Best Technology Articles

Well yesterday a friend came to me and said that his usb drive was not working, i plugged it into my computer and my pc detected it but was unable to format it or access it. so i googled for a solution and found a tool called "On Belay". a shareware with some days before it asks for registeration so i decided it and gave it a try. there was a format button , and it detected the usb drive and formatted it and it told me to plug out the usb and plug back in and when i plugged it back in the usb drive was working. here is the link for the tool.

Download Link

The same day another friend came to me and said that the usb drive was not working. well now that i had the solution i tried the same tool again. but to my surprise it did not work. the message it gave was that there was no media present. well that gave me a shock and i googled again for another tool. well i found two other tools. here they are

HP Usb Drive Format Tool

HDD Low Level Format Tool

i tried the same and both of them did not work, the same media message , i started googling again and finally i read about it in a forum , that some times the power outage or extra power simply burns the usb chip which is usually what the media is located on. but one thing is still bugging me if the chip has burnt why the window is still detecting it and showing it as a removable drive. could some body please explain that to me. i have also tried the manufacturer's tool too.

Try the following techniques to improve the performance of the VPN tunnel:

1. On the client
   1. Increase CPU processing power.
   2. Eliminate or stop nonessential processes that use CPU time.
   3. Increase the bandwidth of the Internet connection by using direct access (cable/DSL) in place of dial-up connections, if possible.
      
2. On the server
   To free memory, stop unnecessary proxy services on the firewall such as SQLNetd, NNTPd, and others.

Note: Disabling proxy daemons lessens the ability of the firewall to fully examine packets at the application layer and may lower the degree of security established on the system. Only disable proxy services if you are certain that they are not in use by the firewall either directly (for instance, DNSd) or indirectly (in rules). If you are not sure of the effect of disabling certain proxy services, consult a Technical Support representative before disabling proxy services.

1. Tunnel Parameters
   1. VPN Policy parameters
      1. Disable Compression on the VPN Policy
      2. Set rekey limits to their defaults (Data Volume: 2100000, Lifetime: 480, Inactivity: 0)
      3. You may also try using a DES VPN Policy in lieu of a 3DES VPN Policy if CPU power is a concern.
         
   2. Disabling/Enabling VPN tunnel use of the Proxy Services
      1. In most cases, a VPN Policy that uses the Proxy services is only required when the administrator wishes to:
         1. Restrict access to services through the tunnel (for instance, only telnet is allowed through the tunnel)
         2. NAT'ing is necessary for packets to return to the firewall (that is, the internal hosts behind the firewall/VPN server do not use the firewall/VPN server in any way, shape or form as their default gateway).
      2. If you do not need to restrict access to specific services through the tunnel (all ports and protocols are allowed through a VPN tunnel to the defined Local Entity of the Secure Tunnel) and, NAT is not necessary because internal hosts use the firewall/VPN server as their default gateway, this setting can be disabled. However, if you wish to restrict services to the tunnel or must use the NAT feature of the firewall/VPN server, this setting must be enabled.
      3. To disable the Proxy Services feature, on the VPN Policy used by the tunnel, clear the "Pass Traffic from the Secure Tunnel to the Proxy Services (Required for NAT)" check box.
         
2. Proxy Services
   There are several rule-based items you can analyze and change to improve the throughput of a VPN tunnel that uses the Proxy services:
   1. Make the VPN rules as specific as possible (including Source, Destination, Out Via, and the Services). If possible, try to avoid multiple rules identifying as a source as the firewall scans the entire rule database to determine a "best fit" application.
   2. If possible, avoid using "all*" as a service in rules, but rather specify the individual services for the VPN rule.
   3. Disable "Log Normal Activity" (on the Miscellaneous tab). This will stop the Logging daemon from logging activity that this rule applies to.
   4. Disable "Application Data Scanning." Disabling this feature invokes the FastPath mechanism (HTTP) or the Kernel Proxy (all other Proxy services) for those services that apply to the specific rule. For information on FastPath and the Kernel Proxy, review the Firewall documentation provided with your product.
      
3. Address Transforms
   If you need to use Address Transforms (the firewall/VPN server NAT functionality), try the following to improve performance:
   1. Use the "Use Gateway Address" option in the Address Transform in place of a NAT pool.
   2. Make the Address Transform specific to your VPN Tunnel (the "best fit" method applies to Address Transforms as it does to rules. See item 4.1, above), and leave the default VPNTunnelExitTransform and VPNTunnelEntryTransform at their defaults.

Question/Issue:

Your client VPN tunnels are experiencing high latency or slower throughput than expected. For instance, file transfers through the VPN tunnel take extended periods of time, or client requests such as telnet or FTP receive slow responses.


