Resolving UWindsor Internet Connectivity Issues - Revision history

Preney: /* Unofficial Open Source Linux Global Protect Client */

2022-11-05T20:00:28Z

Unofficial Open Source Linux Global Protect Client

← Older revision		Revision as of 20:00, 5 November 2022
Line 23:		Line 23:
	The official (proprietary) Linux GlobalProtect VPN client program does not work properly under all Linux distributions, e.g., under Ubuntu it reports an "SSL handshake error" just when it should start working. Additionally, the official client also doesn't remember one's credentials for 30 days, etc. and prompts one to enter their login, password, and do MFA every single time.		The official (proprietary) Linux GlobalProtect VPN client program does not work properly under all Linux distributions, e.g., under Ubuntu it reports an "SSL handshake error" just when it should start working. Additionally, the official client also doesn't remember one's credentials for 30 days, etc. and prompts one to enter their login, password, and do MFA every single time.

	There is a better, unofficial open source '''Global Protect OpenConnect''' client program that establishes the VPN, behaves better, and is configurable, e.g., one can have to NOT set the default route to rout everything through the UWindsor VPN. The latter may be an issue, e.g., when you not at the U traffic not destined to UWindsor ~~will~~ be routed through UWindsor. (Instructions concerning this appear later on this page.)		There is a better, unofficial open source '''Global Protect OpenConnect''' client program that establishes the VPN, behaves better, and is configurable, e.g., one can have to NOT set the default route to rout everything through the UWindsor VPN. The latter may be an issue, e.g., if nothing is done then when you are not at the U traffic not destined to UWindsor can be routed through the UWindsor VPN. (Instructions concerning this appear later on this page.)

	==Connectivity From Outside the UWindsor Network==		==Connectivity From Outside the UWindsor Network==

Preney: Preney moved page UWindsor2022ConnectivityIssues to Resolving UWindsor Internet Connectivity Issues

2022-11-05T18:47:53Z

Preney moved page UWindsor2022ConnectivityIssues to Resolving UWindsor Internet Connectivity Issues

← Older revision	Revision as of 18:47, 5 November 2022
(No difference)

