VPN Connection Problem

**JamesO** · 02-22-2006, 09:12 AM

Here's the VPN issue I am running into. Looking for ideas and suggestions.

Nortel Contivity VPN client - do not have software version info at this time
Panasonic Toughbook CF-W2 with Intel Centrino CPU and Intel PRO 2200 wireless (yea I know, not at all excited about the Intel PRO 2200 wireless)
Windows XP SP2 with all current updates
D-Link wireless router - WGT-624v3 with the latest firmware (1.0.128_1.0.1)
ATT DSL modem - no specifics at this time

2 problems, may be separate, may be related??

Issue #1. Laptop connected directly to DSL modem via CAT5 cable, can connect to VPN, however, VPN kicks client off within 2-3 minutes. Can connect to Internet all day long without problems, only when using Nortel Contivity VPN connection is there a problem.

Issue #2. Laptop connected wirelessly unable to establish VPN connection. Additional testing shows that when pinging router from Panasonic machine with VPN client, when VPN attempts to connect, wireless drops out for about 10 seconds at same time in VPN cycle, causing VPN to never establish a link. Confirmed the router is able to keep a wireless connection alive by using a 2nd wireless machine that does not drop pings while Panasonic CF-W2 does drop ping when trying to connect to VPN.

Have found some references searching the web that there might be some form of switching happening with the wireless card when connecting to the VPN with the VPN client software. I know this Intel PRO 2200 wireless card has a lot of issues. I know I probably need to update the driver which may help the problem, just have not had a chance to do this yet.

These problems also do not appear to be any conflict with IP addressing.

A good source suggested a TCP/IP stack repair for #1 might help. However, I have not had time to try this yet.

A few other ideas I had was putting a PCMCIA wireless card in the Panasonic if the PRO 2200 update does not yield anything positive. The PCMCIA card would hopefully allow me to get away from the Intel wireless issues. Hopefully narrowing the problem down.

I could put a different router in for a test, but at this point, if the router is the problem, it is only dropping the VPN connection but can sustain other wireless connections at the same time.

Ideas and suggestions welcome.

Thanks in advance,

JamesO

**johnwill** · 02-22-2006, 03:15 PM

One obvious question, what's at the other end of the VPN link? I use the Nortel client to connect to one of my client's network, and it runs happily all day if I let it. Have you talked to the help desk on the other end of the link?

**JamesO** · 02-22-2006, 04:56 PM

This is a end user with a Nortel end to end solution.

I did spend some time on the phone with the help desk today. Did get a few tidbits, however, I also asked what I thought was an obvious question if they were using or planning on going to IPV6 anytime soon. As I recall there is a mandate for certain agencies to move to IPV6 sometime soon.

When the help desk person asked me what IPV6 was, I know I was in trouble.

I also inquired if the host side would have any kind of log to see if there were any specific errors that might give more insight. The answer was there is a log, but they did not know how to locate it!

The client uses Zone Alarm as well as the Contivity VPN software. Was pretty scary when I was told to disable the firewall and wireless encryption. They said they do this all the time. I understand this for a test, but the way it came across is seemed they suggested leaving things disabled in this manner!

Anyway, will be a few days before I get my hands on the client machine again.

JamesO

**johnwill** · 02-23-2006, 04:10 PM

Well, disabling the wireless encryption seems pretty stupid, that's transparent to any higher level protocol! However, the firewall may well be the issue, it might make sense to disable that for a test. Actually, with ZA, you sometimes have to totally uninstall it to get it to release it's grip. I just went through this with someone recently.

**JamesO** · 02-24-2006, 04:21 AM

I agree that disabling items for testing purposes is acceptable, however, this did not seem to be the suggested practice.

Appreciate the info on ZA about un-install, hopefully, this will not be the case, but I will keep it in mind.

I just ran into a 2nd situation where the VPN disconnects quickly, not related in anyway to the first case. I have no details yet, but it will be interesting to see what I find and if the cause is similar.

It seems that either the VPN's work or they don't. Not sure if there are any timers that are adjustable in the software somewhere?

JamesO

**johnwill** · 02-24-2006, 08:38 AM

I have little experience with VPN's, I just basically use the ones I'm provided for contact with clients.

I'm somewhat at a loss. Did you consider installing the VPN client on a "clean" machine and see if it's something other than the machine, perhaps the network environment?

**JamesO** · 03-07-2006, 03:05 PM

Finally got to the bottom of the VPN problem.

After much conversation about VPN pass thru, port forwarding and all kinds of router related issues, turns out the firewall was the problem! Still a bit confused as to the different behavior between the direct DSL connection that actually connected for short periods and the router connection that never connected and dropped pings both wirelessly and wired.

Assume that the Pings to the router was dropped when the VPN attempted to reassign a different IP address and the firewall decided this was not a good idea! Firewall made the client machine studder and fall back in line?

Machine has Zone Alarm Pro. Added the VPN IP address and the Remote Desktop address into the Trusted Zone and life was good!

