Vodafone 4G - Work VPN

necstandards

work VPN was working fine when i had fixed Vodafone broadband except for the incredible slow speed, so i changed Vodafone 4G.
4G connection is great, really fast. But when i connect to my work VPN i get problems.
1. Web pages dont open or partially open
2. Outlook sometime connects but not all the time
3. I've no problem accessing the work L drive.

So it seems im connect to the network as i can open the L drive.
Work help desk have looked at this for two weeks but cannot see any problem..

I cant find an email address for VF, but have call to be told that there is no problem..
Any ideas, i badly need to get this resolved

funnyname

You connecting wirelessly or via USB?

I had a similar issue when I updated my phone from 3g to 4g with meteor. Couldn't connect to the VPN when connecting through USB but was OK with wireless hotspot.

Never figured out why but happy with wireless option when ever I need to use it.

necstandards wrote: »

work VPN was working fine when i had fixed Vodafone broadband except for the incredible slow speed, so i changed Vodafone 4G.
4G connection is great, really fast. But when i connect to my work VPN i get problems.
1. Web pages dont open or partially open
2. Outlook sometime connects but not all the time
3. I've no problem accessing the work L drive.

So it seems im connect to the network as i can open the L drive.
Work help desk have looked at this for two weeks but cannot see any problem..

I cant find an email address for VF, but have call to be told that there is no problem..
Any ideas, i badly need to get this resolved

Case Sensitive

Hi,

Same problem and I've been treated to a circus performance by Vodafones Tech Team for the last 2,5 months. I really do wonder about them.

1. I've confirmed that 4G works on its own on both by R216 device and using my Apple 5S as a hotspot.
2. When activating the VPN tunnel then 4G seize to work on both the R216 device and the Apple 5S hotspot.
3. My own IT department has confirmed that 4G works with the VPN tunnel on other networks.
4. If I log in to the devices and set them to 3G only then the devices work with VPN.

So, the problem is specific to Vodafone and specific to their 4G network only, 3G still works. So you have a solution, albeit a sub-optimal one, which is to set the device to 3G.

pizzahead77

Which APN are you using? I had issues years ago with Vodafone when using live.vodafone.com as the APN for the hotspot - I needed to change to hs.vodafone.ie

necstandards

Whats is APN & how would i change this?

necstandards

Just changed network settings to 3G and now it seems to work fine, althou slow.
I actually tried connecting to VPN in Shannon (work) on the 4G network and it seemed to work fine, but when i got home it gave these problems with half opening pages. This suggest the problem is to do with the strenght of the 4g signal..

Will have to check again.. I'll post again.

thanks for the 3G suggestion

Case Sensitive

Hi,

If it was the signal then you surfing would be affected when the APN was turned off, but my understanding is that piece works, no?

APN is something Vodafone has to change for you, but they won't. Googling suggest this was a fix back when they had the same problem on 3G. Vodafone is saying the VNP provider has to fix this, I'm skeptical of suggestion given that this works for every other networks 4G.

You're not with Checkpoint Security VPN by any chance?

Netcelero

This may not help but maybe one to discuss with your company's IT support.

I had a similar problem on a site with Vodafone 3 months ago. Turned out on that cell the MTU was around 1400 and our router was sending 1500 size packets. For some reason the cell wasn't replying about needing to fragment so the router blindly kept sending packets and the vodafone cell kept dropping them.

How we figured it out was by sending a series of pings with the do not fragment bit set and each ping with an increasing mtu size.

ping -f -l 1200 8.8.8.8
ping -f -l 1300 8.8.8.8
ping -f -l 1400 8.8.8.8
ping -f -l 1500 8.8.8.8

Once we knew the correct size we set the router to below that MTU. Solved the problem for us.

A VPN adds overhead to your packets and that might be pushing the size up too much.

DevilTheBit

Did ye manage to resolve this?
I'm having the same issues, can't rely on 3g as its too slow.

chewed

I'm having similar issues on my 3 router. I've contacted my IT department and they can't help nor can 3 support! I'm using a B593 router. Any time I connected to my VPN everything would drop and I wasn't able to access any sites.

The interesting thing is I found that I was (just about) able to get 4G so switched to this on the router. And this seems to be when the problems started. So I'm going to test out using it with 3G when I get home to see if the VPN works.

ED E

Can you guys determine if you're using a UDP or TCP VPN?

