RE: Microsoft VPN keeps getting dropped almost every 10 min s.! Why?

It's possible the NAT'ed session for the tunnels are timing out in the
Netscreen.  This would happen for tunnels that have no activity.  Is it L2TP
or IPsec?  You may want to jack up the timeout value for the service that
represents these tunnels (IP proto 47 for GRE, IP proto 50 for IPsec/ESP,
UDP port 1701 for L2TP, UDP port 500 or 4500 for UDP encapsulated IPsec for
NAT-T).  

Easiest thing to do is to setup a tunnel and do a "get session" on the
Netscreen to find which ports or IP protocols are being used.  Also get the
id of the session.  If the id of that session is 3432, for example, then
watch that session's timer for the next 10 minutes (with "get sess id 3432")
to see if it is timing out. 

If this is the case then one plausible solution (besides jacking the service
timeout to something much higher for this service on the Netscreen) is to
have some form of "keepalive" between the VPN client and server.  Something
that will generate a packet on a quiet tunnel at least once every 10 minutes
(or whatever the timeout values are set to).

Dave Klein
NetScreen SE

> -----Original Message-----
> From: Exo Wa [mailto:[email protected]] 
> Sent: Monday, January 19, 2004 11:31 AM
> To: [email protected]
> Subject: [VPN] Microsoft VPN keeps getting dropped almost 
> every 10 mins.! Why?
> 
> Hi,
> 
> I have setup two VPN servers in my work environment. 
> The two servers sit behind a hardware firewall and 
> both machines are mapped to external IPs via NetScreen
> 25.
> 
> Each machine has two NICs and they both have Windows
> 2000 Server
> installed (with all Microsoft's latest patches
> applied). Internet
> Authentication Service is installed and both machines
> belongs to
> a domain controller which provide authentication
> services for these 
> VPN servers.
> 
> Since both machines have identical setup (except IP), 
> I will give you config of VPN Server1:
> 
> Two NICs:(with bogus IPs)
> 
> NIC#1Public:   192.168.1.90 mapped to 202.15.15.90
> SubNet MasK   255.255.255.0   
> Default Gtw   192.168.1.1
> Preferred DNS 192.168.1.80
> 
> NIC#2Private: 192.168.1.92 
> SubNet MasK   255.255.255.0   
> Default Gtw(blank-per MS manual i found on the
> Internet)
> Preferred DNS 192.168.1.80
> 
> Users are prompted for password and authenticated 
> with no problem but only stay connected for 
> about 10 to 15 minutes then gets dropped 
> eventhough they can reconnect with no problem. 
> This problem persist for every user trying to VPN in.
> 
> Can someone tell me if my configuration is correct?
> What can I do to rectify this?
> 
> Any help on this would be much appreciated.
> 
> Thanks In Advance,
> 
> -Exo
> 
> __________________________________
> Do you Yahoo!?
> Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
> http://hotjobs.sweepstakes.yahoo.com/signingbonus
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn
>