SecuRemote

Troubleshooting

SecuRemote will not work with:

• BellSouth DSL.  We have discovered that BellSouth DSL customers have intermittent problems connecting to the EHc network while using SecuRemote.  These include but are not limited to frequent connectivity loss, certain applications not responding, and the inability to connect to the EHc network at all. We recommend obtaining a different Internet Service Provider such at Charter Communications, Comcast, or Earthlink. You can find a different service provider for your area here or here.
• America Online.  ISPs that install software that replaces any of the Microsoft Windows Dial-up Networking files such as the software provided by America Online will not work with SecuRemote.
• Any operating system other than Microsoft Windows.
• Workstations with a network card that was configured to be used on the Emory Healthcare network. These are usually found on laptops. Simply remove, disable, or reconfigure the network card.
• ISPs or networks that use a proxy firewall. Most ISPs do not use proxy firewalls to protect their client's systems. ISPs such as Charter Communications, Comcast, or Earthlink do not use proxy firewalls. You should contact your Information Services Department or your ISP to determine if your network is using a proxy firewall.
• ISPs or networks that block IPSec (port 500/udp) from the internet to your workstation.  Our firewall must communicate back to SecuRemote on your workstation over this port.  This is most likely the problem if you are getting authenticated yet your applications do not work.  You should contact your Information Services Department or your ISP to determine if your network is blocking this port.

Common Error Messages

Access denied - wrong user name or password:  1) The password you used does not match our database.  Please try again or contact us to reset your password. OR 2) You are using an old version of SecuRemote such as build 4199 and previous. Download the latest version.

Account locked:  You have tried to log in too many times with the wrong password.  Wait 15 minutes before trying again.

Failed to generate RADIUS auth request:  The logon ID you are using does not match the logon ID in our database.

No answer received from a firewall:  Something is blocking the communication.  Please ensure that you have Internet connectivity and that you do not have an intermediary device blocking IPSec (port 500/udp) to your workstation (such as PC firewalls like ZoneAlarm and home routers that have built-in firewalls).

Could not validate the certificate use by gateway 163.246.2.254 at site Emory Healthcare:  1) Your workstation has an invalid date and time.  Adjust the date and time to current and then update the site. OR 2) The firewall has undergone an update and it's certificate has changed. Obtain the new certificate by updating your site.

Communication with site _____ has failed:  1) In some PPPoE installations such as Tango Software Suite or Enternet 300, you need to unbind (uncheck) "Check Point SecuRemote" from the TCP/IP adapter or "Local Area Connection". OR 2) You are using an old version of SecuRemote such as build 4199 and previous. Download the latest version.

Authenticated by FireWall-1 Authentication but applications do not respond: There are a number of possible reasons this would occur.  1) You are a BellSouth DSL or AOL customer.  We recommend changing to a different ISP. You could also try adjusting your MTU. See below for more information.  OR 2) You have not yet requested access to SecuRemote.  Request access through your Access Coordinator. OR 3) If you only have trouble when accessing the EHC intranet site (http://www.eushc.org) or the Web Password Reset tool, then you need to upgrade to a version higher than build 53515. Upgrade to the latest version found on the main page.

SecuRemote does not pop-up the authentication window as it should when starting an EHC application: 1) Open SecuRemote by left-clicking the icon in your systray that looks like an envelope with a gold key. Click Passwords, Invalidate Password and then start the EHC application again. OR 2) SecuRemote is bound to dial-up adapters only and should be bound to all adapters. Open SecuRemote by left-clicking the icon in your systray that looks like an envelope with a gold key. Click Tools, Re-bind Adapters and select "Install on all network adapters".

You have to reauthenticate every 15 minutes: 1) Your IP address matches that of someone else who is using SecuRemote. This often happens to those who are using the IP address 192.168.1.100. This IP address is the default when using a Linksys router at home. Change the "100" value in the last octet to a random value between 2 and 246 (leaving some room for multiple PCs on your network). Your router's manual will have instructions on how to do this or you could reference this link for Linksys routers. OR 2) You are using SecuRemote behind a NAT router that is configured for hide-NAT. Only one person may be connected at any given time in this situation. The firewall will disconnect you in favor of the new user for each time an authentication happens. Your network administrator will have to configure your router to perform 1-to-1 NAT to resolve this.

Additional Resources

• If you are having trouble installing or reinstalling SecuRemote, run the CPclean utility provided by Check Point. This will remove all references of Check Point from your PC.
  
• Broadband cable and DSL users can find very good information on http://www.dslreports.com/ such as in the Atlanta forum.
  
• To have the best possible connection, you should adjust your TCP/IP settings by using the DSLReports Tweak Tester II.
  
• Some telnet sessions may stop responding at certain screens (such as when you perform a "patient lookup" or search) if the max transmission units (MTU) on your network interfaces are set too high. The default MTU setting is 1500. Since SecuRemote adds encryption overhead, Check Point has recommended that the MTU value be decreased to 1250 to solve the problem. There are two methods to adjust the MTU depending upon your connection type. If you do not have to log in to connect to the Internet, adjust your MTU using the instructions in the first link. Some broadband Internet service providers (ISPs) identify your computer on their networks using Point to Point Protocol over Ethernet (PPPoE). If your ISP requires you to supply a name and password to access the Internet, it most likely uses this protocol and you should use the instructions in the second link to adjust your MTU.
  
  How-To Change the Maximum Transmission Unit (MTU) Size
  
  How-To Configure Broadband Connections Using PPPoE
  
• In-depth technical information on SecuRemote can be found on the web at the following websites:  http://www.firewall-1.org/ and http://www.phoneboy.com/
  
• Ports SecuRemote uses that need to be allowed through firewalls.

Contact Information

Please contact the Emory Healthcare Call Center at (404) 778-HELP for assistance.