WINGATE6.2: Windows Live Messenger connect/disconnect: FIXED

[sysneticlabs]

hi all !

We bought a WINGATE Standard release v6.2 this month, from WIngate FRENCH local reseller "WATSOFT", and we made tests in our labs to develop our solution.

We start tests by using "official release" from download location : V6.2.2.1137 (july 2007)

Our solution is "just" using ""WWW PROXY service" with JAVA authentication + using ENS with default firewall parameters, when done, wingate should be transparent and allow ALL traffic... ALL services except WWW PROXY are DISABLED..No DHCP server, nor mail used...minimal option used !

Client worksation opens their browser and get the CLIENT.HTM page , then login with their own login/password then get connected to Internet...


The tests were sucessfull during the 30 days of Test license.... WEB / Outlook email and Windows LIVE messenger were running fine, so we decide to go ahead and bought the license for our final client...

At the same time, reading all interesting posts on the QBIK forum, I read that release v6.2.3.1139 was available but not officially , and that fix some problems.

The final client was already installed and i install this new release on their workstation, then check everything was OK (may be not msn messenger at this time, unfortunately....)

At the same time, our "30 days license" expired so I was not able to run more tests anymore in our labs...

Now, my final client reports me that everything is working fine EXCEPT windows live messenger that doesnt work !



Symptom:
-----------

Once Client workstation is authentified using CLIENT.HTM and java authentication, the windows live messenger application connects sucessfully, then after few seconds disconnect and try to connect again after a delay,, and this in loop ! Same result from a different workstation....



- After 2 hours of testing on client side ,that is not easy, I try to add some firewall rules that microsoft define on their web support site for using Windows live messenegr product => same result

- I try to changethe LEVEL of the firewall in the ENS section => same result

- I try to disable the firewall => same result...


I read some posts on the QBIK forum but I do not find a response....

NOTE: I m 100% sure that MSN Messenger was working fine in our labs, with official release V6.2.2.1137 - tested many days without ANY disconnection....Now, final client uses V6.2.3.1139 with its own configuration environnement and parameters, so it is difficult to find the origin of the problem....I remember that I didnt setup any specific firewall parameters to use MSN messenger....


Now, the problem is still there and I have no possibility to reproduce the problem in our labs, because no testing license available, even by re-installating Wingate :-(

The WINGATE registry was exported, so I have a .REG text file available ! (here in attachement)

Question:
---------

1) Is is possible to setup wingate with SAME license of our final client for testing purpose in our lab ? possibility to get a 2nd temporary license for 30 days in order to FIX this problem ?

2) Does the release V6.2.3 1139 is used by someone else and does someone get the same problem ?

3) Any solution to understand the problem and fix it will be apreciate...

4) when QBIK plan to release an Official update for release V6.2.2 ?? latest official one is already from July 2007 !!!!



Thanks in Advance !
pascal


-------------------------------------
New update - 8 july 2008


I was able ""by chance"........ to recreate the problem in my LAB , I setup all TRACES and DEBUG , so I will post these new information in my own post !

- Please find in attachement ALL LOGs file that seems used !

- I also took ALL required files like explained in a different post, to help WINgate support debugging the problem !

1. WinGate Registry
GateKeeper --> Options menu --> Advanced --> Save Registry
Or if you can't access the Gatekeeper,
Start --> Programs --> WinGate --> Advanced Options --> Registry --> Export Settings

2. WinGate Config Report
GateKeeper --> Options menu --> Advanced --> Save Config Report

3. ipconfig/all from one LAN Client
(Windows) Start menu --> Run --> cmd --> ipconfig/all >> C:\ipa-client.txt

4. ipconfig/all from the WinGate Server
(Windows) Start menu --> Run --> cmd --> ipconfig/all >> C:\ipa-server.txt




Note: Seems that the problem is aroud DNS resolution , I remember to have read a post :

Looking at LOG file named DNS Resolver.log shows that some NAME to resolve are CUT after 5 names after ".", and it seems to be explained that is not normal....Seems to long for WINGATE........so may be the reason ??

example:
----------

07/08/08 23:10:52 Request: request [00b33010] A lookup "echo.edge.messenger.live.com."
07/08/08 23:10:52 Request: request [00b29008] A lookup "echo.edge.msnmessenger.msn.com.akadns.net."
07/08/08 23:11:28 Request: request [00b33010] A lookup "messenger.hotmail.com."
07/08/08 23:11:28 Request: request [00b29008] A lookup "dp.msnmessenger.akadns.net."
07/08/08 23:11:30 Request: request [00b33010] A lookup "c.msn.com."
07/08/08 23:11:30 Request: request [00b29008] A lookup "c.msn.com.nsatc.net."
07/08/08 23:11:52 Request: request [00b396f0] A lookup "ad.fr.doubleclick.net."
07/08/08 23:11:52 Request: request [00b33010] A lookup "ad.3fr.doubleclick.net."
07/08/08 23:11:53 Request: request [00b396f0] A lookup "m.fr.2mdn.net."
07/08/08 23:12:19 Request: request [00b396f0] A lookup "messenger.hotmail.com."
07/08/08 23:12:19 Request: request [00b33010] A lookup "dp.msnmessenger.akadns.net."




