VPN over Comcast

gladney at stsci.edu gladney at stsci.edu
Tue Apr 27 13:02:01 CDT 2010


Are you running IPSec over UDP?  We've had problems in Maryland with IPSec over UDP to Comcast customer.  Try switching to TCP.

Gary
------Original Message------
From: Michael Malitsky
To: nanog at nanog.org
Subject: VPN over Comcast
Sent: Apr 27, 2010 1:42 PM

I will probably be laughed at, but I'll ask just in case.

We are having particularly bad luck trying to run VPN tunnels over
Comcast cable in the Chicago area.  The symptoms are basically complete
loss of connectivity (lasting minutes to sometimes hours), or sometimes
flapping for a period of time.  More often than not, a reboot of the
cable modem is required.  The most interesting ones involve the
following: a PIX or ASA configured as an EZvpn client, connecting to a
3000 concentrator, authentication over RADIUS.  When I go to look at the
RADIUS logs, I see connections from the same box with small intervals.
Timeout is 8 hours, so theoretically I should see 3 connections in a
24-hr period.  In some cases, I see dozens, in the most egregious cases,
thousands over a 24-hour period.  I am taking that as an indicator of a
really unstable Comcast circuit.  We have not had this problem with any
other ISP, anywhere in the country.
I am pretty much down to telling customers to find another provider...  

Any thoughts or ideas on the matter will be appreciated.

PS.  To be fair (?) to Comcast, this is not a ubiquitous problem.  It
affects about 25% of the installations I get to see.

Sincerely,
Michael Malitsky




Sent via BlackBerry from T-Mobile


More information about the NANOG mailing list