topic Re: GlobalProtect VPN Issues in Full Fibre

GlobalProtect VPN Issues

nabllik_new — Thu, 03 Jun 2021 09:59:20 GMT

Hi there,

I started at a new company in March, and since that time, I have experienced slow VPN connections. They use GlobalProtect as their VPN solution.

The previous companies that I was with had no issues with VPN connections. They did not use GlobalProtect for the VPN.

Is there an issue with my connection / VPN connection that is somehow being limited by Plusnet?

This has come to a head, as there was a new software suite that was rolled out over the weekend. This new software requires a download of data / files each time it starts up, and it is timing out.

Can someone from Plusnet look at my connection and see if there is an problem that can be solved within Plusnet?

Thanks in advance.

Nicholas J Ball

Re: GlobalProtect VPN Issues

RichardB — Thu, 03 Jun 2021 12:33:36 GMT

Hi @nablik_new
Another thread on this forum has suggested that changing from using a Netgear modem/router to a draytek router resolved the problem. The globalprotect VPN appears sensitive to some router configurations.
https://community.plus.net/t5/Tech-Help-Software-Hardware-etc/Problem-with-Global-Protect-VPN-connection-to-my-workplace/m-p/1770298#M89982
What router are you using?

Regards
Richard

Re: GlobalProtect VPN Issues

nabllik_new — Thu, 03 Jun 2021 12:58:55 GMT

Hi Richard,

I have a Draytek 2860 router already. I changed the MTU settings, but, to no avail.

I have spoken to someone at PlusNet and they are changing my static IP address.

Hopefully, that will solve it!

Thanks for replying though. I will take a look at that link that you gave me.

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

RichardB — Thu, 03 Jun 2021 13:53:48 GMT

Hi
This is probably a red herring...
I had an issue with a very slow VPN years ago.
I wish I could remember the software vendor...
Anyway the VPN running slow was resolved by enabling responses to ICMP pìngs on the WAN.
I guess the VPN was using the ping responses as a keep alive signal?
Richard

Re: GlobalProtect VPN Issues

nabllik_new — Fri, 04 Jun 2021 13:52:08 GMT

Hi Richard,

I changed the settings to allow ICMP pings on the WAN. That did not improve things.

Plusnet have now changed my static IP address. Guess what? That did not improve things.

It seems that my only option now is to change to another ISP that does not have issues with GlobalProtect VPN.

I had thought that in the current climate, that VPN usage would be a marketing angle.

Anyway, thanks again for your help.

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

RichardB — Fri, 04 Jun 2021 19:46:47 GMT

Hi
Have you proven that the issue is caused by Plusnet and not the router?
Before moving ISP and perhaps finding the same issue, I would recommend trying a different router.
Or setting the draytek to bridge mode and using the PC to establish the PPPoE login to Plusnet.
It would also be a good test to try the Draytek and the VPN at a friend or familiy house who are with a different ISP.
Regards
Richard

Re: GlobalProtect VPN Issues

nabllik_new — Sun, 06 Jun 2021 18:06:10 GMT

Hi Richard,

I have tried using my mobile Hotspot, and also using the BTOpenreach modem that was supplied when I first got Plusnet Fibre.

No issue with the WiFi hotspot, and the issue was still existing with the BTOpenreach Modem.

What I haven't tried is the BTOpenreach modem without the Draytek Router in the mix. I won't be able to use the laptop to create a PPOE connection, as it is a company laptop that is locked down for anything beyond normal user changes.

I shall be asking if I can hop onto my neighbours wifi to test that as another test.

Testing the router in another location will be difficult.

Thanks for your comments, they are helpful for me.

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

nabllik_new — Sun, 06 Jun 2021 20:50:39 GMT

Hi Richard,

Only me!!!

I tried my neighbours WiFi, and I can connect to the VPN, and get full speed downloads.

I then dug out the Openreach Modem again and connected it directly to my work laptop. Once I had setup the connection, all speeds were as good as I have achieved before. 70Mbbs down and 20 Mbps up.

Except when I was downloading on the VPN. I got nothing. There is an company internal speedtest website, and it did not even start working.

This now moves the problem away from my local network and upstream to Plusnet.

Plusnet have already played their joker with me and asked if I achieve over the minimum download speed without the VPN:-

Would you be able to confirm if your connection is performing above the minimum guaranteed speed of: 59.4Mbps when your VPN is not active?

They then followed up with the classic, take a look at the forums:-

Theres nothing on your line to prevent vpn achieving high speeds, the speeds are correct and if the speeds are dropping, its down to vpn configurations or hardware. Perhaps take a look at the community forum to see if you get any help - https://community.plus.net/t5/forums/searchpage/tab/message?advanced=false&allow_punctuation=false&q=vpn

Now that I have confirmed that the issue is not with my network equipment, can one of the Plusnet Staff on the forum take a look at this issue and see if it can be resolved before I pull the trigger on a change of provider?

@Gandalf - Could you maybe take a look at this please?

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

Gandalf — Mon, 07 Jun 2021 07:22:40 GMT

Thanks for your post @nabllik_new

I'm sorry to see you're having connection issues with your VPN.

Vast majority of VPN issues I'd say are down to the VPN itself, there's very little our side which can stop a VPN from working. Moreover if your previous one was working fine then that seems to point an issue towards the new one you're using.

