Authentication Woes

[markc]

Folks

I have just downlaoded and installed the latest version of wingate build 984 on Windows 2000.

Thanks to teh feedback on this forum I was able to get it running after being totally unprepared for the necessary reconfiguration.

However, whenever MSNMessenger or a Browser attempts to connect to a site, I get an authentication popup on 192.168.0.1 (my server address)

My Client is a Xp Home edition

It seems to occur everytime Messenger logs on.

I seem to also be heving problems keeping Messenger logged on.

Is there a timeout or similar. I changed the timeout on the Advanced options to 10 secs on all choices in a vain attempt to get ping and DNS working ..

Any help appreciated ..

Regards

Mark

[Pascal]

Do you have any policies configured which requires authentication ?

[markc]

Hi Pascal

No, I have none set at all.

I had a big problem getting it to work until I saw the Internal Network Card solution on the forums then everything worked fine.

I did a Server reboot and then began having the authentication problems.

Atthem moment we do not use policies and I had none set on the previous version before I upgraded.

Regards

Mark

[markc]

Hi Pascal

It seems to be everytime a new page is opened, even in the same browser window, authentication is requested.

I have rebooted the server and changed teh Advanced Timeouts back to the default

I am also experiencing a lot of socket timeouts when web browsing at the moment

My ISP says it is not them ..

Regards

Mark

[Pascal]

Are you using the WinGate Userdatabase or the Operating System Userdatabase ?

Which username is it reporting the authentication failure against. Secondly, how are you connecting the clients to WinGate ? Are you using NAT, WGIC or proxies ?

[markc]

Hi Pascal
I am using Guest only on the Wingate User database
It may to be happening with nat (if that is what Msn Messenger is using) but I think it is on the www proxy only. I use port 800 bound to the Internal Adaptor (MSN wil use either and I think it is on the proxy)

I do not use WGIC as yet. Once I get ths stable, will look at moving to that.

Regards

Mark

[Pascal]

Okay, no - I'm after how the client connects to the server. If you setup the client to point it's default Gateway and DNS server to WinGate, then you're in all likelyhood using NAT. If you configured MSN or IE to use a proxy, then you are using a proxy. For one application it will be one or the other.

So where do you see the authentication failure ? Is it WinGate logging a System Entry saying: "Authentication Failed" or something similar. If so - then it should have a username associated with that - either if you select a message or as one of the columns.

Or is it happening on the MSN side ?

What about normal web-browsing, etc. Do you have all of those working ?

[markc]

Sorry Pascal, I am not being very clear

The authentication pops up on my XP Client.

I get it every time my Browser tries to access a new page. When I enter my network password in the Clients Popup I can proceed. In fact, if I do not enter any password, ie: press the cancel button, it still lets me proceed but will pop up on the next access. When I access a new page, I am prompted for my network password again.

This has only happened since i installed the new version.

My browser is set up to point to a www proxy on port 800.
I am using Wingate DNS, default setup

Ipconfig reports the following on my client:

Windows IP Configuration

Host Name . . . . . . . . . . . . : TheBoss
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : SURECOM EP-320
er
Physical Address. . . . . . . . . : 00-02-44-30-4D
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1

I hope this is a bit clearer for you.

Regards

Mark

[Pascal]

Yup, that helps a great deal. That looks as if you are using NAT. If the sessions are showing in GateKeeper as Web Sessions, you are most likely using T/R OR Intercepts as well.

So, the first thing to do is to check that (a) you do not have NTLM required. This will happen if the WWW Proxy has the NTLM checkbox checked, and if you go to the Policies Tab, it will have "Everyone" or individual users listed there "Restricted by Security Level". If you see anyone like that - it means they require authentication. If none of those are true - go to the System Policies - Access Rights. Check the same there.

However, I'm not sure that it will be the case - because you say you can click "Cancel" in the browser's login dialog and it lets you carry on. So I'm wondering if it's WinGate at all - or if it's a change that happened on the client end ? (Perhaps even an automatic update ?)

[adrien]

One thing

Is your guest account enabled?

If for instance you chose to use the Windows user database on upgrade, and the local machine guest account is disabled, then this could have disabled your guest account in WinGate.

