Cisco AnyConnect VPN connection keeps dropping

[#1]

I'm experiencing frequent connectivity drop out issues on my work laptop since starting a new job recently.  

The work laptop internet connectivity disappears for maybe 10-30 minutes and then pops back for 10-30 minutes before disappearing again.  Dropouts seemed to occur for no apparent reason - sometimes it's a few minutes into a zoom call, sometimes when there's no activity.  

The work laptop shows a strong connection with the router but indicates there is no internet during these drop outs. However, at these same times my personal laptop doesn't show or experience any internet or connectivity issues.   I suspect it is a VPN issue - Cisco AnyConnect. 

I previously had a static ip address added to my account, but it doesn't appear to be showing now.

The IT helpdesk of my employer has suggested the issue may be due to low bandwidth but I haven't experienced any related problems with my personal devices.

@Gandalf - I sent you a PM on Friday with some further details.  I've also raised this as a question for the support team.

Any help with resolving this issue with be appreciated as it's making it almost impossible to do my job.

Thank you.

[#2]

I have a an AnyConnect VPN and it's running ok pretty much 24/7.
This is with a static IP - you could try adding that, though it does have a one off cost of £5.

[#3]

Thanks @dvorak 

I paid to have a static IP address added in 2017.  My account doesn't seem to be showing it now and states it's unavailable with my current contract.

[#4]

Judging by your IP address it does look like it's a static.

[#5]

Thanks.  I guess we can rule out the static ip address.  

What else could it be?

My work IT desk (of a major global bank) are suggesting it's a bandwidth issue, which surprises me as I'm not experiencing any connectivity issues with my personal devices and I didn't think VPNs were that demanding.  I've had no VPN bandwidth issues with any other employers.

[#6]

My account doesn't seem to be showing it now and states it's unavailable with my current contract.

@Robson don't worry that's a bug with the member centre!. I've had a static IP for a long time now and my account shows exactly the same.

The work laptop shows a strong connection with the router but indicates there is no internet during these drop outs. However, at these same times my personal laptop doesn't show or experience any internet or connectivity issues. 

I'm assuming you are using a PlusNet Hub one router ?

Are both laptops using Wifi and are both using the same band ( 2.4ghz or 5ghz ) ?

[#7]

Thanks @MisterW .

I'm using a different router.  It's a Belkin Wireless G Plus MIMO Router. I've had it for a while, but never experienced any problems with connectivity or VPNs.  I believe it only works on the 2.4ghz band.

[#8]

@Robson  Thanks for that, I assumed you had a Fibre connection but just noticed that you've posted in the ADSL board so I'm guessing that you only have an ADSL connection. That's going to be quite limiting for VPN usage since the upstream is going to be max of 1Mb. If there's any other use of the connection whilst using the VPN , the upstream is going to be easily saturated.

[#9]

That somewhat suggests that the VPN is "overloading" the US, which it ought not to do.  See The Cisco VPN Client gets disconnected intermittently from the Cisco VPN 3000 Concentrator - Cisco C...

"The VPN Client uses a keepalive mechanism called DPD in order to check the availability of the VPN device on the other side of an IPsec tunnel. If the network is unusually busy or unreliable, you need to increase the number of seconds in order to wait before the VPN Client decides that the peer is no longer active. The default number of seconds to wait before the termination of a connection is 90 seconds. The minimum number of seconds you can configure is 30 seconds, and the maximum is 480 seconds."

It would be useful to see the router stats to eliminate the possibility of an issue with the link.

[#10]

Thanks @Townman .  I'm unsure how to get my router stats -  they don't appear to be available when I access it.

This was how the log was looking all day yesterday:

Jan 25 17:23:30 pppd[444]: Received valid IP address from server. Connection UP.
 Jan 25 17:27:22 kernel: ADSL link down
 Jan 25 17:27:23 kernel: ADSL G.994 training
 Jan 25 17:27:24 pppd[444]: Clear IP addresses. Connection DOWN.
 Jan 25 17:27:24 pppd[444]: Clear IP addresses. PPP connection DOWN.
 Jan 25 17:27:33 kernel: ADSL G.992 started
 Jan 25 17:27:40 kernel: ADSL G.992 channel analysis
 Jan 25 17:27:46 kernel: ADSL G.992 message exchange
 Jan 25 17:27:47 kernel: ADSL link up, interleaved, us=432, ds=4327
 Jan 25 17:27:53 pppd[444]: PPP LCP UP.
 Jan 25 17:27:54 pppd[444]: Received valid IP address from server. Connection UP.
 Jan 25 17:28:46 kernel: ADSL link down
 Jan 25 17:28:47 kernel: ADSL G.994 training
 Jan 25 17:28:48 pppd[444]: Clear IP addresses. Connection DOWN.
 Jan 25 17:28:48 pppd[444]: Clear IP addresses. PPP connection DOWN.
 Jan 25 17:28:58 kernel: ADSL G.992 started
 Jan 25 17:29:04 kernel: ADSL G.992 channel analysis
 Jan 25 17:29:11 kernel: ADSL G.992 message exchange
 Jan 25 17:29:11 kernel: ADSL link up, interleaved, us=488, ds=3343
 Jan 25 17:29:13 pppd[444]: PPP: Try to connect to PPP server ...
 Jan 25 17:29:18 pppd[444]: PPP LCP UP.
 Jan 25 17:29:19 pppd[444]: Received valid IP address from server. Connection UP.
 Jan 25 17:45:51 kernel: ADSL link down

Everything seems much more stable today - I'm unsure if someone at plusnet has made changes to my account?

