How to resolve F5 VPN Connection issue

As before, I have to do some homework at home in holiday so that I need to connect to the corporative environment by VPN. When I connect to VPN Server by IE and pass the authentication next to click “Access Network Resources” hyper-link, its error status is “Network Access Connection Device was not found”
In the moment, I still follow my troubleshooting rule --- Based on the error message to search the information by Google. Although I get some information to try and error as uninstall F5 VPN driver next to reinstall it again, the result still fail again and again.
Until I find out that VPN function is the relation with Remote Access Connection Manager Service by System Event Viewer.
So I decide to search the information based on this word. Finally, I get the answer to workaround this problem. That is Edit Registry Key Value!
In Registry Editor, Select “\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan” –> Right-Click “DependOnService” –> Click “Modify…”
The Value Data will exist two strings --- Tapisrv and SstpSvc
Please delete “SstpSvc” next to reboot the computer.
Now you can connect to VPN Server and Remote Access Connection Manager Service will be started.
Although the above problem can be resolved, I still don’t know Why?
Maybe need to research F5 VPN theory if I can touch F5 device in the future.

Install Microsoft Forefront TMG 2010 (part 1 of 3)

To install TMG 2010 as install the Microsoft Product --- mount the DVD next to trigger execution file automatically that the installation guidance will show up. It is very friendly window to explain or guide you about “Before You Start”, “Prepare and Install”, “Additional Options” scenario. In the moment, I have installed Windows Update with up to date into my Server. So I will follow up this flow --- first decide to run Preparation Tool next to Run Installation Wizard.

When click “Run Preparation Tool”, the Forefront TMG Preparation Tool wizard will show up.
Click “Next >” button
Enable “I accept the terms of the License Agreements” check box next to click “Next >” button
Select “Forefront TMG services and Management” option next to click “Next >” button
Enable “Launch Forefront TMG Installation Wizard” check box next to “Finish” button
So does that the Forefront TMG Enterprise Installation Wizard will show up automatically and click “Next >” button to go the next process.
(The above result is the same as execute executable file in TMG 2010 DVD again to select “Run Installation Wizard”.)
Select “I accept the terms in the license agreement” option next to click “Next >” button
Enter some information as User Name、Organization、Product Serial Number next to click “Next >” button
Select Installation path for Forefront TMG next to click “Next >” button
Click “Add…” button to specify the internal network address range
Click “Add Adapter…” button
Select one network adapter for Internal range next to click “OK” button
If the IP address ranges have already added into this network, please click “OK” button to return to the Define Internal Network windows.
So does that the Internal Network Address Ranges will show the defined value. If it is no any problem, click “Next >” button.
This windows just notify you the some Services will be restarted during the installation. Please directly ignore this message to click “Next >” button.
Click “Install” button to begin the installation.
The Installation Wizard is progressing now.
Click “Finish” button to exit the wizard. If you want to continue to do next action, please enable “Launch Forefront TMG Management when the wizard closes” check box.
Until now, we just install the initial software installation and basic internal selection. In next article, I will introduce the three steps --- Configure network settings, Configure system settings, Define deployment option.

Install Microsoft Forefront TMG 2010 (part 2 of 3) >>>

老師,我錯了嗎 !?

一如往常瀏覽網路上今日新聞,無意間發現一則引我注意的事件：〝學生對老師飯菜吐口水〞的報導！在老師PO文的字句中 "自己也是人生父母養，身為導師的尊嚴，是否在一口又一口的飯被消滅", 那樣字裡行間充滿著 "心境無奈、教學失敗、自尊被踐踏與蹂躪"的意喻,真是令人覺得無言!

或許絕大部分人看了這則新聞,會覺得應該是小孩子不懂事、鬧著玩的心態一笑至之;或許有另類團體又有突發奇想的看法：小孩無罪、大人自己也該檢討的論述.  但不知若此事變成 〝老師對學生飯菜吐口水〞,大家的看法又是如何?

每當學校有老師處罰學生,社會上總是用放大鏡來檢視老師,我想無形中會讓老師倍感壓力,以至於日後管教學生,寧可選擇漠視與忽視,也不願多花心思來對待學生,畢竟管教這把尺的拿捏總是見仁見智,沒有也絕不會有公正的標準.

