SonicWall Global VPN Client connection reset

am 03.01.2008 21:40:45 von Rick Martin

I am having an odd problem connecting my WinXP SP2 laptop to our company
SonicWall VPN. My laptop is on a local domain at my home and is connected
to the Internet via a 2Wire DSL modem which is a NAT. I tried placing my
laptop in the DMZ to test and that did not make any difference. I have also
opened a few ports I found in other posts but that didn't help either.

I have tried 3 different client versions including 4.0.0.830, 2.2.2 and
3.1.0.566 all had variations of the same problem.
There are no errors in the sonicwall log. It just shows the connection
starting over. I've included a sequence from the log below.
In the gvs_trace.txt log here are the enteries around the reset.
OnLogMessage(): 'NetUserGetInfo returned: home dir: , remote dir: , logon
script: ' '74.93.179.88'
CheckForDeadPeer(): peer appears to be dead - resetting connection
CInterface::ReleaseOrRenew(release): calling request function synchronously

When I first install the client it offers to run the client when it
finishes without rebooting. If I do this and log into the VPN everything
appear fine. I can access systems and transfer information. I'm primarily
using the connect for version control and have no problems getting or
sending data.

However, after I reboot my system the VPN starts to fail. I can connect OK
but the connection times out every 30-90 seconds and reconnects. I can
still do operations if I initiate the operation immidiately after the
connection completes. By immidiately I mean I have to have the Status
window open and the button pressed and held for the version control
operation. As soon as the connetion completes I let go of the button and
the command usually works fine. If I wait even a fraction of a second the
command will timeout without a response from the server. I then have to
wait for the connection to fail and reconnect and the try again.
When I do successfully start the command it can run for 10-20 minutes or
more and transfer many megabytes of data without issue. But as soon as that
command finishes I cannot initiate another.

Sorry for being long winded I just wasn't sure how to describe this.
If there is any additional information I can provide please let me know or
if there is a better place to post this.

