Globus Connect Personal Troubleshooting Guide

If you encounter a permissions issue when attempting to install the Globus Connect Personal software, then you may see an error something like the above. This error is telling us that you don’t have the needed permissions to be able to install the Globus Connect Personal software to the location mentioned in the error.

If you don’t have the needed permissions to install the Globus Connect Personal software to the default location ("C:\Program Files" for Windows, your home directory for Linux, "/Applications" for Macs) then you’ll want to install the software to a different location for which your user account has permissions. If you need assistance in finding such a location on your system, you’ll want to reach out to your local IT staff.

If you have a home directory on a network share, you may see an error message of the form:

"Your user profile is on a network share, at location "<path>". To use Globus Connect Personal, you must map this location to a local drive. Please contact support@globus.org for more information."

This issue arises when your home directory is stored on a server, and "<path>" takes the form of "\\example.com\share\Users\ExampleUsername".

To resolve this problem, you must use Windows' capability to create a shortcut to a network share, or "Map" it to a drive letter. Microsoft provides official documentation for this here. Follow these instructions to assign a drive letter of your choosing to the network share containing your home directory, and then restart Globus Connect Personal. If you encounter difficulty with mapping the drive to a drive letter, you’ll want to reach out to your local IT staff for additional assistance.

If you have anti-virus or local security policies which prevent GCP from launching your default browser you may encounter an error message similar to the below:

"Browser login did not complete. Failed to open Default Browser."

This issue arises when GCP is unable to launch your default browser to complete the GCP Login process.

This issue is covered in this doc below.

This sort of behavior is commonly caused by the Accessible Folders setting on the personal endpoint not permitting the path in question.

This sort of error is commonly caused by the Accessible Folders setting on the personal endpoint not permitting the path in question.

The actual text of the error may vary somewhat from the sample image above. These sort of errors indicate that the workstation where you are attempting to install the Globus Connect Personal Software cannot connect to the Globus service.

You can work around this issue and complete your Endpoint setup process by creating a GCP Setup key; however, without the network block which is preventing access to relay.globusonline.org [54.237.254.192/29 (IPv4) and 2600:1f28:14:4::/62 (IPv6)] being addressed by your Networking team, you will not be able to initiate transfers without moving your machine to a different network (eg. from a home/other network without the network restriction in place).

If GCP is unable to connect to the Globus service, then the Globus icon (circle with a 'g' in it) in your system tray or menu bar will appear grayed out and will have an exclamation point in it:

Clicking on the Globus icon will then show you a brief description of what is wrong:

If you see the 'Not Connected' error after clicking on the Globus icon, then the GCP software is not able to connect to the Globus service.

You’ll first want to verify that your workstation has a functional Internet connection. You can do this by simply opening your web browser and navigating to the Globus website at the URL below:

https://www.globus.org/

If you’re not able to browse to the Globus website on the system where your endpoint is located, then you’ll need to work with your organization’s IT staff or your ISP to resolve your Internet connectivity issues before you’ll be able to use the GCP software or access your endpoint.

If your issue persists even after verifying that you have a functional Internet connection, you’ll next want to test connectivity to the relay.globusonline.org host from your system.

The GCP software must be able to connect to port 2223 on the relay.globusonline.org server in order to be able to function. A simple way to test if such connections can be made is to use the 'telnet' command to attempt to make such a connection like so:

If attempting to run the 'telnet' command produces something like a 'command not found' error, then you don’t have telnet installed on your system and will need to install it to perform the test.

If the connection is successful, you should see output like this:

If the command produces different output than the above, then the connection attempt was not successful. In such a case, we have some basic Troubleshooting Steps that you’ll want to try next.

All of the above are examples of fault messages you might see if there is a firewall or other networking issue preventing data channel connections from your personal endpoint to a remote endpoint. You’ll notice that these faults are generated by your personal endpoint. You’ll also notice in all cases that the error message contains Unable to connect to IP_ADDRESS:PORT. This is telling us that the personal endpoint is not able to establish a data channel connection to the remote endpoint at that particular IP and port. The IP address and ports given in the example errors above are just samples for illustration purposes.

This sort of error tells us that the endpoint doesn’t trust the cert being offered for the data channel connection. This generally only happens if there is something interfering with the establishment of the data channel session between the two endpoints involved in the transfer. Data channel traffic looks similar to https traffic in some ways, so firewall or network policy designed to limit or monitor such traffic can interfere with the establishment of data channel sessions between endpoints. We sometimes see these sorts of errors for endpoints located behind https intercept proxies or similar devices. Globus data channel traffic cannot be proxied in this way, so sites that do operate with policy designed to intercept https/ssl traffic will need to configure exceptions for Globus data channel traffic for endpoints operating on their network.

