3.4 Virtual Hub Functions

Displaying Session Lists

A list showing the VPN sessions connected to the Virtual Hub and internally generated sessions can be displayed. Simply clicking on the [Manage Sessions] button in the VPN Server Manager displays a list of the sessions. A session list can also be obtained using the vpncmd utility with the [SessionList] command.

When connecting to a cluster controller using clustering, the sessions displayed in the [Session list] include all of the cluster member server sessions.

VPN Session administration window.

The following information is shown when displaying a session list.

Distinguishing Session Types with Icons

The session types in the session list display can be differentiated by looking at [User] or by obtaining session information. When using the VPN Server Manager, it is possible to distinguish between session types using the small icons displayed together with the session name.

The following seven icon types are displayed in the session list.

Icon	Corresponding Session Type
	Indicates a general VPN session (i.e. a session created by receiving a routine VPN connection, and not a bridge / router mode or monitoring mode session).
	Indicates a bridge/ router mode session.
	Indicates a monitoring mode session.
	Indicates a local bridge session.
	Indicates a cascade connection session.
	Indicates a SecureNAT session.
	Indicates a virtual layer 3 switch session.

Obtaining Session Details Data

Double clicking on [Session name] from the session list of the VPN Server Manager displays information relating to that session. The same information can be obtained in the vpncmd utility using the [SessionGet] command.

This enables the identification of detailed information for each session as well as information relating to the source computer (such as its VPN software version and OS).

Session details data display window.

Of the detailed session data, the following is important.

Forced Disconnect of Session

It is possible for Virtual Hub Administrators to forcibly disconnect a connected session. To disconnect a session, simply select the session to be disconnected in the VPN Server Manager and click the [Disconnect] button. In the vpncmd utility, use the [SessionDisconnect] command.

Displaying Virtual Hub MAC Address Tables

Clicking on the [MAC address Table List] button in the [Manage Sessions] window of the VPN Server Manager displays the MAC address tables. In the vpncmd utility, the table can be obtained using the [MacTable] command.

When requesting MAC address tables from the cluster controller in a cluster environment, the cluster controller responds with MAC address tables on all of the cluster member servers together.

MAC address table administration window.

The entries listed for each record (MAC address entry) in the MAC address table are as follows.

Deleting Virtual Hub MAC address tables

Although not normally required, the Virtual Hub Administrator can arbitrarily delete MAC address table entries. To delete a MAC address table entry, select the entry with the VPN Server Manager and click the [Delete selected entry] button. In the vpncmd utility, the entry can be deleted using the [MacDelete] command.

Listing the MAC Address Table associated with a Specific Session

In the VPN Server Manager's [Manage Sessions] window, select the desired session and click [MAC table of This Session] button. This displays a list of only those MAC address table entries associated with the selected session. It is also possible to designate a session and find out which MAC addresses are being used by the VPN client computer for that session. The same task can be carried out using the vpncmd utility by attaching the session name as an argument to the [MacTable] command.

Session-specific MAC address table.

Displaying Virtual Hub IP Address Tables

Clicking on [IP Address Table List] button in [Manage Sessions] window of the VPN Server Manager displays the IP Address Table. In the vpncmd utility, the table can be obtained using the [IpTable] command.

When requesting IP address tables from the cluster controller in a cluster environment, the cluster controller responds with IP address tables on all of the cluster member servers together.

IP address table administration window.

The entries listed for each record (IP address entry) in the IP address table are as follows.

Deleting Virtual Hub IP Address Tables

Although not normally required, Virtual Hub Administrators can arbitrarily delete IP address table entries. To delete an IP address table entry, select the entry with the VPN Server Manager and click the [Delete selected entry] button. In the vpncmd utility, use the [IpDelete] command.

Listing the IP Address Table associated with a Specific Session

In the VPN Server Manager's [Manage Sessions] window, select the desired session and click [IP Table of This Session] button. This displays a list of only those IP address table entries associated with the selected session. This makes it easy to find out which IP addresses are being used by the VPN client computer for a designated session. The same task can be carried out using the vpncmd utility by attaching the session name as an argument to the [IpTable] command.

For VPN sessions where a router is connected at the session destination, all of the IP addresses of packets arriving from the other side of the router (such as the Internet) may be associated. This is because there is no way to distinguish whether each IP address in a Virtual Hub operating in layer 2 has been routed via a router or whether they have been transmitted from a node directly connected by layer 2.

Session-specific IP address table.

Cascade Connections

The mechanisms of and methods for creating cascade connections are very important in creating a site-to-site VPN using SoftEther VPN.

Using the cascade connection function enables the cascade connection of a Virtual Hub within the VPN Server to other Virtual Hubs operating on the same or separate computers.

When two Virtual Hubs are running on separate computers or even when they are running on the same computer, those hubs are originally not connected in any way so they are two completely isolated segments from the perspective of a layer 2 network. However, in many cases there may be a desire to run two Virtual Hubs as a single segment over a public IP network such as the Internet. For instance, a cascade connection is essential to build a site-to-site VPN (see 1.4 VPN Processing Principle and Communication Method). Using a cascade connection enables the connection of two or more Virtual Hubs as if connecting them with a very long network cable.

Cascading a remotely located Virtual Hub A with Virtual Hub B enables free layer 2 (Ethernet level) communication between a Virtual Network Adapter connected to A and a network computer locally bridged to A and a network adapter connected to B and a network computer locally bridged to B. In other words, the computers connected to each other's Virtual Hubs can communicate freely on a layer 2 level irrespective of the actual network topology, wherein that connection may be a virtual one by the VPN Client, or a physical network adapter's destination may be locally bridged to a Virtual Hub and that Virtual Hub is cascade connected to yet another hub so as to arrive at the destination computer.

