We are having an issue (and I noticed that several other people here are as well) of our remote Broadband users not being able to connect. We have just recently started getting complaints from XP home users that they were receiving errors while trying to connect to the Concentrator.
To start troublshooting we temporarily moved our 3015 Concentrator to outside of our firewall. The users were still unable to connect. After quite a bit of further troubleshooting we were able to successfully duplicate this issue by simply switching the users VPN client from IPsec over TCP to IPsec over UDP.
We then tried to identify why it was happening to some clients but not all. In the end the only thing that we could find really different was that the clients who used a USB port to connect to the network instead of a proper Ethernet port failed to connect via IPSec over TCP. We tested and verified this on several operating systems including Windows 2000, XP Home and XP PRO. We also tested and verified this with several VPN Clients including 3.5.1 and 3.6.3b.
The end result is that in all cases users who use a USB type connection cannot connect via IPSec over TCP. All users who connect via a proper Ethernet adapter are able to connect via either method.
Our problem is that we cannot run UDP connections behind our firewall without converting over to NAT. We send out a preconfigured client to our users that forces them to use tcp port 10000 verses the default udp 10000. We do this for several reasons but the most important of them is our firewall will not redirect IPSec UDP sessions, only IPSec TCP sessions.
Leaving the VPN Concentrator outside the firewall and exposed is also not an option. So, I am left with telling all of my USB users that the only way they can connect is to install an Ethernet adapter, which in the end isn't really much of an option if you consider the expense and technical expertise required to pull this off with a couple of hundred home users it just won't fly.
So, this brings me to this forum. Before I open a TAC case I would like to hear from the experts to try and determine as close as possible if this is a Microsoft problem or a Cisco VPN client problem. I have my suspicions that this belongs to Microsoft but I can't prove anything yet. Does anyone else have any idea's on this? Please, I invite anyone to test this out and let us know what you find. If you need more detail on the methodolgy please let me know and I would be happy to provide it. I think this is potentially a huge problem just by the number of complaints that I have seen in this forum. My supervisor thinks I am smoking something when I try and explain this to him. All he can say is "if this really was a problem more people would also certainly have it and we would have heard about it by now, it must be in your configuration. GO FIX IT" (does any of this sound familiar?)
I appreciate any feedback that anyone is willing to give. I believe that if we as a community get together on this we can find a solution.
Thanks for your time!
