Wireless dropping while on VPN

[kjjb0204]

I have a T60 with WPA2 enabled, Netgear N router. Our company uses a Nortel Contivity VPN client with RSA keyfob authentication. Problem: When I'm on vpn via wireless, my wireless connection drops out just about every 15-20 minutes and I have to re-establish my vpn, enter keyfob again, everything. When it's on the dock and connected via hardwire, never drops the vpn connection. I don't think it's the router for two reasons: 1. If my T60 isn't connected to our vpn, the wireless never drops, and 2. My T40 never drops the wireless connection. The guys over at techguy.org couldn't help, so hoping someone here might have a solution.

Thanks!

[bill bolton]

When I'm on vpn via wireless, my wireless connection drops out just about every 15-20 minutes and I have to re-establish my vpn, enter keyfob again, everything.

I have a T60 that I use with Nortel Contivity VPN (V4.86 r3) and its very reliable over my home WiFi connection.... but I'm not using a Netgear router!

Cheers,

Bill B.

[Thing]

XP or Vista?

[kjjb0204]

XP SP2

[steveg47]

Sounds like a router issue. Try removing wpa2 temporary and see if that fixes the issue. Make sure you are flashed to the latest firmware on your router. If removing wpa2 fixes the problem call Netgear support and see if they have a fix.

FYI...I have a T60P and an older Dlink router (no N) and when connected via nortel vpn I never get drops using Vista or XP.

[kjjb0204]

Sounds like a router issue. Try removing wpa2 temporary and see if that fixes the issue. Make sure you are flashed to the latest firmware on your router. If removing wpa2 fixes the problem call Netgear support and see if they have a fix.

FYI...I have a T60P and an older Dlink router (no N) and when connected via nortel vpn I never get drops using Vista or XP.

Yep, I'm going to have to try another router. The strange thing is that the T60 only has the disconnect problem when I'm running the vpn. My T40 stays connected just fine with wpa2 enabled and the T60 does as well when not on vpn.

[kjjb0204]

Just an update - I'm on my second new router, and still having the disconnect problems on wireless vpn. I had to disable Access Connections and use windows to configure the wireless and now it doesn't drop the wireless. I wish I could figure out why thinkvantage ac keeps dropping...

[kjjb0204]

So, I'm still having this issue. Wireless connection drops when running VPN software client. Only happens if I'm using Access Connections. If I configure Windows to operate the wireless connection, it doesn't drop at all. Has to be something with Access Connections that is causing the wireless to drop. I really need to use AC since I have multiple profiles set for our corp network, home network, customer networks, etc. Anyone have any thoughts?

[ninjaronin18]

So, I'm still having this issue. Wireless connection drops when running VPN software client. Only happens if I'm using Access Connections. If I configure Windows to operate the wireless connection, it doesn't drop at all. Has to be something with Access Connections that is causing the wireless to drop. I really need to use AC since I have multiple profiles set for our corp network, home network, customer networks, etc. Anyone have any thoughts?

I had the same issue. However, my wireless dropped out after 2-3 hours. I couldn't get back on wireless unless i completely restarted my computer. However, once i uninstalled Cisco Access Agent, the problem seemed to have been remedied.

[dr_st]

I sometimes experience the same issue with my T60, Intel Wifi card, Intel Proset Wireless Manager, Intel NetStructure VPN and Edimax router.

On some days, the connection drops every 15-30 minutes, on some days it drops a couple of times in the day, and on some days does not drop at all.

I am not sure it is directly related to the VPN. I can't see how it would be, because the WiFi connectivity is direct between the PC and the router, and should be oblivious to any tunneling protocol that you use.

I believe that it is possible that the WiFi just experiences occasional disconnects that last 5-10 seconds, which is usually not something you would notice just surfing the web, but something that is often enough to boot you off the VPN, which is why you (and I) only observe it when connected to VPN. That's my theory. Of course I have no idea what causes it and how to fix it.

[kjjb0204]

I believe that it is possible that the WiFi just experiences occasional disconnects that last 5-10 seconds, which is usually not something you would notice just surfing the web, but something that is often enough to boot you off the VPN, which is why you (and I) only observe it when connected to VPN. That's my theory. Of course I have no idea what causes it and how to fix it.

Nope. I can run a virtual desktop session via web browser that requires a constant connection and run it for hours. Wireless only dropping when I sign into the vpn client. Definitely has something to do with the combination of vpn client and access connections.

[shinjiplus]

i have the same problem as ninjaronin18, but do not have Cisco Access Agent installed.

i am running Vista SP1 with all available updates. i do not use access connections though.

any ideas as to the root cause?

[ninjaronin18]

i have the same problem as ninjaronin18, but do not have Cisco Access Agent installed.

i am running Vista SP1 with all available updates. i do not use access connections though.

any ideas as to the root cause?

hey man

i still have the problem even w/o cisco access connections
ive finally made up my mind that it must have sumthing to do with the campus' router that serves my dorm because at home it doesnt do this

[Beaver11]

Just to add my experience. I have been using Access Connections for the last 3 years and have had the same issues:
- at home, on my wireless network (with both Linksys and Airport extreme routers), I got kicked out of my corporate VPN usually within 15-20 minutes. If I change the WPA timeout on the Airport to 1 day (instead of 1 hour), I seem to be able stay on longer, but still rarely over 4-5 hours (and usually less).
- at another external corporate network (where I have no access to the router to make changes), I get kicked out of the VPN in as little as 10 minutes. Other colleagues of mine (same company) never have this problem.
In both these cases, if I connect directly (ethernet), I never get kicked out. The VPN connection stays on all the time.

