Re: VPN keeps dropping at the 3 minute mark

Very possible that you are saturating the link which would explain why it is
site specific. Building and tearing down VPN tunnels can be resource
intensive. You should really be setting up site-to-site VPNs for remote
offices, not client-server VPNs. *much* easier to manage, troubleshoot,
easier on WAN links.

-Cliff


"hooj" <> wrote in message
news:c5bfb424-4dbc-4061-9bbf-...
> Hi,
>
> Our main office runs SBS 2003 R2 and the standard VPN server. All our
> remote offices, except one, have no issue with connecting to the VPN
> and everything works fine.
>
> The one office which does have an issue manages to connect but then
> after approx 3 minutes the connection drops and they have to
> reconnect. As you can imagine this becomes very frustrating and means
> that accessing files on the network becomes virtually impossible.
>
> I've tried using my own machine on their network and I experience the
> same problem as they do, so I know it's not related to their computer.
> I've also tried 3 other machines (Windows XP, Vista and 7) all of
> which experience the same issue.
>
> I've tried upgrading the firmware on their router (D-Link) but this
> hasn't helped either and now I'm at a complete loss as to what the
> problem might be and how to go about fixing it.
>
> This is the connection log for the VPN on the clients machine,
>
> [3556] 12-01 14:56:45:195: PROTOCOL_MSG_Start recvd, d=ADIDO,
> hPort=5,flags=8,mask=8821288,IfType=-1
> [3364] 12-01 14:56:45:196: Line up event occurred on port 5
> [3364] 12-01 14:56:45:196: Local identification = MSRAS-0-BARNEY
> [3364] 12-01 14:56:45:196: PortName: VPN3-1
> [3364] 12-01 14:56:45:196: Starting PPP on link with
> IfType=0xffffffff,IPIf=0xffffffff,IPv6If=0xfffffff f
> [3364] 12-01 14:56:45:196: RasGetBuffer returned 5fd2070 for SendBuf
> [3364] 12-01 14:56:45:196: FsmInit called for protocol = c021, port =
> 5
> [3364] 12-01 14:56:45:196: FsmInit for protocol = c021 Configuration
> 0x8821288
> [3364] 12-01 14:56:45:196: PPP ConfigMask 0x8821288
> [3364] 12-01 14:56:45:196: PPP ConfigMask = 8821288
> [3364] 12-01 14:56:45:196: PPP ConfigMask = 8821288
> [3364] 12-01 14:56:45:196: APs available = 6
> [3364] 12-01 14:56:45:196: FsmReset called for protocol = c021, port =
> 5
> [3364] 12-01 14:56:45:197: Inserting port in bucket # 5
> [3364] 12-01 14:56:45:197: Inserting bundle in bucket # 2
> [3364] 12-01 14:56:45:197: FsmOpen event received for protocol c021 on
> port 5
> [3364] 12-01 14:56:45:197: FsmThisLayerStarted called for protocol =
> c021, port = 5
> [3364] 12-01 14:56:45:197: FsmUp event received for protocol c021 on
> port 5
> [3364] 12-01 14:56:45:197: <PPP packet sent at 12/01/2009 14:56:45:197
> [3364] 12-01 14:56:45:197: <Protocol = LCP, Type = Configure-Req,
> Length = 0x17, Id = 0x0, Port = 5
> [3364] 14:56:45:197: <C0 21 01 00 00 15 01 04 05 78 05 06 40 B6 26 6F
> |.!.......x..&.&o|
> [3364] 14:56:45:197: <07 02 08 02 0D 03 06 00 00 00 00 00 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:197:
> [3364] 12-01 14:56:45:197: InsertInTimerQ called
> portid=24,Id=0,Protocol=c021,EventType=0,fAuth=0,T imeout=1
> [3364] 12-01 14:56:45:197: InsertInTimerQ called
> portid=24,Id=0,Protocol=0,EventType=3,fAuth=0,Time out=150
> [3568] 12-01 14:56:45:238: Packet received (59 bytes) for hPort 5
> [3364] 12-01 14:56:45:238: >PPP packet received at 12/01/2009
> 14:56:45:238
> [3568] 12-01 14:56:45:238: Packet received (23 bytes) for hPort 5
> [3364] 12-01 14:56:45:238: >Protocol = LCP, Type = Configure-Req,