Adrien

[markc]

Guys

I just read the looooong post on the Socket Errors. FYI, this was a problem for me as well. In version 5, I was using a mapped DNS Link. I did not check the forums and just upgraded to version 6 when it was available. The socket errors ahve gone away to be replaced by the Authentication problems being discussed here.
What IS different, though, is that I enabled the Wingate DNS and always had a suspicion in the back of my mind that DNS was responsible for teh socket errors.

From my server, I was able to ping every Ip in my ISP Subnet EXCEP the two DNS Servers. Intermittantly, I WAS ABLE to ping the DNS. It drove me and my ISP nuts. WG6 solved this problem. I thought it could have been a sub netting issue??

Now, I have an authenticate problem and m,y gut feel tells me it is occurring everytime a DNS lookup is initiated. My DNS server is set to 192.168.0.1 on my client and that is the Network LOgon that is being authenticated.

I dis not have ANTY policies set in the DNS, just whatever was the default when I enabled it. I have now set a default policy where everyone can do everything. Teh DNS Service is set to any adaptor on any ip, as this is the only binding that will work.

Hope this helps.

Regards

Mark

[markc]

Guys

I just read the looooong post on the Socket Errors. FYI, this was a problem for me as well. In version 5, I was using a mapped DNS Link. I did not check the forums and just upgraded to version 6 when it was available. The socket errors HAVE NOT gone away and I now have the Authentication problems being discussed here.

What IS different, though, is that I enabled the Wingate DNS and always had a suspicion in the back of my mind that DNS was responsible for the socket errors.

From my server, I was able to ping every Ip in my ISP Subnet EXCEPT the two DNS Servers. Intermittantly, I WAS ABLE to ping the DNS. It drove me and my ISP nuts. I thought it could have been a sub netting issue?? Having read the other posts, it may be a routing issue??

Now, I have an authenticate problem and m,y gut feel tells me it is occurring everytime a DNS lookup is initiated. My DNS server is set to 192.168.0.1 on my client and that is the Network LOgon that is being authenticated.

I dis not have ANY policies set in the DNS, just whatever was the default when I enabled it. I have now set a default policy where everyone can do everything. Teh DNS Service is set to any adaptor on any ip, as this is the only binding that will work.

Hope this helps.

Regards

Mark

PS: I was getting timeouts when trying to post to this forum. Several refreshes fixed it ...

[adrien]

OK I take it your guest account is enabled though?

If you were using mixed authentication in WinGate 5.x, this would have changed over to using the NT user database, as we no longer support both at the same time (caused too many problems).

Also, can you post a copy of what you get with "route print" from the command line?

Adrien

[markc]

Hi Adrien

Hope these help. From both the Client and the server:

Regards

Mark

==========================================

This is the Route Print from the CLient:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\mark>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 02 44 30 4d 67 ...... SURECOM EP-320X-R 100/10/M PCI Adapter - Packet
Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.2 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.2 192.168.0.2 20
192.168.0.2 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.0.255 255.255.255.255 192.168.0.2 192.168.0.2 20
224.0.0.0 240.0.0.0 192.168.0.2 192.168.0.2 20
255.255.255.255 255.255.255.255 192.168.0.2 192.168.0.2 1
Default Gateway: 192.168.0.1
===========================================================================
Persistent Routes:
None

here is the Route Print from my Server

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\Documents and Settings\Administrator.SERVER>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x1000003 ...00 50 fc e3 7d d3 ...... NDIS 5.0 driver

0x1000004 ...00 08 a1 6f a5 2e ...... CNet PRO200WL PCI Fast Ethernet Adapter

===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 202.69.177.62 202.69.177.34 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.1 192.168.0.1 1
192.168.0.1 255.255.255.255 127.0.0.1 127.0.0.1 1
192.168.0.255 255.255.255.255 192.168.0.1 192.168.0.1 1
202.69.177.0 255.255.255.192 202.69.177.34 202.69.177.34 1
202.69.177.34 255.255.255.255 127.0.0.1 127.0.0.1 1
202.69.177.255 255.255.255.255 202.69.177.34 202.69.177.34 1
224.0.0.0 224.0.0.0 192.168.0.1 192.168.0.1 1
224.0.0.0 224.0.0.0 202.69.177.34 202.69.177.34 1
255.255.255.255 255.255.255.255 202.69.177.34 202.69.177.34 1
Default Gateway: 202.69.177.62
===========================================================================
Persistent Routes:
None

[adrien]

The route table looks fine on the server, although I note an interface named "NDIS 5.0 Driver" which is odd - what is this do you know?