Note: Also, in the wingate NAT.log file, MSN messenger log ALWAYS the same NAT TCP connection that seems to failed :

Example
---------

07/08/08 23:10:49 192.168.2.10 Guest 0000000000 Created:
07/08/08 23:10:49 192.168.2.10 jean 0000000188 Requested: NAT: TCP Connection to 207.46.109.22:1863
07/08/08 23:10:53 192.168.2.10 Guest 0000000000 Created:
07/08/08 23:10:53 192.168.2.10 jean 0000000198 Requested: NAT: TCP Connection to 207.46.26.253:7001
07/08/08 23:10:53 192.168.2.10 jean 0000000198 Traffic 112 192 192 112 0s
07/08/08 23:10:53 192.168.2.10 jean 0000000198 Terminated exit code 42
07/08/08 23:10:53 192.168.2.10 Guest 0000000000 Created:
07/08/08 23:10:53 192.168.2.10 jean 0000000199 Requested: NAT: TCP Connection to 207.46.26.254:7001
07/08/08 23:10:54 192.168.2.10 jean 0000000199 Traffic 112 192 192 112 1s
07/08/08 23:10:54 192.168.2.10 jean 0000000199 Terminated exit code 42




thanks in advance

PS: AS my final client is a 4 STAR HOTEL, I would like to be able to give them a "Quick Response"............:-)

pascal
Sysnetic-Labs
FRANCE

[sysneticlabs]

POST Update done - 8 july 2008
Pascal

[jasona]

I was taking a quick look at your settings, can you please confirm that you have not manually set a proxy in MSN?

Thanks

[sysneticlabs]

POST Update done - 10 july 2008
-------------------------------------

Hi Mr Jasona !

- Yes, I confirm that I DO NOT setup anything in Windows Live Messenger configuration. I mean, If I re-connect My XP workstation ethernet cable DIRECTLY to my ADSL routeur, then Messenger is working fine again like it does since many years......

I add some comments to my previous post, as I spend again my evening to debug it in our labs, as I can reproduce it easyly...Our final client has the problem I report....!

Now, I can said:

- The problem is not related to windows XP SP2 or SP3 installed : Both wingate server have the problem !
- The problem is not related to the Wingate release : Both release V6.2.2.1137 AND V6.2.3.1139 have the problem !
- The problem is not related to the presence of an antivirus software running on the wingate server : I remove it !

Also, I read ALL post here, until one year , and I found 3 others post with the same problem with MSN messenger ,and also, made seach on Google, this problem occurs ALSO with some other router without using WINGATE ! so, seems to be a routing problem anyway....

As I read some interesting post, I try do test some of them :

- Timeout : I try , "no timeout" by unchecking ALL timeout paramaters in ALL service I setup => same problem !
- Timeout : I try , "timeout=3000" in ALL service I setup => same problem !
- DNS/wins resolver section : I try add the 2 static DNS server given by my ADSL provider => same problem !
- DNS/wins resolver section : I try to activate and not activate the CACHE option (enable lookup) => same problem !

- I have to try some few others stuff, like may be, put the Microsoft server used by MSN messenger directlty in the WWW proxy service to bypass the authentication process, and my be, avoid the problem... but I near "out of" ideas ....:-) I will took also a Ethernet Trace using WIRESHARK (ethereal like...) if it can help debugging !



Also, I look at the LOG file and seems that the problem always occured during DNS lookup...but I m not a wingate specialist, so I hope that the Attachment given with the FULL wingate config + the LOGs file given will help debugging this problem ! Of course, I m FULLY available to test anything WINGATe support will ask me to TEST !

Thanks in advance
pascal
Sysnetic-labs

[logan]

Hi Pascal,

I'm currently setting up a few tests at the moment. In the meantime, can you try the following tests in your environment.

1) Create a port security rule that opens port 1863 and specifies no timeout.
- GateKeeper -> System -> Extended Networking -> Port Security
- Click Add
- Select "Local computers to the internet" and "TCP"
- Enter the port range 1863 to 1863
- Select "Allow Packet"
- Select "Never timeout"
- Click OK, then OK to finalise the change.

2) Allow unauthenticated access to the internet via the ENS for testing.
- GateKeeper -> System -> Extended Networking -> Policies
- Click Add, OK, then OK

[sysneticlabs]

Hi Mr Logan,

Thanks for your answer...!

Ok, I will re-import my own final CLIENT's wingate configuration using the registry that I export from their WIngate server to go back to the SAME situation define in this post, then I will made tests according to your remarks...

Note: I read a lot of posts here, and "i remember" to have made some tests by opening ALL ports, just to see if it change something, but i m not sure that is it the same as you mentionned, so I will do it...

By the way, Does my configuration is "normal" from WINGATE team point of view ?

I mean, I need to intercept all request to port 80, and just identify who try to conenct by a User + password. So, I setup WWW proxy service (all others services are STOPPED), then in other section, I stop all services EXCEPT "DNS + remote control service (as required for JAVA authentication) + ENS service...