> Length = 0x3b, Id = 0x0, Port = 5
> [3364] 14:56:45:238: >C0 21 01 00 00 39 01 04 05 78 03 05 C2 23 81 05
> |.!...9...x...#..|
> [3364] 14:56:45:238: >06 65 96 28 2E 07 02 08 02 0D 03 06 11 04 06 4E
> |.e.(...........N|
> [3364] 14:56:45:238: >13 17 01 5B 18 12 27 5E CF 42 48 A9 F3 22 A6 F1
> |...[..'^.BH.."..|
> [3364] 14:56:45:238: >2C 06 2C 00 00 00 00 17 04 02 52 00 00 00 00 00
> |,.,.......R.....|
> [3364] 12-01 14:56:45:238:
> [3364] 12-01 14:56:45:238: CheckOption: Negotiated Options 2
> [3364] 12-01 14:56:45:238: CheckOption: Negotiated Options a
> [3364] 12-01 14:56:45:238: CheckOption: Negotiated Options 2a
> [3364] 12-01 14:56:45:238: CheckOption: Negotiated Options aa
> [3364] 12-01 14:56:45:239: CheckOption: Negotiated Options 1aa
> [3364] 12-01 14:56:45:239: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:239: <PPP packet sent at 12/01/2009 14:56:45:239
> [3364] 12-01 14:56:45:239: <Protocol = LCP, Type = Configure-Reject,
> Length = 0x25, Id = 0x0, Port = 5
> [3364] 14:56:45:239: <C0 21 04 00 00 23 11 04 06 4E 13 17 01 5B 18 12
> |.!...#...N...[..|
> [3364] 14:56:45:239: <27 5E CF 42 48 A9 F3 22 A6 F1 2C 06 2C 00 00 00
> |'^.BH.."..,.,...|
> [3364] 14:56:45:239: <00 17 04 02 52 00 00 00 00 00 00 00 00 00 00 00
> |....R...........|
> [3364] 12-01 14:56:45:239:
> [3364] 12-01 14:56:45:239: >PPP packet received at 12/01/2009
> 14:56:45:239
> [3364] 12-01 14:56:45:239: >Protocol = LCP, Type = Configure-Ack,
> Length = 0x17, Id = 0x0, Port = 5
> [3364] 14:56:45:239: >C0 21 02 00 00 15 01 04 05 78 05 06 40 B6 26 6F
> |.!.......x..&.&o|
> [3364] 14:56:45:239: >07 02 08 02 0D 03 06 00 00 00 00 00 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:239:
> [3364] 12-01 14:56:45:239: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=c021,EventType=0,fAuth=0
> [3568] 12-01 14:56:45:279: Packet received (28 bytes) for hPort 5
> [3364] 12-01 14:56:45:280: >PPP packet received at 12/01/2009
> 14:56:45:280
> [3364] 12-01 14:56:45:280: >Protocol = LCP, Type = Configure-Req,
> Length = 0x1c, Id = 0x1, Port = 5
> [3364] 14:56:45:280: >C0 21 01 01 00 1A 01 04 05 78 03 05 C2 23 81 05
> |.!.......x...#..|
> [3364] 14:56:45:280: >06 65 96 28 2E 07 02 08 02 0D 03 06 00 00 00 00
> |.e.(............|
> [3364] 12-01 14:56:45:280:
> [3364] 12-01 14:56:45:280: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:280: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:280: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:280: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:280: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:280: CheckOption: Negotiated Options 21aa
> [3364] 12-01 14:56:45:280: <PPP packet sent at 12/01/2009 14:56:45:280
> [3364] 12-01 14:56:45:280: <Protocol = LCP, Type = Configure-Ack,
> Length = 0x1c, Id = 0x1, Port = 5
> [3364] 14:56:45:280: <C0 21 02 01 00 1A 01 04 05 78 03 05 C2 23 81 05
> |.!.......x...#..|
> [3364] 14:56:45:280: <06 65 96 28 2E 07 02 08 02 0D 03 06 00 00 00 00
> |.e.(............|
> [3364] 12-01 14:56:45:280:
> [3364] 12-01 14:56:45:280: FsmThisLayerUp called for protocol = c021,
> port = 5
> [3364] 12-01 14:56:45:280: LCP Local Options-------------
> [3364] 12-01 14:56:45:280:
> MRU=1400,ACCM=-1,Auth=0,MagicNumber=1085679215,PFC=ON,ACFC=ON
> [3364] 12-01 14:56:45:280: Recv Framing =
> PPP,SSHF=OFF,MRRU=1500,LinkDiscrim=0
> [3364] 12-01 14:56:45:280: LCP Remote Options-------------
> [3364] 12-01 14:56:45:280:
> MRU=1400,ACCM=-1,Auth=c223,MagicNumber=1704339502,PFC=ON,ACFC=ON
> [3364] 12-01 14:56:45:280: Send Framing =
> PPP,SSHF=OFF,MRRU=1500,LinkDiscrim=0
