|
|
User Registration has several elements residing on different machines on the network. All of these elements must work correctly in order for the entire system to work. These sections help you resolve some problems that you might encounter:
These sections describe problems you might encounter while using the URT management interface, and how to resolve those problems:
If you add a switch to the network, you need to configure VMPS on the switch to use the URT servers. If the switch does not show up in the Switch folder in URT's left-hand pane:
Step 2 If URT is not running, start it. The switch should show up in the list.
(a). Select the Switch folder in URT.
(b). Select View>Refresh. The switch should appear in the list.
If you cannot change the VMPS configuration on a switch through the URT management interface, the SNMP community strings are probably not correctly set in CWSI Campus.
If URT cannot configure VMPS on a switch, you receive this message:
The ip-address variable shows the IP addresses of all switches whose configuration could not be changed.
To set the SNMP community strings in CWSI Campus for these switches:
Step 2 Select Edit>SNMP Communities. Enter the community strings for the switches using this format:
In this example, public is the read community string, private is the write community string.
All installed URT servers should show up in the URT Servers folder in the left pane in the URT management interface. It takes a minute or so for a URT server to show up in this folder if the URT server is just started.
If the URT management interface is already running when you started or installed the URT server, you need to refresh the URT Servers folder. Select the folder and select View>Refresh.
If refreshing the folder does not solve the problem, check the URT server to ensure that it is running. Check the Windows NT Task Manager's Process tab on the server machine and ensure that UrtService and urtsvc are running. If these processes are not running, restart the URT server. See "Starting, Stopping, or Disabling a URT Server" in Chapter 5 for more information.
If there are a large number of users, groups, or organizational units in a domain or NDS directory, URT can take several minutes to download the entire list of names from the domain controller or NetWare server. If the domain controller or NetWare server becomes unavailable during the download, URT will show no users in the NT/NDS Domain folder for the domain. To retry the download, select the folder and select View>Refresh.
All currently running Windows NT Microsoft Networking clients should appear in the NT Host folder (displayed in the right pane) in the NT domain folder for the machine's NT domain. Windows NT machines must appear in this folder for you to install the client service on them. (This does not apply to Windows NT hosts that use NetWare.)
For a workstation to appear in URT, it also must appear in Network Neighborhood. Otherwise, URT cannot see the host. See the Microsoft Windows NT documentation for more information about Network Neighborhood.
Once the host shows up in Network Neighborhood, select the NT Hosts folder and select View>Refresh to refresh the list in the right pane.
When you select a VLAN in the left pane in URT, the right pane includes a list of logged-on users. This list includes users on dynamic and static switch ports.
If a user on a static switch port does not show up in this list, even though the user is logged on, it means that there is no record for the user in the CWSI Campus UserTracking tables. You must update the UserTracking tables before the user appears in URT.
To update the UserTracking tables for a user on a static port:
Step 2 Once the discovery is complete, Action>Display>All Entries.
Check to ensure the user's machine was discovered. The NT user name should be shown in the record.
In order to make changes to VLAN associations for an NT domain, you must use an NT account with Administrator authority to the NT domain being changed. You can do this with an account in a domain that has appropriate trust relationships to the other domains you want to change, or you can use separate accounts for each domain.
If you try to change settings for a domain when the account you are currently using does not have Administrator authority in the domain, URT prompts you to log into the domain. You must log in using the NT_DOMAIN\username format for the account name.
However, due to Windows NT limitations, you will not be able to change URT settings for a domain if you have already been authenticated for that domain using a non-Administrator account. Windows NT displays this message when you try to log in:
Windows NT does not allow you to hold more than one set of credentials at a time for a specific NT domain. If this happens, you must log into NT again using an account with Administrator authority.
Here are some examples of how you might have been authenticated in a domain:
In order to make changes to VLAN associations for an NDS directory, you must use an NDS account with read and browse privileges to the NDS directory being changed.
If you are not logged into the NDS directory that you are trying to change, you are prompted to log in with a user account that has browse and read privileges. If you are logged into NDS with a user account does not have browse and read privileges to the directory, you must exit URT and log into the NetWare network with an appropriate account.
There are several errors that you might encounter when installing the URT client service on Windows NT machines that use Microsoft Networking. In addition to these messages, URT shows the status of the URT client service in the Host List shown in the right-hand pane when you select NT Hosts in the left-hand pane. This section discusses some likely errors based on installation error messages and client service status.
Error Message The RPC server is unavailable
Explanation If the URT client status is Service Query Error, the Windows NT host probably does not have an IP address. This happens if you are using the Release IP on logout setting (see "Ensuring that Logged-Out Users Do Not Hold an IP Address" in Chapter 4).
Another possibility is that the IP address for the workstation has changed since the last time WINS was updated, so that the WINS entry for the workstation contains the wrong IP address for the machine.
