Problem accessing IPSEC VPN

[stu]

(sorry for English, this is too technical for poor Dutch)

Yesterday my VPN connection stopped working!

But, I can connect if I tether my laptop to my mobile phone for a data connection.
This means it's not a laptop problem, nor is it a problem with the VPN server.

Has anybody else had this problem since 7/3 in the morning? Is there a fix?

Thanks, Stu

[Marco]

Stu,

Is there a specific error message you get when building up the connection?
I presume that your internet connection itself is still working?
Without a specific error message it's going to be hard to troubleshoot, have you had contact with the servers administrator yet to verify whether or not your connection attempts reach the vpn server?

[stu]

Hi there - yes the connection is in negotiation and then fails.
(the internet is still working, the error message I see is a vanilla 'failed to negotiate' type message).

These are the typical racoon messages across the 30 second timeout period:
13:43:07.191805 +0100 racoon Disconnecting. (Connection tried to negotiate for, 0.050498 seconds).
com.apple.message.result: failure
com.apple.message.value2: 0.050498
com.apple.message.signature: Stopped by Peer
com.apple.message.domain: com.apple.Networking.ipsec.connect.ciscoipsec
SenderMachUUID: 7CDDB6AB-04D1-3B20-9ECD-7ED25515D5A6

13:43:37.316704 +0100 racoon Disconnecting. (Connection tried to negotiate for, 30.118763 seconds).
com.apple.message.result: success
com.apple.message.value2: 30.118763
com.apple.message.domain: com.apple.Networking.ipsec.connect.ciscoipsec
com.apple.message.signature: Stopped by VPN disconnect. NAT detected by Me
SenderMachUUID: 7CDDB6AB-04D1-3B20-9ECD-7ED25515D5A6

This from the server admin:
"We see the packets come from you, get processed and go back...this happens 3 times before the failure completes"

Is this enough to go on or shall I see if I can get some server log entries?

[GoeRoe]

Stu, are you by chance using a EPC3925 or EPC3940 modem as well as a separate router? In this case you might have a 'double NAT' issue that could very well explain the problems that you are running into.
Easy fix is to change the modem type to 'bridge' mode at the MijnDELTA site and then reboot both the modem and your own router.
Alternatively ensure you are using a direct connection to the Cisco modem either using WiFi or an Ethernet cable, bypassing a custom router that might be in between.

[stu]

It's a very simple setup with no extra complexity - and it has been working. Any changes on the delta side since yesterday morning?

[Marco]

Stu,

I checked with our system engineers, no changes have been made either in the network or on our modems for a while.
Is there any chance that you are accidentaly connecting through your public wifi spot ( wifispots) instead of your private wifi network?
Does the error occur as well when you're connected with a cable?

[GoeRoe]

It's a very simple setup with no extra complexity - and it has been working.

Could you please elaborate - that's not a very specific answer.

[stu]

Marco - many thanks for coming back. Definitely not connecting through wifi-spots, I tried that but they just didn't work because the authentication server was timing out.

The only change that I can find in the whole equation was a firmware update on the vpn server at the end of last week. So the focus of attention has returned to that end. It's still unexplained why it has appeared to blackhole the connection via delta and allow traffic from other sources, but this is where it's at.

I propose to leave the thread open and I'll put in a solution if one arrives, if only for future searchers to find.

[stu]

GoeRoe
- 1 laptop with wifi connection (working)
- 1 standard issue delta cable modem (Cisco EPC3940) (working)
- 1 internet (working, more or less)

[TimH]

I propose to leave the thread open and I'll put in a solution if one arrives, if only for future searchers to find.

That would be great, please do so when and if you find a solution. Hope you'll find a solution soon.

[Gast]

Hi stu,

Did you find a solution for your VPN connection?
If you did, would you like to share this solution with us?