I am having seemingly random disconnects of active RDP sessions (I am actively typing or otherwise interacting with the desktop) when connected over the VPN connection. The attempted to reconnect 1/20 pops up and proceeds all the way through 20 then drops. Once the session drops I can open a new session and connect again.

This started happening about a week ago,

The VPN connection is an IPSec VPN connection from a SonicWall NSA 2400. The NIC drivers are up to date. The VPN client is up to date. The firmware on the SonicWall is up to date (both regular and the early-release versions work the same).

I have attempted to connect over three ISPs all with the same behavior. Two different workstations were used to test the VPN connection.

The same behavior occurs when connecting to a domain workstation or server.

If I am within the firewall I can connect to the same workstations and servers with the disconnect.

The VPN connection has "enable fragmented packet handling" and "ignore DF (don't fragment) bit" set.

Is there something I am missing in where I am looking for the problem?

2 Answers 2


Have you run a packet capture from either end? That will let you know whether a timeout is occurring, or whether a TCP RST is being sent one way or another. I would start with that known first.

I'd suspect a policy on your firewall is doing this. Though, if that's the case, the capture will show the TCP RST coming from the inside host's IP (same socket) .

  • This was an issue with the firewall (sonicwall nsa2400), but not what I suspected at first. I did end up running a packet trace and found that an interface assigned to managing SonicPoint Access points (with their custom freaking control protocol...) had a firewall policy with a destination of (any) instead of a named group (LAN, WAN, WLAN, etc). The built-in IDS was grabbing the packets and blocking them as they were being routed between ports incorrectly. Once I changed the policy everything started working again.
    – TopHat
    Aug 15, 2012 at 3:47

Why are you ignoring DF? Are you aware that every RDP packet has the Do Not Fragment bit set?

You may want to verify the MTU of the VPN connection, and setting the MTU of your Remote Desktop host to match that to see if it helps. The usual way of doing this is ping -f -l nnnn until you receive the message "Packet needs to be fragmented but DF set", but that probably will not work for you if you are ignoring DF. You would probably need to lower the host MTU to 1400 or 1370, but that should be confirmed in testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.