Solution:
VPN Client performance depends on several factors including processor (CPU) power, levels of encryption, Internet connection bandwidth, and others. Use the following information to troubleshoot VPN performance issues:

The following items affect VPN performance
On the client

• CPU processing power of the client computer.
• Bandwidth (speed) of the Internet connection.
  

On the server

• CPU processing power of the firewall/VPN server.
• The VPN Policy being used for the tunnel such as encryption and integrity level, data compression, and rekey intervals.
• Proxy analysis of packets (configuration of rules to pass traffic to the proxy services).
• NAT types, if being used.
• The patch level of the firewall/VPN server.

Installing and Configuring a Windows Server 2003 Enterprise Certification Authority

Certification Authorities (CAs) issue certificates for a number of different purposes. In the context of your ISA Server firewall/VPN server, a CA can provide a certificate that allows:

• L2TP/IPSec VPN connections from VPN clients

VPN clients can establish L2TP/IPSec connections to the ISA Server firewall/VPN server. A machine certificate is required to create the IPSec encrypted tunnel.

• L2TP/IPSec VPN connections from VPN gateways (VPN routers)

Remote VPN gateways can call the ISA Server firewall/VPN server and establish a gateway to gateway link. VPN gateways act as VPN routers and allow packets to be routed between networks through a the VPN tunnel established between the VPN gateways.

• L2TP/IPSec VPN connections to VPN servers

The ISA Server firewall/VPN server may need to establish a VPN client connection to a VPN server. For example, some Internet Service Providers require machines to establish a VPN connection with their own VPN server to obtain a public address for the ISA Server firewall/VPN server’s external interface. In this case. the ISA Server firewall/VPN server is a VPN client to the ISP’s VPN server.

• Certificate-based user authentication using a certificate stored on the user machine

Users can obtain certificates and use those certificates to authenticate with the VPN server. The user certificate is stored on the user’s computer and a VPN connectoid (dial-up connection) can be configured to present this certificate during the PPP (in this case, EAP-TLS) user authentication process.

• Certificate-based user authentication using a certificate stored on a Smart Card

A user certificate can be stored on a Smart Card. The user certificate is stored on a Smart Card and the VPN connectoid is configured to present the Smart Card certificate during the PPP (in this case, EAP-TLS) user authentication process.

A Microsoft Certificate Server can take on one of four roles:

• Enterprise Root CA
• Enterprise Subordinate CA
• Stand-alone Root CA
• Stand-alone Subordinate CA

A Microsoft Enterprise CA has the following characteristics:

• The enterprise CA must be a member of a Windows 2000 or Windows Server 2003 Active Directory domain
• The enterprise Root CA certificate is automatically added to the Trusted Root Certification Authorities node for all users and computers in the domain
• User certificates can be issued that allow users to log on to the Active Directory domain using computer-stored certificates or certificates installed on Smart Cards
• User certificates and the Certificate Revocation List (CRL) are stored in the Active Directory
• In contrast to stand-alone CAs, an enterprise CA issues certificates via certificate templates that can be added and customized by the CA administrator
• In contrast to the stand-alone CA, the enterprise CA confirms the credentials of the user requesting a certificate
• The subject name (the name of the user or computer) on the certificate can be entered manually or automatically

We recommend that you install an Enterprise CA if:

• You have an Active Directory domain, and/or
• You require automatic deployment of certificates to users and computers

The enterprise CA is the ideal solution for any network with a Windows 2000 or Windows Server 2003 domain. All domain members can be assigned certificates via Group Policy based certificate autoenrollment. You can limit the scope of autoenrollment by assigning permissions to the certificate template used for autoenrollment. Users and computers that are not domain members can use the Web enrollment site to obtain certificates.

If you want to support certificate enrollment via Web enrollment site, then you must install the Internet Information Services World Wide Web service before installing Microsoft Certificate Services.

In this ISA Server 2000 VPN Deployment Kit document we cover the following procedures:

• Installing the Internet Information Services 6.0 World Wide Web service (W3SVC) to support the enterprise CA Web enrollment site
• Installing the Windows Server 2003 Certificate Services on a domain controller. The CA is installed as an enterprise CA.

Note:
You can install an enterprise CA on any domain member. The machine does not need to be a domain controller.

Installing Microsoft Internet Information Services World Wide Web Service

Perform the following steps to install IIS 6.0 on the Windows Server 2003 member server or domain controller computer that will be the enterprise CA:

1. Click Start, point to Control Panel and click Add or Remove Programs.
2. Click the Add/Remove Windows Components button in the Add or Remove Programs window (figure 1).

Figure 1 (fig111)

3. On the Windows Components window, click on the Application Server entry and click the Details button (figure 2).

Figure 2 (fig112)

4. On the Application Server page, click on the Internet Information Services (IIS) entry and click the Details button (figure 3).

