Network Connect Tunnel Drops with Error control channel disconnected due to error

[cbeahm_]

We've been having issues with several users having their VPN tunnel randomly drop. In reviewing the NCService log, I see the following messages in all cases:

2008/12/11 16:11:35.105 dsNcService: tC04 "DebugId" 'DSSSL_recv' [Debug] DSSSL_recv: returned 0x2746 error.
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'ncphandler' [Debug] ncphandler: control channel disconnected due to error 2746
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'session' [Debug] session: reconnecting attempts = 1
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'session' [Debug] session: Registering new timer for reconnection
2008/12/11 16:11:35.105 dsNcService: t4EC "DebugId" 'adapter' [Debug] adapter: unregistering the adapter IO handler

In some cases the error is 2745 rather than 2746. Has anybody else seen this or know what may be causing it?

[Bill10421_]

I'm experiancing the same error, did you have any resolution?

[Swal64_]

We experienced the same error and upgrading to IVE version 6.3 R4 resolved it.

[Frederic_]

Hello,

I'm running IVE OS v6.3R1.2 and I'm experiencing the same issue.

I've asked JTAC to investigate because I did not find any trace of this issue on the release note 6.3R4

Regards.

[Jickfoo_]

BUMP

6.5R3.1 is give me this same problem. Anyone have any ideas?

[cgpoonam_]

Did anyone find the cause or resolution for the "ncphandler: control channel disconnected due to error 2746" problem?

Appreciate your help in advance.

[MattS_]

Hi,

The information I can find on error 2746 is that is a disconnect due to a TCP RESET. The RESET usually happens due to the IVE or devices between the IVE and NC. A tcpdump on the IVE external port and NC ethernet port will find out where the RESET is coming from. If the SSL control channel traffic is not being transferred between the NC client and the IVE then the NC session will be closed.

Some possible causes are client DHCP leases expiring; client interfaces going down; SSL traffic blocked so the IVE RESETs the connection; client IP changing when roaming is not enabled; third party software such as AVs or Firewalls on the client PC interfering with the NC connection or route monitoring enabled and the client route table changing. Is http://kb.pulsesecure.net/KB14131 applicable -are the clients using Verizon Aircard?

Do the users see any pop-up messages about the failing NC connection? Are they able to re-connect? Can they access and log into the SA webpage and get their homepage during the failure?

[Jickfoo_]

https://forums.pulsesecure.net/topic/pulse-connect-secure/40123-upgraded-to-65r31-now-users-complain...

I fixed my issue. My problem occured because the ESP Rekey timer was set higher then the NCP Timeout. Even when you set your sessions to use ESP, NCP is still used to handle the control traffic. By default, the NCP timer is set to 2 hours. If you set your ESP rekey timeout to anything more then 2 hours. You will get this problem. The solution is to either to leave the ESP timeout at 1 hour or to increase to NCP timeout to a value higher then the ESP timeout.

Good Luck,

Justin

[epjls_]

Does anyone have a solution for this issue? I am running 6.3R5 and just had a user show up with this symptom.

[epjls_]

I found the rest of the blog and read about the ESP lifetime setting vs the NCP timeout. My ESP lifetime is set for 20 minutes and NCP timeout is 120 minutes so i already fit the scenerio that was described. I'm on 6.3R5 code. So far I have only seen this on the one user i am working with so will try some other things but was just checking to see if anyone else was still seeing the issue after adjusting the timers.