Error <Thin Client Users cannot Log On>

Transcription

1 Error <Thin Client Users cannot Log On> Applicable Version: onwards Scenario Thin Client users cannot log on error may occur due to discrepancies in the CATC setup in your network. Given below are steps to troubleshoot CATC. These steps are based on the following network setup. The network comprises of Thin Clients that authenticate with an Active Directory Server ( ), which is the Remote Desktop Server (formerly, called Terminal Server). Cyberoam ( ) is Gateway for the Server and the users. The Remote Desktop Server has CATC as well as CTAS (Cyberoam Transparent Authentication Suite) clients installed in it.

2 To Troubleshoot CATC, follow the steps below. Step 1: Check Remote Desktop Server Configuration in Cyberoam To check the configuration: Login to Cyberoam CLI. Choose option 4. Cyberoam Console Execute the following command console> cyberoam auth thin-client show Step 2: Check Cyberoam Configuration in Remote Desktop Server To check configuration: Login to Server with Administrator profile Run the CATC Client to display the Cyberoam Authenticated Thin Client Suite window. Check if the configured Cyberoam IP address is correct. If not, update it.

3 Step 3: Check if LSP has been registered in Server To check the LSP in Server: Go to the Command Prompt. Traverse to the installation directory and execute the following command C:\Program Files\Cyberoam\Cyberoam Authenticated Thin Client> netsh winsock show catalog The TCP and UDP components of CATCLSP have to register with Winsock, as shown above, so that Cyberoam can intercept the user traffic. In case of a 64-bit operating system you will find two sets of Winsock registrations; One set for 32-bit and another set for 64-bit. If the LSP is not registered, you may follow the below troubleshooting tips. - Install CATC with Administrative rights. - Certain tools, like VMWare tools, hamper the CATC installation. Uninstall them before CATC installation and then reinstall them. If the problem still persists, contact Cyberoam Support. Step 4: Check if users are authenticated properly After login, when user starts surfing Internet, in other words, when a new TCP connection is initiated, CATC sends a UDP packet to Cyberoam. This UDP packet is sent to Cyberoam on port 6060 before the TCP connect call is completed and contains the following information.

4 Login Code (1 Byte) Session ID (2 Bytes) Source Port (2 Bytes) Destination Port (2 Bytes) Destination IP (4 Bytes) Username (64 Bytes) Based on the Session ID, Source and Destination ports Cyberoam authenticates the user who has sent the TCP request. Cyberoam then treats that user s traffic according to policies applied on him. You can see how Cyberoam authenticates user traffic by observing packet flow when a TCP connection is initiated by a user. As an example, we have taken a tcpdump on port 6060 when a user John Smith initiates an Internet connection. console> tcpdump "port 6060 or port 80 -xx" 11:55: PortB, IN: IP > : UDP, length 139 0x0000: a faf 0a E...w0...g.. 0x0010: 0a ac ec g...5.`... 0x0020: 8f00 50cb 5887 c26a 6f68 6e2e 736d P.X..john.smith 0x0030: d h..m.i.t.h...c.h 0x0040: e 004c 004f 0043.I.R.A.G...L.O.C 11:55: PortB, IN: IP > : Flags [S], seq , win 64240, options [mss 1460,nop,nop,sackOK], length 0 0x0000: efe 0a E..0w2@...g.. 0x0010: cb58 87c2 098f c0c e X...Pl... 0x0020: 7002 faf0 c b p... Description: > : Remote Desktop Server sends a UDP packet to Cyberoam on port : Login Request (60 in Hexadecimal = 96 in Decimal) 00 02: Session ID 09 8f: Source Port (098f in Hexadecimal = 2447 in Decimal) 00 50: Destination Port (0050 in Hexadecimal = 80 in Decimal) john.smith: Username > : TCP Packet reaches Cyberoam with Source Port 2447 and Destination Port 80 as mentioned in previous UDP packet.

5 As shown above, Cyberoam authenticates the TCP connection based on the source and destination ports it receives in the UDP packet. Certain applications like AntiVirus and Proxies tamper with the source and destination ports of the Internet traffic before it reaches Cyberoam. This results in the packets being dropped or being allowed through different Firewall Rules. To avoid this, it is recommended to install CATC before any such applications. Step 5: Check Authentication Server Settings in Cyberoam To check the settings go to Identity > Authentication > Firewall and check if AD Server is selected under Authentication Methods. Step 6: Check Authentication logs in Cyberoam To check logs go to Logs & Reports > Log Viewer > Log Viewer and set the filter for Authentication logs. You can also check if the user has been successfully authenticated from Identity > Live Users > Live Users.

6 Step 7: Minimize or disable UAC controls To know how to manage UAC Controls, refer the article When to Disable User Account Control (UAC) in Windows 2008 Server for Thin Client (CATC) users. Document Version: August, 2014