FHC ERR_TUNNEL_CONNECTION_FAILED

Greetings,

One of our Family History Centers is unable to access any of the premium websites. When we try, we get the "ERR_TUNNEL_CONNECTION_FAILED" error.

I've reinstalled the FHC Services Portal and the Portal Check says it's good to go. I've verified the machines are on the "Special Purpose" port on the firewall, showing the expected IP address range. I looked at the proxy settings and it grabs the proxy information from a machine in the familysearch.org domain. One of the more technical members in the ward has been on the phone with Family Search support and they're telling him that its the Internet connection. The Internet connection is a Cradlepoint LTE router like we use in other buildings in the stake and it's 15M down and 10M up, so it has plenty of bandwidth for these two computers. It will go any other site including FamilySearch.org and anything on the commodity Internet without any issues.

Anyone have any ideas what I'm missing? I'm having a super hard time thinking that it's the Internet connection.

Dave

Oh, and if I turn off the proxy, it does go to the premium websites, but of course without the proxy, you don't get in. I've checked the date/time and that the browser versions are the latest. It does it in every browser. I rebooted the firewall. It seems to me like it's most likely a firewall issue, but I'm stumped. I'm hoping for a nugget of brilliance from someone.

Dave

superdave98 wrote:It seems to me like it's most likely a firewall issue, but I'm stumped.

Have the STS check the filtering level on the firewall for that site. It's possible that is having an effect.

superdave98 wrote:I've verified the machines are on the "Special Purpose" port on the firewall, showing the expected IP address range.

Just to double-check - that range should be a 10.x.x.x address. Also, at some point the firewall/switch setup probably has been changed out. It's no longer a set port on the firewall itself, but an assigned port on a cisco managed switch set in Technology Manager.

Thanks for the response. I'm the STS.

The filtering level is Managed, which as I understand is the most lenient. Yes, they're in the right 10.x.x.x IP address range.

I haven't yet installed the Meraki switch at this location, so it's still on a non-managed switch plugged into the firewall.

Dave

superdave98 wrote:I haven't yet installed the Meraki switch at this location, so it's still on a non-managed switch plugged into the firewall.

I'd look into doing the upgrade. It's possible there's done kind of change that's affecting the proxy.

I have other buildings where I haven't upgraded the switches yet and their FHCs can still access the premium sites. I'll give that a try though. Thanks.

Someone else mentioned that they had machines with similar issues and it was that the proxy server the church was using had changed and re-imaging the machines solved the issue. They were just reimaged last year, so I don't know if that's the solution, but a proxy server change would definitely explain what I'm seeing. I'll go see what the proxy settings are in a working building and compare.

So, the saga continues. When we last left our hero, he had received suggestions to replace the switch with the new Meraki switches and to re-image the computer. In further investigation, he found that the local FHC near his home also had the same issue. Since that building is 5 minutes away from his home instead of the 1.5 hours away that the original building was, he decided to focus on the nearby building first.

OK, enough third-person hero stuff.

I've replaced the switches in this building. No improvement. I just spent about 4 hours of my life downloading the Windows 10 FHC image from the FHC Application Finder and re-imaging one of the machines. The machine came up great. I ran the Portal Status program and it said the portal was working. Unfortunately, all three of the installed browsers give me the same error that I saw before. I'm at a loss at this point. Unfortunately, I work during the day, so it's tough to call FHC support. I guess I'll have to take some time off and do just that.

I'm having a hard time believing that I'm the only person with this issue. I must be missing something really obvious since I have at least two FHCs with this issue.

Another quick update. I did actually just find a help item for this issue in the Family Search support website with the title 'Family history center getting the error: "The proxy server is refusing connections..."' So, I guess I'm not the only one. Unfortunately, their solution was to just run"FHC Services Portal Installer" which did not resolve my issue.

superdave98 wrote:I have other buildings where I haven't upgraded the switches yet and their FHCs can still access the premium sites.

How many FHCs does your stake have? Looking in CDOL, I only see two. If some of your locations are not recognized by church headquarters as having a FHC, that would be a problem.

Good suggestions Russell. We have 4. There are two listed in the CDOL at the top and two more listed below in the pays bills for section. The one closest to me is in the same city as the Stake Center and it’s listed at the top.

I didn’t realize until today that Family History support was open on Saturday. I ended up talking to them and found out they have at least 6 other FHCs with the same issue. At least I’m not the only one. They’re working on the issue and hopefully will have an answer for me next week.

Dave

superdave98 wrote:Good suggestions Russell. We have 4. There are two listed in the CDOL at the top and two more listed below in the pays bills for section. The one closest to me is in the same city as the Stake Center and it’s listed at the top.

Ah, the other two are "child" of wards instead of the stake.

Glad you got though. Frequently the first challenge is to get past the service missionaries to someone who can answer the question.

Something else you might check is to make sure the serial numbers of the firewall and any managed switches match what's shown in TM. If the system checks the property number associated with the firewall and it doesn't match a FHC location, that might create a problem.

Here at Copenhagen Denmark FHC we had the issue not being able to have the Premium Websites listed; it happened around each 1-1½ years!
Now I have given up -it is surely a common problem, but of course it can be due to hardware..

-Henrik Hansen

I'm sorry to hear you're having the same issue Henrik. I need to call support again and see if they've come up with a solution. If I find it, I'll post information here so perhaps we can solve your issue as well.

Dave

since it occurs so regularly, perhaps it has something to do with the ExpiryDate found in the FHC Services Portal?

I am happy to report that I have solved the problem in the two Family History Centers where it was happening. I am unhappy to report that the solution wasn't consistent.

In one FHC, I replaced the network switch with the new Meraki switch provided by the church. It made zero difference. The problem continued. We were waiting for a new Internet connection so we had installed a CradlePoint LTE router with AT&T cellular service. As soon as we completed the Comcast installation, the problem disappeared. That FHC is now able to access the premium websites without issue.

I spent last Saturday at the other FHC. It also has the CradlePoint LTE router with AT&T cellular service so I was pretty confident that was the issue and we would need a new Internet connection to fix it. I was replacing their switch and adding a second one to replace a 10/100 Ethernet hub. Yep, it was really a hub. Surprisingly, as soon as I replaced the switch in the FHC, the proxy problem disappeared. The FHC computers are now able to access the premium websites.

So, if you're experiencing this issue, I would suggest making sure the new Meraki switches are in place, and if that doesn't resolve the issue, look at perhaps changing out the Internet connection. I have no idea why each site with the same symptoms and Internet connection seemed to have a different solution.

Dave

In the first case, I'm suspecting an issue with the public IP assigned by the ISP. It's probably not in the range of known ISPs. Or possibly that the ISP didn't allow any connections to the firewall, only outgoing connections.

In the second case, I'm guessing it was an issue the computers were in the "public" zone and not the "special" zone that's a VPN.

Yeah, I don't get why there is a difference.

On the AT&T wireless being the cause, all I could figure is that they were filtering something. The machines at both centers were fully able to access ANY other resources on the Internet. I was extremely surprised when the second center started working with just the switch replacement.

Your second guess makes sense, but it would be wrong in this case. I had confirmed multiple times that they were in the right zone. The machine IPs were all in the correct "special" zone. I even tried moving them to other zones in my troubleshooting to eliminate that as a potential issue.

I guess it's possible that each center had a different issue with the same symptoms, but that doesn't match my previous experience.

Dave