0

I use an L2TP/IPSEC vpn client behind a CG3000DCR Comcast Business Gateway Router, and while it establishes a connection initially, after about 3mb of data transfer, it stalls out, doesn't do any more transfer, but stays connected.

This has happened since the new Comcast router was installed. Neither the VPN client nor server (in TX) have changed. The connection works fine from my Comcast home connection without issue.

I've seen various solutions, most of which point to trying to talk Comcast into giving me a different modem. This one apparently has serious issues, and the different brand modems are apparently scarce.

I've tried the following as a workaround:

  1. Set up port forwarding in the Comcast router for explicit ports that L2TP requires. No change
  2. Put my PC in a DMZ, and try the same thing. After doing 3mb or so of transfers, it stalls out.

Are there any other workarounds I can use to get a reliable VPN connection while I fight with Comcast on this? Note: we have Static IP.

6
  • See if firmware updates are available for the comcast router. I have seen some cable modem issues that cause similar behavior that were resolved in newer firmware.
    – Grant
    Jun 5 '14 at 19:14
  • 1
    The irony here is that all of the "business class" cable modem/router combos that I've seen for the past several years have been complete junk. I've had much better reliability with a "consumer grade" Surfboard and my own routers. Jun 5 '14 at 19:20
  • 1
    You can shed some light on exactly what is happening by running wireshark/tcpdump to view the VPN traffic (include icmp/icmpv6 in your filters) to see what is happening when the connection dies. Sometimes routers/firewalls can be sending back a useful message that goes unnoticed by software but can be seen within the ICMP packet(s) sent by the device.
    – regulatre
    Jun 6 '14 at 14:35
  • I know of no current settings on Comcast business modems (SBC or otherwise) that rate limits a connection, does inherent port filtering, or has any kind of timeout like that. Could this be another issue (protocol timeout on the VPN, packet loss, etc). A few missed keepalives can drop a VPN connection. Are there any relevant logs to show what you're seeing (vpn disconnect, timeout, auth errors?). So many different things can cause this, even an upstream router issue or BGP/OSPF/RIP protocol change Jun 9 '14 at 14:07
  • I've got wireshark installed, but don't know much about a trace. What do I need to include in the trace?
    – Caveatrob
    Jun 9 '14 at 16:47
3

What about putting it in bridged mode, and using your own router to see if the problem still happens. My guess some kind of problem in the routing side of things, persistent NAT? Anyway, just about no one that I know uses carrier provided gear, mainly for security and manageability concerns. Even if you get something else, you should consider something business class, like a Meraki or similar.

Good luck!

6
  • +1 for that crucial observation about not using carrier-provided gear. It's your infrastructure, make sure it's your kit that powers / enables / provisions / guards it.
    – MadHatter
    Apr 20 '14 at 5:47
  • We have a static IP, so we'd have to change that to go into bridged. Also, you have to have a Comcast engineer change to bridged, because the config is locked down to only have a few options available to the client. I also understand that at any time, a Comcast account person can switch the bridged thing off, since it's not "standard." I like your idea of another business class modem, but the company I'm supporting is not technical by nature, and generally counts on Comcast support.
    – Caveatrob
    Apr 20 '14 at 18:59
  • Usually in bridged, you keep your address, it's just assigned to the router instead of the modem/router combo. I would say who cares about the Comcast Engineer, that's what they are paid to do, but you seem to have some aversion to that. If you're going to run a network, you may do well to care less how many people you have to involve to make it right. Nature of the beast. Finally, Comcast support is failing them, which is why you’re here. Most small business I know would rather pay a little every month for a managed firewall through an MSP than go with their ISP. Con.t next
    – MagnaVis
    Apr 21 '14 at 19:54
  • Anyway, even if it was just for a few days, putting it into bridged would have pinpoint the problem. Feel free to mail me if you want to know more, but I feel this is going to be the general consensus around these parts. Good Luck.
    – MagnaVis
    Apr 21 '14 at 19:54
  • It's a difficult situation b/c the Comcast guy (who is here now) doesn't seem too cluefull. And the person who runs this shop (it's a coworking space; i'm just the only member who connects to a workplace through a vpn) is non-technical.
    – Caveatrob
    Apr 21 '14 at 20:29
2
+50

It may be caused by a router or your CG3000DCR gateway dropping a packet since this one is too large for him. At this time, the dropping equipment shoud send a notification but sometimes this notification can be dropped too, causing the transfer to stall.

To avoid this, you can try to :

  • set up a reduce MTU on your L2TP/IPSEC client
  • reduce the MTU directly on your network interface configuration

Hope this help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.