Figure 3 (fig113)

5. IN the Internet Information Service (IIS) dialog box, put a checkmark in the World Wide Web Service checkbox and click OK (figure 4).

Figure 4 (fig114)

6. Click OK on the Application Server dialog box (figure 5).

Figure 5 (fig115)

7. Click Next on the Windows Components dialog box (figure 6).

Figure 6 (fig116)

8. Click Finish on the Completing the Windows Components Wizard page (figure 7).

Figure 7 (fig117)

Installing Microsoft Certificate Services

Perform the following steps to install and configure an enterprise CA on a Windows Server 2003 computer:

Note:
You must install the enterprise CA on a member server or domain controller on your internal network.

1. At a member server or domain controller in your internal network, log on as a domain administrator. Click Start, point to Control Panel and click Add/Remove Programs.
2. In the Add or Remove Programs window (figure 8), click the Add/Remove Windows Components button.

Figure 8 (fig100)

3. In the Windows Components dialog box (figure 9), click on the Certificate Services entry and click the Details button.

Figure 9 (fig101)

4. In the Certificate Services dialog box, put a checkmark in the Certificate Services CA checkbox (figure 10). A Microsoft Certificate Services dialog box appears and informs you that you can not change the machine name or the domain membership of the machine while it acts as a certificate server. Read the information in the dialog box and click Yes.

Figure 10 (fig102)

5. Both the Certificate Services CA and Certificate Services Web Enrollment Support checkboxes are checked (figure 11). Click OK in the Certificate Services dialog box.

Figure 11 (fig103)

6. Click Next in the Windows Components dialog box (figure 12).

Figure 12 (fig104)

7. Select the Enterprise root CA option on the CA Type page (figure 13). Click Next.

Figure 13 (fig118)

8. On the CA Identifying Information page (figure 14), type in a Common name for this CA. The common name of the CA is typically the DNS host name or NetBIOS name (computer name) of the machine running Certificate Services. In this example, the name of the machine is WIN2003DC, so we enter WIN2003DC in the Common name for this CA text box. The default Validity Period of the CA’s self-signed certificate is 5 years. Accept this default value unless you have a reason to change it. Click Next.

Figure 14 (fig106)

9. On the Certificate Database Settings page (figure 15), use the default locations for the Certificate Database and Certificate Database Log. You do not need to specify a shared folder to store configuration information because this information will be stored in the Active Directory. Click Next.

Figure 15 (fig107)

10. Click Yes on the Microsoft Certificate Services dialog box (figure 16) informing you Internet Information Services must be temporarily stopped.

Figure 16 (fig108)

11. Click Yes on the Microsoft Certificate Services dialog box (figure 17) informing you Active Server Pages must be enabled on IIS if you wish to use the Certificate Services Web enrollment site.

Figure 17 (fig109)

12. Click Finish on the Completing the Windows Components Wizard page (figure 18).

Figure 18 (fig110)

13. Close the Add or Remove Programs window.

The Enterprise Certificate Authority is now installed and can issue certificates without requiring a machine restart.

For Windows to automatically log on a user account during the startup process, the following must be met:

- The Welcome screen must be available
- Guest account access must be turned off
- There must be only one user account on the computer
- The user account must not have a password


Auto-Dial: Disconnect/Disable

Check your settings here:

Right click the My computer icon (Desktop), open Manage/Services and Applications/Services. In the right pane scroll down to Remote Access Auto Connection Manager and double click it. Use the Startup type drop box and choose Disabled.

Network Connections/Advanced/Dial-Up Preferences/Enable Auto-Dial by Location/Uncheck all locations and Always ask me before Auto-Dialing.

Also check all programs with a Notification Area icon (system tray) for an option to disable or not start at startup. Most can be unselected here: Start/Run/Msconfig/Startup and/or removed from here: Start/Run/Regedit

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Windows has the option to automatically dial your Internet Service Provider (ISP) to establish an Internet connection. This option can be controlled using this tweak.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Create a new binary value named "EnableAutodial", and set the new value to equal "01 00 00 00" to enable autodial or "00 00 00 00" to disable it.

Note: This restriction can be used either on a user by user basis by adding it to HKEY_CURRENT_USER or on a computer wide basis by adding it to HKEY_LOCAL_MACHINE.