TIA,
Rick

Log:
2008/01/03 11:45:26:820 Information 74.93.179.88 Starting ISAKMP phase 1
negotiation.
2008/01/03 11:45:27:100 Information 74.93.179.88 Starting aggressive mode
phase 1 exchange.
2008/01/03 11:45:27:100 Information 74.93.179.88 NAT Detected: Local host
is behind a NAT device.
2008/01/03 11:45:27:100 Information 74.93.179.88 The SA lifetime for phase
1 is 28800 seconds.
2008/01/03 11:45:27:110 Information 74.93.179.88 Phase 1 has completed.
2008/01/03 11:45:27:160 Information 74.93.179.88 Received XAuth request.
2008/01/03 11:45:27:160 Information 74.93.179.88 XAuth has requested a
username but one has not yet been specified.
2008/01/03 11:45:27:160 Information 74.93.179.88 Sending phase 1 delete.
2008/01/03 11:45:27:160 Information 74.93.179.88 User authentication
information is needed to complete the connection.
2008/01/03 11:45:27:230 Information An incoming ISAKMP packet
from 74.93.179.88 was ignored.
2008/01/03 11:45:31:957 Information 74.93.179.88 Starting ISAKMP phase 1
negotiation.
2008/01/03 11:45:32:238 Information 74.93.179.88 Starting aggressive mode
phase 1 exchange.
2008/01/03 11:45:32:238 Information 74.93.179.88 NAT Detected: Local host
is behind a NAT device.
2008/01/03 11:45:32:238 Information 74.93.179.88 The SA lifetime for phase
1 is 28800 seconds.
2008/01/03 11:45:32:238 Information 74.93.179.88 Phase 1 has completed.
2008/01/03 11:45:32:298 Information 74.93.179.88 Received XAuth request.
2008/01/03 11:45:32:298 Information 74.93.179.88 Sending XAuth reply.
2008/01/03 11:45:32:348 Information 74.93.179.88 Received XAuth status.
2008/01/03 11:45:32:348 Information 74.93.179.88 Sending XAuth
acknowledgement.
2008/01/03 11:45:32:348 Information 74.93.179.88 User authentication has
succeeded.
2008/01/03 11:45:32:398 Information 74.93.179.88 Received request for
policy version.
2008/01/03 11:45:32:398 Information 74.93.179.88 Sending policy version
reply.
2008/01/03 11:45:32:458 Information 74.93.179.88 Received policy change is
not required.
2008/01/03 11:45:32:458 Information 74.93.179.88 Sending policy
acknowledgement.
2008/01/03 11:45:32:458 Information 74.93.179.88 The configuration for the
connection is up to date.
2008/01/03 11:45:32:498 Information 74.93.179.88 Starting ISAKMP phase 2
negotiation with 74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP.
2008/01/03 11:45:32:498 Information 74.93.179.88 Starting quick mode phase
2 exchange.
2008/01/03 11:45:32:578 Information 74.93.179.88 The SA lifetime for phase
2 is 28800 seconds.
2008/01/03 11:45:32:578 Information 74.93.179.88 Phase 2 with
74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP has completed.
2008/01/03 11:45:32:578 Information Renewing IP address for
the virtual interface (00-60-73-EB-DD-EA).
2008/01/03 11:45:36:831 Information The IP address for the
virtual interface has changed to 192.168.10.170.
2008/01/03 11:45:36:891 Information The system ARP cache has
been flushed.
2008/01/03 11:45:36:911 Information 74.93.179.88 NetWkstaUserGetInfo
returned: user: rick, logon domain: SYS001, logon server: SYS001
2008/01/03 11:45:41:458 Information 74.93.179.88 NetGetDCName failed: Could
not find domain controller for this domain.
2008/01/03 11:45:41:458 Information 74.93.179.88 calling NetUserGetInfo:
Server: \\SYS001, User: rick, level: 3
2008/01/03 11:45:41:468 Information 74.93.179.88 NetUserGetInfo returned:
home dir: , remote dir: , logon script:
2008/01/03 11:46:19:859 Information Releasing IP address for
the virtual interface (00-60-73-EB-DD-EA).
2008/01/03 11:46:24:010 Information 74.93.179.88 Sending phase 2 delete for
74.93.179.88/255.255.255.255.
2008/01/03 11:46:24:130 Information 74.93.179.88 Sending phase 1 delete.
2008/01/03 11:46:24:751 Information 74.93.179.88 Starting ISAKMP phase 1
negotiation.
2008/01/03 11:46:25:051 Information 74.93.179.88 Starting aggressive mode
phase 1 exchange.
2008/01/03 11:46:25:051 Information 74.93.179.88 NAT Detected: Local host
is behind a NAT device.
2008/01/03 11:46:25:051 Information 74.93.179.88 The SA lifetime for phase
1 is 28800 seconds.
2008/01/03 11:46:25:051 Information 74.93.179.88 Phase 1 has completed.
2008/01/03 11:46:25:111 Information 74.93.179.88 Received XAuth request.
2008/01/03 11:46:25:111 Information 74.93.179.88 Sending XAuth reply.
2008/01/03 11:46:25:161 Information 74.93.179.88 Received XAuth status.
2008/01/03 11:46:25:161 Information 74.93.179.88 Sending XAuth
acknowledgement.
2008/01/03 11:46:25:161 Information 74.93.179.88 User authentication has
succeeded.
2008/01/03 11:46:25:221 Information 74.93.179.88 Received request for
policy version.
2008/01/03 11:46:25:221 Information 74.93.179.88 Sending policy version
reply.
2008/01/03 11:46:25:271 Information 74.93.179.88 Received policy change is
not required.
2008/01/03 11:46:25:271 Information 74.93.179.88 Sending policy
acknowledgement.
2008/01/03 11:46:25:271 Information 74.93.179.88 The configuration for the
connection is up to date.
2008/01/03 11:46:25:502 Information 74.93.179.88 Starting ISAKMP phase 2
negotiation with 74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP.
2008/01/03 11:46:25:512 Information 74.93.179.88 Starting quick mode phase
2 exchange.
2008/01/03 11:46:25:562 Information 74.93.179.88 The SA lifetime for phase
2 is 28800 seconds.
2008/01/03 11:46:25:562 Information 74.93.179.88 Phase 2 with
74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP has completed.
2008/01/03 11:46:25:562 Information Renewing IP address for
the virtual interface (00-60-73-EB-DD-EA).
2008/01/03 11:46:30:899 Information The IP address for the
virtual interface has changed to 192.168.10.170.
2008/01/03 11:46:31:000 Information The system ARP cache has
been flushed.
2008/01/03 11:46:31:030 Information 74.93.179.88 NetWkstaUserGetInfo
returned: user: rick, logon domain: SYS001, logon server: SYS001
2008/01/03 11:46:35:536 Information 74.93.179.88 NetGetDCName failed: Could
not find domain controller for this domain.
2008/01/03 11:46:35:536 Information 74.93.179.88 calling NetUserGetInfo:
Server: \\SYS001, User: rick, level: 3
2008/01/03 11:46:35:536 Information 74.93.179.88 NetUserGetInfo returned:
home dir: , remote dir: , logon script:
2008/01/03 11:47:05:147 Information Releasing IP address for
the virtual interface (00-60-73-EB-DD-EA).