=> Is it OK ?

Also, may be, there is misunderstanding from my part and may be, for others, on where to put and what to setup for policies for these 4 services......I made a lot of tests until I found a way to do it !!! hard job !!! but i m not sure that is the "correct configuration" for my needs.......

I think, a "good idea" from Wingate customer point of view, "would be", to create a POST for each specific and used configurations, like this one, and explained what to configure to achieve the goal !! ..............:-) It will avoid a lot of posts and "user error", I think..........:-)

PS: I m sure at 100% , then I evaluate the Wingate product for the 1st time, and check what happens on my remote XP workstation, the MSN messenger was working fine...........that is why, I don't know what I change that cause the problem and why I m not able to fix it.........So, I will also remove + reinstall wingate ,then try to setup services one by one, with what is stritcly necessary, and see the result.....May be, some changes are irreversible ?

I let you know when tests are done !!

Thanks in advance for you help !

pascal
sysnetic-labs

[sysneticlabs]

POST Update done - 15 july 2008
-------------------------------------

Hi Mr Logan,

New testing done ! I discover that Msn messenger has an option to activate "debug log files" => "tools - options - connection - advanced" + chec kthe box "Keep connection log....... " or something like that , I have FRENCH interface here, sorry :-)

I will send you this LOG file directly as it seems to contains some "personal info in it", and also, wich port is used by MSN and also, why it failed , I think !!


Thanks in advance
pascal

[logan]

That sounds great! Can you create a new support ticket at the online helpdesk and include the log files there when you've got them?

[sysneticlabs]

POST Update done - 20 july 2008
-------------------------------------


Hi Mr Logan,

1) I open a ticket ( #XND-29646 ) with the windows live messenger log !

2) I try to do your test, without sucess => I mean :

=> "1) Create a port security rule that opens port 1863 and specifies no timeout."


3) IMPORTANT information:

I write here ,that I read some articles searching this king of MSN connect/disconnect problem on GOOGLE, and I read that "some people" get the SAME troubles BUT without using WINGATE at all, just a router !

So, I have the "idea" to remove by current "ADSL modem/Routeur" BOX that is connected AFTER the wingate server , and replace it by my OLD "ADSL modem/Routeur" ( a THOMSON SPEEDTOUCH 510 4 ports) , and after testting , I get a BIG SURPRISE, it is working fine !! and this, without touching anything on WINGATE server NOR my XP workstation !!

As soon as I put back my "normal" Modem/routeur, I get AGAIN the same trouble ! So, according to the articles on the net about this problem on other router, It seems to be related to "routing" problem..........

So, difficult to see why the problem occurs USING wingate and my normal router BOX, but not when i m connected DIRECTLY to it.......! or that using WINGATE with another king of modem/router, the problem does not occur !!!

Seems Windows Live messenger has a "strange" connection process, according to the LOG file I took.....(see the ticket attached file)

PS: I stay at your disposition ,to test <<ANYTHING>> that could help to fix it ..................!!!

Thanks in advance

Pascal

[sysneticlabs]

POST Update done - 28 july 2008
-------------------------------------

With the help of Mr Logan from Wingate support team, I found a solution to my problem using windows live messenger when a Wingate V6.2 server is installed.


First of all, the problem is NOT related to Wingate itself, but installing the wingate product will show the problem in your configuration !

1) According to some articles found on GOOGLE, this problem occurs also without WINGATE product, when using some specific routeur model => I apply this comment to my own configuration, and the problem disapears immediately with the SAME wingate configuration and my own network !

Note: My Modem ADSL/routeur model is : NEUFBOX V4 (from NEUF-CEGETEL-AOL provider in FRANCE )


So, I encourag people who have the SAME problem, to first try it !


2) As, in my case, I could not change the Modem/routeur from my final client site, Mr Logam gives me the following idea, to find a "Bypass" to the problem !

- Mr Logan said :
=> "This may be a long shot, but you could try intercepting any traffic on port 1863 in a TCP Mapping Service. This will elevate the Live Messenger connection from the NAT level into a proxy service."


Here it is:

-------------------------------------

- GateKeeper -> Services
- Right click an existing service -> New Service -> TCP Mapping Service
- Enter a unique Sevice Name, example=MSN service
- Set the Service port to 1863

- Go to the "Sessions" section
- Select "Intercept connections made via ENS" and add port 1863 to the list
- Uncheck [] session "time out.." parameter.

- Go to the "policies" section
- Set in "Users can connect to this service" = "Everyone - restricted by security level = Users must be authentified"
- Set "Default right" = "are ingored"

- Click OK

-------------------------------------

Conclusion: In both #1 and #2 solution given, I do NOT experiment anymore the "connect/disconnect" problem , in both my lab and also, of course, in my Final Client's site !

So, Thanks a lot to the wingate support team for their help !

Best regards
Pascal

[tasmia86]

I am not sure which part you are referring to. Do you mean the settings? I was taking a quick look at your settings, can you please confirm that you have not manually set a proxy in MSN?

Thanks

Hi Jasona,
Thanks for the question.I am also looking this solution.