RV082 QuickVPN & 4gLTE Hot Spot

[fastteks0390]

I have a Small Business Router RV082 in my office.  I have set up user VPN access and sucessfully connected to using the QuickVPN software from my home network wired and wirelessly.  However if I try to connect using my Verizon 4g LTE hotspot, the QuickVPN connection process gets to 'Verifying Network' than displays an error "The remote gateway is not responding. Do you want to wait?" YES or NO, pressing neither helps. 

I called Cisco and they said its the 4g LTE, I called verizon and they said there is no issue with the device...VPN Passthrough is enabled and they do not restrict VPN in any way shape or form.

While I attempt to connect, if I am logged into the Router Webconsole I can see my connection occuring on the VPN Summary Page.  I states ONLINE for about 10 secs.

The QuickVPN Log:

2012/08/15 20:14:41 [STATUS]OS Version: Windows 7

2012/08/15 20:14:41 [STATUS]Windows Firewall Domain Profile Settings: ON

2012/08/15 20:14:41 [STATUS]Windows Firewall Private Profile Settings: ON

2012/08/15 20:14:41 [STATUS]Windows Firewall Private Profile Settings: ON

2012/08/15 20:14:42 [STATUS]One network interface detected with IP address 192.168.1.2

2012/08/15 20:14:42 [STATUS]Connecting...

2012/08/15 20:14:42 [DEBUG]Input VPN Server Address = 24.XXX.XXX.226

2012/08/15 20:14:42 [STATUS]Connecting to remote gateway with IP

address: 24.XXX.XXX.226

2012/08/15 20:14:43 [STATUS]Remote gateway was reached by https ...

2012/08/15 20:14:43 [STATUS]Provisioning...

2012/08/15 20:14:54 [STATUS]Success to connect.

2012/08/15 20:14:54 [STATUS]Tunnel is configured. Ping test is about to start.

2012/08/15 20:14:54 [STATUS]Verifying Network...

2012/08/15 20:14:59 [WARNING]Failed to ping remote VPN Router!

2012/08/15 20:15:02 [WARNING]Failed to ping remote VPN Router!

2012/08/15 20:15:05 [WARNING]Failed to ping remote VPN Router!

2012/08/15 20:15:08 [WARNING]Failed to ping remote VPN Router!

2012/08/15 20:15:11 [WARNING]Failed to ping remote VPN Router!

2012/08/15 20:15:15 [WARNING]Ping was blocked, which can be caused by an unexpected disconnect.

What confuses me is we have a QNAP NAS at this office behind the router.  The QNAP offers VPN connectivity as well..when I attempt to connect to the QNAP in the same fashion using Windows 7 built in VPN software it connects fine

[Tom Watts]

Hello JP,

The built in VPN software on Window is a PPTP connection. The QVPN software is IPsec. Connectivity through a mobile hotspot/air card is unsupported due to reliability.

I have also experienced some issues, not only with mobile devices, including LAN routers, where the product will discard the packets coming back in response to the ESP packets being sent to the router from the QVPN. If you are able to connect using the same computer from a different connection, but not when using the mobile connection, the mobile connection either has a reliability or passthrough issue.

-Tom

[fastteks0390]

no as I indicated above I am able to connect, via the Mobile hotspot, to the QNAP's internal VPN via Windows 7 VPN client.  However, also through the same mobile hotspot, I am not able to connect to the Cisco RV0082 using QuickVPN..so VPN passthrough is working with this mobile hotspot it just seems Cisco and QuickVPN are the issues...not the abilities of the hotspot...please advise

[Tom Watts]

Hi JP, you are using 2 different technologies. The Windows VPN connection is PPTP while the QVPN is IPsec. It is two completely different operations and handling.

-Tom

[fastteks0390]

Ok I understand.

So in other words, my reps who are in the field, if they want access to our network via VPN, Cisco and QuickVPN they MUST be connected to a wired or wireless solution other than a mobile hotspot?  Even though Veriizon states their 4g LTE hotspots supporrt all VPN and VPN passthroughs?

[cchamorr]

Hello Mr. Lesser,

I'm sorry you are having issues with this. I reviewed the logs from the router and what I can see is that the only part that is failing is the test the quickvpn software does right after it gets connected to see if there is traffic flowing. Whn you get the "

Ping was blocked, which can be caused by an unexpected disconnect" that usually means that ports 500 nad/or 4500 are blocked by the provider, in this case Verizon.

But lets assume that is not the case, or Verizon can't change the settings. You explained that you are able to connect to the QNAP's PPTP connection via the verizon $G LTE connection, so that means that you know for a fact that PPTP works fine with the Verizon hardware, so you could configure the PPTP server on the RV082 to receive the connections from your mobile users and gain the same access as if they were connected with the QVPN software.

The PPTP VPN will provide the same benefits as the QVPN.

I hope this helps.

Carlos Chamorro

[rmanthey]

While Verison supports VPN communications through there hotspot we can't support the solution; it is a best effert support. The simple reason that there are to many veriables that can cause issues with cellular, and wimax solutions. While wimax is a more reliable solution than the older cellular solutions it still has MTU and stability issues over wired connections.

Two things I would recommend looking at. PPTP sets up a second network addapter (virtual) on your computer. ( Firewall rules are automatically build for this adapter) You must manually create allow rules for ICMP on the addapter you are using to allow ICMP through from any remote subnet and to any remote subnet. Most windows 7 computers block this by default. The QuickVPN utility needs windows firewall enabled. If it is off it will not connect.

The second issue that could be happening is even though you establish the IPSec tunnel the ICMP packet isn't getting back to the QVPN client and the communication path dosn't establish. This could be due to an MTU issue. There is added header size in IPSec packets over PPTP packets. What might be happening is the ICMP packet is being fragemented and dropped. To fix this you would have to adjust your addapters MTU settings to send out smaller size packets.

Cisco Small Business Support Center

Randy Manthey

CCNA, CCNA - Security

[fastteks0390]

In response to the two entries above from Randy and Calos

"..so you could configure the PPTP server on the RV082 to receive the  connections from your mobile users and gain the same access as if they  were connected with the QVPN software."  

-

How would go about setting this up in the RV0082?  Are there any severe Pros or Cons I need to worry about by using PPTP?

"The second issue that could be happening is even though you establish  the IPSec tunnel the ICMP packet isn't getting back to the QVPN client  and the communication path dosn't establish. This could be due to an MTU  issue. There is added header size in IPSec packets over PPTP packets.  What might be happening is the ICMP packet is being fragmented and  dropped. To fix this you would have to adjust your addapters MTU  settings to send out smaller size packets."

-What adjustments should I make specifically...change MTU settings where and to what?