Re: [Openvpn-users] Intermittently lost connections - affecting IP Phones

[Leonard Isham <leonard.isham@xxxxxxxxx>]

On 2/2/06, Cameron Gocke <livedrive777@xxxxxxxxx> wrote:
> On 2/1/06, Leonard Isham <leonard.isham@xxxxxxxxx> wrote:
> > On 2/1/06, Cameron Gocke <livedrive777@xxxxxxxxx> wrote:
> > > Over the last couple of months I've had numerous reports of
> > > intermittent loss of connectivity.  This doesn't last for more than a
> > > few seconds, but it results in the users' dropping their IP phone
> > > connection.  At first I started troubleshooting the Inactivity timeout
> > > messages, but have all but eliminated those and the issue continues.
> > > (Aside from which I would assume that the IP phone would be sending
> > > traffic over the VPN and therefore keep it from timing out.)
> > >
> > > I am getting these messages:
> > > Wed Feb 01 15:21:58 2006 clientname/71.99.3.226:1142 TLS: tls_process:
> > > killed expiring key
> > >
> > > Almost exactly every hour on the client side, but am not losing
> > > connection nearly that often.
> > >
> > > I've done some preliminary testing, and I don't see any evidence that
> > > their internet connectivity is dropping at any point.
> > >
> > > Does anyone have any suggestions for me?
> > >
> >
> > Packet loss, latency issues, bottlenecking, or dynamic IP
> > reallocation(with a new IP).  Could all potentually cause the problem.
> >
> > Is the universal or anly limited to a few?
> >
> > Have you checked for resource starvation on your systems?
> >
> > How about bandwidth saturation, typically about 70%+ utilization,?
> >
> > Use packet captures to look for latency issues or lost packets.
> >
> > --
> > Leonard Isham, CISSP
> > Ostendo non ostento.
> >
>
> Well, I know that we don't have any packet loss or latency issues on
> the OpenVPN server side.  There is always the posssibility of having
> some connectivity issues on the client side, but I have checked for
> that with specific clients and not found anything.  Plus with the
> number of clients reporting the issue it seems unlikely that all of
> them are having issues like that.
>
> The issue is a universal one; although not all of my users use IP
> phones, so they typically don't notice if they drop connection for a
> few seconds.
>
> My OpenVPN server is basically sitting idle all the time, and its
> resources are hardly being touched.  The only thing I'm not 100% sure
> about is that since the TAP-WIN32 driver that OpenVPN uses is a 10Mb
> connection, I know that we spike at times to 50% and 60% utilization
> of that 10Mb adapter's connection.  Would that result in these sort of
> issues?
>

The speed of the TAP-WIN32  is acut=ually only limited by the speed of
your card and the computer's ability to process the encryption and
encapsulation.  The 10MB isn't an actual speed.

You may have a bottlrneck elsewhere.  One example if your ISP,
especially if it is a smaller one, may have completely oversubscribed
it's iInternet connection(s).

Additionally there may be a a link with intermittant errors,  Ths can
happen with any link, dial-up, DSL,T-1, OC12, etc.

--
Leonard Isham, CISSP
Ostendo non ostento.


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
Openvpn-users mailing list
Openvpn-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/openvpn-users