11.1 Troubleshooting

Combined revision comparison

...

• From Windows 2000 on, this type of problem may occur right after defining a local bridge that connects to a network adapter with hardware offloading capabilities. If this is the case, try restarting your computer. Please refer to section 3.6 Local Bridges#3.6.10# for more details.
• If you are using Linux or Solaris, you can communicate within the Virtual Hub (VPN) from the network adapter connected to by the local bridge to the LAN, but you can not communicate to the network adapter itself. This is a restriction imposed by the Linux kernel. For more information please refer to #3.6.11#3.6 Local Bridgesand #3.6.12#..
• If you are using local bridging to make a bridged connection between a Virtual Hub and a physical LAN as described in section #3.6.3#,3.6 Local Bridges, we recommend you set aside a network adapter specifically for this purpose. This will result in the best performance when using local bridging.

...

• Check to make sure that the host name or IP address of the VPN Server you are trying to connect to is correct. Also, make sure the TCP/IP port number is the same as the VPN Server's listener port. Furthermore, confirm that that listener port is not being used by some other server software (such as a webserver like IIS or Apache). Please refer to section 3.3 VPN Server Administration#3.3.6# for more information.
• The global address of the connecting computer to be recognized by VPN Server may not have reverse DNS lookup configured.
• If there is a proxy server, transparent firewall, or some other special networking devices between the connecting computer and the VPN Server, these devices may misinterpret the SoftEther VPN protocol and write over it or block it completely. In this case, check with the administrator of these networking devices.
• If your network uses a HTTP proxy or SOCKS proxy, check with the proxy server's administrator to confirm if the proxy can be used to forward the SoftEther VPN protocol.

...

SecureNAT may not be configured properly. Check to make sure the following things are not occurring on your network. Also check the items listed in section #3.7.4#.3.7 Virtual NAT & Virtual DHCP Servers.

...

The SecureNAT functionality is designed for creating a simple remote access VPN under special circumstances (see section #10.11 Exploit SecureNAT for Remote Access into Firewall without Any Permission#), ), and therefore we do not recommend it for continuous use in a corporate setting. Remember, SecureNAT is not required to set up a normal LAN-to-LAN VPN or remote access VPN.

...

• Check to make sure that you have not enabled a security policy that has a broadcast limit in the security policies for VPN Client or for any cascade connections you need for your VPN. Note that the default policy does have a broadcast limit enabled. Please refer to section 3.5 Virtual Hub Security Features#3.5.9# for more details.
• If you are using local bridge connections, the physical network adapter connected to via the local bridge or that segment's layer 2 switching Hub may not be able to handle the large number of broadcast frames and will fail to forward them properly.

...

• Multicast packets will be treated the same as a broadcast packet by a VPN Server's Virtual Hub. Check to make sure that you have not enabled a security policy that has a broadcast limit in the security policies for VPN Client or for any cascade connections you need for your VPN. Note that the default policy does have a broadcast limit enabled. Please refer to section 3.5 Virtual Hub Security Features#3.5.9# for more details.
• If you are using local bridge connections, the physical network adapter connected to via the local bridge or that segment's layer 2 switching Hub may not be able to handle the large number of broadcast frames and will fail to forward them properly. Your layer 2 switching Hub/router, or layer 3 switch may not recognize multicast packets and may be filtering them out.

...

• Refer to section # 3.6 Local Bridges# and configure a proper local bridge connection.
• For a simple remote access server you can also use the Virtual NAT functionality as described in section #3.7Virtual NAT & Virtual DHCP Servers#..

...

If you have forgotten the administrator password for your VPN Server, refer to 3.3 VPN Server Administration#3.3.7# and delete the following lines from the VPN Server configuration file with a text editor:

...

If you are unable to use RADIUS authentication, refer to section 3.5 Virtual Hub Security Features#3.5.3# and confirm the following:

...

If you have defined a local bridge connection but it is always offline or showing an error, check sections #3.6.10#,3.6 Local Bridges#3.6.11#,  and the following:

...

If you have defined a local bridge connection between a Virtual Hub and a wireless network adapter but the local bridge is not functioning properly, refer to section #3.6.6#.  3.6 Local Bridges.

...

If you have created a Virtual Layer 3 Switch, defined a Virtual Interface to a Virtual Hub, and started it up but it remains offline or shows an error, refer to section #3.8.6#.  3.8 Virtual Layer 3 Switches.

...

If you have set up a cluster but can not communicate between Virtual Hubs you have made on the cluster, refer to section #3.9.7#.3.9 Clustering. Also verify that you have correctly set up and configured the cluster as described in section #10.8Build a Large Scale Remote Access VPN Service#..