> [3364] 12-01 14:56:45:281: LCP Configured successfully
> [3364] 12-01 14:56:45:281: Sending Version Identification MSRASV5.20
> [3364] 12-01 14:56:45:281: <PPP packet sent at 12/01/2009 14:56:45:281
> [3364] 12-01 14:56:45:281: <Protocol = LCP, Type = Identification,
> Length = 0x14, Id = 0x1, Port = 5
> [3364] 14:56:45:281: <C0 21 0C 01 00 12 40 B6 26 6F 4D 53 52 41 53 56
> |.!....&.&oMSRASV|
> [3364] 14:56:45:281: <35 2E 32 30 00 00 00 00 00 00 00 00 00 00 00 00 |
> 5.20............|
> [3364] 12-01 14:56:45:281:
> [3364] 12-01 14:56:45:281: Sending ComputerName Identification MSRAS-0-
> BARNEY
> [3364] 12-01 14:56:45:281: <PPP packet sent at 12/01/2009 14:56:45:281
> [3364] 12-01 14:56:45:281: <Protocol = LCP, Type = Identification,
> Length = 0x18, Id = 0x2, Port = 5
> [3364] 14:56:45:281: <C0 21 0C 02 00 16 40 B6 26 6F 4D 53 52 41 53 2D
> |.!....&.&oMSRAS-|
> [3364] 14:56:45:281: <30 2D 42 41 52 4E 45 59 00 00 00 00 00 00 00 00 |
> 0-BARNEY........|
> [3364] 12-01 14:56:45:281:
> [3364] 12-01 14:56:45:281: Client: LCP Configured successfully for
> Guid {E4C7AA4B-D411-4A48-BA8B-128973D68BEE}
> [3364] 12-01 14:56:45:281: Sending Correlation Guid {E4C7AA4B-
> D411-4A48-BA8B-128973D68BEE}
> [3364] 12-01 14:56:45:281: <PPP packet sent at 12/01/2009 14:56:45:281
> [3364] 12-01 14:56:45:281: <Protocol = LCP, Type = Identification,
> Length = 0x1a, Id = 0x3, Port = 5
> [3364] 14:56:45:281: <C0 21 0C 03 00 18 40 B6 26 6F 4B AA C7 E4 11 D4
> |.!....&.&oK.....|
> [3364] 14:56:45:281: <48 4A BA 8B 12 89 73 D6 8B EE 00 00 00 00 00 00 |
> HJ....s.........|
> [3364] 12-01 14:56:45:281:
> [3364] 12-01 14:56:45:281: Authenticating phase started
> [3364] 12-01 14:56:45:284: Calling APWork in APStart
> [3568] 12-01 14:56:45:322: Packet received (31 bytes) for hPort 5
> [3364] 12-01 14:56:45:322: >PPP packet received at 12/01/2009
> 14:56:45:322
> [3364] 12-01 14:56:45:322: >Protocol = CHAP, Type = Protocol specific,
> Length = 0x1f, Id = 0x0, Port = 5
> [3364] 14:56:45:322: >C2 23 01 00 00 1D 10 71 7B B1 8D 0C 24 F0 60 C0
> |.#.....q{...$.`.|
> [3364] 14:56:45:322: >00 9B 8F E3 01 73 C2 53 43 52 41 54 43 48 59 00
> |.....s.SCRATCHY.|
> [3364] 12-01 14:56:45:322:
> [3364] 12-01 14:56:45:324: <PPP packet sent at 12/01/2009 14:56:45:324
> [3364] 12-01 14:56:45:324: <Protocol = CHAP, Type = Protocol specific,
> Length = 0x49, Id = 0x0, Port = 5
> [3364] 14:56:45:324: <C2 23 02 00 00 47 31 EE 90 74 31 8D 97 9C F5 5A
> |.#...G1..t1....Z|
> [3364] 14:56:45:324: <30 6D 10 53 53 EB 27 00 00 00 00 00 00 00 00 4E |
> 0m.SS.'........N|
> [3364] 14:56:45:324: <72 AE 4E F1 D9 48 05 2F 0E 13 43 CC 9A 85 C3 75 |
> r.N..H./..C....u|
> [3364] 14:56:45:324: <D9 59 C3 55 05 65 68 00 41 44 49 44 4F 5C 61 6C
> |.Y.U.eh.ADIDO\al|
> [3364] 14:56:45:324: <65 78 2E 6F 74 68 6F 6C 64 00 00 00 00 00 00 00 |
> ex.othold.......|
> [3364] 12-01 14:56:45:324:
> [3364] 12-01 14:56:45:325: InsertInTimerQ called
> portid=24,Id=0,Protocol=c223,EventType=0,fAuth=0,T imeout=1
> [3568] 12-01 14:56:45:428: Packet received (48 bytes) for hPort 5
> [3364] 12-01 14:56:45:428: >PPP packet received at 12/01/2009
> 14:56:45:428
> [3364] 12-01 14:56:45:428: >Protocol = CHAP, Type = Protocol specific,
> Length = 0x30, Id = 0x0, Port = 5
> [3364] 14:56:45:428: >C2 23 03 00 00 2E 53 3D 43 37 34 44 46 32 30 34
> |.#....S=C74DF204|
> [3364] 14:56:45:428: >37 31 33 34 35 36 41 30 33 39 42 31 37 33 39 37 |
> 713456A039B17397|
> [3364] 14:56:45:428: >46 39 41 35 34 46 41 45 38 43 38 39 46 37 36 44 |
> F9A54FAE8C89F76D|
> [3364] 12-01 14:56:45:428:
