For mobile or remote employees, a corporate VPN promises simple, secure access to privileged data and resources. But when that access fails, troubleshooting VPN connectivity issues can be frustrating for the end user and networking staff alike. In this FAQ troubleshooting guide, read answers to three typical IP address challenges users have in connecting to the VPN with advice provided by IT Knowledge Exchange readers and our site connectivity expert, Lisa Phifer.
Is it mandatory to have a static address to get VPN service?
'Mrdenny,' IT Knowledge Exchange: It's not required, but it does make things a lot easier.
If you don't have a
Then have your employees connect to VPN.MyCompany.com.
Make sure that your TTL for the VPN.MyCompany.com CNAME is setup for the same TTL that DynDNS.com uses.
I was connected to a VPN, but I switched to cable from DSL, and now my laptop won't connect to the VPN. Can you help?
'Wrobinson,' IT Knowledge Exchange: It is possible that you went from having a static IP address to using DHCP. The VPN connection may be configured to allow specific IP addresses to establish a session. You can investigate this internally.
You may have also changed the broadband modem/router and the new equipment -- or the broadband service provider may not support VPN. You will need to check with the broadband service provider and possibly the manufacturer of the broadband modem/router for answers to resolve these unknowns.
I have been working out of the house for years for a large corporation and have had no prior problems connecting to our virtual private network (VPN). However, my cable Internet provider recently forced me to close my residential account and open a separate business account to use a VPN. We have tried using two different modems: one with a static IP and the other with a dynamic IP. When I connect either of these directly to my laptop, I can get into the VPN, but when I go through a Linksys router, the VPN does not work. Any suggestions?
Lisa Phifer, site expert: Without knowing the make and model of your router and VPN, I can only guess -- but I can make a pretty good guess, based on your symptoms. Since your VPN tunnel works when directly connected through the modem, the problem is not the modem or its IP address. The problem must be introduced by the router -- most likely, by creating an IP address conflict, blocking a VPN protocol, or corrupting VPN packets using Network Address Translation (NAT).
I have seen cases where the router's default LAN subnet happens to overlap with the modem's default LAN subnet, or with a private subnet used inside an enterprise network. For example, if your modem and your router both assign 192.168.1.x to their LAN connections, you will never be able to route traffic successfully from your laptop onto the Internet. Similarly, your company network and your router both use 192.168.1.x, you may be able to connect to your VPN but never able to actually route traffic into your company network. Simply change the default LAN subnet on your router (both the router's LAN IP and its DHCP IP range) to detect and avoid this problem.
More often, I see broadband routers (which are really firewalls) block incoming VPN protocols by default. For example, an IPsec VPN requires the router to accept protocol 50 or 51 (ESP or AH), while a PPTP VPN requires the router to accept protocol 47 (GRE). You can usually accept these protocols by enabling a feature on your broadband router. For example, on a Linksys RT31P2, this option is enabled under Security / VPN Passthrough.
Even when VPN passthrough has been enabled on the router, some VPN tunnels get broken by NAT. An extremely common symptom of this problem is to see your VPN tunnel established ("displaying banner text") but never see any data being exchanged through the tunnel ("timing out, tunnel disconnected"). Most VPN gateways have been updated to include NAT Traversal capabilities that encapsulate VPN protocols inside UDP packets. When this is done, NAT changes the UDP packet header (the wrapper) without modifying the UDP packet payload (the VPN protocol inside the wrapper). That avoids breaking the VPN tunnel by leaving the VPN protocol alone. You see, VPNs are designed to detect forged or modified packets and may otherwise discard packets that your router's NAT has changed. The solution to this problem depends on your company's VPN gateway and client. Have your IT department ask your VPN vendor about "NAT Traversal," also known as NAT-T.
If all else fails, consider using a different router -- at least briefly -- to find and then fix the problem. Broadband routers are readily available from office supply and electronics stores for less than $50, or perhaps you can borrow one from a neighbor or co-worker just long enough to diagnose your VPN problem.
This was first published in November 2008