If you have set up a cluster and only want to allow communication within each individual Virtual Hub (such as for a Virtual Hub hosting service VPN Server as described in section #10.9Build a Large Scale Virtual Hub Hosting Service#), ), make sure that you have made your Virtual Hubs dynamic, not static.

...

Even if you have not established a VPN connection the VPN Client sometimes sends some packets through the physical network interface. These packets are described in section #4.9.2#.4.9 Other Functions. (You can modify some settings to stop VPN Client from sending these packets.)

...

• Packets for ARP polling by the Virtual Hub as explained in section #3.4.8#.3.4 Virtual Hub Functions.
  (By setting the [NoArpPolling] option in the configuration file to 'true' you can stop ARP polling from occurring.)
• Packets sent by the SoftEther VPN protocol to confirm the existence of each TCP/IP connection, or KeepAlive packets sent to prevent the TCP/IP connection from timing out. The interval that KeepAlive packets are sent by the TCP/IP connections that make up the SoftEther VPN protocol is approximately half of the timeout interval defined in that VPN session's security policy.

...

If you create a Virtual Network Adapter with VPN Client, you must be connected to a VPN Server its status will stay as [No network cable is connected.]. This is the same as if an Ethernet cable is not connected between a physical network adapter and a switching Hub. Please refer to section #4#4. SoftEther VPN Client Manual for more information on this topic.

...

Any user modified files, Virtual Network Adapters, and configuration data created after VPN Client is installed are not automatically deleted and thus remain on the system even after VPN Client is uninstalled. If you want to delete the configuration files (vpn_client.config) or Virtual Network Adapters registered to your system, delete them manually when you are sure that you do not need them anymore. Please refer to section #8.3.2#8.3 Uninstall SoftEther VPN Client for information on how to delete a Virtual Network Adapter.  

...

• Check to see if the smart card or hardware security device you are using has been confirmed for use by SoftEther by referring to section #12.2.6#. Make sure that the device driver(s) for your smart card reader, etc. and PKCS #11 drivers necessary to access the smart card are installed properly. After you have installed new drivers for your smart card you must restart your computer in order to use that device with SoftEther VPN.
• Confirm that the correct smart card type is selected. Please refer to section # 4.6Using and Managing Smart Cards# for more information.
• Some smart card drivers will not function properly if there are multiple smart card readers on your system. Make sure you read the manual for your smart card to determine if these limitations exist.
• Some smart card drivers require you to use a separate utility to format the smart card before it can be used. Refer to your smart card's manual for instructions on how to do this.

...

You can reset the administrator password for VPN Bridge by using the same method used for VPN Server. Refer to section 11.1.11,#11.1.11#, changing vpn_server.config to vpn_bridge.config where appropriate.  

...

If you have used the methods described in section #10.5Build a LAN-to-LAN VPN (Using L2 Bridge)# to to connect multiple network segments together with a layer 2 connection by using VPN Server and VPN Bridge, but can still not communicate between the computers on these networks, use the following method to determine if the networks are properly connected at a layer 2 level.

1. If you are dealing with two LANs you can try this test. Set up one computer on LAN A with an unused IP address (for example, 192.168.222.1) and a computer on LAN B with an unused IP address on the same IP network as the computer you set up on LAN A (such as 192.168.222.2). Now try the ping command on both computers to see if they can ping each other. If they succeeded in communicating with each other, both networks are properly connected at a layer 2 level and the problem lies in the configuration of the rest of the computers. Remember that both LANs are logically functioning as a single Ethernet segment, so check settings such as TCP/IP, etc. very carefully.
2. If the computers failed to communicate with each other by using the method above, you have probably made a mistake somewhere in the process of setting up your LAN-to-LAN VPN. In this situation, refer to sections #10.5 Build a LAN-to-LAN VPN (Using L2 Bridge)#, #3#,, 3. SoftEther VPN Server Manual, or 5. SoftEther VPN Bridge Manual#5# and confirm your VPN configuration.
3. If each LAN has a different IP network structure and you want to allow communication between the computers on each LAN, refer to the method described in section #10.6Build a LAN-to-LAN VPN (Using L3 IP Routing)#..

...

Normally you can just ignore this message with no problems, but if there are many FreeBSD machines on the same segment this could cause problems for the administrator of those machines. In this situation you can stop these polling packets from being sent. For instructions on how to stop a Virtual Hub from sending polling packets to confirm the existence of an IP address, please refer to section #3.4.8#.3.4 Virtual Hub Functions.