I've just got another VPN dropouts, but this time it was accompanied by an explanation "The VPN connection failed due to unsuccessful domain name resolution." 

[#11]

Which router are you using?

What you have supplied there is the router log, not overly helpful I'm afraid though the snippet you have shared is interesting.  There is nearly 1mbps difference in the DS between the two attempts to establish a viable connection.  That rather points to some operational difficulty.  It would be worth you working through the standard broadband fault checks...

Broadband is not going to work well if the "phone" line is not working properly.

Please perform a quiet line test - dial 17070 select option 2 using a corded phone plugged into the test socket behind the face plate of the master socket. It should be silent. A noisy phone line (or no dial tone) will have a marked adverse impact on the performance of broadband.

If the line is noisy or there is no dial tone, then a PHONE LINE fault needs to be raised with your phone provider. If this is PlusNet, you can report a fault on line using the button below.  From the Q&A list, choose the one which matches the problem, 'open' the 'section' and click the trouble-shooter link.  NB: If you receive a failure message (rather than a log-in prompt) then log-in to the user portal in a different browser tab and attempt to use the trouble-shooter again.

• Phone Faults

How is your line performing?

Please post your router stats; for PN TG582n and 2704n routers use the buttons below, for other routers look at the Kitz link.

Also run a BT Wholesale speed test (ideally using an Ethernet wired PC with the WiFi turned off) then run the further diagnostics and post the results here. DO NOT REBOOT the router!

NB: Please use an Edge browser or IE as there have been many reports that others fail to function correctly when accessing the BTw speed test.

• TG582n Stats
• 2704n Stats
• Kitz list
• BTw Speedtest

 As for the unsuccessful domain resolution message, that too could indicate a link failure.

[#12]

Thanks @Townman for your help with this.

My router is a Belkin wireless g plus mimo.  I have had it for a while but it's never had any problems.

Unfortunately I don't have a corded phone available for the quiet line test.

Router stats.  Followed your link, and it gave an address to access the Belkin hidden pages for stats.  But when I tried these while connected to the router it came back as a 400 bad request.

However, the following stats are available on the main router status page - are these the stats you're thinking of?

                                 Downstream   Upstream
Data rate (kps)                5115             432
Noise margin (dB)            25.1           17.1
Output power (dBm)        12.2            21.0
Attenuation (dB)               21.0            8.3

I also performed the BT speedtest and advanced diagnostics as you suggested.

Performance Test -

Ping             60 ms

Download   4.12 Mbps

Upload        0.36 Mbps

Advance Test-

Download speed achieved was 4.12Mbps

For connection, acceptable speeds is 1.2-4 Mbps

IP profile for line is 4.51 Mbps

Upload speed achieved was 0.36 Mbps

IP profile for line is 0.83 Mbps

What I have found yesterday and today is that if I'm only doing very light activity over the VPN such as email, the VPN seems entirely stable.  However, the VPN will drop within about a minute of starting a zoom call.  

[#13]

Bingo!!!  Huston, we have a problem!!

Please do the QLT with whatever telephone hand set you do have.

These stats are exactly what we are looking for, however, they are not where we would like them.  It is very evident that this line is being managed for stability in the face of operational issues.

A 21dB attenuated line with a 6dB SNRM should deliver 19.8mbps - you are seeing 5.1mbps. Your SNRM is 25dB - each 3dB above 6dB is "worth" an additional 2+mbps - that is something over 10mbps!!!

One might therefore infer that data is being lost (needs to be retransmitted) on the line, which well lead to time outs.  It will certainly not cope with data intensive activities such as zoom.

Please check the QLT, follow the broadband fault investigation guide (see speed issues link below) and report a phone line fault if the line is noisy or a broadband fault if it is not.  You are not going to fix your VPN issue until the line performance issues are resolved.

[#14]

@Townman  is there an upstream problem as well, which really would indicate a basic line problem.

Due to the high noise margin, I thought at first it was a capped upstream but now I'm not sure ?

That would give an upstream of 448k whereas its only achieving 432k

[#15]

@MisterW 

I agree entirely, but given that the DS is so exceedingly bad, I thought it not worth a mention, as fixing the line issue should fix US as well.  However, we have seen after the event line resets leave the US running slower that the line will sustain, so something worth noting to watch for later!