Adrien

[markc]

I have NetBEUI installed on our private lan and I guess that is the driver for it, possibly NetBEUI over TCP/IP??

It has been there, I guess, from day one as we have not tiuched out network setup in months.

Regards

Mark

[adrien]

Hmmm, since it has an ethernet address, it looks more like another network adapter.

You have two in that machine right?

Adrien

PS. you still haven't answered whether your guest account is enabled.

[markc]

Hi Adrian

oops, sorry.

Guest Account IS enabled.

Here is the IPconfig from my server. Looks like the NDIS driver is for the Ethernet realtek adaptor, which is the adaptor the Internet is connected to.

Regards

Mark

---------------------------------------------------------

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\Documents and Settings\Administrator.SERVER>ipconfig /all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : server
Primary DNS Suffix . . . . . . . : rebel.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : rebel.local

Ethernet adapter Intranet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : CNet PRO200WL PCI Fast Ethernet Adap
ter
Physical Address. . . . . . . . . : 00-08-A1-6F-A5-2E
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 202.69.170.10
202.69.165.10
Primary WINS Server . . . . . . . : 192.168.0.1

Ethernet adapter Comclark:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139(A) PCI Fast Ethernet
Adapter
Physical Address. . . . . . . . . : 00-50-FC-E3-7D-D3
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 202.69.177.34
Subnet Mask . . . . . . . . . . . : 255.255.255.192
Default Gateway . . . . . . . . . : 202.69.177.62
DNS Servers . . . . . . . . . . . : 202.69.170.10
202.69.165.10
Primary WINS Server . . . . . . . : 192.168.0.1

C:\Documents and Settings\Administrator.SERVER>

[adrien]

OK, the best way probably to track this down is to turn on debug logging in the WWW proxy, and then send me a snip of what that shows when your browsers are trying to connect.

Normally WinGate will only request authentificiation if your policies require it, and it is also enabled on the WWW proxy, but since in your case you have no policies, I wonder if it is coming through from somewhere else.

You don't have your WWW Proxy set to cascade to another proxy somewhere do you? If that proxy then required authentication (i.e. it might have changed its config), then that would show up on your client machines.

Adrien

[markc]

Hi Adrian

Well, you wouldn't believe it. The problem magicall disappeared overnight. Just came in and it stoped asking. Nothing was done to either the client or the server, no auto updates, nothing ...

However, I am still getting timeouts and have emailed you a www proxy logh of this. Perhaps it will help.

I will let you know if we start getting the problem again. I still think it is in the Dns, for what that is worth ..

Regards

Mark

[markc]

Hi Adrian

YOur email address is not in your profile. here is the log ..

