seems the receipt is getting denied. i've analyzed the reports but can't find specific info on what or why packets were dropped.

i did use netstat -a, but do not see the pcanywhere ports listed that i defined.

Maybe your lowdown cable company is blocking those ports? They have a bad habit of doing nasty things like that.

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

good idea but it can't be that 'cause when i use the section from your book about opening everything up in a test environment, i get great throughput from napster. can also get through to my remote host via pcanywhere.

wouldn't this HAVE to be a function of the protocol defs or ip filtering?

thanks,
roger

I've just tested it again, just to *make sure* I wasn't doing any special, and it does work.

Have you tried it both with the SecureNAT and the Firewall Client? It shouldn't make any difference but it might be worth trying.

Now, I am calling a machine that is directly connected to the Internet, and this machine does NOT run ISA Server and is NOT behind an ISA Server. There's nothing behind the machine I'm calling and the Internet. It is directly connected.

Are you trying a similar scenario?

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

quote:

---

Originally posted by tshinder:
Hi Brad,

I noticed that your "internal" client that is trying to call the external client on the Internet has a public IP address. Are you using public IP addresses for your private network?

Tom

---

Yes our internal network is using a public IP subnet... future plans are to change to a private subnet, but that class C is registered to us, so it shouldn't be a problem (I hope!)

I've got a lot of configuration to change, that's why it hasn't happened yet.

Hope this clarifies things,

Regards,
Brad

------------------
Brad Taylor - Computability Ltd.
brad.taylor@computability.ab.ca

Well, I don't *think* it should make a difference, esp. if you have everything else working correctly. We haven't deployed ISA using public IP address behind the ISA Server, but if you put them all in the LAT, it "shouldn't" cause a problem.

Did you ever get it to work with my protocol defintions?

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

quote:

---

Originally posted by tshinder:
Hi Brad,

Well, I don't *think* it should make a difference, esp. if you have everything else working correctly. We haven't deployed ISA using public IP address behind the ISA Server, but if you put them all in the LAT, it "shouldn't" cause a problem.

Did you ever get it to work with my protocol defintions?

Tom

---

Nope... and I haven't had too much time to play around with them

I don't have Firewall client installed, would that make a difference? (I can't remember if that was mentioned previously in the thread.)

Brad

pcAnywhere - directed
primary: TCP port 5631 outbound
secondary: TCP port 5631 inbound

pcAnywhere - broadcast
primary: UDP port 5632 send/receive
secondary: UDP port 5632 receive/send

Set up a protocol rule using both of these definitions.

Or use the first one and set the following registry value on the remote system:
HKLM\SOFTWARE\Symantec\pcAnywhere\CurrentVersion\System\TCPIPConnectIfUnknown=1

Note that if you don't set up the second protocol definition, you won't be able to browse the subnet for available pca hosts by entering a x.x.x.255 address.

I've also set HKLM\SOFTWARE\Symantec\pcAnywhere\CurrentVersion\System\TCPIPPortCompatibility=0 on the remote at least, but I don't know if that's required or not. (It forces pca to only connect using the ports defined in TCPIPDataPort and TCPIPStatusPort.)

(See http://service1.symantec.com/SUPPORT/pca.nsf/docid/1997471006 for the pcAnywhere registry settings.)

Let me know if these work or if there are better ones out there. It took me some time with NetMon to figure out what was going on, but I'm sure some of you are more adept and can refine these

HTH,
Brad

PS. I don't have the Firewall Client installed and I have _no_ idea how to connect to pca hosts behind ISA... but there seems to be quite a few articles about that out there on the microsoft and symantec knowledge bases.

One last thing... my usage of remote and host may be counter-intuitive: when I say remote, I mean the pc _behind_ ISA that is running pca in remote control mode and when I say host, I mean the pc out in the internet cloud.

quote:

---

Originally posted by BLTaylor:
A bit more info...

Here's what the pcAnywhere internet host is doing (netstat -a)

Active Connections

Proto Local Address Foreign Address State
TCP test-client-01:5632 TEST-CLIENT-01:0 LISTENING
TCP test-client-01:5631 TEST-CLIENT-01:0 LISTENING
TCP test-client-01:137 TEST-CLIENT-01:0 LISTENING
TCP test-client-01:138 TEST-CLIENT-01:0 LISTENING
TCP test-client-01:nbsession TEST-CLIENT-01:0 LISTENING
UDP test-client-01:5632 *:*
UDP test-client-01:nbname *:*
UDP test-client-01:nbdatagram *:*

I'm not sure where the first connection should be however.

I've tried 2 combinations: As Tom suggested above and a single protocol definition:
primary:
5632 TCP Out
secondary:
5632 TCP In
5631 TCP In
5631 TCP Out
5631 - 5632 UDP Send/Receive

Next I'm going to try revising the definitions Tom sent to include inbound replies.

I'll let you know...

Brad

---

------------------
Brad Taylor - Computability Ltd.
brad.taylor@computability.ab.ca

[This message has been edited by BLTaylor (edited 23 February 2001).]

[This message has been edited by BLTaylor (edited 23 February 2001).]

I followed your instructions....and it worked for me. Right now I can connect to a remote PcAnyhere from all clients behind ISA.

CrazyBoy...

you are genious ))
it also works for me now.

I just tested it out...
Thanks !

tcp in and out looks proper
pcAnywhere - directed
primary: TCP port 5631 outbound
secondary: TCP port 5631 inbound

but whats the diff between these two ?

pcAnywhere - broadcast
primary: UDP port 5632 send/receive
secondary: UDP port 5632 receive/send

pcAnywhere (TCP)
TCP port 5631 send
TCP port 1025-5000 receive

pcAnywhere (UDP)
UDP port 5632 send
UDP port 1025-5000 receive

then added a Protocol Rule allowing the two protocols.

Works just fine...

In Your Service,

Joseph King, MCSE

Now, can someone please explain why it works! What are secondaries and why do they make a difference here when the local (client) port is random?

quote:

---

Originally posted by BLTaylor:
I've managed to get two protcol definitions that work for me (anyway):

pcAnywhere - directed
primary: TCP port 5631 outbound
secondary: TCP port 5631 inbound

pcAnywhere - broadcast
primary: UDP port 5632 send/receive
secondary: UDP port 5632 receive/send

Set up a protocol rule using both of these definitions.

---

Wonder why it worked for you and me, but not for some of the others here?

Good to hear you got it working!

Tom

quote:

---

Originally posted by Crazyboy:
Hi tshinder,

I followed your instructions....and it worked for me. Right now I can connect to a remote PcAnyhere from all clients behind ISA.

CrazyBoy...

---

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Good to hear that it worked! Keep coming back to the site to solve your future problems

Thanks!

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Get it Here!

[This message has been edited by tksadmin (edited 22 May 2001).]

I finally got it to work as follows:
pcAnywhere (TCP)
TCP port 5631 send
TCP port 1025-5000 receive

pcAnywhere (UDP)
UDP port 5632 send
UDP port 1025-5000 receive

BUT, I don't like the way I am wide open coming in. Could this be an issue? Is there something else that I am missing with some of the other configurations.

JohnZ

Then added the 3023 port and it seemed to work for PcAnywhere 10. However not with 8.*, which is really strange since they supposedly use the same ports. Dunno.