VPN over Comcast

Tue Apr 27 18:56:04 UTC 2010

http://ckdake.com/content/2008/disable-gateway-smart-packet-detection.html
showed a feature of "Gateway Smart Packet Detection" in some SMC
cable modem.

The current solution is to identify the affected Comcast modem, and ask
Comcast engineer to turn that "IDS" feature off remotely.

I spend several days to talk with comcast about our blackboard will
not work sometimes in some shared business class residential building.
Finally got hold of a Regional Engineer to confess this with my
tcpdump proof. Local comcast engineer may not be aware of this
feature.

Schilling

On Tue, Apr 27, 2010 at 2:36 PM, Owen DeLong <owen at delong.com> wrote:
>
> On Apr 27, 2010, at 10:48 AM, Kevin Day wrote:
>
>>
>> On Apr 27, 2010, at 12:42 PM, Michael Malitsky wrote:
>>
>>> I will probably be laughed at, but I'll ask just in case.
>>>
>>> We are having particularly bad luck trying to run VPN tunnels over
>>> Comcast cable in the Chicago area.  The symptoms are basically complete
>>> loss of connectivity (lasting minutes to sometimes hours), or sometimes
>>> flapping for a period of time.  More often than not, a reboot of the
>>> cable modem is required.  The most interesting ones involve the
>>> following: a PIX or ASA configured as an EZvpn client, connecting to a
>>> 3000 concentrator, authentication over RADIUS.  When I go to look at the
>>> RADIUS logs, I see connections from the same box with small intervals.
>>> Timeout is 8 hours, so theoretically I should see 3 connections in a
>>> 24-hr period.  In some cases, I see dozens, in the most egregious cases,
>>> thousands over a 24-hour period.  I am taking that as an indicator of a
>>> really unstable Comcast circuit.  We have not had this problem with any
>>> other ISP, anywhere in the country.
>>> I am pretty much down to telling customers to find another provider...
>>>
>>> Any thoughts or ideas on the matter will be appreciated.
>>>
>>> PS.  To be fair (?) to Comcast, this is not a ubiquitous problem.  It
>>> affects about 25% of the installations I get to see.
>>>
>>> Sincerely,
>>> Michael Malitsky
>>>
>>>
>>
>> We experienced the same thing, and switching from UDP tunnels to TCP tunnels fixed it. There are two things at play here.
>>
>> 1) The SMC modem/router that they insist you use for their "Small Business" cable internet service seems to have trouble with very high rates of non-TCP traffic going through its NAT.
>>
> If you have business class service, insist that they put the cablemodem in BRIDGE-ONLY mode.  This will resolve this issue and eliminate the unnecessary NAT.
>
>> 2) Comcast rate limits non-TCP traffic somewhere on their network.
>>
> Comcast rate limits traffic in general. TCP is not less rate limited than anything else in my
> experience.
>
> Owen
>
>
>