If its TCP theres a TCP over TCP problem which tends to be ok on a very consistent connection but rears its ugly head when there's jitter involved. In such a case switching over to UDP would be an instant fix.

chewed

ED E wrote: »

Can you guys determine if you're using a UDP or TCP VPN?

I have no idea! Is there easy way to find otu?

editorsean

One possibility is that Three reduced its MTU size with the 4G mast you're using, especially if the VPN continues to work fine in 3G mode. In Letterkenny, I've seen them go as low as 1300. At home, it's mainly been 1446 over the past two months. I must check it at my end again when I'm back home.

Try going through the steps I posted here without the VPN connected to set the MTU size in your router.

You mentioned a while back that you previously got your VPN working after a factory reset on your router, so might be worth a try also.

chewed

editorsean wrote: »

One possibility is that Three reduced its MTU size with the 4G mast you're using, especially if the VPN continues to work fine in 3G mode. In Letterkenny, I've seen them go as low as 1300. At home, it's mainly been 1446 over the past two months. I must check it at my end again when I'm back home.

Try going through the steps I posted here without the VPN connected to set the MTU size in your router.

You mentioned a while back that you previously got your VPN working after a factory reset on your router, so might be worth a try also.

I tried this but unfortunately it didn't work for me. I found that 1370 was the lowest I could go in the ping test. I added 28 and put 1398 into the MTU settings, but unfortunately it's still not working properly when connected to VPN. Email and Lync disconnect immediately and I can't access any company urls.

The reason why it worked when I reset my router last time was because it changed the connection back to "auto". My 3G signal is stronger than 4G, so that's why the VPN was working correctly. I changed it back to 4G again, but never made the connection!

So, as mentioned above, the only way to get VPN working is for me to use 3G!

editorsean

That indeed is strange as it still seems like the MTU size is causing issues with 3G being able to work fine.

Just in case it needs a smaller MTU size, could you try the VPN over 4G with the MTU size in the router set to 1300.

chewed

editorsean wrote: »

That indeed is strange as it still seems like the MTU size is causing issues with 3G being able to work fine.

Just in case it needs a smaller MTU size, could you try the VPN over 4G with the MTU size in the router set to 1300.

No luck with 1300 either! :-(

editorsean

One more possibility is that the VPN itself might need a lower MTU size such as if the VPN software or server has trouble handling the lower MTU size of the Three connection.

With the router MTU size set back to 1398, close any running software, connect the VPN and then try a regular "ping 8.8.8.8" to see if it replies. If this gives request timed outs, then there's likely some other issue such as Three's content filter blocking something over 4G the VPN needs that it doesn't block over 3G.

If you get ping replies with the VPN connected, I'll try writing steps for finding and setting the MTU size for the VPN connection.

chewed

editorsean wrote: »

One more possibility is that the VPN itself might need a lower MTU size such as if the VPN software or server has trouble handling the lower MTU size of the Three connection.

With the router MTU size set back to 1398, close any running software, connect the VPN and then try a regular "ping 8.8.8.8" to see if it replies. If this gives request timed outs, then there's likely some other issue such as Three's content filter blocking something over 4G the VPN needs that it doesn't block over 3G.

If you get ping replies with the VPN connected, I'll try writing steps for finding and setting the MTU size for the VPN connection.

I tried that with 1398 and VPN connected. This was the result...

editorsean

Those ping times seem very low for a VPN connection over 4G and could mean the VPN connection is only handling company network subnet, while all other Internet traffic bypasses it.

If you are able to browse the web (e.g. boards.ie) fine with the VPN connected, but not work related sites, you will need to replace 8.8.8.8 below with an IP address of a host at work, such as a file server IP address and make sure it also replies to ping requests with the VPN connected.

With the VPN connected, perform the steps below. The reason I start with 1200 below is that some VPNs lose connectivity altogether once it faces a packet over the maximum MTU size, so we need to start as low as the MTU size may go.

1. Open an administrator command prompt. In Windows 10, this can be done by right-clicking the start button and selecting 'Command Prompt (Admin)'

2. Type the command: ping -n 2 -f -l 1200 8.8.8.8

3. Rerun the above command increasing the 1200 value by 10 until you either get "Request timed out" or "Packet needs to be fragmented..." results.

4. Add 28 to this value to get the MTU size. For example, if 1380 was the largest figure that gave ping replies, 1380 + 28 gives an MTU size of 1408.