Preney: /* Connectivity From the UWindsor Network */

2022-11-05T18:37:45Z

Connectivity From the UWindsor Network

← Older revision		Revision as of 18:37, 5 November 2022
Line 49:		Line 49:
	*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.		*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.
	*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).		*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).
			* If using Linux (unofficial open source client):
			** NOTE: Generally using this is better than using the official GP VPN client which doesn't work under all Linuxes (including common ones such as Ubuntu).
			*# Follow the installation instructions at [https://github.com/yuezk/GlobalProtect-openconnect].
			*# After installation, the connection gateway to use is <code>securelogin.uwindsor.ca</code>. Test that this works.
			*# Optional: To have only UWindsor traffic flow through the VPN, install [https://github.com/dlenski/vpn-slice vpn-slice] following the instructions on that page (after checking whether or not your distribution's package manager has a package for this).
			# Edit <code>/etc/gpservice/gp.conf</code> so that <code>openconnect-args</code> is set to be: <code>openconnect-args=--script "vpn-slice 137.207.0.0/16 10.0.0.0/8 %192.168.0.0/16 %172.17.0.0/16"</code>.
			# %192.168.0.0/16 ensures the 192.168/16 network address range is not part of the VPN. Most person's home LAN addresses are in the 192.168. range. Modify or delete accordingly per your situation.
			# %172.17.0.0/16 is a typical docker0 network address. Modify (if you use Docker) or delete.
			# NOTE: Running <code>vpn-slice --help</code> will output help concerning command line options.
			# Reconnect to the UWindsor VPN for these settings to take effect.
	* If using Linux (official client):		* If using Linux (official client):
	# NOTE: Currently Global Protect VPN does not appear to work properly with at least Ubuntu --use the unofficial Global Protect OpenConnect software (see ~~below~~) instead.		** NOTE: Currently Global Protect VPN does not appear to work properly with at least Ubuntu --use the unofficial Global Protect OpenConnect software as that does work (see above) instead.
	*# On the https://www.uwindsor.ca page search for '''Global Protect VPN Linux''' and look in the results for sometihng like "Installing GlobalProtect VPN client on Linux" and click on that link.		*# On the https://www.uwindsor.ca page search for '''Global Protect VPN Linux''' and look in the results for sometihng like "Installing GlobalProtect VPN client on Linux" and click on that link.
	# As of this writing it is [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=120611 this link].		# As of this writing it is [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=120611 this link].
Line 70:		Line 80:
	*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.		*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.
	*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).		*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).
	* If using Linux (unofficial open source client):
	*# Follow the installation instructions at [https://github.com/yuezk/GlobalProtect-openconnect].
	*# After installation, the connection gateway to use is <code>securelogin.uwindsor.ca</code>. Test that this works.
	*# Optional: To have only UWindsor traffic flow through the VPN, install [https://github.com/dlenski/vpn-slice vpn-slice] following the instructions on that page (after checking whether or not your distribution's package manager has a package for this).
	# Edit <code>/etc/gpservice/gp.conf</code> so that <code>openconnect-args</code> is set to be: <code>openconnect-args=--script "vpn-slice 137.207.0.0/16 10.0.0.0/8 %192.168.0.0/16 %172.17.0.0/16"</code>.
	# %192.168.0.0/16 ensures the 192.168/16 network address range is not part of the VPN. Most person's home LAN addresses are in the 192.168. range. Modify or delete accordingly per your situation.
	# %172.17.0.0/16 is a typical docker0 network address. Modify (if you use Docker) or delete.
	# NOTE: Running <code>vpn-slice --help</code> will output help concerning command line options.
	# Reconnect to the UWindsor VPN for these settings to take effect.

	After Global Protect VPN is installed and active, you should be able to do the following:		After Global Protect VPN is installed and active, you should be able to do the following:

Preney at 18:35, 5 November 2022

2022-11-05T18:35:20Z

← Older revision		Revision as of 18:35, 5 November 2022
Line 1:		Line 1:
	=University of Windsor 2022 Connectivity Issues=		=University of Windsor 2022 Connectivity Issues=
	==Notice==		==Notice==
	The content of this page is current as of ~~Sept~~. 28, 2022. Should you have issues please create a SHARCNET ticket [mailto:help@sharcnet.ca help@sharcnet.ca] or [mailto:preney@sharcnet.ca email Paul Preney] (SHARCNET staff at UWindsor) to seek more assistance.		The content of this page is current as of Nov. 4, 2022. Should you have issues please create a SHARCNET ticket [mailto:help@sharcnet.ca help@sharcnet.ca] or [mailto:preney@sharcnet.ca email Paul Preney] (SHARCNET staff at UWindsor) to seek more assistance.

	==Overview==		==Overview==
Line 18:		Line 18:

	Finally, should you need to submit a ticket to UWindsor's ITS, you can do so via [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/Requests/ServiceCatalog the appropriate link on this page].		Finally, should you need to submit a ticket to UWindsor's ITS, you can do so via [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/Requests/ServiceCatalog the appropriate link on this page].

			===Unofficial Open Source Linux Global Protect Client===

			The official (proprietary) Linux GlobalProtect VPN client program does not work properly under all Linux distributions, e.g., under Ubuntu it reports an "SSL handshake error" just when it should start working. Additionally, the official client also doesn't remember one's credentials for 30 days, etc. and prompts one to enter their login, password, and do MFA every single time.

			There is a better, unofficial open source '''Global Protect OpenConnect''' client program that establishes the VPN, behaves better, and is configurable, e.g., one can have to NOT set the default route to rout everything through the UWindsor VPN. The latter may be an issue, e.g., when you not at the U traffic not destined to UWindsor will be routed through UWindsor. (Instructions concerning this appear later on this page.)