Recommended Action If you are using Release IP address on logout, you can only reinstall the client if a user is logged into the machine, or if the Windows NT logon dialog is displayed. If the problem is due to WINS, wait five to ten minutes for WINS to be updated (when the workstation appears in Network Neighborhood, WINS has been updated).
Error Message The dependency service or group failed to start
Explanation The Windows NT machine does not use DHCP.
Recommended Action You cannot install the URT client service on a machine that is not using DHCP.
Error Message The process cannot access the file because it is being
used by another process
Explanation One of the URT client service files was active when you tried reinstalling the software.
Recommended Action No action required. The installation completes successfully even if you get this message.
When you install URT, you select whether you want to continue to create MAC-to-VLAN mappings in addition to the user-to-VLAN mappings you can do in URT. You must use UserTracking to create these MAC-based mappings.
If you choose not to support MAC-based mappings, you will not be able to use the URT Update MAC to VLAN Mappings command to update the URT servers with mappings created in UserTracking.
If you decide you do want to use MAC-based mappings after all, you must reconfigure the URT servers to allow these mappings. See "Viewing and Configuring URT Server Characteristics" in Chapter 5 for the procedure.
If you are having problems getting Resource Manager Essentials (part of CiscoWorks2000) to run correctly after you install URT, try setting an environment variable on the machine running Resource Manager Essentials and URT. If this does not solve the problem, call Cisco Technical Support.
Step 2 Select the System Variables group by clicking in the list. This selects an existing variable, but you must have an active selection in this list before you can add a variable. Add the variable as described in Table 7-1.
Step 3 Click Set.
Step 4 Verify that the variable was added to the System Variables list, not to the User Variables list.
Step 5 Click OK and reboot the machine.
Cisco Technical Support might require trace and log information to resolve problems you experience with URT. The information in these logs in mainly of interest to Cisco. You may or may not be able to interpret the log messages. Table 7-2 describes the logs URT creates.
These sections describe problems you might encounter with the VLAN associations you create in URT, and how to resolve those problems:
URT can only dynamically assign a user and machine to an appropriate VLAN if the machine is connected directly to a switch port that allows dynamic VLAN membership. If there is a hub between the switch and the user (for example, if the user has a hub at their desk to accommodate several computers), you cannot assign the user to a VLAN based on user name.
Create a static VLAN mapping for ports that are connected to hubs.
When you select a user in URT, you can see the user's VLAN associations, and actual logon status, in the right-hand pane. From this information, you can determine if the user is actually logged into the correct VLAN (based on your VLAN association).
If there is a mismatch between the VLAN association and the actual logon status for the user, check these items to determine the cause of the incorrect logon:
1. If you have more than one VTP domain, make sure the user is logged into a VTP domain for which you have created a VLAN association. The Logon Information for a user shows the VTP domain for each of the user's current machines.
If the user is logged into a VTP domain for which you have not created a VLAN association, the user is placed in the logon VLAN for the VTP domain, unless the user belongs to a group or organizational unit that has a VLAN association. See "What Happens When a User with Both NT and NDS Names Logs In?" and "What Happens If an Unmapped User Logs In?" in Chapter 1 for information about how URT chooses the VLAN association.
2. Does the user have both Microsoft Networking and NetWare user accounts?
If a user has multiple accounts, and you map the user names to different VLANs, URT uses the mapping for the first logon that is processed. For example, if you configure the workstation to log into NetWare first, then log into the NT domain controller, the user is given the VLAN association for the NetWare user name.
3. Is the user directly connected to a supported switch?
URT cannot handle users connected to your network over serial connections (dial-in, ISDN, and so forth), or users connected to hubs.
4. Is the switch port static or dynamic?
In the Logon Information for the user, you can determine the switch and switch port for the user. Then, use the CWSI Campus UserTracking application to view the port status for the switch. If the user is attached to a static port, URT cannot switch the user to a different VLAN: the user is placed in the VLAN defined on the switch for that port.
To make it possible for URT to place the user in the correct VLAN, use UserTracking or CiscoView to change the port status to dynamic.
5. Is VMPS configured correctly on the switch?
The switch must be configured to use URT servers as VMPS servers before URT can handle users connected to the network through the switch.
6. Is URT installed on the user's machine?
If the user's machine is Windows 95 or Windows 98, the URT client service is automatically installed on the machine during network logon.
If the user's machine is Windows NT, you must install the URT client service. For machines that use Microsoft Networking, you can check the installation status by selecting the NT Hosts folder in the user's NT domain, and finding the name of the user's machine in the Hosts in Domain list. The Service Status column shows the status of the server. If the status is Service Query Error or Not Installed, install the URT client service. See "Installing the URT Client Service on Workstations" in Chapter 6 for the procedure.
7. Is the correct URT script on the domain controller?
You can check the domain controller or NetWare server for the urt.bat file, or you can just reinstall the URT script to ensure it is up to date.
Next, check to ensure that the logon script calls the URT script. See "Installing the URT Script on the Domain Controller" in Chapter 6 for the procedure.
