Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

VPN Connection Timing Out

Status
Not open for further replies.

Matanzu

IS-IT--Management
Jan 28, 2008
4
GB
Salut,

Firstly apologies if this has been asked before; I had a hunt through the threads for the past 3-4 months and couldn't find any issues similar to mine so I'm hoping it's a new one.

On to the point - we have a company with the main office based in the UK and a satellite office in Australia. The main office's network is an AD network running on Windows Server 2003.

I had to do a quick cut-and-shut solution to allow the Australian users to remotely access the network, I opted for a remote access VPN, using the stuff that comes with Server 2003, connecting directly to the AD machine (where you go through the process and select "Allow incoming VPN connections", yeah I know this is really bad practice!) The long term objective is to set up a site-to-site VPN, but this solution was deemed to suffice for now.

Anyway, the VPN worked fine - users connect in via autheticated accounts with strong passwords, etc, access the Intranet and generally work.

There is one slight snag, however; every hour, on the hour, the connection times out.

I have subsequently created a RAAS server that sits in front of the network that authenticates the users, to replace the above solution, at this time the users still individually connect in (phase 2, once this is out of the way I start the fun of working on how to sort out site-to-site) and it still works fine.

The 1 hour disconnect still persists.

Interestingly it doesn't appear to disconnect from the VPN (the RAAS server still registers an active connection), it's just that from that point, on the hour, users are completely unable to browse the network and Intranet (in my case, I use Remote Desktop quite a bit over the VPN to access the office outside of office hours and I find the Remote Desktop connection times out, but I still have to manually disconnect and connect to the VPN again) The VPN connection stays open and when the user disconnects / reconnects the logs on the RAAS machine pick up on the user initiated disconnect and user initiated connect.

Because two totally different processes are affected by the same issue, and that it doesn't matter what time you connect to the VPN it always kicks you off on the hour, I'm inclined to believe it's not related to settings I have on the AD and I'm edging towards configuration settings on the Firewall / Router in to the office to be the cause (mainly as I've gone through all the Group Policies and Terminal Services settings to check for timeouts).

The router itself is a naff BT 1800HG (which as I understand it is essentially a 2wire 1800HG that has been re-branded) but I doubt that will help anyone.

I suppose my first question is has anyone come across this before, and if no-one has (or no-one found a solution) is there a good methodical process I can follow to working out what exactly is causing this time out? On the router about the only thing I've done is the appropriate port forwarding to allow the VPN connections through - someone did mention looking at the MTU size but I couldn't find any resources specific to MTU and VPN connections.

Apologies for the long post, any help would be greatly appreciated.
 
Hi,

I have seen a simialr problem when using an IPSEC VPN.

The problem I had was that the Windows Firewall on the Vista client which was connecting was not allowing the VPN Keep Alive packets through. Once I modified this on the local client all was well.

This isn't good practice but purely for testing how about disabling any local firewalls on the client computers and testing to see if they then last longer than an hour?

Thanks.

----------------------------------------
"Nobody cares how it works, as long as it works
 
Hi,

Thanks for the quick response.

I tried disabling the various firewalls client-side from the machines that access the VPN (we have varying OS, primarily XP Pro and Vista Business) and unfortunately no joy there.

I've managed to replicate the setup of our UK office using virtual machines on a server I have at home so I will probably use that to see if turning off firewalls server-side has any effect at all (there's no way I'd turn off the firewalls in the UK office, even for a minute as we've had hacking issues before), unfortunately that route will have to wait a few weeks as I'm currently in the Australian office (using the VPN...).

To further update the checks I've been doing I also performed a quick test with MS's support tools (pptpclnt and pptpsrv) and I can confirm that the applications were able to exchange TCP and GRE packets without dropping any so I definately know the firewall isn't blocking anything crucial there (as is commonly the case with VPN issues).

I'm convinced it's something firewall / router-related so I'll probably continue to investigate on that avenue. Thanks for the suggestion, and if you have any other thoughts I will be more than happy to give them a bash.

Cheers.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top