	==Connectivity From Outside the UWindsor Network==		==Connectivity From Outside the UWindsor Network==
Line 43:		Line 49:
	*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.		*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.
	*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).		*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).
	* If using Linux:		* If using Linux (official client):
			# NOTE: Currently Global Protect VPN does not appear to work properly with at least Ubuntu --use the unofficial Global Protect OpenConnect software (see below) instead.
	*# On the https://www.uwindsor.ca page search for '''Global Protect VPN Linux''' and look in the results for sometihng like "Installing GlobalProtect VPN client on Linux" and click on that link.		*# On the https://www.uwindsor.ca page search for '''Global Protect VPN Linux''' and look in the results for sometihng like "Installing GlobalProtect VPN client on Linux" and click on that link.
	# As of this writing it is [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=120611 this link].		# As of this writing it is [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=120611 this link].
Line 63:		Line 70:
	*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.		*# In the window that pops up (or look in your status/task bar for an "Earth" icon and click it) prompting you for a connection gateway, enter '''securelogin.uwindsor.ca''' and click the '''Connect''' icon.
	*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).		*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).
	# NOTE: ~~As of Sept~~. 28, ~~2022 Global Protect~~ VPN ~~does~~ not ~~appear~~ to ~~work properly with Ubuntu~~. ~~This means one can only~~ use ~~HTTP and HTTPS with web browser with Ubuntu at this time~~. :-(		* If using Linux (unofficial open source client):
			*# Follow the installation instructions at [https://github.com/yuezk/GlobalProtect-openconnect].
			*# After installation, the connection gateway to use is <code>securelogin.uwindsor.ca</code>. Test that this works.
			*# Optional: To have only UWindsor traffic flow through the VPN, install [https://github.com/dlenski/vpn-slice vpn-slice] following the instructions on that page (after checking whether or not your distribution's package manager has a package for this).
			# Edit <code>/etc/gpservice/gp.conf</code> so that <code>openconnect-args</code> is set to be: <code>openconnect-args=--script "vpn-slice 137.207.0.0/16 10.0.0.0/8 %192.168.0.0/16 %172.17.0.0/16"</code>.
			# %192.168.0.0/16 ensures the 192.168/16 network address range is not part of the VPN. Most person's home LAN addresses are in the 192.168. range. Modify or delete accordingly per your situation.
			# %172.17.0.0/16 is a typical docker0 network address. Modify (if you use Docker) or delete.
			# NOTE: Running <code>vpn-slice --help</code> will output help concerning command line options.
			# Reconnect to the UWindsor VPN for these settings to take effect.

	After Global Protect VPN is installed and active, you should be able to do the following:		After Global Protect VPN is installed and active, you should be able to do the following:
	* connect to any Digital Research Alliance of Canada (formerly Compute Canada) compute cluster login node using SSH		* connect to any Digital Research Alliance of Canada (formerly Compute Canada) compute cluster login node using SSH

	~~However, as of Sept. 30, 2022~~, one cannot do the following:		That said, one still cannot do the following:
	* Globus Connect Personal to transfer files		* Globus Connect Personal to transfer files
	* SSH to any of your Digital Research Alliance of Canada '''cloud''' nodes		* SSH to any of your Digital Research Alliance of Canada '''cloud''' nodes
Line 76:		Line 91:
	* Connect using SSH, rsync, and other protocols/tools to any other HPC clusters, e.g., CERN, EuroHPC, XSEDE (Access), etc.		* Connect using SSH, rsync, and other protocols/tools to any other HPC clusters, e.g., CERN, EuroHPC, XSEDE (Access), etc.
	** NOTE: You will need to open a ticket with ITS to have them allow this for you and your research team.		** NOTE: You will need to open a ticket with ITS to have them allow this for you and your research team.