08/17/04 09:46:20 192.168.0.2 Guest 0000020910 Debug: WWW Session sending server request in thread 8f4
08/17/04 09:46:20 192.168.0.2 Guest 0000020911 Requested: http://metalcrafters.ph/animate.js
08/17/04 09:46:20 192.168.0.2 Guest 0000020911 Debug: WWW Session sending server request in thread a7c
08/17/04 09:46:20 192.168.0.2 Guest 0000020911 Debug: Server response contains 4048 bytes of resource data
08/17/04 09:46:20 192.168.0.2 Guest 0000020911 Debug: WWW Session processing HTTP response in thread a7c - response code 200
08/17/04 09:46:20 192.168.0.2 Guest 0000020911 Debug: Pragma: no-cache in server response - disabling caching
08/17/04 09:46:20 192.168.0.2 Guest 0000020910 Debug: Server response contains 19 bytes of resource data
08/17/04 09:46:20 192.168.0.2 Guest 0000020910 Debug: WWW Session processing HTTP response in thread 8f4 - response code 200
08/17/04 09:46:21 192.168.0.2 Guest 0000020910 Requested: http://metalcrafters.ph/images/logo.gif
08/17/04 09:46:21 192.168.0.2 Guest 0000020910 Debug: WWW Session sending server request in thread 8f4
08/17/04 09:46:21 192.168.0.2 Guest 0000020910 Debug: Server response contains 4063 bytes of resource data
08/17/04 09:46:21 192.168.0.2 Guest 0000020910 Debug: WWW Session processing HTTP response in thread 8f4 - response code 200
08/17/04 09:46:21 192.168.0.2 Guest 0000020910 Debug: Pragma: no-cache in server response - disabling caching
08/17/04 09:46:22 192.168.0.2 Guest 0000020911 Requested: http://banners.wunderground.com/banner/ ... /98327.gif
08/17/04 09:46:22 192.168.0.2 Guest 0000020911 Debug: WWW Session sending server request in thread a7c
08/17/04 09:46:22 192.168.0.2 Guest 0000020916 Created:
08/17/04 09:46:22 192.168.0.2 Guest 0000020916 Requested: http://www.net2phone.com/clienturl/sysmessage.asp
08/17/04 09:46:22 192.168.0.2 Guest 0000020916 Debug: WWW Session sending server request in thread 39c
08/17/04 09:46:22 192.168.0.2 Guest 0000020911 Debug: WWW Session processing HTTP response in thread a7c - response code 200
08/17/04 09:46:23 192.168.0.2 Guest 0000020911 Debug: Server closed connection in thread a7c
08/17/04 09:46:23 192.168.0.2 Guest 0000020911 Traffic 0 0 0 0 0s
08/17/04 09:46:23 192.168.0.2 Guest 0000020911 Terminated exit code 0
08/17/04 09:46:26 192.168.0.2 Guest 0000020910 Debug: Client closed connection in thread 8f4
08/17/04 09:46:26 192.168.0.2 Guest 0000020910 Traffic 0 0 0 0 5s
08/17/04 09:46:26 192.168.0.2 Guest 0000020910 Terminated exit code 1
08/17/04 09:46:33 192.168.0.2 Guest 0000020916 Debug: Server closed connection in thread 39c
08/17/04 09:46:33 192.168.0.2 Guest 0000020916 Traffic 0 167 143 0 11s
08/17/04 09:46:33 192.168.0.2 Guest 0000020916 Terminated exit code 0
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Created:
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Requested: http://metalcrafters.ph/
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Debug: WWW Session sending server request in thread 39c
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Debug: Server response contains 657 bytes of resource data
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Debug: WWW Session processing HTTP response in thread 39c - response code 200
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Debug: Pragma: no-cache in server response - disabling caching
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Requested: http://metalcrafters.ph/Default%20Left.asp
08/17/04 09:46:38 192.168.0.2 Guest 0000020917 Debug: WWW Session sending server request in thread 39c
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Created:
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Debug: Server response contains 4039 bytes of resource data
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Debug: WWW Session processing HTTP response in thread 39c - response code 200
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Debug: Cookie set in server response - disabling caching
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Requested: http://metalcrafters.ph/Default%20Right.asp
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: WWW Session sending server request in thread a7c
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: Server response contains 4095 bytes of resource data
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: WWW Session processing HTTP response in thread a7c - response code 200
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: Cookie set in server response - disabling caching