Cascade connection between Virtual Hubs.

Cascading obviously requires the existence of two Virtual Hubs, i.e. a Virtual Hub to initiate the cascade connection and a Virtual Hub to receive it. From the perspective of the Virtual Hub receiving the cascade connection, the incoming connection is processed as a common VPN session (bridge / router mode session), in which case user authentication is required just as though a VPN Client were carrying out a VPN connection to a Virtual Hub.

Initiating & receiving cascade connection.

Creating a Cascade Connection

To create a cascade connection for a Virtual Hub to another Virtual Hub, click on the [Manage Cascade Connections] button in the VPN Server Manager. This displays [Cascade Connection on "Virtual Hub name"] window. Next click on [Create] and enter the relevant details for the VPN Server host name, Virtual Hub and user authentication. It is also possible to make the VPN connection via a HTTP or SOCKS proxy server in addition to using a direct TCP/IP connection when cascading.

The items to be entered when creating a new cascade connection are practically the same as those required for a creating a new VPN Client connection setting. Please therefore refer to 4.4 Making Connection to VPN Server for the meanings of each item.

All user authentication methods are available for cascade connections except smartcard authentication.

Cascade connection create & edit window.

Online & Offline Status of Cascade Connection

Upon creating a new cascade connection on a Virtual Hub, that cascade connection is offline. It is not possible to communicate on a cascade connection which is offline. To start communication using a cascade connection, select the desired cascade connection in the [Cascade Connection on "Virtual Hub name"] window of the VPN Server Manager and click the [Online] button.

Upon setting the cascade connection to online status, the Virtual Hub attempts to maintain the cascade connection as far as possible in line with the cascade connection settings. The cascade is successful once the connection to the destination VPN Server Virtual Hub is confirmed, and [Online (connected)] appears in the [Status] display. When an error occurs, the error code will appear in this [Status] display. When the cause of the error is attributed to an input error in the cascade connection settings, first take the cascade connection offline, correct the connection settings by clicking on the [Edit] button, and click the [Online] button once again.

As explained in 2.1 VPN Communication Protocol on reconnect settings where the VPN connection fails or is disconnected during communication, an attempt to reconnect is made every 10 seconds when the VPN session connection fails or is disconnected while cascading. In this way, the Virtual Hub attempts to maintain a constant connection with the cascade destination Virtual Hub as far as the latter's network allows.

Any change in the cascade connection status is recorded on the VPN Server's server log and Virtual Hub security log. Regularly checking these logs provides knowledge on cascade connection success and failure records and enables an understanding of the line status. Please refer to 3.10 Logging Service for details on how to view the VPN Server's server log and Virtual Hub security log.

Cascade connection management window.

Cascade Connection Security Policies

Security policies can be set as desired for cascade connection users so that the virtual Ethernet frames which travel over the cascade connection are subject to scrutiny on the hub receiving the cascade.

To apply security policies in relation to the virtual Ethernet frames which travel over the cascade connection on the hub initiating the cascade, click on the [Security policy] button in the cascade connection's connection settings window and set as desired.

However, some policies affect the packets sent to that session. Please regard to the description of each policy.

security policy settings applicable to Cascade sessions window.

Creatable Number of Cascade Connections

A maximum of 128 cascade connections can be created in a Virtual Hub, although in reality, it is not necessary to connect a large amount of cascade connections from a single Virtual Hub.

Cascade Connection Status

The cascade connection status of the hub initiating the cascade can be obtained at any time. Selecting the desired cascade connection in the [Cascade Connection on "Virtual Hub name"] window of the VPN Server Manager and clicking the [Status] button displays the communication status for that cascade connection session in real time. The communication status displayed here is virtually the same as the connections settings' communication status shown in the VPN Client Manager. For details, please refer to 4.5 Connect to VPN Server.

The hub receiving the cascade connection recognizes it as being a Bridge / Router Mode session, which means that it is shown in the Virtual Hub session list. Note that the cascade is not automatically displayed in the [Cascade connection] list of the receiving hub. For details, please refer to 3.4.5.

Points to Note when Performing a Cascade Connection

Cascading is a very convenient and useful function without which the value of the SoftEther VPN software would be halved. However, the following points should be observed in order to use the cascade connection properly.

• Before creating the cascade connection, careful consideration should be given to the design of the VPN network topology and notes should be taken to ensure the connection is used in a suitable manner. For instance, where three Virtual Hubs are each attached to their own site and those sites are in turn locally bridged to a physical LAN, cascading each of the Virtual Hubs results in a looped layer 2 network topology which can cause communication paralysis and give rise to broadcast storms. As such, any actions which result in the creation of a layer 2 loop should definitely be avoided when using the cascade connection.
• The SoftEther VPN Server's cascade connection function does not support the Spanning Tree Protocol.
• It is necessary to create a cascade connection setting for the Virtual Hub performing the cascade connection and to put it online. It is necessary to predefine the users to receive the cascade connection on the receiving Virtual Hub.
• The hub initiating the cascade treats the cascade connection the same as it treats a VPN connection by the VPN Client, so the settings for creating a cascade connection are similar to those for creating a new connection on the VPN Client.

Creating, Deleting, Modifying & Controlling a Cascade Connection with the vpncmd Utility

To control the cascade connection with the vpncmd utility, use commands beginning with "Cascade". These commands enable the same tasks performed by VPN Server Manager's GUI settings to be carried out with the vpncmd utility. Please refer to 6.4 VPN Server / VPN Bridge Management Command Reference (For Virtual Hub) for details on how to control a cascade connection using the vpncmd utility.