ActiveSync 4.1 USB Forever Connecting Problem Fixed - Cisco VPN Co

I had the ActiveSync 4.1 forever "Connecting" problem connecting to my USA
T-Mobile MDA (HTC Wizard) using USB. Previously I had ActiveSync 3.8
installed on the machine and it was working perfectly with my Audiovox
SMT5600. But like most people here, I was forced to upgrade to ActiveSync
4.x to sync with my new WM5 device... what a nightmare.

I had upgraded my old Windows 2000 SP4 machine (it's an old VAIO laptop that
doesn't have Sony driver support for Windows XP) at home from ActiveSync 3.X
to 4.1 and everything went smoothly. The IPAQ 3510 and the SMT5600 I had
syncing with it before using USB still synced properly, although the profiles
were deleted and new ones were created on the PC side. Also the MDA synced
perfectly with it using USB. I also tried a new ActiveSync 4.1 install on a
Windows XP SP2 Home laptop and that synced with the MDA as well...

Then I upgraded my work machine (Windows XP SP2 Prof) to ActiveSync 4.1...
that's when the problem occurred. The install went smoothly, but when I
connected the MDA to the USB cable, I'd just spin the ActiveSync logo and
display "Connecting" forever. I looked at the ipconfig.exe results and the
WM5 network adapter had gotten the address 169.254.2.2 and the routing tables
looked correct, yet I could not ping 169.254.2.1 (my MDA.) I tried an IR
sync with and that worked perfectly (at least IR connections still worked.)

I even tried installing ActiveSync 4.2 Beta and that didn't help much, other
than instead of "Connecting" showing forever, it would eventually time out
and offer a web page with some help. After reading that web page, I realized
that ActiveSync 4.X didn't always work well with Firewalls, Virus Scanners
and VPN software... but I had already disabled the Windows Firewall, the
Virus Scanner and the Cisco VPN Client didn't look like it was active (didn't
show up in the Task Manager Process listing, or had the icon in the task
bar...)

That's when I got suspicious about the Cisco VPN Client (Version
4.6.04.0043), since it was in the startup... maybe it was still running...
So I started up the Cisco VPN Client and went through the options and
realized I had the "Stateful Firewall (always on)" option checked. When I
unchecked the option, my ActiveSync 4.2 Beta immediated connected with my WM5
device. Problem solved!

I don't know what the most recent version of the Cisco VPN Client is, but
since it's installed on my work laptop, I'm not privy to upgrade that piece
of software, so don't have access to the registered area of the Cisco website
where upgrades are located. I don't know if the stateful firewall feature is
still broken in the most recent version of the Cisco VPN Client. (Note that
unchecking that option also fixed some other network problems I had with
talking through USB to Ethernet network adapters that were attached after
computer had booted.)

Hope this will be of some aid to others with the forever connecting problem
with ActiveSync 4.1 or 4.2 Beta.

It's probably not "broken", really. The whole purpose of a firewall is to
prevent things from happening like external devices connecting to network
ports on your machine, where they might be able to do some sort of damage.
In a VPN situation, the whole idea is to prevent other, insecure, networks
that the computer (your PC), might be attached to from penetrating the
private network, as that's assumed to be behind security perimeters and
individual machines inside that perimeter might not be particularly secure.
The VPN therefore carefully blocks anything that might 'get through', as
part of its job.

Since ActiveSync running on the mobile device is trying to do exactly that
sort of thing, connect to a network service running on the PC from a network
outside the security perimeter of the VPN, it makes sense that a firewall
would block it, unless you can somehow set an exception. If your company
doesn't want you to set *any* exceptions, you'll have to stick with IR or
Bluetooth to sync with those machines.

Paul T.

"BBF" <> wrote in message
news:351E055D-E0F1-4805-B88D-...
>I had the ActiveSync 4.1 forever "Connecting" problem connecting to my USA
> T-Mobile MDA (HTC Wizard) using USB. Previously I had ActiveSync 3.8
> installed on the machine and it was working perfectly with my Audiovox
> SMT5600. But like most people here, I was forced to upgrade to ActiveSync
> 4.x to sync with my new WM5 device... what a nightmare.
>
> I had upgraded my old Windows 2000 SP4 machine (it's an old VAIO laptop
> that
> doesn't have Sony driver support for Windows XP) at home from ActiveSync
> 3.X
> to 4.1 and everything went smoothly. The IPAQ 3510 and the SMT5600 I had
> syncing with it before using USB still synced properly, although the
> profiles
> were deleted and new ones were created on the PC side. Also the MDA
> synced
> perfectly with it using USB. I also tried a new ActiveSync 4.1 install on
> a
> Windows XP SP2 Home laptop and that synced with the MDA as well...
>
> Then I upgraded my work machine (Windows XP SP2 Prof) to ActiveSync 4.1...
> that's when the problem occurred. The install went smoothly, but when I
> connected the MDA to the USB cable, I'd just spin the ActiveSync logo and
> display "Connecting" forever. I looked at the ipconfig.exe results and
> the
> WM5 network adapter had gotten the address 169.254.2.2 and the routing
> tables
> looked correct, yet I could not ping 169.254.2.1 (my MDA.) I tried an IR
> sync with and that worked perfectly (at least IR connections still
> worked.)
>
> I even tried installing ActiveSync 4.2 Beta and that didn't help much,
> other
> than instead of "Connecting" showing forever, it would eventually time out
> and offer a web page with some help. After reading that web page, I
> realized
> that ActiveSync 4.X didn't always work well with Firewalls, Virus Scanners
> and VPN software... but I had already disabled the Windows Firewall, the
> Virus Scanner and the Cisco VPN Client didn't look like it was active
> (didn't
> show up in the Task Manager Process listing, or had the icon in the task
> bar...)
>
> That's when I got suspicious about the Cisco VPN Client (Version
> 4.6.04.0043), since it was in the startup... maybe it was still running...
> So I started up the Cisco VPN Client and went through the options and
> realized I had the "Stateful Firewall (always on)" option checked. When I
> unchecked the option, my ActiveSync 4.2 Beta immediated connected with my
> WM5
> device. Problem solved!
>
> I don't know what the most recent version of the Cisco VPN Client is, but
> since it's installed on my work laptop, I'm not privy to upgrade that
> piece
> of software, so don't have access to the registered area of the Cisco
> website
> where upgrades are located. I don't know if the stateful firewall feature
> is
> still broken in the most recent version of the Cisco VPN Client. (Note
> that
> unchecking that option also fixed some other network problems I had with
> talking through USB to Ethernet network adapters that were attached after
> computer had booted.)
>
> Hope this will be of some aid to others with the forever connecting
> problem
> with ActiveSync 4.1 or 4.2 Beta.
>

