topic problem with remote access vpn in Network Security

problem with remote access vpn

prashantrecon — Tue, 12 Mar 2019 02:57:36 GMT

Hi All,

I am facing slow connectivity issues when connected to remote access vpn.

Able to do RDP to the server intially it works fine once i excute some queries or commands it freezes.

speed is also good.when pinged to far end peer ip from windows machine displays packets needs to fragemented but df set

shall i change tcp-mss value.If i do does it have any reverse affect on other traffic.

problem with remote access vpn

Marius Gunnerud — Mon, 04 Nov 2013 09:50:09 GMT

I would suggest trying to change the mss to something lik 1400

ip tcp adjust-mss 1400

problem with remote access vpn

prashantrecon — Tue, 05 Nov 2013 08:32:31 GMT

Thanks,Thus it have reverse impact on other traffic.

problem with remote access vpn

Marius Gunnerud — Tue, 05 Nov 2013 08:34:55 GMT

What impact does the reverse traffic experience?

problem with remote access vpn

prashantrecon — Wed, 06 Nov 2013 08:42:17 GMT

With current mss seetings(1480) it work fine when there is no tarrfic load on the network.

During the peak working hours users starts facing slowness problem.

Currently i have priotized traffic with max bandwith.

problem with remote access vpn

Marius Gunnerud — Wed, 06 Nov 2013 18:56:42 GMT

Have you tried lowering the MTU? lower it to 1200

problem with remote access vpn

prashantrecon — Thu, 07 Nov 2013 03:22:47 GMT

Currently it is set to 1500 ,I will check and let u know.

Thanks for your guidance

problem with remote access vpn

prashantrecon — Thu, 07 Nov 2013 17:24:50 GMT

No luck,Is there any other parameters need to be check.

problem with remote access vpn

prashantrecon — Thu, 07 Nov 2013 18:06:43 GMT

Hi,

Below are my inputs.

1. usres can easily connect to remote access SSL VPN and do RDP to Virtual machine.

Note: On My end we have asa firewall and far end it is Juniper firewall.

2 Once they connect to Virtual machine they start excuting there works after every 10 to 15 min suddenlly there machine gets freezed neither they can move the mouse .after one minute it become normal.

Note- This issues oocurs for the all users simultaneous connected to that machine at SAME time.

3 Changed mss and mtu value , even shutdown the ips sensor still no luck.

problem with remote access vpn

Julio Carvajal — Thu, 07 Nov 2013 20:37:57 GMT

Hello Prashant,

U told us this is a remote access SSL VPN.

Does the SSL VPN terminates on the ASA or the Juniper box?

Is the Juniper just a pass-through device??

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

problem with remote access vpn

prashantrecon — Fri, 08 Nov 2013 03:49:11 GMT

Hi,

SSl vpn terminates on Juniper.On our side it is ASA.

problem with remote access vpn

Julio Carvajal — Fri, 08 Nov 2013 04:00:31 GMT

So,

The ASA is just a passthrough device?

I mean a firewall in the path That's it right?

My recommendation is to determine what's the biggest packet you can send through the FW and the Junos box to determine who is the one with the MTU having the problem (Also on the local and remote networks)

Run pings from client machines with different sizes and the DF set and determine the PMTU.

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

problem with remote access vpn

prashantrecon — Fri, 08 Nov 2013 04:21:52 GMT

Thanks,

Ya the firewall is in the path.Ping is blocked from far end client machine.Allowed from my side.

Is there any other way to detemine it.

Another thing to add i have changed to 1200 .But issue didnot resolve infact other vpn got afecting with slowness issue.

Re: problem with remote access vpn

Julio Carvajal — Fri, 08 Nov 2013 04:27:00 GMT

I see,

Okey, Cisco recommended value is 1380 when dealing with Traffic that will be encapsulated over differente headers such as IPsec, GRE, etc.

In our case is regular TCP (Just that goes encrypted) but no overhead.

Now, all TCP traffic is by default set with the DF value flag so it will not get fragmented.

The other way would be clearing the DF value before the traffic reaches the ASA.

Read the following blog so you can understand what I am talking about and why PMTU is needed here

http://www.networkworld.com/community/blog/mtu-size-issues

Changing the MTU will be needed buddy but instead of making it lower it needs to be higher,

Again the best way to approach this would be PMTU but we make sure the application understands the ICMP "Message too big"

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

problem with remote access vpn

prashantrecon — Fri, 08 Nov 2013 04:42:26 GMT

So MTU has to be changed for inside and as well as Outside interface.

Currently it is 1500

problem with remote access vpn

Julio Carvajal — Fri, 08 Nov 2013 04:45:11 GMT

That's exactly my point.

Unless you find out what's the size of the packet being sent you will not know which is the size and also it will need to be done on all of the devices across the path.

Not something scalable man Path MTU is our way to go

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

problem with remote access vpn

prashantrecon — Fri, 08 Nov 2013 05:15:09 GMT

Thanks

Let u know once i do the changes.

problem with remote access vpn

prashantrecon — Sun, 10 Nov 2013 06:57:00 GMT

Hi Jullio,

Just to add my findings.

I have 10 Mbps linlks which is directly connected to PC.Doesnot involve any firewall stuff.

But still w e are facing same problem on that too.

On My network some times it works absoulety fine with default MTU seetings on firewall. Really confused.

Is it any thing related to que Size seetings on firewall.

problem with remote access vpn

Julio Carvajal — Sun, 10 Nov 2013 07:00:24 GMT

Hello Prashant,

U lost me man!

I mean,

Know you have a PC directly connected to which other device???

and what you need to check is the MTU of the devices in the path not the access-rate they have.

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

problem with remote access vpn

prashantrecon — Sun, 10 Nov 2013 07:11:30 GMT

Hi,

This connection goes directly from PC to MUX .

MUX to ISP side.

So need to check the seeting on MUX and as well as ISP side.

Another thing i want to know there are 10 site to site VPN om my side.

Chaning the MTU seetings can affect the other VPN trafic?