> [3364] 12-01 14:56:45:428: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=c223,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:429: MS-CHAP-MPPE-Keys set
> [3364] 12-01 14:56:45:429: FsmThisLayerUp called for protocol = c223,
> port = 5
> [3364] 12-01 14:56:45:429: NotifyCaller(hPort=5, dwMsgId=20)
> [3364] 12-01 14:56:45:429: Callback phase started
> [3364] 12-01 14:56:45:429: CallbackPriv in CB = 0
> [3568] 12-01 14:56:45:429: Packet received (8 bytes) for hPort 5
> [3364] 12-01 14:56:45:429: >PPP packet received at 12/01/2009
> 14:56:45:429
> [3364] 12-01 14:56:45:429: >Protocol = CBCP, Type = Protocol specific,
> Length = 0x8, Id = 0x1, Port = 5
> [3364] 14:56:45:429: >C0 29 01 01 00 06 01 02 00 00 00 00 00 00 00 00
> |.)..............|
> [3364] 12-01 14:56:45:429:
> [3364] 12-01 14:56:45:429: <PPP packet sent at 12/01/2009 14:56:45:429
> [3364] 12-01 14:56:45:429: <Protocol = CBCP, Type = Protocol specific,
> Length = 0x8, Id = 0x1, Port = 5
> [3364] 14:56:45:429: <C0 29 02 01 00 06 01 02 00 00 00 00 00 00 00 00
> |.)..............|
> [3364] 12-01 14:56:45:429:
> [3364] 12-01 14:56:45:429: InsertInTimerQ called
> portid=24,Id=1,Protocol=c029,EventType=0,fAuth=0,T imeout=1
> [3568] 12-01 14:56:45:467: Packet received (8 bytes) for hPort 5
> [3364] 12-01 14:56:45:467: >PPP packet received at 12/01/2009
> 14:56:45:467
> [3364] 12-01 14:56:45:467: >Protocol = CBCP, Type = Protocol specific,
> Length = 0x8, Id = 0x1, Port = 5
> [3364] 14:56:45:467: >C0 29 03 01 00 06 01 02 00 00 00 00 00 00 00 00
> |.)..............|
> [3364] 12-01 14:56:45:467:
> [3364] 12-01 14:56:45:467: RemoveFromTimerQ called
> portid=24,Id=1,Protocol=c029,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:467: FsmThisLayerUp called for protocol = c029,
> port = 5
> [3364] 12-01 14:56:45:467: NotifyCaller(hPort=5, dwMsgId=3)
> [3364] 12-01 14:56:45:467: FsmInit called for protocol = 8057, port =
> 5
> [3364] 12-01 14:56:45:467: FsmInit for protocol = 8057 Configuration
> 0x8821288
> [3364] 12-01 14:56:45:468: InsertInTimerQ called
> portid=24,Id=0,Protocol=8057,EventType=8,fAuth=0,T imeout=9
> [3364] 12-01 14:56:45:468: FsmReset called for protocol = 8057, port =
> 5
> [3364] 12-01 14:56:45:468: FsmInit called for protocol = 80fd, port =
> 5
> [3364] 12-01 14:56:45:468: FsmInit for protocol = 80fd Configuration
> 0x8821288
> [3364] 12-01 14:56:45:468: FsmReset called for protocol = 80fd, port =
> 5
> [3364] 12-01 14:56:45:468: FsmInit called for protocol = 8021, port =
> 5
> [3364] 12-01 14:56:45:468: FsmInit for protocol = 8021 Configuration
> 0x8821288
> [3568] 12-01 14:56:45:469: Packet received (12 bytes) for hPort 5
> [3364] 12-01 14:56:45:469: InsertInTimerQ called
> portid=24,Id=0,Protocol=8021,EventType=8,fAuth=0,T imeout=9
> [3364] 12-01 14:56:45:469: FsmReset called for protocol = 8021, port =
> 5
> [3364] 12-01 14:56:45:469: FsmOpen event received for protocol 8057 on
> port 5
> [3364] 12-01 14:56:45:469: FsmThisLayerStarted called for protocol =
> 8057, port = 5
> [3364] 12-01 14:56:45:469: FsmUp event received for protocol 8057 on
> port 5
> [3364] 12-01 14:56:45:469: <PPP packet sent at 12/01/2009 14:56:45:469
> [3364] 12-01 14:56:45:469: <Protocol = IPv6CP, Type = Configure-Req,
> Length = 0x10, Id = 0x4, Port = 5
> [3364] 14:56:45:469: <80 57 01 04 00 0E 01 0A 00 00 00 00 00 00 00 00
> |.W..............|
> [3364] 12-01 14:56:45:469:
> [3364] 12-01 14:56:45:470: InsertInTimerQ called
> portid=24,Id=4,Protocol=8057,EventType=0,fAuth=0,T imeout=1
> [3364] 12-01 14:56:45:470: FsmOpen event received for protocol 80fd on
> port 5