A VPN connection is *NOT* active at the time.
It's just Cisco's Stateful Firewall.

Stateful firewalls shouldn't block new network connections where I connect
up a new network adapter and send pings, *I'm* send the first packets out
from behind the firewall, so it should not block the responses to *my*
requests.
It doesn't only whack my ActiveSync, it whacks communication on any new
network adapter I attach to the computer.

So it *is* broken. (At least in the version I'm running.)

"Paul G. Tobey [eMVP]" wrote:

> It's probably not "broken", really. The whole purpose of a firewall is to
> prevent things from happening like external devices connecting to network
> ports on your machine, where they might be able to do some sort of damage.
> In a VPN situation, the whole idea is to prevent other, insecure, networks
> that the computer (your PC), might be attached to from penetrating the
> private network, as that's assumed to be behind security perimeters and
> individual machines inside that perimeter might not be particularly secure.
> The VPN therefore carefully blocks anything that might 'get through', as
> part of its job.
>

Hi,
A stateful firewall won't work with ActiveSync. It expects certain ports to
be opened and they are not.

See http://www.pocketpcfaq.com/faqs/acti...shoot-as4x.htm for a list of
ports and their use.


--
Chris De Herrera
http://www.pocketpcfaq.com
http://www.tabletpctalk.com
http://www.pocketpctalk.com
http://www.mobilitytalk.com

ActiveSync 4.x Troubleshooting Guide -
http://www.pocketpcfaq.com/faqs/acti...shoot-as4x.htm

"BBF" <> wrote in message
news:C735C3B6-125A-4FA3-8993-...
>A VPN connection is *NOT* active at the time.
> It's just Cisco's Stateful Firewall.
>
> Stateful firewalls shouldn't block new network connections where I connect
> up a new network adapter and send pings, *I'm* send the first packets out
> from behind the firewall, so it should not block the responses to *my*
> requests.
> It doesn't only whack my ActiveSync, it whacks communication on any new
> network adapter I attach to the computer.
>
> So it *is* broken. (At least in the version I'm running.)
>
> "Paul G. Tobey [eMVP]" wrote:
>
>> It's probably not "broken", really. The whole purpose of a firewall is
>> to
>> prevent things from happening like external devices connecting to network
>> ports on your machine, where they might be able to do some sort of
>> damage.
>> In a VPN situation, the whole idea is to prevent other, insecure,
>> networks
>> that the computer (your PC), might be attached to from penetrating the
>> private network, as that's assumed to be behind security perimeters and
>> individual machines inside that perimeter might not be particularly
>> secure.
>> The VPN therefore carefully blocks anything that might 'get through', as
>> part of its job.
>>
>

I had the same 'challenge' and found the same 'solution'. What I'd really like
is the ability to change the IP address that ActiveSync uses to put it into the
192.168.x.x subnet which is enabled in the VPN client (also Cisco) for local lan
access.

But I've not found a way to do this. I found the ActiveSync subnet in several
places in the windows registry but am reluctant to change it without knowing
before hand what it could do wrong.

ActiveSync should have a config option to set the subnet or ip address.

--
Lionel B. Dyck <><
AIM ID: lbdyck
Homepage http://www.lbdsoftware.com

I don't think that changing the activesync subnet to 192.168.x.x will help
with the Cisco VPN Client's Stateful Firewall.

The USB ethernet adapter that I connect to my PC after boot time has an
address of 192.168.0.1 and talks to a wireless AP with a hard coded address
of 192.168.0.99. If the network adapter is plugged in when Windows Boots, I
can talk to 192.168.0.99 fine with or without the Stateful Firewall enabled.
If I start up windows without the USB ethernet adapter connected, then I plug
it in, if the Cisco Stateful Firewall is enabled, it will refuse to talk to
the AP, I can't even get a ping response. But when I turn off the Stateful
firewall I can talk to the AP no problem.

Note that I've not tried using activesync while a VPN connection is active.

"Lionel B. Dyck" wrote:

> I had the same 'challenge' and found the same 'solution'. What I'd really like
> is the ability to change the IP address that ActiveSync uses to put it into the
> 192.168.x.x subnet which is enabled in the VPN client (also Cisco) for local lan
> access.
>