In my own company Wifi network, Access Connections links up fine and there are no issues; of course, I am not using VPN in this case.

I have a T61 on XP and use the Nortel Contivity client, like others in this thread.

I never assumed this problem was due to Access Connections until yesterday. I had to uninstall AC and connect with Windows directly and guess what? After 8 hours, I realized that the VPN connection had still not dropped! So today, I started some testing. With the lastest version of AC, I lost my VPN connection within 20 minutes. I removed and connected direcly via Windows and after 5 hrs, I am still connected! More evidence: when I mentioned above that I lost my VPN connection at the other external site and my colleagues did not, I just realized that I was the only on using AC.

I love AC, but this is a show stopper. It may be as simple as a setting within AC, but I am not knowledgeable enough to know what. So I will disable unless/until I find a solution.

Another interesting point: Disabling AC is not easy. (Google for the instructions!) but every switch between AC and the Windows native function required disabling and re-enabling the Intel Wireless Wifi network adapter (My Computer/Properties/Hardware/Device manager/network adapters). Until I figured this out, I could not connect to any wireless network, period.

Hope this is helpful.

[Beaver11]

Some more info...

Looking into the Contivity Logs, the "Keepalive" interval is set to 60 seconds with maximum of 3 retries (without response).

Fri Dec 23 08:07:26 2011 | ConfMode      | I | Keepalive interval set to 60 seconds.
Fri Dec 23 08:07:26 2011 | ConfMode      | I | Maximum keepalive retransmissions set to 3 retries.
Fri Dec 23 08:07:26 2011 | ConfMode      | I | Mandatory tunneling enforced.

At some point (about 25 minutes later), there is a break and there is no response to the 3 Keepalive transmissions:

Fri Dec 23 08:32:12 2011 | Isakmpd           | I | Keepalive sent. 2 left, next one in 30 seconds.
Fri Dec 23 08:32:31 2011 | Isakmpd           | I | Keepalive sent. 2 left, next one in 30 seconds.
Fri Dec 23 08:32:50 2011 | Isakmpd           | I | Keepalive sent. 2 left, next one in 30 seconds.
Fri Dec 23 08:33:21 2011 | Isakmpd           | I | Keepalive sent. 1 left, next one in 15 seconds.
Fri Dec 23 08:33:36 2011 | Isakmpd           | I | Keepalive sent. 0 left, next one in 7 seconds.
Fri Dec 23 08:33:45 2011 | Isakmpd           | F | Connection lost due to no response from keepalives or no incomming packets for 2 minutes.
Fri Dec 23 08:33:48 2011 | Isakmpd           | E | Switch did not respond to keep alives.  Connection Lost

I am wondering... Would it help to enable "Silent Keepalives" under the Options Menu of the Contivity client? If I have a chance, I will test this and report back.

From Nortel:
The Silent keep-alive is client generated only and sent at all times. Its purpose is to maintain a
state table in either a NAT or Stateful Firewall. These are sent on UPD port 500. Silent keep-
alives do not expect a response, therefore these types of keep-alive packets, will not detect a lost
end-point during times of inactivity. The down side to this is if either tunnel endpoint is down, the
tunnel will remain up, until idle timeout on the Contivity switch. They are sent at the ISAKMP
interval configured on the switch, or the NAT Traversal Interval configured on the Switch, if NAT
Traversal is enabled and negotiated during tunnel establishment. For Silent keep-alives to
become active they must be enabled, and the ISAKMP keep-alive must be disabled on the Client,
the switch or both.
http://sysdoc.doors.ch/NORTEL/TT030503.pdf

[bill bolton]

Do you have your Wifi card power management setting in Access Connections on Maximum Performance in the profiles you are using for VPN purposes?

Cheers,

Bill B.

[Beaver11]

Do you have your Wifi card power management setting in Access Connections on Maximum Performance in the profiles you are using for VPN purposes?

I am so happy that my VPN is not dropping (incredulous in fact) that I currently have Access Connections disabled. If I get adventurous, I will enable it again and resume testing it. In general, however, I would have had that setting on whatever the default was.

Thanks!

[bill bolton]

In general, however, I would have had that setting on whatever the default was.

The default is maximum power saving

Cheers,

Bill B.

[Beaver11]

So I changed the power setting to Low Power (Best network performance) with "enable radio management support" unchecked. I also went into Windows XP Network Connections/Wireless Network Connection icon/General tab/Configure and unchecked the box that says "Allow the computer to turn off this device ...".

The VPN cutoff after about 35 minutes.

I have now checked off "Silent Keepalives" in the Nortel Contivity client to see if that makes a difference. I'll let you know if that works.