	~~==Work-Around: Using GlobalProtect VPN Under Ubuntu Linux==~~

	Unfortunately, GlobalProtect VPN under Ubuntu Linux exhibits an <code>SSL handshake error</code> at the very last moment when it should just connect. This makes using GlobalProtect VPN under Ubuntu Linux not possible. There is a work-around however:

	* Install <code>libvirt</code> and <code>VirtManager</code> (or something that allows running virtual machines under Linux).
	* Install Debian Linux in a virtual machine --ensure KDE is installed as the GUI for GlobalProtect VPN will need Qt libraries.
	** I recommend using an installation method that does not require Internet connectivity to work.
	** Know it is possible in the Debian installer to get to an Advanced setup menu to skip certain things such as synchronizing with an NTP (network time protocol) server, etc. Use this method of installation if doing this at the University of Windsor as access to such services are blocked --and so things will hang at those points.
	* Install GlobalProtect VPN in the Debian Linux virtual machine. (This will work without issues.)
	* Install any software you want to use in the virtual machine over the Internet.

	==Work-Around: Connecting to SHARCNET/Compute Ontario/Alliance Resources If Only HTTP/HTTPS Are Available==		==Work-Around: Connecting to SHARCNET/Compute Ontario/Alliance Resources If Only HTTP/HTTPS Are Available==

Preney at 03:04, 18 October 2022

2022-10-18T03:04:17Z

← Older revision		Revision as of 03:04, 18 October 2022
Line 76:		Line 76:
	* Connect using SSH, rsync, and other protocols/tools to any other HPC clusters, e.g., CERN, EuroHPC, XSEDE (Access), etc.		* Connect using SSH, rsync, and other protocols/tools to any other HPC clusters, e.g., CERN, EuroHPC, XSEDE (Access), etc.
	** NOTE: You will need to open a ticket with ITS to have them allow this for you and your research team.		** NOTE: You will need to open a ticket with ITS to have them allow this for you and your research team.

			==Work-Around: Using GlobalProtect VPN Under Ubuntu Linux==

			Unfortunately, GlobalProtect VPN under Ubuntu Linux exhibits an <code>SSL handshake error</code> at the very last moment when it should just connect. This makes using GlobalProtect VPN under Ubuntu Linux not possible. There is a work-around however:

			* Install <code>libvirt</code> and <code>VirtManager</code> (or something that allows running virtual machines under Linux).
			* Install Debian Linux in a virtual machine --ensure KDE is installed as the GUI for GlobalProtect VPN will need Qt libraries.
			** I recommend using an installation method that does not require Internet connectivity to work.
			** Know it is possible in the Debian installer to get to an Advanced setup menu to skip certain things such as synchronizing with an NTP (network time protocol) server, etc. Use this method of installation if doing this at the University of Windsor as access to such services are blocked --and so things will hang at those points.
			* Install GlobalProtect VPN in the Debian Linux virtual machine. (This will work without issues.)
			* Install any software you want to use in the virtual machine over the Internet.

	==Work-Around: Connecting to SHARCNET/Compute Ontario/Alliance Resources If Only HTTP/HTTPS Are Available==		==Work-Around: Connecting to SHARCNET/Compute Ontario/Alliance Resources If Only HTTP/HTTPS Are Available==

Preney: /* Overview */

2022-09-28T17:01:40Z

Overview

← Older revision		Revision as of 17:01, 28 September 2022
Line 16:		Line 16:

	If one needs to use the University of Windsor's network, e.g., from home or elsewhere using GlobalProtect VPN installed and activated, then the content of this should help you connect to Digital Research Alliance of Canada (formerly Compute Canada) / SHARCNET resources.		If one needs to use the University of Windsor's network, e.g., from home or elsewhere using GlobalProtect VPN installed and activated, then the content of this should help you connect to Digital Research Alliance of Canada (formerly Compute Canada) / SHARCNET resources.

	~~ASIDE: The University of Windsor's ITS has been activity working to bring back various network services and has the following pages detailing their progress:~~
	* [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=145164 campus restoration of (network) services], and,
	* [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=144970 security requirements] for connecting to the University of Windsor's network.

	Finally, should you need to submit a ticket to UWindsor's ITS, you can do so via [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/Requests/ServiceCatalog the appropriate link on this page].		Finally, should you need to submit a ticket to UWindsor's ITS, you can do so via [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/Requests/ServiceCatalog the appropriate link on this page].