> [3364] 12-01 14:56:45:470: FsmThisLayerStarted called for protocol =
> 80fd, port = 5
> [3364] 12-01 14:56:45:470: FsmUp event received for protocol 80fd on
> port 5
> [3364] 12-01 14:56:45:470: <PPP packet sent at 12/01/2009 14:56:45:470
> [3364] 12-01 14:56:45:470: <Protocol = CCP, Type = Configure-Req,
> Length = 0xc, Id = 0x5, Port = 5
> [3364] 14:56:45:470: <80 FD 01 05 00 0A 12 06 01 00 00 40 00 00 00 00
> |...........&....|
> [3364] 12-01 14:56:45:470:
> [3364] 12-01 14:56:45:470: InsertInTimerQ called
> portid=24,Id=5,Protocol=80fd,EventType=0,fAuth=0,T imeout=1
> [3364] 12-01 14:56:45:470: FsmOpen event received for protocol 8021 on
> port 5
> [3364] 12-01 14:56:45:470: FsmThisLayerStarted called for protocol =
> 8021, port = 5
> [3364] 12-01 14:56:45:470: FsmUp event received for protocol 8021 on
> port 5
> [3364] 12-01 14:56:45:470: <PPP packet sent at 12/01/2009 14:56:45:470
> [3364] 12-01 14:56:45:470: <Protocol = IPCP, Type = Configure-Req,
> Length = 0x24, Id = 0x6, Port = 5
> [3364] 14:56:45:470: <80 21 01 06 00 22 03 06 00 00 00 00 81 06 00 00
> |.!..."..........|
> [3364] 14:56:45:470: <00 00 82 06 00 00 00 00 83 06 00 00 00 00 84 06
> |................|
> [3364] 14:56:45:470: <00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:470:
> [3364] 12-01 14:56:45:470: InsertInTimerQ called
> portid=24,Id=6,Protocol=8021,EventType=0,fAuth=0,T imeout=1
> [3364] 12-01 14:56:45:470: >PPP packet received at 12/01/2009
> 14:56:45:470
> [3364] 12-01 14:56:45:470: >Protocol = CCP, Type = Configure-Req,
> Length = 0xc, Id = 0x3, Port = 5
> [3364] 14:56:45:470: >80 FD 01 03 00 0A 12 06 01 00 00 01 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:470:
> [3364] 12-01 14:56:45:470: <PPP packet sent at 12/01/2009 14:56:45:470
> [3364] 12-01 14:56:45:470: <Protocol = CCP, Type = Configure-Nak,
> Length = 0xc, Id = 0x3, Port = 5
> [3364] 14:56:45:470: <80 FD 03 03 00 0A 12 06 01 00 00 40 00 00 00 00
> |...........&....|
> [3364] 12-01 14:56:45:470:
> [3568] 12-01 14:56:45:471: Packet received (12 bytes) for hPort 5
> [3364] 12-01 14:56:45:471: >PPP packet received at 12/01/2009
> 14:56:45:471
> [3364] 12-01 14:56:45:471: >Protocol = IPCP, Type = Configure-Req,
> Length = 0xc, Id = 0x4, Port = 5
> [3364] 14:56:45:471: >80 21 01 04 00 0A 03 06 C0 A8 01 78 00 00 00 00
> |.!.........x....|
> [3364] 12-01 14:56:45:471:
> [3364] 12-01 14:56:45:471: <PPP packet sent at 12/01/2009 14:56:45:471
> [3364] 12-01 14:56:45:471: <Protocol = IPCP, Type = Configure-Ack,
> Length = 0xc, Id = 0x4, Port = 5
> [3364] 14:56:45:471: <80 21 02 04 00 0A 03 06 C0 A8 01 78 00 00 00 00
> |.!.........x....|
> [3364] 12-01 14:56:45:471:
> [3568] 12-01 14:56:45:509: Packet received (12 bytes) for hPort 5
> [3364] 12-01 14:56:45:509: >PPP packet received at 12/01/2009
> 14:56:45:509
> [3568] 12-01 14:56:45:510: Packet received (18 bytes) for hPort 5
> [3568] 12-01 14:56:45:510: Packet received (22 bytes) for hPort 5
> [3364] 12-01 14:56:45:510: >Protocol = CCP, Type = Configure-Ack,
> Length = 0xc, Id = 0x5, Port = 5
> [3364] 14:56:45:510: >80 FD 02 05 00 0A 12 06 01 00 00 40 00 00 00 00
> |...........&....|
> [3364] 12-01 14:56:45:510:
> [3364] 12-01 14:56:45:510: RemoveFromTimerQ called
> portid=24,Id=5,Protocol=80fd,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:510: >PPP packet received at 12/01/2009
> 14:56:45:510
> [3364] 12-01 14:56:45:510: >Protocol = IPCP, Type = Configure-Reject,
> Length = 0x12, Id = 0x6, Port = 5
> [3364] 14:56:45:510: >80 21 04 06 00 10 83 06 00 00 00 00 84 06 00 00
> |.!..............|
> [3364] 14:56:45:510: >00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:510:
> [3364] 12-01 14:56:45:510: RemoveFromTimerQ called
> portid=24,Id=6,Protocol=8021,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:511: <PPP packet sent at 12/01/2009 14:56:45:511
> [3364] 12-01 14:56:45:511: <Protocol = IPCP, Type = Configure-Req,
> Length = 0x18, Id = 0x7, Port = 5
> [3364] 14:56:45:511: <80 21 01 07 00 16 03 06 00 00 00 00 81 06 00 00
> |.!..............|
> [3364] 14:56:45:511: <00 00 82 06 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:511:
> [3364] 12-01 14:56:45:511: InsertInTimerQ called
> portid=24,Id=7,Protocol=8021,EventType=0,fAuth=0,T imeout=1
> [3364] 12-01 14:56:45:511: >PPP packet received at 12/01/2009
> 14:56:45:511
> [3364] 12-01 14:56:45:511: >Protocol = LCP, Type = Protocol-Reject,
> Length = 0x16, Id = 0x5, Port = 5
> [3364] 14:56:45:511: >C0 21 08 05 00 14 80 57 01 04 00 0E 01 0A 00 00
> |.!.....W........|
> [3364] 14:56:45:511: >00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> |................|
> [3364] 12-01 14:56:45:511:
> [3364] 12-01 14:56:45:511: PPP Protocol Reject, Protocol = 0
> [3364] 12-01 14:56:45:511: RemoveFromTimerQ called
> portid=24,Id=4,Protocol=8057,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:511: FsmThisLayerFinished called for protocol =
> 8057, port = 5
> [3568] 12-01 14:56:45:513: Packet received (12 bytes) for hPort 5
> [3364] 12-01 14:56:45:514: >PPP packet received at 12/01/2009
> 14:56:45:513
> [3364] 12-01 14:56:45:514: >Protocol = CCP, Type = Configure-Req,
> Length = 0xc, Id = 0x6, Port = 5
> [3364] 14:56:45:514: >80 FD 01 06 00 0A 12 06 01 00 00 40 00 00 00 00
> |...........&....|
> [3364] 12-01 14:56:45:514:
> [3364] 12-01 14:56:45:514: <PPP packet sent at 12/01/2009 14:56:45:514
> [3364] 12-01 14:56:45:514: <Protocol = CCP, Type = Configure-Ack,
> Length = 0xc, Id = 0x6, Port = 5
> [3364] 14:56:45:514: <80 FD 02 06 00 0A 12 06 01 00 00 40 00 00 00 00
> |...........&....|
> [3364] 12-01 14:56:45:514:
> [3364] 12-01 14:56:45:514: FsmThisLayerUp called for protocol = 80fd,
> port = 5
> [3568] 12-01 14:56:45:550: Packet received (24 bytes) for hPort 5
> [3364] 12-01 14:56:45:550: >PPP packet received at 12/01/2009
> 14:56:45:550
> [3364] 12-01 14:56:45:550: >Protocol = IPCP, Type = Configure-Nak,
> Length = 0x18, Id = 0x7, Port = 5
> [3364] 14:56:45:550: >80 21 03 07 00 16 03 06 C0 A8 01 77 81 06 C0 A8
> |.!.........w....|
> [3364] 14:56:45:550: >01 65 82 06 C0 A8 01 65 00 00 00 00 00 00 00 00
> |.e.....e........|
> [3364] 12-01 14:56:45:550:
> [3364] 12-01 14:56:45:550: RemoveFromTimerQ called
> portid=24,Id=7,Protocol=8021,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:550: <PPP packet sent at 12/01/2009 14:56:45:550
> [3364] 12-01 14:56:45:550: <Protocol = IPCP, Type = Configure-Req,
> Length = 0x18, Id = 0x8, Port = 5
> [3364] 14:56:45:550: <80 21 01 08 00 16 03 06 C0 A8 01 77 81 06 C0 A8
> |.!.........w....|
> [3364] 14:56:45:550: <01 65 82 06 C0 A8 01 65 00 00 00 00 00 00 00 00
> |.e.....e........|
> [3364] 12-01 14:56:45:550:
> [3364] 12-01 14:56:45:551: InsertInTimerQ called
> portid=24,Id=8,Protocol=8021,EventType=0,fAuth=0,T imeout=1
> [3568] 12-01 14:56:45:590: Packet received (24 bytes) for hPort 5
> [3364] 12-01 14:56:45:590: >PPP packet received at 12/01/2009
> 14:56:45:590
> [3364] 12-01 14:56:45:590: >Protocol = IPCP, Type = Configure-Ack,
> Length = 0x18, Id = 0x8, Port = 5
> [3364] 14:56:45:590: >80 21 02 08 00 16 03 06 C0 A8 01 77 81 06 C0 A8
> |.!.........w....|
> [3364] 14:56:45:590: >01 65 82 06 C0 A8 01 65 00 00 00 00 00 00 00 00
> |.e.....e........|