Re: SonicWall Global VPN Client connection reset

am 04.01.2008 13:10:23 von Mak

Rick Martin wrote:
>2008/01/03 11:45:41:468 Information 74.93.179.88 NetUserGetInfo returned:
>home dir: , remote dir: , logon script:

here you are logged in successfully
>2008/01/03 11:46:19:859 Information Releasing IP address for
>the virtual interface (00-60-73-EB-DD-EA).

and this is where you are loosing your ip adress for some reason...

try setting a fixed adress on the virtual adapter (you might have to allow this in the vpn policy, dhcp relay settings)
see if that helps,
also set your logging to "debug" on the sonicwall and make sure "vpn client" is checked in the categories.

M

Re: SonicWall Global VPN Client connection reset

am 11.01.2008 17:04:17 von Rick Martin

On Fri, 04 Jan 2008 13:10:23 +0100, mak wrote:

>
> try setting a fixed adress on the virtual adapter (you might have to allow this in the vpn policy, dhcp relay settings)
> see if that helps,
> also set your logging to "debug" on the sonicwall and make sure "vpn client" is checked in the categories.
>
> M

Thanks, mak

I tried setting up the config to have a fixed IP and entries to the VPN
server but it didn't help it actually made it worse.
Another interesting point. Another XP laptop on my LAN has the same
problems as the first one. However, my Windows 2000 server connects and
stays connected to the VPN without any problems.
Something about the OS?

Rick

Re: SonicWall Global VPN Client connection reset - Partially Solved

am 01.02.2008 21:21:25 von Rick Martin

On Thu, 3 Jan 2008 12:40:45 -0800, Rick Martin wrote:

> I am having an odd problem connecting my WinXP SP2 laptop to our company
> SonicWall VPN. My laptop is on a local domain at my home and is connected
> to the Internet via a 2Wire DSL modem which is a NAT. I tried placing my
> laptop in the DMZ to test and that did not make any difference. I have also
> opened a few ports I found in other posts but that didn't help either.
>

My IT guy made the following changes and I can now access the VPN from both
the XP and W2k boxes. There is still a problem with access one of the web
applications that we are working on.

Here are the changes he made:
You were configured for "All Interface IP" which basically gives you full
run of all firewall zones. Apparently that doesn't work. I changed it so
that you have "All LAN Subnets" and "All WAN Subnets" instead.

Maybe this will help someone, someday.

Thanks,
Rick