I have three offices -- the main and two branches connected via Win2000 VPNs over a T1. For some reason, the connection between the main office and one branch will continually drop out, while the other stays up for weeks on end. Pinging the remote office for an hour will generate almost 20 drops, but the drop will be only for a duration of 20-30 seconds, then comes right back up. I first thought it was my ISP's fault, but they claim that it's not. I even got them to come and swap the router, which did nothing. Any ideas?
It

    Requires Free Membership to View

    Login

sounds like the tunnel between the two locations is dropping and rebuilding continually. This would explain the 30 seconds downtime that it takes to renegotiate the session keys and get the tunnel back up and running. Since the connection between the main office and one branch office stays up while the connection between the main office and the other branch office is flaky, I would guess that the problem is at or near the second branch office.

Without knowing what type of Internet access the second branch office has, it is difficult to provide a specific answer. But that's never stopped me before. So here goes.

Since your ISP already swapped the router, let's assume for a minute that the problem is not there. Here are a couple of other things you could check:

  1. Is there a proxy or other type of intermediate device that is timing out the connection?
  2. Is there a problem with the quality of the link while passing traffic? Monitoring the link to see how it behaves when sending data in bursty patterns would reveal this pretty quickly.
  3. Running a packet trace over an hour period between the locations outside the VPN tunnel (in the clear) would indicate which side was dropping the connection and probably why.

My guess is that the quality of the link to the second branch office is somehow noisy or congested.

Hope this helps,
Mark

This was first published in June 2002

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top