SSL VPN
Reply
New User
cbeahm
Posts: 1
Registered: ‎12-19-2008
0

Network Connect Tunnel Drops with Error control channel disconnected due to error

We've been having issues with several users having their VPN tunnel randomly drop.  In reviewing the NCService log, I see the following messages in all cases:

 

2008/12/11 16:11:35.105 dsNcService: tC04 "DebugId" 'DSSSL_recv' [Debug] DSSSL_recv: returned 0x2746 error.
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'ncphandler' [Debug] ncphandler: control channel disconnected due to error 2746
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'session' [Debug] session: reconnecting attempts = 1
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'session' [Debug] session: Registering new timer for reconnection
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'adapter' [Debug] adapter: unregistering the adapter IO handler

 

In some cases the error is 2745 rather than 2746.  Has anybody else seen this or know  what may be causing it?

Visitor
Bill10421
Posts: 1
Registered: ‎05-28-2009
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

I'm experiancing the same error, did you have any resolution?
Visitor
Swal64
Posts: 1
Registered: ‎06-11-2009

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

We experienced the same error and upgrading to IVE version 6.3 R4 resolved it.
Visitor
Frederic
Posts: 3
Registered: ‎07-09-2008
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

Hello,

 

I'm running IVE OS v6.3R1.2 and I'm experiencing the same issue.

I've asked JTAC to investigate because I did not find any trace of this issue on the release note 6.3R4

 

Regards.

 

Trusted Contributor
Jickfoo
Posts: 401
Registered: ‎11-06-2007
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

BUMP

 

6.5R3.1 is give me this same problem. Anyone have any ideas?

New User
cgpoonam
Posts: 1
Registered: ‎06-09-2010
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

Did anyone find the cause or resolution for the "ncphandler: control channel disconnected due to error 2746" problem?

 

Appreciate your help in advance.

Recognized Expert
MattS
Posts: 205
Registered: ‎11-06-2007
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

Hi,

 

The information I can find on error 2746 is that is a disconnect  due to a TCP RESET.  The RESET usually happens due to the IVE or devices between the IVE and NC. A tcpdump on the IVE external port and NC ethernet port will find out where the RESET is coming from.  If the SSL control channel traffic is not being transferred between the NC client and the IVE then the NC session will be closed.

 

Some possible causes are client DHCP leases expiring; client interfaces going down; SSL traffic blocked so the IVE RESETs the connection; client IP changing when roaming is not enabled; third party software such as AVs or Firewalls on the client PC interfering with the NC connection or route monitoring enabled and the client route table changing.  Is http://kb.juniper.net/KB14131 applicable -are the clients using Verizon Aircard? 

Do the users see any pop-up messages about the failing NC connection?  Are they able to re-connect?   Can they access and log into the SA webpage and get their homepage during the failure?  

Trusted Contributor
Jickfoo
Posts: 401
Registered: ‎11-06-2007

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

http://forums.juniper.net/t5/SSL-VPN/Upgraded-to-6-5R3-1-now-users-complain-of-drops/m-p/40123#M7607

 

I fixed my issue. My problem occured because the ESP Rekey timer was set higher then the NCP Timeout. Even when you set your sessions to use ESP, NCP is still used to handle the control traffic. By default, the NCP timer is set to 2 hours. If you set your ESP rekey timeout to anything more then 2 hours. You will get this problem. The solution is to either to leave the ESP timeout at 1 hour or to increase to NCP timeout to a value higher then the ESP timeout.

 

Good Luck,

 

Justin

 

 

Visitor
epjls
Posts: 5
Registered: ‎06-14-2010
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

Does anyone have a solution for this issue? I am running 6.3R5 and just had a user show up with this symptom.

Visitor
epjls
Posts: 5
Registered: ‎06-14-2010
0

Re: Network Connect Tunnel Drops with Error control channel disconnected due to error

I found the rest of the blog and read about the ESP lifetime setting vs the NCP timeout. My ESP lifetime is set for 20 minutes and NCP timeout is 120 minutes so i already fit the scenerio that was described. I'm on 6.3R5 code. So far I have only seen this on the one user i am working with so will try some other things but was just checking to see if anyone else was still seeing the issue after adjusting the timers.

Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.