Find answers to your technical support questions using our knowledgebase.
Using the seach below, enter keywords related to your technical support question. We will search our support database and find support articles related to your inquiry.
Title
FireBox VPN instability from remote office to Host
ID
0000000008
Subtitle
VPN fails irregularly between remote and host.
Description
Remote VPN offices complain of loss of connection to MAS host server. RDP sessions fail.
Text
Remote offices complain that RDP sessions disconnect or hang disrupting work in application or desktop. Command line pings from host to remote office are inconsistant. VPNLog shows mature VPN connection at Host. Pings from host to remote may revitalize the VPN connection to the remote office.
Resolution
Problem is latency on the remote office end. Lag prevents VPN from staying alive even with VPN KeepAlives running. Must set the MTU (Maximum Transmission Unit) to less than 1500 default to throttle back packet size over internet. To figure out what to set the MTU to, perform this task:
Here is a simple ping test you can try to see if packets are 'fragmenting' due to MTU -
2. Do a ping test to a device on the other side of the tunnel. Example - Your Exchange or Terminal server is 192.168.10.5
C:\ping 192.168.10.5 -f -l 1500
Pinging 192.168.10.5 with 1500 bytes of data:
Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set.
Ping statistics for 192.168.10.5: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
This means the packet is fragmenting and is rejected since the –f (do not fragment is set) as most PC’s are set to 1500 MTU by default.
Reduce the size in the ping command until you get good reply pings.
C:\ping 192.168.10.5 -f -l 1350
Pinging 192.168.10.5 with 1350 bytes of data:
Reply from 192.168.10.5: bytes=1350 time=109ms TTL=52 Reply from 192.168.10.5: bytes=1350 time=32ms TTL=52 Reply from 192.168.10.5: bytes=1350 time=235ms TTL=52 Reply from 192.168.10.5: bytes=1350 time=141ms TTL=52
Ping statistics for 192.168.10.5: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 32ms, Maximum = 235ms, Average = 129ms
3. Once you have found the good size, subtract 10 from this and that is your MTU size.
MTU is set in FireBox admin at Network/External/Advanced/. Make adjustment at the remote office firebox. Changing MTU at host is not necessary.