Classroom and Lab Computing

KarlBridge Authentication Server
Problems, Administration and Contacts

Contents

• Introduction — what's it all about
• Support — what we will do and not do
• Servers — there are two
• Problems — if you think there is a problem, do these things first
• Contacts — who you gonna call
• Configuration Changes — for new or changed bridges
• Server Files — just so you know
• Administrative Programs — for advanced administrators
• Changes and Outages — table of

Introduction

This page is for network support personnel responsible for "mobile" (open) network ports secured by KarlNet KarlBridge and KarlRouter hardware and Extreme Networks Summit switches.  It lists the contacts and procedures for reporting problems with the secure web server and the authentication program used by end-users to authenticate and gain network access.  Also see a summary of how it works and user information.

The web server is Microsoft Internet Information Server.  The portlogin.aspx and portlogout.aspx (and newer optional netlogin.aspx) pages invoke the CGI program "noah.exe".  A new instance of that program is launched for every login/logout, so there is no single "authentication server" that runs all the time.  However, new for 2004 is an SNMP trap service that the Summit switches notify when a port is disconnected; that removes the ACLs for the address, eliminating a need for users to logout.

Support

This service is offered to PSU campuses and departments on a conditional basis.  Before deploying mobile ports that depend on it we ask that you tell us:

• how many ports
• how many bridges/switches
• locations and local support personnel

Server capacity has not been an issue, but we must be sure we have the capacity for new ports and increased load on the server.

We will test connectivity to your bridge.  We will not debug problems with your bridge or its configuration.

Servers

The primary server and page is:
    https://clc.its.psu.edu/portlogin.aspx
A backup server and page is at:
    https://clc1.its.psu.edu/portlogin.aspx

Note the S after "http".

The same two machines run non-SSL servers.  If users can connect to http://clc.its.psu.edu (no S after http), then the path to the machine is ok and the server is probably down.

Problems

Note that if the login program reports system errors to the user, it also sends e-mail to administrators, so it is not necessary to report these error messages.

(1) Bridge at <name> <ip address> did not answer

If the SNMP set for the filter bypass does not receive a reply from the bridge(s) in 10 tries, the user is given this message.  The error is also e-mailed as noted above.

In the case of a segment with multiple bridges, the message is:

Bridges at <name>: only x of y answered

The user may be ok if s/he are on the part of the segment protected by a bridge that did acknowledge the filter bypass.

Authorized persons can use the config page to see which bridge is not working.

(2) Client Browser, No Reply

If there is no answer from https://clc.its.psu.edu, please do the following:

• Try http://clc.its.psu.edu -- the non-SSL server on the same machine.
• If OK: then machine and the network are ok, but the secure web server is down.  Please contact.
• If fails: next step.
• Ping clc.its.psu.edu.
• If OK: please contact.
• If fails: next step.
• Ping 128.118.155.1 (the gateway for that machine).
• If OK: please contact.
• If fails, please call TNS Network Operations Center (NOC) at 814-865-4662.

(3) Other Problems

If the server answers, but there is another problem logging in:

• Have the user read the error messages to you and write them down.
• Check that the bridge is operational.
• Check that the server's configuration is correct.
• Try snmp or ping tests from the config page see if the server can reach the bridge.
• Fix the problem if it is yours; contact us if it is ours.

Contacts

Server Down

Please verify that the server really is down as described above, and it is not a network problem.  Note that the web server is monitored continuously and outages are reported immediately to cell phones (if that mechanism is working).  There are occasional deliberate outages to reboot the server after installing something or to upgrade hardware.  Remember, your end users should know to try the backup server.

If you think the server is down, please contact the CLC Hotline.

Configuration Changes

New Fall 2005: we are developing a new database and web programs to access it to provide self-service for adding and changing device configurations.   Configuration changes can still be done the old way (see below), or you and request that you are added to the authorization list for the new service.  

To be given access to the new service at https://clc.its.psu.edu/MopAdmin/, send an email to us at  admin at staff.win.psu.edu with your access account userid, what unit (department, college, or campus) you are with and what devices you administer.

Old Way

Send email with configuration changes (new bridges, etc.) to admin at staff.win.psu.edu.  Please do not email Brian or Chris directly.    Entries should be in the form of:

[Hazleton] Bridge=146.186.xx.x  (use Switch= for Extreme Networks switches) Prefix=146.186.xx IPLow=y IPHigh=z Password=xxxxxx Timeout=600          (optional; default is 1800 seconds) Pals=no              (optional; default is NO)

(no leading blanks) would be appreciated.   Definitions of values:

• Bridge -- IP address of the Karl Bridge that the defined addresses are behind
• Switch -- IP address of the Extreme Networks switch (Alpine or Summit); use this in place of "Bridge"
• Prefix -- The first 3 octals of the IP addresses that are behind the bridge
• IPLow -- The lowest address (to be appended to the Prefix to define the first address behind the bridge)
• IPHigh -- The highest address
• Password -- The write-access password for the bridge (or admin password for the Extreme switch)
• Timeout -- Idle timeout setting; no activity on the port for this time and the bridge removes the filter bypass.  Default is 1800 (30 minutes); maximum is 1800 (30 minutes).  Doesn't apply to an Extreme Networks switch; ACL's are removed when the client disconnects.
• Pals -- Send a logon record to PALS so users can print (default = NO)

Server Files

Irrelevant now.

Administrative Programs

Several administrative programs are being replaced by a new system; part of that is working now; click here to try it. If you don't have access, send your userid and department or campus, to admin at staff.win.psu.edu requesting access to the MopAdmin application.  Provide your access account userid, what unit (department, college, or campus) you are with and what devices you administer.

Changes and Outages

For Fall 2005, changes are moved to the private page at https://clc.its.psu.edu/MopAdmin -- go there.