Using Connect with a VPN

There are circumstances when an organization will need to use a Connect meeting room, webinar room or virtual classroom through a VPN connection (Virtual Private Network).  This might be a situation where you need to demonstrate a tool that is internal to the company and requires VPN to function such as an Intranet Portal for example.

You do not have the option in these cases to use Connect without a VPN connection.

Out of the box, Connect does not always play nicely with VPN connections and the performance can be intermittent (disconnects) and/or latency.

Once option here is that Connect is using a port that is not ideal for the VPN.  There is a setting that you may want to consider on your Connect Server to fix this, or at least give it a try.

How might it go wrong in the first place?

Connect will by default use Port 1935 and the protocol RTMP (‘Real Time Messaging Protocol’) to communicate with the Flash Media Server (FMS).  This is how all of the live communication such as camera, VoIP,, screen sharing etc. is transmitted.

The organization and/or the VPN may not allow the use of Port 1935, so Connect may move to Port 443 and even tunnel through Port 80.  If  the VPN or the infrastructure forces Connect to Port 80 then it is likely that you will see latency and in ‘forcing’ Connect to Port 80 you may very well see disconnects as the meeting ‘fights’ with the VPN and the network security.

What can we do to change things?

By default, the communications through Port 1935 using RTMP are not encrypted through SSL (note that the web interface, password etc. are all encrypted through SSL all of the time, we are just talking about the live meetings communications).

You can turn on SSL in your account, it is a single ‘switch’ that will send all live meeting communications through SSL and then use Port 443 and the protocol RTMPS (RTMP secure).  Chances are that the VPN will play much more nicely over Port 443 and also chances are much more likely that this port is more commonly open.

You make the change as an Administrator from your account in the ‘Administration’ tab, ‘Account>’More Settings’.  You check the box next to ‘Requires SSL Connection (RTMPS)’ and then ‘Save’.  You can revert back to RTMP and Port 1935 using the same method above (See Figure 1 below).

Note for Administrators – This is an account-wide change, all sessions will now be encrypted using SSL and use Port 443 and RTMPS as the protocol.

Figure 1

fig-1-ssl

How will I know if my meeting room is using SSL/RTMPS and Port 443?

There are a couple of simple way to see how your meeting is communicating.  Inside of your meeting room, look to the top-right of the screen and you will see the green bars that represent connectivity.  If you are using no SSL, RTMP and Port 1935 you will see just the bars (Figure 2).  If you are using SSL, RTMPS and Port 443 you will see a small gold lock icon (Figure 3)

Figure 2

fig-2-ssl

Figure 3

fig-3-ssl

Note – I am pretty sure that if you are using Port 80 then you will see a small ‘T’ on the icon representing ‘tunneling’.  I cannot confirm that as of the writing of this post and using the current Connect version).

You can also glean a lot of information on your connection by clicking on the ‘Help’ menu in your meeting room, mousing over the ‘Above Adobe Connect’ item, holding down the ‘Shift’ key and then clicking ‘About Adobe Connect’.  This will give you the screen in  Figure 4 below.  The first letters show the protocol (in this case ‘RTMPS’) and the numbers after ‘…adobeconnect.com’ show the port being used (in this case ‘443’ as we would expect with RTMPS).

Figure 4

fig-4-ssl

This is a simple change and something to try if you are seeing issues with your connectivity or latency in Connect meeting rooms.  You can always change it back.

Note on persistency – As Connect meeting rooms retain a persistent connection for 10 minutes or so after a room has been closed, you should wait 15 minutes with a room completely unoccupied before testing it again so that the connection can reset.  This may not be necessary, but I always give it time or build a new room for the test.