5. Type the command: netsh interface ipv4 show subinterfaces

6. Look for your VPN connection in the list. It'll likely be the one with the second highest 'Bytes in' count such as the following example. Take note of the current MTU size (usually 1500).



7. Type the following command, replacing 'VPN_Name' with the name of your VPN from the above step and '####' with the new MTU size: netsh interface ipv4 set subinterface "VPN_Name" mtu=#### store=persistent

The following shows an example of setting the VPN listing from my screenshot to 1410:



9. Disconnect and reconnect your VPN to see if you get connectivity.

If you still don't get connectivity, it would be worth checking your VPN software configuration for an MTU setting or ask your IT department in case the MTU size needs to be set somewhere else for the VPN connection.

To undo the above change, re-run the above last command with original VPN MTU size that you noted earlier.

chewed

Thanks for all your help. Unfortunately I'm still having issues after doing these steps. I assume between steps 4 and 5 you were suggesting to update the MTU settings on the router with the new MTU size?

editorsean

You don't need to change the router MTU size for the steps, it should remain at 1398, which you obtained earlier.

The MTU size you're trying to get with these steps is for the VPN connection itself which is set in step #7.

Sorry if this is getting too technical.

chewed

editorsean wrote: »

You don't need to change the router MTU size for the steps, it should remain at 1398, which you obtained earlier.

The MTU size you're trying to get with these steps is for the VPN connection itself which is set in step #7.

Sorry if this is getting too technical.

Still no luck! Thanks again. I tried it with 1398 as MTU and tried to change the other settings



I'm not sure what other Local Connection is?

editorsean

It looks like you either have two VPNs set up (e.g. an old configuration) or one of them is your physical network port. In this case #9 might be your network port and #15 is your VPN. The third one with the two zero counts could be for some other interface such as if you have a Firewire connection.

Try setting "Local Area Connection* 9" back to 1400 and set "Local Area Connection* 15" to "1326", i.e. type these from the Administrator command prompt:

netsh interface ipv4 set subinterface "Local Area Connection* 9" mtu=1400 store=persistent

netsh interface ipv4 set subinterface "Local Area Connection* 15" mtu=1326 store=persistent

chewed

editorsean wrote: »

It looks like you either have two VPNs set up (e.g. an old configuration) or one of them is your physical network port. In this case #9 might be your network port and #15 is your VPN. The third one with the two zero counts could be for some other interface such as if you have a Firewire connection.

Try setting "Local Area Connection* 9" back to 1400 and set "Local Area Connection* 15" to "1326", i.e. type these from the Administrator command prompt:

netsh interface ipv4 set subinterface "Local Area Connection* 9" mtu=1400 store=persistent

netsh interface ipv4 set subinterface "Local Area Connection* 15" mtu=1326 store=persistent

Hi @editorsean

Well, well, well, it looks like your final suggestion is working for me now!

I am able to access VPN (company urls) and Internet and it's all running fast for me. Nothing is dropping out anymore. I have been testing it for the past hour with no issues.

Thank you so much for all your help on this. I really appreciate the time and effort you gave me. It's people like you who make Boards.ie such an invaluable source of help for novices like me!

editorsean

That's brilliant and thanks for letting me know. :cool:

If it gives an issue later on, I suggest going through the process again as I've seen the MTU size change occasionally. At home, Three last changed it about 2 months ago.

If they increase the MTU size, the VPN will still work fine albeit with a slight drop in performance, which you'll unlikely notice. However, if they reduce the MTU size further, the VPN will unlikely work until the lower MTU size is set.

chewed

editorsean wrote: »

That's brilliant and thanks for letting me know. :cool:

If it gives an issue later on, I suggest going through the process again as I've seen the MTU size change occasionally. At home, Three last changed it about 2 months ago.

If they increase the MTU size, the VPN will still work fine albeit with a slight drop in performance, which you'll unlikely notice. However, if they reduce the MTU size further, the VPN will unlikely work until the lower MTU size is set.

Thanks again! I'll keep an eye out for any issues and will be bookmarking this thread!

chewed

Unfortunately this issue is back again! :mad:

I've tried all the steps again but have had no luck this time.

1326 is my lowest MTU setting. I've changed this on my router and in the Local Area Connection. But the VPN is now not working again with any company links.