Preney: /* Work-Around: Connecting to a Cloud Node With SSH */

2022-09-28T16:59:37Z

Work-Around: Connecting to a Cloud Node With SSH

← Older revision		Revision as of 16:59, 28 September 2022
Line 121:		Line 121:

	What the "JumpHost" feature does is connect to the "JumpHost" machine first and then connects to the desired target machine. This does mean you will need to enter in your password twice: the first time is on the compute cluster login node and the second time will be the password for your cloud instance.		What the "JumpHost" feature does is connect to the "JumpHost" machine first and then connects to the desired target machine. This does mean you will need to enter in your password twice: the first time is on the compute cluster login node and the second time will be the password for your cloud instance.

			NOTE: You can also use JupyterHub (see earlier on this page), open a Terminal window, and then ssh to your cloud node as well.

	==Other Items==		==Other Items==

Preney: /* Connectivity From the UWindsor Network */

2022-09-28T16:57:44Z

Connectivity From the UWindsor Network

← Older revision		Revision as of 16:57, 28 September 2022
Line 35:		Line 35:

	Should you need to use anything other than HTTP and/or HTTPS web pages, then you must either:		Should you need to use anything other than HTTP and/or HTTPS web pages, then you must either:
	* if the machine you are using is '''owned~~'''~~ by the University of Windsor, then the SentinelOne software can be installed on it for full Internet access (local or external to the University network), or,		* if the machine you are using is '''owned by the University of Windsor''', then the SentinelOne software can be installed on it for full Internet access (local or external to the University network), or,
	* if the machine you are using is '''not owned''', then the Global Protect VPN software must be installed.		* if the machine you are using is '''not owned by the University of Windsor''', then the Global Protect VPN software must be installed.

	If you are unsure if the SentinelOne software is installed on your computer, see [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=144482 this link]. Your department's computer staff will be able to help you with installing SentinelOne.		If you are unsure if the SentinelOne software is installed on your computer, see [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=144482 this link]. Your department's computer staff will be able to help you with installing SentinelOne.

Preney: /* Connectivity From the UWindsor Network */

2022-09-28T16:57:13Z

Connectivity From the UWindsor Network

← Older revision		Revision as of 16:57, 28 September 2022
Line 42:		Line 42:
	To obtain and install Global Protect VPN on your computer:		To obtain and install Global Protect VPN on your computer:
	* If using Windows or MacOS:		* If using Windows or MacOS:
	*# Go to [https://securelogin.uwindsor.ca] to download the appropriate Global Protect VPN client.		*# Go to https://securelogin.uwindsor.ca to download the appropriate Global Protect VPN client.
	*# Install the downloaded client.		*# Install the downloaded client.
	*# Run the Global Protect VPN client program.		*# Run the Global Protect VPN client program.

Preney: /* Connectivity From the UWindsor Network */

2022-09-28T16:57:00Z

Connectivity From the UWindsor Network

← Older revision		Revision as of 16:57, 28 September 2022
Line 48:		Line 48:
	*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).		*# A browser window will open prompting you to login using your UWinID, password, and will require you to use MFA (e.g., approve the login using your phone).
	* If using Linux:		* If using Linux:
	*# On the [https://www.uwindsor.ca] page search for '''Global Protect VPN Linux''' and look in the results for sometihng like "Installing GlobalProtect VPN client on Linux" and click on that link.		*# On the https://www.uwindsor.ca page search for '''Global Protect VPN Linux''' and look in the results for sometihng like "Installing GlobalProtect VPN client on Linux" and click on that link.
	# As of this writing it is [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=120611 this link].		# As of this writing it is [https://uwindsor.teamdynamix.com/TDClient/1975/Portal/KB/ArticleDet?ID=120611 this link].
	*# If you are not already logged in to the UWindsor page, you will need to log in by clicking the '''Sign in''' link at the top-right hand side of the page.		*# If you are not already logged in to the UWindsor page, you will need to log in by clicking the '''Sign in''' link at the top-right hand side of the page.