Q: What are multiple sessions? How are they useful?
A: Multiple sessions means two or more simultaneous PPPoE connections to an Internet-based network. Examples of multiple sessions are varied and can consist of two or more of any of these combinations:
The advantage of multiple PPPoE sessions is that it provides the Service Provider with the ability to offer additional, revenue-enhanced access to content providers. Each connection has it's own specific authentication process, a unique set of IP, gateway and Domain Name Servers addresses. In addition every packet and byte that's transferred within that session can be accounted for and charged to either directly to the users or to the advertised service providers.
The following illustration is an example of a network that allows multiple sessions: one for general internet access, and a second for Corporate VPN access:
NOTE: Multiple sessions are a relatively new option with most service providers. Typically they require a network subscription or agreement with your service provider. Contact your service provider if you wish to use this feature.
Q: How do you build a multiple session with Tango Access?
A: Tango Access stores the connection requirements for each session via Profiles. Each profile has a username and password associated with it, as well as Services, optional inactivity timeouts, and default browser locations. Your Service Provider can pre-configure these profiles within Tango Manager, or they may be accessed dynamically via the Profile wizard by the user.
In the following illustration, sessions are configured to access three different networks: basic internet access, an advertised financial network, and a corporate VPN. Each profile contains a specific username, password, and optional service and settings characteristics. In the case of most general Internet access profiles, leaving the service and server name blank will default to the correct service.
| First Profile for basic Internet Access (Server and Service field blank): | |
 |
 |
| Second Profile for Corporate VPN connection: | |
 |
 |
Click Connect on each of the profiles in sequence to activate the sessions. In this example, two of the sessions are active (as shown by the green icons): the basic Internet access, and the Corporate VPN:
The connection details for the two active sessions show they have distinct Servers and IP addresses. This allows the user's applications to access two distinct networks simultaneously.
 |
 |
Q: Are there any problems to resolve with providing multiple sessions?
A: The most common assumption with multiple session support is that the user will try the same username and password combination for their basic internet service. Normally each connection to a different service will require separate authentication.
The other typical limitations involved with providing multiple sessions are Routing table maintenance and Domain Name Resolution.
Q: How does Tango Access handle DNS requests on multiple sessions?
A: The original Windows networking component was not designed to support unique DNS servers over multiple sessions. This means that when sessions to two distinct networks were active, the DNS servers were not always reachable without adding custom routing options and application changes to enable switching across the networks.
Starting with version 1.2 SP1, Tango Access has added enhancements to enable polling of a series of DNS servers over multiple sessions by adding an internal DNS Proxy control. When this feature is enabled, the DNS request is sent to a loopback address. The PPPoE driver in turn propagates (or Spoofs) the request in sequence over all the available DNS servers for each active interface. When the first positive response is received, the proxy completes and passes the response up to the application.
To enable this feature, click the Home -> Preferences button and check the box for DNS Proxy (available only in Tango Access version 1.2 SP1 or later).
DNS Proxy is controlled within the Tango Access driver, which spoofs the PPPoE negotiation for the DNS addresses using the internal loopback address of 127.0.0.1, and the Tango Access application, which adds specific routes to access all of the DNS servers (per interface) in the Windows TCP Routing table, and stores the negotiated DNS Proxy entries in its own internal database.
The Efficient.ini parameters to disable the display of this option from the Home -> Preferences page is:
[Access]
ShowDnsProxy=0
Q: How does Tango Access handle routing?
Internet Applications, such as browsers and email utilities, are generally unaware of the connection media. When two or more sessions are established, the application will typically pass all traffic over the most recently activated connection, which is managed by the Windows TCP Routing Table. A common Windows networking limitation occurs when your second connection, for example, is made to a VPN with a limited subnet. This situation can result in the gateway being limited to only the VPN subnet, which can prevent access to your basic internet access, even if the first connection is still active.
To overcome this limitation, Tango Access enhances control of the Routing Table using several configurable options to statically or dynamically assign routing information with each connection:
In addition, Tango Access provides the ability to assign preferential routing control to a specific profile. This case is ideal for situations like the one describe above, where a second VPN connection prevents access to the previous internet connection.
To enable Preferential routing for profiles, click the Home -> Preferences button and check the box for "adjust physical network adapter route metrics" (available only in Tango Access version 1.2 SP1 or later). Then select the profile properties for the default route, select the Routing tab, and check the box for Force Default Route.
Note: In order for the Routing tab to be displayed, this must be added to the Efficient.ini file:
[ProfileProperties]
ShowRouting=1
The Efficient.ini parameters to disable the display of this option from the Home -> Preferences page is:
[Access]
ShowAdjustPhysicalRoutes=0
Q: How many simultaneous connections are available with tango Access?
A: tango Access will support up to 2 concurrent PPPoE connections on Windows 95, 98 and Me. It will support up to 8 concurrent connections on Windows NT, 2000, and XP. An active PPPoE connection is called a session. An example use for multiple sessions would be an active connection to the Internet through your ISP, with an additional specific connection to a games network or a Virtual Private Network (VPN) connection.
A: PADN is an extension of the PPPoE protocol, RFC 2516, which enables the Network server to send a routing packet to the client. This PADN packet will contain one or more Routes which the Tango Access client will dynamically add to the TCP component's routing table, after the connection is established.