當然,老師們也像一個團體社群,也會有優、劣之區別;也是會有私心或分寸拿捏不準的時候,畢竟他們也都是人. 就如同現行社會,也有好人、壞人之別,但好、壞衡量的標準也是用人來判斷. 除非違反道德與法律上的行為才會有明確的區別,否則單純用事的對與錯來判斷,多少也會因人而異. 就如同政治上在解讀 "一國兩制 或 一個中國", 立場或觀念不同,所看的角度與論述也是不一樣的.但若能聽聽每個人的說法,多少論點也是滿認同的.

我想：時間久了,過陣子大家也就漸漸淡忘了;但對於受傷與受害的當事人,或許這件事就永遠烙印在自己的心理,成為心中永遠不可磨滅的惡夢與痛！畢竟,大人或小孩都是人,都只是個平凡人,沒有任何區別.但大人犯錯與小孩犯錯,我想世俗的看待多少會有些不一樣.

真擔憂我們的下一代，用名與利來評鑑與衡量一切,忽視我們最基本的倫理與道德,造成日後不可一世的性格. 或許這是未來普羅眾世所有人的想法, 以我們過去年代的思維來看待當今,多少有些落伍了吧！

果然是無言的！

Windows Server 2008 R2 is as Router role

How to make Windows Server 2008 R2 as LAN Router device? It is very simple for everybody if we search the related information by Google or Microsoft.

(1).Add Server Roles --- Network Policy and Access ServicesIn Server Manager, click “Add Roles” to trigger the wizard
Click “Next > “ button
Enable “Routing and Remote Access Services” check box next to click “Next > “ button
Click “Next > “ button
Enable “Routing and Remote Access Services” check box so that Remote Access Service and Routing will be selected. To click “Next” button to continues the next step.
Click “Installation” button
If no any exception, the installation almost be succeeded.
Now, the system has already added a new roles “Network Policy and Access Services”.


(2).Configure and Enable Routing and Remote Access
When you expand the “Network Policy and Access Services” tree, the red arrow down icon express this function never be enabled.
To right-click it and select “Configure and Enable Routing and Remote Access” in menu,the setup wizard will show up.
Click “Next > “ button
Select “Custom configuration” option next to click “Next > “ button
Enable “LAN routing” check box next to click “Next > “ button
Click “Finish” and “Start service” button
Now the icon become green arrow up.


(3).Verify IPv4 setting
Right-click “Routing and Remote Access” next to select “Properties” in menu
You will see this computer pay a role as IPv4 Router now.


(4).View IPv4 Routing table
To expand "IPv4” tree and right-click “Static Routes” to select “Show IP Routing Table…”
The current IPv4 Routing information will show up

In the time, the computers in 10.10.101.x and in 10.11.101.x can communicate each other. Of course, the computer default gateway need to be set on the IP of Router interface.

Open firewall port for Computer join Domain & Account logon Domain

I want to understand which firewall port need to be opened if the computer will join and log on Domain. I use Microsoft Forefront Threat Management Gateway 2010 as firewall and assign two network segment for creating DC(VBHV-DC-01 in LAN3) and Workstation(VBHV-FS-01 in LAN4) role. And the network rules is route mode from LAN4 to LAN3.To create a new Access Rule from LAN4 to LAN3 and open the following protocols:
                              Microsoft CIFS/SMB: 445/TCP
                              Kerberos-Sec: 88/TCP, 88/UDP
                              DNS: 53/TCP, 53/UDP
                              LDAP: 389/TCP, 389/UDP
                              NetBIOS Datagram: 138/UDP
                              NetBIOS Name Service: 137/UDP
                              NetBIOS Session: 139/TCP
                              NTP: 123/UDP
                              RPC Endpoint Mapper(Custom): 135/TCP
                              ADLogon/DirRep(Custom): 50000/TCP
                              RPC Netlog(Custom): 50001/TCP
For limiting the special port for RPC to a single port(50000/TCP), we need to add a registry on each domain controller.
In “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\" registry key to new a DWORD (32-bit) Value
Rename the entry from “New Value #1” to “TCP/IP Port”
Double-Click this entry and select “Decimal” option –> enter “50000” in Value data field –> click “OK” button
After finish the above correct, please reboot DC so that the registry function will enable.
To force RPC port for client RPC traffic to a specific port, I need to do the same activity in “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ ”
To new a DWORD (32-bit) Value type “REG_DWORD”, rename the entry from “New Value #1” to “DCTcpipPort” and name a Registry value “50001” next to reboot it
Now,I try to join Domain “dw.com” and the result is successful.
The computer can log on Domain “VBHV-DC-01”.
By TCPView Utility, you will see there is no any port limited now.