JamesO

02-22-2006, 09:12 AM	#1 (permalink)
JamesO Join Date: Mar 2005 Location: Fairfax, VA USA Posts: 2,289 OS: 98SE, W2k Pro, XP Pro	VPN Connection Problem Here's the VPN issue I am running into. Looking for ideas and suggestions. Nortel Contivity VPN client - do not have software version info at this time Panasonic Toughbook CF-W2 with Intel Centrino CPU and Intel PRO 2200 wireless (yea I know, not at all excited about the Intel PRO 2200 wireless) Windows XP SP2 with all current updates D-Link wireless router - WGT-624v3 with the latest firmware (1.0.128_1.0.1) ATT DSL modem - no specifics at this time 2 problems, may be separate, may be related?? Issue #1. Laptop connected directly to DSL modem via CAT5 cable, can connect to VPN, however, VPN kicks client off within 2-3 minutes. Can connect to Internet all day long without problems, only when using Nortel Contivity VPN connection is there a problem. Issue #2. Laptop connected wirelessly unable to establish VPN connection. Additional testing shows that when pinging router from Panasonic machine with VPN client, when VPN attempts to connect, wireless drops out for about 10 seconds at same time in VPN cycle, causing VPN to never establish a link. Confirmed the router is able to keep a wireless connection alive by using a 2nd wireless machine that does not drop pings while Panasonic CF-W2 does drop ping when trying to connect to VPN. Have found some references searching the web that there might be some form of switching happening with the wireless card when connecting to the VPN with the VPN client software. I know this Intel PRO 2200 wireless card has a lot of issues. I know I probably need to update the driver which may help the problem, just have not had a chance to do this yet. These problems also do not appear to be any conflict with IP addressing. A good source suggested a TCP/IP stack repair for #1 might help. However, I have not had time to try this yet. A few other ideas I had was putting a PCMCIA wireless card in the Panasonic if the PRO 2200 update does not yield anything positive. The PCMCIA card would hopefully allow me to get away from the Intel wireless issues. Hopefully narrowing the problem down. I could put a different router in for a test, but at this point, if the router is the problem, it is only dropping the VPN connection but can sustain other wireless connections at the same time. Ideas and suggestions welcome. Thanks in advance, JamesO

02-22-2006, 03:15 PM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,685 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	One obvious question, what's at the other end of the VPN link? I use the Nortel client to connect to one of my client's network, and it runs happily all day if I let it. Have you talked to the help desk on the other end of the link? __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

02-23-2006, 04:10 PM	#4 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,685 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Well, disabling the wireless encryption seems pretty stupid, that's transparent to any higher level protocol! However, the firewall may well be the issue, it might make sense to disable that for a test. Actually, with ZA, you sometimes have to totally uninstall it to get it to release it's grip. I just went through this with someone recently. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

02-24-2006, 08:38 AM	#6 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,685 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	I have little experience with VPN's, I just basically use the ones I'm provided for contact with clients. I'm somewhat at a loss. Did you consider installing the VPN client on a "clean" machine and see if it's something other than the machine, perhaps the network environment? __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

02-22-2006, 04:56 PM	#3 (permalink)
JamesO Join Date: Mar 2005 Location: Fairfax, VA USA Posts: 2,289 OS: 98SE, W2k Pro, XP Pro	This is a end user with a Nortel end to end solution. I did spend some time on the phone with the help desk today. Did get a few tidbits, however, I also asked what I thought was an obvious question if they were using or planning on going to IPV6 anytime soon. As I recall there is a mandate for certain agencies to move to IPV6 sometime soon. When the help desk person asked me what IPV6 was, I know I was in trouble. I also inquired if the host side would have any kind of log to see if there were any specific errors that might give more insight. The answer was there is a log, but they did not know how to locate it! The client uses Zone Alarm as well as the Contivity VPN software. Was pretty scary when I was told to disable the firewall and wireless encryption. They said they do this all the time. I understand this for a test, but the way it came across is seemed they suggested leaving things disabled in this manner! Anyway, will be a few days before I get my hands on the client machine again. JamesO

02-24-2006, 04:21 AM	#5 (permalink)
JamesO Join Date: Mar 2005 Location: Fairfax, VA USA Posts: 2,289 OS: 98SE, W2k Pro, XP Pro	I agree that disabling items for testing purposes is acceptable, however, this did not seem to be the suggested practice. Appreciate the info on ZA about un-install, hopefully, this will not be the case, but I will keep it in mind. I just ran into a 2nd situation where the VPN disconnects quickly, not related in anyway to the first case. I have no details yet, but it will be interesting to see what I find and if the cause is similar. It seems that either the VPN's work or they don't. Not sure if there are any timers that are adjustable in the software somewhere? JamesO

03-07-2006, 03:05 PM	#7 (permalink)
JamesO Join Date: Mar 2005 Location: Fairfax, VA USA Posts: 2,289 OS: 98SE, W2k Pro, XP Pro	Finally got to the bottom of the VPN problem. After much conversation about VPN pass thru, port forwarding and all kinds of router related issues, turns out the firewall was the problem! Still a bit confused as to the different behavior between the direct DSL connection that actually connected for short periods and the router connection that never connected and dropped pings both wirelessly and wired. Assume that the Pings to the router was dropped when the VPN attempted to reassign a different IP address and the firewall decided this was not a good idea! Firewall made the client machine studder and fall back in line? Machine has Zone Alarm Pro. Added the VPN IP address and the Remote Desktop address into the Trusted Zone and life was good! JamesO