1. Home
  2. Networking Firewalls
  3. SonicWall Global VPN Client connection reset

SonicWall Global VPN Client connection reset

I am having an odd problem connecting my WinXP SP2 laptop to our company SonicWall VPN. My laptop is on a local domain at my home and is connected to the Internet via a 2Wire DSL modem which is a NAT. I tried placing my laptop in the DMZ to test and that did not make any difference. I have also opened a few ports I found in other posts but that didn't help either.

I have tried 3 different client versions including 4.0.0.830, 2.2.2 and

3.1.0.566 all had variations of the same problem. There are no errors in the sonicwall log. It just shows the connection starting over. I've included a sequence from the log below. In the gvs_trace.txt log here are the enteries around the reset. OnLogMessage(): 'NetUserGetInfo returned: home dir: , remote dir: , logon script: ' '74.93.179.88' CheckForDeadPeer(): peer appears to be dead - resetting connection CInterface::ReleaseOrRenew(release): calling request function synchronously

When I first install the client it offers to run the client when it finishes without rebooting. If I do this and log into the VPN everything appear fine. I can access systems and transfer information. I'm primarily using the connect for version control and have no problems getting or sending data.

However, after I reboot my system the VPN starts to fail. I can connect OK but the connection times out every 30-90 seconds and reconnects. I can still do operations if I initiate the operation immidiately after the connection completes. By immidiately I mean I have to have the Status window open and the button pressed and held for the version control operation. As soon as the connetion completes I let go of the button and the command usually works fine. If I wait even a fraction of a second the command will timeout without a response from the server. I then have to wait for the connection to fail and reconnect and the try again. When I do successfully start the command it can run for 10-20 minutes or more and transfer many megabytes of data without issue. But as soon as that command finishes I cannot initiate another.

Sorry for being long winded I just wasn't sure how to describe this. If there is any additional information I can provide please let me know or if there is a better place to post this.

TIA, Rick

Log:

2008/01/03 11:45:26:820 Information 74.93.179.88 Starting ISAKMP phase 1 negotiation. 2008/01/03 11:45:27:100 Information 74.93.179.88 Starting aggressive mode phase 1 exchange. 2008/01/03 11:45:27:100 Information 74.93.179.88 NAT Detected: Local host is behind a NAT device. 2008/01/03 11:45:27:100 Information 74.93.179.88 The SA lifetime for phase 1 is 28800 seconds. 2008/01/03 11:45:27:110 Information 74.93.179.88 Phase 1 has completed. 2008/01/03 11:45:27:160 Information 74.93.179.88 Received XAuth request. 2008/01/03 11:45:27:160 Information 74.93.179.88 XAuth has requested a username but one has not yet been specified. 2008/01/03 11:45:27:160 Information 74.93.179.88 Sending phase 1 delete. 2008/01/03 11:45:27:160 Information 74.93.179.88 User authentication information is needed to complete the connection. 2008/01/03 11:45:27:230 Information An incoming ISAKMP packet from 74.93.179.88 was ignored. 2008/01/03 11:45:31:957 Information 74.93.179.88 Starting ISAKMP phase 1 negotiation. 2008/01/03 11:45:32:238 Information 74.93.179.88 Starting aggressive mode phase 1 exchange. 2008/01/03 11:45:32:238 Information 74.93.179.88 NAT Detected: Local host is behind a NAT device. 2008/01/03 11:45:32:238 Information 74.93.179.88 The SA lifetime for phase 1 is 28800 seconds. 2008/01/03 11:45:32:238 Information 74.93.179.88 Phase 1 has completed. 2008/01/03 11:45:32:298 Information 74.93.179.88 Received XAuth request. 2008/01/03 11:45:32:298 Information 74.93.179.88 Sending XAuth reply. 2008/01/03 11:45:32:348 Information 74.93.179.88 Received XAuth status. 2008/01/03 11:45:32:348 Information 74.93.179.88 Sending XAuth acknowledgement. 2008/01/03 11:45:32:348 Information 74.93.179.88 User authentication has succeeded. 2008/01/03 11:45:32:398 Information 74.93.179.88 Received request for policy version. 2008/01/03 11:45:32:398 Information 74.93.179.88 Sending policy version reply. 2008/01/03 11:45:32:458 Information 74.93.179.88 Received policy change is not required. 2008/01/03 11:45:32:458 Information 74.93.179.88 Sending policy acknowledgement. 2008/01/03 11:45:32:458 Information 74.93.179.88 The configuration for the connection is up to date. 2008/01/03 11:45:32:498 Information 74.93.179.88 Starting ISAKMP phase 2 negotiation with 74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP. 2008/01/03 11:45:32:498 Information 74.93.179.88 Starting quick mode phase 2 exchange. 2008/01/03 11:45:32:578 Information 74.93.179.88 The SA lifetime for phase 2 is 28800 seconds. 2008/01/03 11:45:32:578 Information 74.93.179.88 Phase 2 with 74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP has completed. 2008/01/03 11:45:32:578 Information Renewing IP address for the virtual interface (00-60-73-EB-DD-EA). 2008/01/03 11:45:36:831 Information The IP address for the virtual interface has changed to 192.168.10.170. 2008/01/03 11:45:36:891 Information The system ARP cache has been flushed. 2008/01/03 11:45:36:911 Information 74.93.179.88 NetWkstaUserGetInfo returned: user: rick, logon domain: SYS001, logon server: SYS001 2008/01/03 11:45:41:458 Information 74.93.179.88 NetGetDCName failed: Could not find domain controller for this domain. 2008/01/03 11:45:41:458 Information 74.93.179.88 calling NetUserGetInfo: Server: \\\\SYS001, User: rick, level: 3 2008/01/03 11:45:41:468 Information 74.93.179.88 NetUserGetInfo returned: home dir: , remote dir: , logon script: 2008/01/03 11:46:19:859 Information Releasing IP address for the virtual interface (00-60-73-EB-DD-EA). 2008/01/03 11:46:24:010 Information 74.93.179.88 Sending phase 2 delete for 74.93.179.88/255.255.255.255. 2008/01/03 11:46:24:130 Information 74.93.179.88 Sending phase 1 delete. 2008/01/03 11:46:24:751 Information 74.93.179.88 Starting ISAKMP phase 1 negotiation. 2008/01/03 11:46:25:051 Information 74.93.179.88 Starting aggressive mode phase 1 exchange. 2008/01/03 11:46:25:051 Information 74.93.179.88 NAT Detected: Local host is behind a NAT device. 2008/01/03 11:46:25:051 Information 74.93.179.88 The SA lifetime for phase 1 is 28800 seconds. 2008/01/03 11:46:25:051 Information 74.93.179.88 Phase 1 has completed. 2008/01/03 11:46:25:111 Information 74.93.179.88 Received XAuth request. 2008/01/03 11:46:25:111 Information 74.93.179.88 Sending XAuth reply. 2008/01/03 11:46:25:161 Information 74.93.179.88 Received XAuth status. 2008/01/03 11:46:25:161 Information 74.93.179.88 Sending XAuth acknowledgement. 2008/01/03 11:46:25:161 Information 74.93.179.88 User authentication has succeeded. 2008/01/03 11:46:25:221 Information 74.93.179.88 Received request for policy version. 2008/01/03 11:46:25:221 Information 74.93.179.88 Sending policy version reply. 2008/01/03 11:46:25:271 Information 74.93.179.88 Received policy change is not required. 2008/01/03 11:46:25:271 Information 74.93.179.88 Sending policy acknowledgement. 2008/01/03 11:46:25:271 Information 74.93.179.88 The configuration for the connection is up to date. 2008/01/03 11:46:25:502 Information 74.93.179.88 Starting ISAKMP phase 2 negotiation with 74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP. 2008/01/03 11:46:25:512 Information 74.93.179.88 Starting quick mode phase 2 exchange. 2008/01/03 11:46:25:562 Information 74.93.179.88 The SA lifetime for phase 2 is 28800 seconds. 2008/01/03 11:46:25:562 Information 74.93.179.88 Phase 2 with 74.93.179.88/255.255.255.255:BOOTPC:BOOTPS:UDP has completed. 2008/01/03 11:46:25:562 Information Renewing IP address for the virtual interface (00-60-73-EB-DD-EA). 2008/01/03 11:46:30:899 Information The IP address for the virtual interface has changed to 192.168.10.170. 2008/01/03 11:46:31:000 Information The system ARP cache has been flushed. 2008/01/03 11:46:31:030 Information 74.93.179.88 NetWkstaUserGetInfo returned: user: rick, logon domain: SYS001, logon server: SYS001 2008/01/03 11:46:35:536 Information 74.93.179.88 NetGetDCName failed: Could not find domain controller for this domain. 2008/01/03 11:46:35:536 Information 74.93.179.88 calling NetUserGetInfo: Server: \\\\SYS001, User: rick, level: 3 2008/01/03 11:46:35:536 Information 74.93.179.88 NetUserGetInfo returned: home dir: , remote dir: , logon script: 2008/01/03 11:47:05:147 Information Releasing IP address for the virtual interface (00-60-73-EB-DD-EA).
Reply to
Rick Martin
Loading thread data ...

Rick Martin wrote: >2008/01/03 11:45:41:468 Information 74.93.179.88 NetUserGetInfo returned: >home dir: , remote dir: , logon script:

here you are logged in successfully >2008/01/03 11:46:19:859 Information Releasing IP address for >the virtual interface (00-60-73-EB-DD-EA).

and this is where you are loosing your ip adress for some reason...

try setting a fixed adress on the virtual adapter (you might have to allow this in the vpn policy, dhcp relay settings) see if that helps, also set your logging to "debug" on the sonicwall and make sure "vpn client" is checked in the categories.

M
Reply to
mak

this in the vpn policy, dhcp relay settings)

is checked in the categories.

Thanks, mak

I tried setting up the config to have a fixed IP and entries to the VPN server but it didn't help it actually made it worse. Another interesting point. Another XP laptop on my LAN has the same problems as the first one. However, my Windows 2000 server connects and stays connected to the VPN without any problems. Something about the OS?

Rick

Reply to
Rick Martin

My IT guy made the following changes and I can now access the VPN from both the XP and W2k boxes. There is still a problem with access one of the web applications that we are working on.

Here are the changes he made: You were configured for "All Interface IP" which basically gives you full run of all firewall zones. Apparently that doesn't work. I changed it so that you have "All LAN Subnets" and "All WAN Subnets" instead.

Maybe this will help someone, someday.

Thanks, Rick

Reply to
Rick Martin

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.