IPSEC - wireless gateway packet loss dpd connection loss

[jstevens]

Greetings,

I am posting this here and in Cisco's forum. Cisco client 4.0.5.D connecting to a Cisco VPN concentrator. My local sites original ISP connection method is a Trango bridged wireless link.

http://www.trangobroadband.com/

The problem that is occurring is the tunnel is going down intermediately. The affects are loss of communication over the tunnel and the client starts sending DPD packets to no avail. The tunnel does not appear to time out. I have to click disconnect and then reconnect to re-establish the tunnel. Working with the site that is hosting the concentrator they have made the claim that the problem is our wireless link. We do have mild to moderate packet loss and here is their conclusion.

Packet loss greatly affects IPSEC traffic and can cause the failure of IPSEC tunnels in this manner. At first I laughed and thought this idea was not technically reasonable. There of course is packet loss over the Internet and people use IPSEC tunnels all over the place.

Well to appease corporate my site installed a cable wired connection and I directed the clients who use the Cisco VPN through that link. To my amazement I appear to no longer have the problem.

Is this true that IPSEC is severely affected by mild to moderate packet loss? I would have thought that packet fragmentation and the reassembly thereof has no affect on packet encryption. Does IPSEC decryption have to be in a certain order and if packets get dropped this issue occurs?

I feel that IPSEC should be able to be used over bridged wireless with packet loss and that there is a technical bug or problem with the equipment that is being used. I feel that my problem is more related to MTU size but I can't technically specify where an MTU problem would be.

Any Ideas?
Jason

 

[atimike]

Have a similar problem here as well - I have a VPN tunnel established between our corporate office and a remote site, configured exactly the same as six other locations, but the VPN connection keeps failing, apparently at random times.

The remote location is served by a local wireless ISP using a 900MHz signal to their central facility. However, I have another location served by the same ISP which has no problems.

I've checked the MTU settings, and determined that 1442 was the ideal setting, with 4% packet loss (which is still high). I've been in communication with my ISP to no avail.

Any help would be appreciated!

Mike Molenda
Antioch Tire Inc

 

[jstevens]

My wireless is a GHZ solution but not sure exactly what frequency. After switching to a wired connection I have had no further disconnects so I know 100$ that the disconnects were being caused by the wireless bridge.

My ISP has agreed to put in a new wireless system that supports quality of service and or re-transmissions. Not speaking authoritatively packets are routinely dropped by the wireless bridge and never re-transmitted. I am still not understanding technically as to the cause of the problem with IPSEC. It also appears to be more of a problem with the VPN client running on Windows platform. We have had much less issues with router to router because as soon as the router sees a dead tunnel it rebuilds it automatically.

My ISP is expecting to start using us as a test site in March or April and I will update this when I have more information.

Jason Stevens

jstevens @ palmspringscc . com