Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My network has two gateways, one is a pfSense box that everyone uses. The other one is a TP-Link firewall essentially for tests.

Some machines inside my network need to access a VPN through the Cisco VPN client. If one of those machines is using the pfSense box as the gateway, I experience random connection drops on the VPN. If I am using the TP-Link gateway that doesn't happen.

I've tried changing the MTU in the pfSense box and that improved things a little bit but didn't really solve the problem. I also followed the guidelines for traffic shaping in pfSense and the connections still drop quite often.

Ideas?

share|improve this question
1  
No direct experience with pfsense, but could it be that idle connections are being timed-out? Do connections get dropped in the middle of active data transfers, or only after a long period of no transfer? –  Steven Monday Feb 27 '12 at 21:28
    
It's not a timeout issue at all. This morning I managed to stay connected for like 3h without transferring anything over the connection, really. And sometimes it drops after 5min. What did make the problem much, much worse was lowering the MTU in the firewall (some forum suggested doing that) –  Andre Feb 27 '12 at 21:36

1 Answer 1

For anybody else who might be tracking down this same issue. I am using openconnect (an opensource version of AnyConnect) to connect to a network and the connection would time out rather quickly. When using a dd-wrt router, it would stay connected.

The root of the problem is the stateful firewall will kill an idle UDP based VPN connection fairly quickly. If you use the Conservative firewall optimization setting, it should help keep you connected. The setting "tries to avoid dropping any legitimate idle connections at the expense of increased memory usage and CPU utilization."

Change the Firewall Optimization Option (from pfSense 2.1.4)

  1. Navigate to the Firewall/NAT advanced settings (System -> Advanced -> Firewall/NAT)
  2. Change Firewall Optimization Option to Conservative
  3. Apply the settings

You can also keep the connection alive by using something that has a persistent connection that has some kind of keepalive mechanism - or just ping a server on the other end of the VPN connection to keep it alive.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.