> [3364] 12-01 14:56:45:590:
> [3364] 12-01 14:56:45:590: RemoveFromTimerQ called
> portid=24,Id=8,Protocol=8021,EventType=0,fAuth=0
> [3364] 12-01 14:56:45:590: FsmThisLayerUp called for protocol = 8021,
> port = 5
> [3364] 12-01 14:56:45:590: RemoveFromTimerQ called
> portid=24,Id=8,Protocol=8021,EventType=8,fAuth=0
> [3364] 12-01 14:56:45:673: Notifying IPCP of projection notification
> [3364] 12-01 14:56:45:673: Client: Ipv4 successful for Guid {E4C7AA4B-
> D411-4A48-BA8B-128973D68BEE}
> [3364] 12-01 14:56:45:673: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=0,EventType=3,fAuth=0
> [3364] 12-01 14:56:45:673: NotifyCaller(hPort=5, dwMsgId=4)
> [3364] 12-01 14:56:45:673: NotifyCaller(hPort=5, dwMsgId=0)
> [3364] 12-01 14:56:45:673: Inserting autodisconnect in timer q for
> port=5, sec=-1
> [3364] 12-01 14:56:45:673: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=0,EventType=1,fAuth=0
> [3364] 12-01 14:56:45:673: InsertInTimerQ called
> portid=24,Id=0,Protocol=0,EventType=1,fAuth=0,Time out=-1
> [3364] 12-01 14:56:55:197: Peer Conf Recv timeout event received for
> portid=24,Id=0,Protocol=8057,fAuth=0
> [3568] 12-01 15:00:45:115: PROTOCOL_MSG_LineDown recvd, hPort=5
>
> [3364] 12-01 15:00:45:115: Line down event occurred on port 5
> [3364] 12-01 15:00:45:140: FsmDown event received for protocol c021 on
> port 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=c021,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:140: FsmDown event received for protocol 8057 on
> port 5
> [3364] 12-01 15:00:45:140: FsmThisLayerDown called for protocol =
> c021, port = 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=4,Protocol=8057,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:140: FsmThisLayerStarted called for protocol =
> 8057, port = 5
> [3364] 12-01 15:00:45:140: FsmReset called for protocol = 8057, port =
> 5
> [3364] 12-01 15:00:45:140: FsmDown event received for protocol 80fd on
> port 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=5,Protocol=80fd,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:140: FsmThisLayerDown called for protocol =
> 80fd, port = 5
> [3364] 12-01 15:00:45:140: FsmReset called for protocol = 80fd, port =
> 5
> [3364] 12-01 15:00:45:140: FsmDown event received for protocol 8021 on
> port 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=8,Protocol=8021,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:140: FsmThisLayerDown called for protocol =
> 8021, port = 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=8,Protocol=8021,EventType=8,fAuth=0
> [3364] 12-01 15:00:45:140: FsmReset called for protocol = 8021, port =
> 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=c223,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=1,Protocol=c029,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:140: FsmReset called for protocol = c021, port =
> 5
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=0,EventType=3,fAuth=0
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=0,EventType=7,fAuth=0
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=0,EventType=2,fAuth=0
> [3364] 12-01 15:00:45:140: RemoveFromTimerQ called
> portid=24,Id=0,Protocol=0,EventType=1,fAuth=0
> [3364] 12-01 15:00:45:191: RemoveFromTimerQ called
> portid=24,Id=1,Protocol=c029,EventType=0,fAuth=0
> [3364] 12-01 15:00:45:191: LcpEnd
> [3364] 12-01 15:00:45:191: Post line down event occurred on port 5
> [3364] 12-01 15:00:45:191: NotifyCaller(hPort=5, dwMsgId=25)
> [3364] 12-01 15:00:45:191: NotifyCaller(hPort=5, dwMsgId=10)
>
> Any help would be appreciated.