I appreciate though that you've tried it on another connection but there are a lot of factors you've changed by doing that, for example the router itself. Can you try a different router on your own connection?

Also have you contacted your company's IT team to investigate this from their end?

Finally you've got the broadband firewall enabled on your account. Try turning it off: https://www.plus.net/help/broadband/about-plusnets-broadband-firewall/ and retest.

I hope this helps.

Re: GlobalProtect VPN Issues

MisterW — Mon, 07 Jun 2021 07:34:12 GMT

Finally you've got the broadband firewall enabled on your account. Try turning it off: https://www.plus.net/help/broadband/about-plusnets-broadband-firewall/ and retest.

@nabllik_new just to add to @Gandalf s note. You will need to disconnect and reconnect the broadband connection for the firewall change to take effect

Re: GlobalProtect VPN Issues

nabllik_new — Mon, 07 Jun 2021 07:42:00 GMT

Hi Gandalf,

Thanks for getting back to me.

One of the previous companies used Pulse Secure, and the other required a browser based secure connection to setup access to a remote workstation. Both of those worked well.

Regarding the router, I connected the BTOpenreach modem to the phoneline and connected my company laptop directly to that, so there was no router in the network at all. That gave the same problem that had been seeing for the VPN whilst connected to my router. In fact, it gave worse performance on the company speedtest using the BTOR Modem than using my router.

My company IT support are throwing the issue downstream, as there is "nothing wrong with their network"...

They say they are looking at another VPN solution, but, that is not available for users at this time. I have requested being on a Beta test if that solution is to be rolled out to a broader user group.

I have changed the firewall to "Off", and I will retest.

Thanks again for the reply, I shall feedback once I have retested with the firewall off.

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

corringham — Mon, 07 Jun 2021 11:34:43 GMT

I use a Draytek 2860 with GlobalProtect (and several other VPNs - sometimes simultaneously) without problem so it won't be the router that is he problem. I'm no longer using Plusnet, but never had a problem with VPN (other than MTU) when I did.

Re: GlobalProtect VPN Issues

Townman — Mon, 07 Jun 2021 11:45:48 GMT

IIRC in the past we have seen issues with some VPN providers who have out of date Geolocation data. It would be worthwhile checking the geolocation data for your current IP address. Some of the dynamic IP address pools used by BT (they assign the IP address) have been "imported" from overseas and some systems are using out of date geolocation data.

@Gandalf might a temporary static IP address be applied here to see if that eliminates the user's issue?

@nabllik_new we have also seen out of date VPN setups have problems working over VPN - that is @bobpullen's arena!

Re: GlobalProtect VPN Issues

dvorak — Mon, 07 Jun 2021 12:27:45 GMT

@Townman, static IP was tried and a new one given, stated in earlier messages.

Re: GlobalProtect VPN Issues

nabllik_new — Mon, 07 Jun 2021 12:42:45 GMT

Hello all,

So, I changed the Firewall settings to "Off", and then I restarted my router.

No change in the performance over VPN.

@corringham do you remember what MTU you had that worked well?

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

RichardB — Mon, 07 Jun 2021 14:50:23 GMT

This is probably another Red Herring.
Which ISP (which worked at full speed) is the neighbour with?
I am wondering if the neighbours ISP supports IPV6 and that is what enables faster VPN speeds?
Plusnet have yet to implement IPV6 support (I think that TalkTalk retail and Vodafone also do not support IPV6.

Re: GlobalProtect VPN Issues

corringham — Mon, 07 Jun 2021 14:53:33 GMT

I seem to think that 1420 worked fine on Plusnet for me. I had to have it much lower when I was using Three 4G.

You need to be aware that every path through the internet may have a different MTU, so there isn't one value that is guaranteed to work - you really need to test against your intended destination to be confident of avoiding issues.

Of course that may not be the issue at all - can you get any logs which may give a clue? The GlobalProtect host-state info might be interesting, as would any error info.

Re: GlobalProtect VPN Issues

nabllik_new — Mon, 07 Jun 2021 15:29:55 GMT

Hi again,

My neighbour is on Vodafone, so probably not an IPV6 issue.

With regards to the MTU, I pinged the company speedtest site and got a figure of 1372 without fragmentation.

Does this mean that I need to add 28 for the IP / ICMP headers, and then take off 73 for the IPSEC overhead?

That would mean setting the MTU on my router to:-

1372 + 28 - 73 = 1327

I will give it a try and see what difference there is.

I will keep you posted.

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

nabllik_new — Tue, 08 Jun 2021 20:36:35 GMT

Well, the MTU change did not help, I am getting no feedback from Plusnet as to how to resolve this issue, and so the next course of action is to research other providers and choose the one that is the least bad.

Best regards,

Nicholas J Ball

Re: GlobalProtect VPN Issues

corringham — Wed, 09 Jun 2021 09:25:16 GMT

There will be a way to find out exactly what is failing - logging at your end or the far end should give some insight.

I have some sympathy with Plusnet being unable to help with VPNs, as there are a lot of different ones around and can be configured in a variety of ways. However, with so many people working from home they are no longer a rarity, and they are losing customers that have problems using VPNs on Plusnet when the same VPN configuration works on other networks.