Citrix Secure Access VPN keeps disconnecting on DSL 1

[ict2000]

Hi,

I have Windows XP SP2, and DSL at home. When I use Internet alone, there is no issue. When I connect to a remote site using Citrix Secure Access VPN, it connects ok. After a couple of minutes (sometimes it varies), VPN loses connection and internet connection also drops off. VPN then reconnects very quickly, same as the Internet. But the problem is all my Citrix client applications hang and take a long time to reconnect.

What do you suggest to do to fix the disconnection problem? Other people connect to the same VPN site without any problem.

Thanks in advance.

 

[ict2000]

I used to use Smartpass. I no longer have it on my pc because it is replaced by Citrix now. I already tried uninstalling and reinstalling Citrix Secure
Access when the problem first happened. So far IT have no idea because other people do not have the same problem as myself.

Yes, I agree, it looks like all traffic has been forced onto vpn. Is there any setting locally I can check, or is it a setting on VPN server? Adding a router is the next thing I may try, but I am a bit puzzled that I did not have this kind of problem before. By the way, did try "ipconfig /release" and "ipconfig /renew", but no effect.

 

[g8orade]

If you still have dial-up. Use it to dial into internet and then try connecting with client. This should tell you whether or not the client is the issue. Also, have you tried using another computer with client on same connection to see if problem follows. You could try a router in the middle to see if it takes care of the lease problem. Or, If this is yours then read.

http://support.dlink.com/SupportFAQ/default.asp?model=DSL-502G

g8orade

 

[John Lewis]

The D-Link support website uses frames and therefore is not linkable. Is this what you were trying to link to?

No Support for IPSec Print
The current version of firmware for the DSL-500 / DSL-504 does not support IPSec in any form at this time. Please go to and occasionally check for the latest firmware. At this time, there is no timeline on when new firmware will become available. The current firmware is version 1.14 and 1.14A. The only difference between the two is that the 1.14A comes up with a default PPPoA screen, not PPPoE. Other than that, they are both the same.

This information is only for the US version of the DSL-500/504. The information in this knowledge base does not apply to the Generation 2 versions.

Either way, I was surprised to read this. I can't think of any reason a fairly modern DSL modem would not support IPSec passthrough.

 

[g8orade]

I guess question is this, is this your modem? And if it is, is it time to buy new. And other question, is the client ipsec or ssl? If you know its ipsec traffic then it may be time to ask the telco for a new modem or purchase one yourself.

 

[ict2000]

That is not my modem model.

Before I try a router to give my pc a fixed IP, do you think if my ISP could increase the interval from 1 minute to 1 or 2 hours, or more, that will temporarily fix the problem?

But why are all traffic forced onto VPN? Is there something locally I can check?

 

[John Lewis]

For what it is worth, the information indicated for the DL-500/504 is listed in the section for the DL-502. I would be concerned about any DL-5xx model.

If your lease time were increased to something reasonable, it would certainly help your problem. I would guess that your ISP also services dialup accounts, which would explain the short DHCP lease. It would benefit their network to give all broadband accounts a longer lease, as it would reduce overhead on their DHCP server and free up a small amount of bandwidth.

Many VPN clients have the ability to force all traffic over the VPN. Usually DHCP traffic is excluded. Most of the VPN clients can operate without forcing all traffic over the VPN, but sometimes it requires a setting change on the server side. I am not familiar with the Citrix client, but it is possible there is a configuration option on the client. Look for something that references the using the default gateway on the host network or similar. Also, you may want to check with the admin of the server.

 

[ict2000]

After speaking with my ISP regarding the IP address, I have configured my modem to use NAT. This also changes the lease time from 1 minute to 3 days. Thus the disconnection problem goes away.

Thanks a lot for all your help.

 

[g8orade]

Good call mhkwood. You were dead on the money. This is what makes Tek-Tips one of the better forums on the net. You deserve a star.

G8orade