I should have been more specific, but also without knowing a lot more about
your setup it is tough to be *too* specific.

In short, VPN tunnels still keep an open encryption tunnel open, so an idle
connection still consumes some bandwidth and resources.

In particular, consumer grade routers can *really* have a problem with VPN
tunnels and NAT. NAT devices try to do address translation, not just on the
packet, but also at the protocol level. There is a reason you can FTP
behind a NAT router, for example. The NAT stack on the router actually
changes the IP on various places within the packet itself. Because of that
deep packet inspection, encrypted packets can *easily* overwhelm a poorly
designed consumer router...they simply weren't designed for this type of
traffic. Depending on your infrastructure, your connection to your ISP may
also suffer similar limitations (older Motorola SURFboard modems, for
example, were very PPTP unfriendly.) So, back to what I said above, without
knowing more about your infrastructure, I can't say with too much
specificity where the problem lies.

But the fact that it drops after three minutes pretty consistently does tell
me that some device along the chain is, in fact, having issues. It slowly
bleeds resources while the tunnel is open until it has no more resources
left, then the connection drops. When the connection drops, those resources
are freed, and the cycle repeats.

With that in mind, I'd still recommend a site-to-site VPN. It is easier to
manage because you don't have to troubleshoot individual connections, but
also many site-to-site VPNs are established *at* the network edge so, in
many cases, you are avoiding the problem of VPN traffic going through NAT
devices that can be problematic. Obviously if your ISP device has issues
then that will still occur, but it is one less thing to worry about
regardless.

-Cliff


"hooj" <> wrote in message
news:ca95a9c8-f204-4580-965b-...
> I'm not sure how we could be saturating the link as it's only one
> person connecting from this office, and when they connect, even if
> they do nothing, they still get disconnected
>

I agree about the site-to-site, but in the short term, how about just
connecting a machine directly to the DSL modem or whatever. You already
know it's not their PC, which seems to leave their router and the ISP -
leaving the customer's router and other network infrastructure out of the
picture will let you know which.

FWIW, we've got two local broadband providers, the telco and RoadRunner.
I've seen fairly major issues with both of them because of hardware - they
put a piece of equipment in your location and leave it there until it fails,
while at the same time constantly upgrading their own infrastructure. Your
cable or DSL router becomes more and more obsolete, and less and less
reliable, as time goes on.

Hooj, it's a wired LAN connection at the remote location, right? If any
part of it's wireless, I'd see what happens over a wired connection before
troubleshooting further.


"Cliff Galiher" <> wrote in message
news:...
>I should have been more specific, but also without knowing a lot more about
>your setup it is tough to be *too* specific.
>
> In short, VPN tunnels still keep an open encryption tunnel open, so an
> idle connection still consumes some bandwidth and resources.
>
> In particular, consumer grade routers can *really* have a problem with VPN
> tunnels and NAT. NAT devices try to do address translation, not just on
> the packet, but also at the protocol level. There is a reason you can FTP
> behind a NAT router, for example. The NAT stack on the router actually
> changes the IP on various places within the packet itself. Because of
> that deep packet inspection, encrypted packets can *easily* overwhelm a
> poorly designed consumer router...they simply weren't designed for this
> type of traffic. Depending on your infrastructure, your connection to
> your ISP may also suffer similar limitations (older Motorola SURFboard
> modems, for example, were very PPTP unfriendly.) So, back to what I said
> above, without knowing more about your infrastructure, I can't say with
> too much specificity where the problem lies.
>
> But the fact that it drops after three minutes pretty consistently does
> tell me that some device along the chain is, in fact, having issues. It
> slowly bleeds resources while the tunnel is open until it has no more
> resources left, then the connection drops. When the connection drops,
> those resources are freed, and the cycle repeats.
>
> With that in mind, I'd still recommend a site-to-site VPN. It is easier
> to manage because you don't have to troubleshoot individual connections,
> but also many site-to-site VPNs are established *at* the network edge so,
> in many cases, you are avoiding the problem of VPN traffic going through
> NAT devices that can be problematic. Obviously if your ISP device has
> issues then that will still occur, but it is one less thing to worry about
> regardless.
>
> -Cliff
>
>
> "hooj" <> wrote in message
> news:ca95a9c8-f204-4580-965b-...
>> I'm not sure how we could be saturating the link as it's only one
>> person connecting from this office, and when they connect, even if
>> they do nothing, they still get disconnected
>>

In article <4f45bb09-911a-4a55-b1d0-
>, says...
> I've ordered a new router, so will give that a go next and will let
> you guys know what happens.
>
> Thanks for all your input so far
>

One thing - is this a DSL line by chance?

I've seen VPN solutions fail because the MTU setting was wrong for the
DSL connection, most times I've had to set the MTU value to 1430 or
somewhere in that range - the default of 1500 doesn't always play well
with VPN's - at the same time, with the failing VPN, web browsing and
email worked fine.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
(remove 999 for proper email address)