Note: PADN support is not available with some Network Servers.
Q: How are Static routes configured in Tango Access?
A: Static routes are configured in the Tango Access client configuration. These will be added to the TCP table after the connection is established. There are two ways to configure the Static routes.
1. If the Show Routing option is enabled, select the properties for the Profile from Tango Access. Click the Routing tab, and click the Add button. Then enter the information for the Route in the fields provided:
 |
 |
2. To preconfigure the static routes for all your users, edit the Efficient.ini file and add your routing information using the following example:
| ;Key<n> | Name | Route | Subnet Mask | Gateway | Metric | Locked? |
| [Routes] | ||||||
| Route1= | VPNRoute, | 172.17.5.0, | 255.255.255.0, | 172.17.1.1, | 2, | 0 |
| Route2= | BackupRoute, | 172.17.6.0, | 255.255.255.0, | 172.17.1.1, | 3, | 1 |
The Keyword Then configure the names of the routes you want assigned for each Profile in the same Efficient.ini file. In this example, the profile session VPN will have both routes added:
[Profile_VPN]
Routes=VPNRoute,BackupRoute
Note: The last column in the Routes values - Locked - means that the route entry cannot be modified from the application. When this value is set to 1, the Edit and Delete buttons are disabled.
Q: How are Dynamic routes using HTTP supported in Tango Access?
A: Tango Access supports dynamic routing from a webserver at connection time. Domain-specific routes can be created for each network supported at connection time. Periodic updates allow the network to keep the route info on the desktop current. An additional option to delete the default route satisfies certain network-specific topologies.
To enable dynamic http routing update, add your routing information on your webserver following the example below:
Http://www.MyIsp.com/WebRouteUpdate.html:
|
<HTML>
<HEAD> <TITLE>Tango Access Web Routing Update </TITLE> </HEAD> <BODY> [Routes] Route1=Add,172.17.7.0,255.255.255.0,172.17.1.1,2 Route2=Add,172.17.8.0,255.255.255.0,172.17.1.1,3 Route3=Delete,172.17.5.0,255.255.255.0,172.17.1.1,1 DeleteDefaultRoute=0 Version=3 </BODY> </HTML> |
In the Efficient.ini file, make the following changes:
[ProfileRoutes]
HideRouteServer=0
UseRouteServerNames=1
[RouteServerNames]
Server1=RouteServer1,http://www.MyIsp.com/WebRouteUpdate.html
Each Profile must also be configured to use these routes, either from the Routing tab on the Profile, by selecting from the scrollable list in the Route Server field, or by editing the Profile section of the Efficient.ini file. The Profile section in this example is CorporateVPN:
[Profile_CorporateVPN]
Server1=RouteServer1,http://www.MyIsp.com/WebRouteUpdate.html
The Routing update will be performed based on the value of the RouteCheckInterval in minutes:
[Access]
RouteCheckInterval=10
Using the above example, the Routing table will be updated as follows:
Analysis of Routing Table:
In this example, after the connection is established, the default route (highlighted in blue - 0.0.0.0) is updated to direct traffic for all IP-related data to the client's new local address, which is assigned by the network server (172.17.4.199). The Network Server's address is also added to the Route Table as the Gateway address (172.17.4.201), and directed to route all incoming traffic to the local address (172.17.4.199) In addition, three other subnet addresses are received from the WebRouteUpdate.html file. Two of these subnets are added to the routing table (172.17.7.0 and 172.17.8.0, with a Routing Metric of 2 and 3, respectively). The third subnet, (172.17.5.0) is deleted and therefore does not show in the routing table.
Note: Tango Access currently requires that the Routing update html file be located in the root folder of the webserver.
A: The Route Metric defines the priority of a routing entry in the Route Table. The lower the Route Metric, the higher the priority that the Route entry will take.
Q: What are Preferential Profile-specific routes?
A: When multiple sessions are active, Tango Access can assign a preferential route that will override the normal order of default routes as they are added to the Route Table. The default routes are typically assigned in order of connection. In the following example, the CorporateVPN profile is established before the Internet profile is connected. The Routing Table shows that the CorporateVPN address's (172.17.32.13) Route Metric priority is now incremented to 2, which effectively means that all traffic will be directed over the Internet profile's address of 172.17.4.199 (since it's Route Metric has a higher priority of 1) :
In order to ensure that the CorporateVPN's profile is always accessible, no matter which order the connections are established, the Service Provider assigns the Force default Route option on the Corporate VPN profile:
This can also be done by editing the profile for CorporateVPN in the Efficient.ini file:
[Profile_CorporateVPN]
ForceDefaultRoute=1
After connecting, we see that the higher priority Routing Metric is now always assigned to the CorporateVPN address's (172.17.32.13). This will happen regardless of the order that the connections are established.
Q: Why delete the Default Route for a connection?
A: Since the routing table is updated with each connection, there are some cases where adding the default route for the new connection will cause the routing to the earlier connection to become inaccessible. Checking the Delete Default Route may help make both connections work. To do this, select the profile, and from the Routing tab, check Delete Default Route:
Upon connection of the two profiles, the second default route will be deleted, leaving the first default route active (the Route Metric of 2 in this case is still the highest priority since there is no Metric 1 for the default route):