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Requested: http://toolbarqueries.google.com/search
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Debug: WWW Session sending server request in thread 39c
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Requested: http://metalcrafters.ph/animate.js
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: WWW Session sending server request in thread a7c
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: Server response contains 4048 bytes of resource data
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: WWW Session processing HTTP response in thread a7c - response code 200
08/17/04 09:46:39 192.168.0.2 Guest 0000020918 Debug: Pragma: no-cache in server response - disabling caching
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Debug: Server response contains 24 bytes of resource data
08/17/04 09:46:39 192.168.0.2 Guest 0000020917 Debug: WWW Session processing HTTP response in thread 39c - response code 200
08/17/04 09:46:40 192.168.0.2 Guest 0000020918 Requested: http://metalcrafters.ph/images/logo.gif
08/17/04 09:46:40 192.168.0.2 Guest 0000020918 Debug: WWW Session sending server request in thread a7c
08/17/04 09:46:40 192.168.0.2 Guest 0000020918 Debug: Server response contains 4063 bytes of resource data
08/17/04 09:46:40 192.168.0.2 Guest 0000020918 Debug: WWW Session processing HTTP response in thread a7c - response code 200
08/17/04 09:46:40 192.168.0.2 Guest 0000020918 Debug: Pragma: no-cache in server response - disabling caching
08/17/04 09:46:48 192.168.0.2 Guest 0000020920 Created:
08/17/04 09:46:48 192.168.0.2 Guest 0000020920 Requested: http://www.net2phone.com/clienturl/sysmessage.asp
08/17/04 09:46:48 192.168.0.2 Guest 0000020920 Debug: WWW Session sending server request in thread a74
08/17/04 09:46:59 192.168.0.2 Guest 0000020920 Debug: Server response contains 76 bytes of resource data
08/17/04 09:46:59 192.168.0.2 Guest 0000020920 Debug: WWW Session processing HTTP response in thread a74 - response code 200
08/17/04 09:47:39 192.168.0.2 Guest 0000020917 Requested: http://metalcrafters.ph/Default%20Right.asp
08/17/04 09:47:39 192.168.0.2 Guest 0000020917 Debug: WWW Session sending server request in thread 39c
08/17/04 09:47:39 192.168.0.2 Guest 0000020917 Debug: Server response contains 4162 bytes of resource data
08/17/04 09:47:39 192.168.0.2 Guest 0000020917 Debug: WWW Session processing HTTP response in thread 39c - response code 200
08/17/04 09:47:39 192.168.0.2 Guest 0000020918 Requested: http://banners.wunderground.com/banner/ ... /98327.gif
08/17/04 09:47:39 192.168.0.2 Guest 0000020918 Debug: WWW Session sending server request in thread a7c
08/17/04 09:47:40 192.168.0.2 Guest 0000020918 Debug: Server response contains 6116 bytes of resource data
08/17/04 09:47:40 192.168.0.2 Guest 0000020918 Debug: WWW Session processing HTTP response in thread a7c - response code 200
08/17/04 09:47:40 192.168.0.2 Guest 0000020918 Debug: Server closed connection in thread a7c
08/17/04 09:47:40 192.168.0.2 Guest 0000020918 Traffic 0 0 0 0 0s
08/17/04 09:47:40 192.168.0.2 Guest 0000020918 Terminated exit code 0
08/17/04 09:48:04 192.168.0.2 Guest 0000020920 Debug: Client closed connection in thread a74
08/17/04 09:48:04 192.168.0.2 Guest 0000020920 Traffic 0 0 0 0 65s
08/17/04 09:48:04 192.168.0.2 Guest 0000020920 Terminated exit code 1
08/17/04 09:48:04 192.168.0.2 Guest 0000020933 Created:
08/17/04 09:48:04 192.168.0.2 Guest 0000020933 Requested: http://www.net2phone.com/clienturl/sysmessage.asp
08/17/04 09:48:04 192.168.0.2 Guest 0000020933 Debug: WWW Session sending server request in thread a80
08/17/04 09:48:04 Configuration changed
08/17/04 09:48:25 192.168.0.2 Guest 0000020933 Error: Caught socket exception in CWWWSession::HTTPProcessRequest() Connection to Remote Host timed out - terminating
08/17/04 09:48:25 192.168.0.2 Guest 0000020933 Debug: Client closed connection in thread a80
08/17/04 09:48:25 192.168.0.2 Guest 0000020933 Traffic 0 167 0 0 21s
08/17/04 09:48:25 192.168.0.2 Guest 0000020933 Terminated exit code 1
08/17/04 09:48:39 192.168.0.2 Guest 0000020917 Debug: Client closed connection in thread 39c
08/17/04 09:48:39 192.168.0.2 Guest 0000020917 Traffic 0 0 0 0 60s
08/17/04 09:48:39 192.168.0.2 Guest 0000020917 Terminated exit code 1
08/17/04 09:48:44 192.168.0.2 Guest 0000020936 Error: Caught socket exception in CWWWSession::HTTPProcessRequest() Connection to Remote Host timed out - terminating