To view the list of names and addresses recorded by AutoDial, type the following command at a command
prompt: rasautou -s

To delete a name or address entry from the list: Start/Run/Regedit

HKEY_CURRENT_USER\Software\Microsoft\RAS Autodial\Addresses

You can delete any TCP/IP addresses that you see under this key. Note that AutoDial can use IP addresses, DNS fully qualified domain names (FQDN), and NetBIOS names.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To enable this option so that it is always checked, use the following steps to edit the registry:

1.	Start Registry Editor (Regedt32.exe).
2.	Locate and select the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
3.	From the Edit menu, click Add Value, and type the following information: Value Name: RasForce Data Type: REG_SZ Value: 1

NOTE: After you add this value, the Log on using dial-up connection option will be permanently selected. If the remote network is not available to authenticate your logon, then you will not be able to logon to the computer until one of the following conditions is met:

•	The remote network becomes available.
•	You use the Emergency Repair Disk (ERD).
•	You use another computer to edit the registry remotely and change the RasForce value from 1 to 0, which turns off the Log on using dial-up connection option.

NOTE: This will only be possible if the computer is also on a LAN. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

A VPN is a private network created over a public one. It’s done with encryption, this way, your data is encapsulated and secure in transit – this creates the ‘virtual’ tunnel. A VPN is a method of connecting to a private network by a public network like the Internet. An internet connection in a company is common. An Internet connection in a Home is common too. With both of these, you could create an encrypted tunnel between them and pass traffic, safely - securely.

If you want to create a VPN connection you will have to use encryption to make sure that others cannot intercept the data in transit while traversing the Internet. Windows XP provides a certain level of security by using Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP). They are both considered tunneling protocols – simply because they create that virtual tunnel just discussed, by applying encryption.

Configure a VPN with XP

If you want to configure a VPN connection from a Windows XP client computer you only need what comes with the Operating System itself, it's all built right in. To set up a connection to a VPN, do the following:

1. On the computer that is running Windows XP, confirm that the connection to the Internet is correctly configured.

• You can try to browse the internet
• Ping a known host on the Internet, like yahoo.com, something that isn’t blocking ICMP

2. Click Start, and then click Control Panel.

3. In Control Panel, double click Network Connections

4. Click Create a new connection in the Network Tasks task pad

5. In the Network Connection Wizard, click Next.

6. Click Connect to the network at my workplace, and then click Next.

7. Click Virtual Private Network connection, and then click Next.
8. If you are prompted, you need to select whether you will use a dialup connection or if you have a dedicated connection to the Internet either via Cable, DSL, T1, Satellite, etc. Click Next.

9. Type a host name, IP or any other description you would like to appear in the Network Connections area. You can change this later if you want. Click Next.

10. Type the host name or the Internet Protocol (IP) address of the computer that you want to connect to, and then click Next.
11. You may be asked if you want to use a Smart Card or not.

12. You are just about done, the rest of the screens just verify your connection, click Next.

13. Click to select the Add a shortcut to this connection to my desktop check box if you want one, if not, then leave it unchecked and click finish.
14. You are now done making your connection, but by default, it may try to connect. You can either try the connection now if you know its valid, if not, then just close it down for now.

15. In the Network Connections window, right-click the new connection and select properties. Let’s take a look at how you can customize this connection before it’s used.
16. The first tab you will see if the General Tab. This only covers the name of the connection, which you can also rename from the Network Connection dialog box by right clicking the connection and selecting to rename it. You can also configure a First connect, which means that Windows can connect the public network (like the Internet) before starting to attempt the ‘VPN’ connection. This is a perfect example as to when you would have configured the dialup connection; this would have been the first thing that you would have to do. It's simple, you have to be connected to the Internet first before you can encrypt and send data over it. This setting makes sure that this is a reality for you.

17. The next tab is the Options Tab. It is The Options tab has a lot you can configure in it. For one, you have the option to connect to a Windows Domain, if you select this check box (unchecked by default), then your VPN client will request Windows logon domain information while starting to work up the VPN connection. Also, you have options here for redialing. Redial attempts are configured here if you are using a dial up connection to get to the Internet. It is very handy to redial if the line is dropped as dropped lines are very common.

18. The next tab is the Security Tab. This is where you would configure basic security for the VPN client. This is where you would set any advanced IPSec configurations other security protocols as well as requiring encryption and credentials.

19. The next tab is the Networking Tab. This is where you can select what networking items are used by this VPN connection.

20. The Last tab is the Advanced Tab. This is where you can configure options for configuring a firewall, and/or sharing.

Connecting to Corporate

Now that you have your XP VPN client all set up and ready, the next step is to attempt a connection to the Remote Access or VPN server set up at the corporate office. To use the connection follow these simple steps. To open the client again, go back to the Network Connections dialog box.

1. One you are in the Network Connection dialog box, double-click, or right click and select ‘Connect’ from the menu – this will initiate the connection to the corporate office.

2. Type your user name and password, and then click Connect. Properties bring you back to what we just discussed in this article, all the global settings for the VPN client you are using.

3. To disconnect from a VPN connection, right-click the icon for the connection, and then click “Disconnect”