xxx Shutting down xxx on VR xxx Starting xxx as Backup forVR xxx Starting xxx as master delayed Backup for Unable to get configuration for VR RIP xxx RIP EnabledRIP xxx RIP Disabled RIP xxx Cant alloc main node RIP xxx Circuit xxx deleted RIP xxx Unable to register with UDPRIP xxx setsockopt RIP socket xxx Sorcvbuf xxx failed RIP xxx bind RIP socket xxx failed RIP xxx Unable to spawn timer task xxx for RIP RIP xxx cid xxx mismatched auth password fromInterface nnn not present, deleting from config Interface nnn replaced, resetting config Interface nnn replaced, deleting from config HWAccel nnn not present, deleting from config Appendix C System messages NN46110-602 Appendix D Configuring for interoperability Configuring the Cisco 2514 router, Version VPN Router and Cisco 2514 network topology NN46110-602 Following is a show config command Configuring the VPN Router for Cisco interoperability Appendix D Configuring for interoperability Connecting to IRE SafeNET/Soft-PK Security Policy Client Mask 10.42 Click Pre-Shared Key SafeNet/Soft-PK Security Policy Editor dialog box appears Configuring the VPN Router for IRE interoperability Encapsulation Protocol ESPSA Life Seconds and 3000 Seconds Go to Profiles Networks and click Edit Third-party client installation Considerations for using third-party clients Appendix D Configuring for interoperability Configuring the VPN Router as a branch office tunnel Configuring the VPN Router as a user tunnel Set Perfect Forward Secrecy PFS to match the client side To configure the VPN Router as a user tunnel Configuring IPX IPX client IPX group configuration Sample IPX VPN Router topologyWindows 95 and Windows Windows NT IPX topology Nortel VPN Router Troubleshooting Appendix D Configuring for interoperability NN46110-602 Index Index Pptp Wins