"ICE negotiation failed" refers to Globus Connect Personal’s use of the STUN and ICE protocols to do "NAT hole punching". These are protocols for traversing a NAT device, typically something like a home router, and establishing peer-to-peer connections between two Globus Connect Personal endpoints.

Some networks are incompatible with these protocols. In particular, if both of the endpoints are behind symmetric NAT, ICE cannot be used to establish connections. If you’re getting errors related to this, it strongly suggests that your network topology does not allow ICE to create a connection between the Globus Connect Personal endpoints you’re using.

Your endpoints should function correctly when used with any Globus Connect Server, including Globus Tutorial Collection 1 and Globus Tutorial Collection 2. That’s because Globus Connect Personal will simply make outbound connections to Globus Connect Server and doesn’t need to try to use ICE.

In order for two Globus Connect Personal Endpoints to connect to one another using ICE, they need to be able to communicate with one another using UDP on ephemeral ports. You can see a detailed document on the ports which are needed by Globus Connect Personal here.

The requirement for Outbound UDP 32768-65535 refers to the use of ephemeral ports.

Transfers between two Globus Connect Personal endpoints require the use of ICE and STUN to be able to work. If one or both of the Globus Connect Personal endpoints involved in such an attempted transfer are on networks that don’t support these protocols, then such transfers will not be possible.

If you were able to successfully complete the set up process for your endpoint, then start here. If not, then skip to the next step immediately.

You’ll first want to attempt to transfer files in both directions between your personal endpoint and the Globus Tutorial Collection. If you are new to the Globus service, the file transfer tutorial will explain how to perform transfers.

Users have a 10MB quota on the Tutorial Endpoint, so you’ll want to keep that in mind when doing your test transfers.

If you find that transfers to and from your personal endpoint and the Globus Tutorial Endpoint SUCCEED, but you still encounter problems when transferring with a different particular endpoint, then it is likely that the problem is related to that other endpoint. You’ll want to reach out to the support staff for that remote endpoint and ask for their help in resolving the issue. If the admin of that endpoint should require further support, then they can open a ticket with us so that we can work directly with them to resolve the issue.

If either of the above test transfers FAIL, then the issue is likely on the side of your personal endpoint. Go ahead and proceed with the next step.

You’ll next want to try disabling the host firewall on your workstation.

If your attempts SUCCEED when your host firewall is disabled, then you’ll need to configure your host firewall to be consistent with our Globus Connect Personal Firewall Requirements Documentation. You’ll want to reach out to your local IT staff if you need assistance in configuring your host firewall.

If your attempts still FAIL then go ahead and proceed with the next step.

If possible, go ahead and attempt to setup a new personal endpoint on a different workstation at the same location/network as the workstation you are having trouble with is located. If the setup attempt succeeds, then go ahead and attempt to transfer with the Globus Tutorial Endpoint as well.

If you find that you now SUCCEED in setting up the Globus Connect Personal software and conducting transfers when using the personal endpoint on the alternate workstation, then the issue is very likely with the original workstation.

If you find that you still FAIL to be able to setup the Globus Connect Personal software or conduct transfers when using the personal endpoint on the alternate workstation, then go ahead and proceed with the next step.

If possible, go ahead and attempt to setup a new personal endpoint on a different workstation at a different location/network than the workstation you are having trouble with is located. For example, if the original workstation is located at work, try using a different workstation located at home. If the setup attempt succeeds, then go ahead and attempt to transfer with the Globus Tutorial Endpoint as well.

If you find that you now SUCCEED in setting up the Globus Connect Personal software and conducting transfers when using the personal endpoint on the alternate workstation, then the issue is very likely with the original workstation or the network where it is located. You’ll want to reach out to the IT staff at the original location and work with them to get the Globus Connect Personal software working at that location. You’ll want to be sure to mention the Globus Connect Personal Firewall Requirements Documentation to your IT staff when you contact them so they can ensure that policy for any campus firewalls will meet those requirements.

If you find that you still FAIL to be able to setup the Globus Connect Personal software or conduct transfers when using the personal endpoint on the alternate workstation, then go ahead and open a support ticket with us so we can help you look into things further.