8. If none of these steps solves the problem, contact Cisco Technical Support.
A user might be logged into the correct associated VLAN from one machine but not from another for several reasons:
If URT resets the switch port to the VLAN associated with a user, but the IP address remains in a subnet associated with the logon VLAN, then there is a problem with the routing setup for DHCP on your network.
To ensure routing is done correctly:
A static switch port must be assigned a VLAN. If you do not assign a specific VLAN to the port, the switch assigns a default VLAN to the port. For some switches, such as the Catalyst 2900XL or the Catalyst 4000, the default VLAN is VLAN 1. For other switches, such as the Catalyst 1900, the default VLAN is whichever VLAN was last used on the port. The default VLAN may not supply the networking services required by the machine connected to the switch.
If you change the port status from dynamic to static, make sure you also assign a specific and appropriate VLAN to the port (based on how you have defined services for your VLANs). For most switches, you can make this assignment when you change the port state using the CiscoWorks2000 User Tracking or CiscoView applications. If setting the port state and VLAN is not supported in these applications for your switch, you must use the switch's command line.
These sections describe problems you might encounter with the URT servers, and how to resolve those problems:
If the URT server starts correctly, and you have configured the switches to use it as a VMPS server, it should respond to VMPS queries correctly.
If the URT server is not responding to VMPS queries, check for these problems:
If URT server installation fails with the message "URT install: urtsvc could not be installed. Return error= 1073 Failed to install NT service," it is likely that a previous attempt to install the URT server was aborted.
To clean up the aborted installation, first uninstall the URT server. See "Uninstall the URT Servers" in Appendix A for more information.
If a URT server becomes unavailable, the server's icon in the folder view is shown with a red X through it. The X goes away when the server becomes available. When you see a server with an X through the icon, check the server and resolve any problems that you find.
Uninstalled servers also appear in the management interface with a red X through the icon. Although the URT scripts are given this server's IP address, this has no effect on URT processing. When you restart ANI, these uninstalled servers are removed from the management interface, and any subsequent URT scripts that you install do not include the uninstalled server's IP address.
These sections describe problems you might encounter with the clients supported by URT, and how to resolve those problems:
If users occasionally cannot obtain IP addresses during logon or logout, you might not have enough IP addresses available in the subnets used by the URT logon VLAN. Users are assigned an IP address from this pool of addresses before URT switches them into their associated VLAN. Users also get an address from this pool when they log out of the network. If a user is not associated with a different VLAN than the logon VLAN, the user keeps that IP address.
You must have sufficient IP addresses on this VLAN to handle logon and logout traffic, and for all the users in your network not associated with a different VLAN.
Besides adding subnets to the logon VLAN (see "Setting Up (or Changing) a URT Logon VLAN" in Chapter 4), you can configure URT to prevent Microsoft Networking users on Windows NT workstations from obtaining an IP address when they log out of the network (see "Ensuring that Logged-Out Users Do Not Hold an IP Address" in Chapter 4).
Another potential problem might be that you do not have the DHCP helper addresses defined in the routers. The helper addresses ensure that DHCP packets are forwarded to the DHCP servers.
Normally, URT will not prevent logons, even if some URT servers are unavailable. Several things can cause these network error messages. If URT is the cause of this error, it will be due to one of these reasons:
Typically, the network error problem can be resolved by the user retrying the logon. If all URT servers are down, however, you must resolve the problems preventing connectivity to the servers.
If users get this message during logon, it means that they were unable to connect to the DHCP server. Typically, this is due to network load. Have the user retry the logon one or more times. If this does not resolve the problem, check the DHCP server to ensure that it is working correctly.
If users get this message during logon, it means that the domain controller did not respond to the user's logon before the logon timed out. The user should log out and log back in. If that does not resolve the problem, the user should restart the computer. If the problem persists, check the domain controllers to ensure that they are functioning correctly.
Users who get this message are placed in the URT logon VLAN.
If users get this message during logon, it means that they were unable to connect to the DHCP server. Typically, this is due to network load. Have the user retry the logon one or more times. If this does not resolve the problem, check the DHCP server to ensure that it is working correctly.
If users get this message during logon, it means that the domain controller did not respond to the user's logon before the logon timed out. The user should log out and log back in. If that does not resolve the problem, the user should restart the computer. If the problem persists, check the domain controllers to ensure that they are functioning correctly.
If you run Microsoft's System Management Server (SMS), or another asynchronous application, during user logon, URT can switch the user's VLAN before the application finishes. This can prevent the normal functioning of the application.
In order to give the asynchronous application time to finish, you must delay URT's switching VLANs.
Step 2 Add the -delay n-secs option to the onoffhandler command. You might need to experiment with the number of seconds (n-secs) to determine the best delay time for your network.
For example, to delay URT for 5 seconds, update the onoffhandler command with this change:
Do not change the other parameters on the onoffhandler command: they are set by URT when you install the script.
Posted: Wed May 14 10:45:05 PDT 2003
All contents are Copyright © 1992--2003 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.