BEFSX41 to BEFSX41 VPN? 2

[hudr]

can this be done? I have 2 Linksys BEFSX41 routers. One will be hooked to DSL w/ Static IP(Site A) and the other to cable with possible persistent IP(worst case:dynamic)(Site B). Can I set up a VPN between these two sites (A and B)using these routers? If so, how do I make it as stable as possible? I have had issues with Linksys routers dropping VPN connections in the past (look for that question in another post soon).
Thanks all,
Hudr

 

[cdogg]

Issues with VPN over DSL normally relate to the MTU setting. DSL over PPPoE usually requires a smaller MTU setting for some connections and sites to work correctly. Next time you try, lower the MTU to something like 1400 as a test. You might also need to allow IPSec passthrough. Both settings can be found in the router configuration screen under Advanced -> Filters.

If dropped connections persist, even when the router is not involved, then I would suspect an ISP issue.


~cdogg
[tab]"All paid jobs absorb and degrade the mind";
[tab][tab]- Aristotle
[tab][navy]For general rules and guidelines to get better answers, click here:[/navy] faq219-2884

 

[bcastner]

I agree with cdogg, but there is a way to affirmatively test your MTU.

. For DSL it is almost always 1492, unless you are using AOL which for odd reasons is 1412-1420. Rather than guess use a testing tool:

http://www.dslreports.com/tweaks

. You need to make entries for the MTU both in the router, and in each Windows client. I use the freeware DrTCP tool from the same site as the testing tools:

http://www.dslreports.com/drtcp

 

[bcastner]

See also the firmware discussion for the BEFSX41 here: thread916-864467

You may have to on both sides fiddle with the firmware used.

A downgrade to the firmware is not out of the question as far as I am concerned, but see the discussion in the linked thread above.

 

[hudr]

I got the VPN working. I actually made it work with only one end having a static IP. I don't know how stable it will be and I am not at all satisfied with the security. How bad do you think it is to have the <Security-VPN-Remote Security Group> set to "Any"? I still have 3DES enabled with PFS and a pre-shared key. The VPN works but I think it could be more secure. Also, I found a link on Linksys's website that dealt directly with my question. (do a search on Linksys's site for Answer ID 247). But I think y'all have answered it more clearly. Also, first thing I did was upgrade both routers to the latest firmware available before even setting them up with the ISP.