VPN connections
Frank Davis
I have CISCO VPN for my work.
I am very happy to finally have some decent high speed internet here in my
country home. Unfortunately, I can not use this to connect to my office
in town as they of course have a very nice VPN system. It does work great
on phone line but is just too slow to be effective. I was looking forward
to the benefits of the high speed download when connecting to work, but it
seems VPN is not supported by DirecPC. I have learned that the community
of users of a product, quite often have solutions….
Can anyone make a suggestion?
-----
Cable Modem FAQ: http://www.cablemodemhelp.com
-----
Kevin
be VERY slow.
I use a VPN product called VSClient. It actually works. However, the speed
is at best, Modem speed. By using VPN your bypassing all the caching and
compression that DW do to achieve the speed (at least that is what I was
told).
Some VPN clients require a public IP address, if that's the case, your
looking at getting the business edition.
Good Luck,
Kevin
"Frank Davis" <fjd0_R...@aol.com> wrote in message
news:7g7p7b...@www.cablemodemhelp.com...
> Has anyone out there been successful in getting a VPN connection to work?
>
> I have CISCO VPN for my work.
> I am very happy to finally have some decent high speed internet here in my
> country home. Unfortunately, I can not use this to connect to my office
> in town as they of course have a very nice VPN system. It does work great
> on phone line but is just too slow to be effective. I was looking forward
> to the benefits of the high speed download when connecting to work, but it
> seems VPN is not supported by DirecPC. I have learned that the community
> of users of a product, quite often have solutions..
Patrick Gannon
is a guaranteed service protocol. As such it has a sophisticated technique
for determining how fast a line is and confirming that all packets were
received correctly before sending any more. So when your PC or a server
sends data, a process takes place by which TCP sends a little data, waits
for a response, sends a little more, waits for a response, and speeds up the
transmission by sending more data each time, until a packet is dropped. At
that point it has learned the capabilities of the circuit and will send data
at the optimized rate. You can see this when you do a large file transfer
and you see the data transfer rate slowly getting faster and faster till it
reaches a certain point where it stabilizes.
What happens on a satellite is that the response from the remote site takes
a very long time, due to satellite latency. The sending device thinks it is
running on a string between two cans or a piece of barbed wire, so
throughput is very low. To combat this, broadband satellite providers
either accelerate or spoof the TCP control header information so that the
sending device can transmit at full speed. They intercept the TCP control
headers and respond to them locally. The spoofing or acceleration software
knows the satellite throughput capabilities and can control the ACK
responses to optimize use of the available bandwidth.
When you take your TCP/IP data an put it in a VPN, what generally happens is
that the data (encrypted or not) is wrapped in a UDP packet. UDP is a spray
and pray protocol. There are no acknowledgments, there are no guarantees.
There is no way to spoof or accelerate it. So now your VPN packet must go
across the link, get unwrapped, and only at that point can the TCP control
information be responded to - so the benefits of TCP spoofing or
acceleration are completely lost.
As indicated below, a common requirement for many VPNs is having a static IP
address, and you can get this with the DW BE - see www.skycasters.com
however, throughput will max out at about 70 Kbps per session with VPNs, and
there is little that can be done about it without some buy-in from your IT
department. Workarounds include client-based and standalone TCP
acceleration appliances and client software such as provided by Mentat; or
using SSL-based VPNs such as provided by Neoteris. SSL is carried in TCP,
not UDP, so TCP Acceleration or spoofing still works. A company called
Encore Networks http://www.encorenetworks.com has an interesting product
called BANDIT that uses something called SLE or selective layer encryption
that can provide a solution by encrypting the data, but it doesn't wrap the
packet in UDP so the original TCP control information is retained. It
requires an appliance on both sides of the connection. It can work with
client-based VPNs by terminating them in the local appliance and setting up
a new SLE VPN to the headquarters. The problem with all of these is that you
have to convince your IT dept to help implement a solution.
Depending on what you need the VPN for and the number of people on satellite
who need to be supported, an SSL- VPN is probably the easiest to implement.
Tell your IT dept. it can also be used as a platform for extranet partners.
The Neoteris solution limits access to specific applications on specific
servers, unlike an IPSec VPN that grants access to the entire LAN.
Pat
Patrick Gannon
Business Satellite Solutions
(804) 556-3069
ptga...@earthlink.net
"Kevin" <rockl...@yahoo.com> wrote in message
news:FUXna.62357$NV.15...@news.direcpc.com...
Frank Davis
discussion about the possibilities. I looked on skycasters site for DW
BE. Could not find anything that get’s me to the solution you suggested.
If I could see 70K I would be ecstatic. I am seeing 21.6 typically on my
rural phone line!
Thanks for the info so far.
Frank
Spankmaster
If you're going to use DW with VPN access the "best" way to use it, even
with the BE edition is to convert it to the one way system. You will get a
lower ping time (best) with the one way connection and be able to pull down
files, email, etc., from your VPN at about 150k to 200k.
But if you don't have a phone line you've only got the two way system. Try
doing most of your major downloads and uploads during the early morning
hours. During the day, the system will slow down.
If there is any way to get a phone line where you are at, I would try to get
one for one way connectivity. You will be pleased with the one way
connection but not the two way on your VPN. Now for web browsing and
downloading and uploading from the web, the two way connection is better,
believe it or not. I get speeds up 60-70k and down 1500k-2500k on the web.
It's great for downloading and surfing.
Peace.
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Spankmaster
Windows XP Pro SP1, AMD 1.7GHz, 512MB
DW4000, SATMEX5, BE 4.0.3.9 SPB 990MHz
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Frank Davis" <fjd0_R...@aol.com> wrote in message
news:7g7p7b...@www.cablemodemhelp.com...
> Has anyone out there been successful in getting a VPN connection to work?
>
> I have CISCO VPN for my work.
> I am very happy to finally have some decent high speed internet here in my
> country home. Unfortunately, I can not use this to connect to my office
> in town as they of course have a very nice VPN system. It does work great
> on phone line but is just too slow to be effective. I was looking forward
> to the benefits of the high speed download when connecting to work, but it
> seems VPN is not supported by DirecPC. I have learned that the community
> of users of a product, quite often have solutions..
Christophe Prévotaux
> Actually the problems with VPNs have to do with TCP over satellite. TCP/IP
> is a guaranteed service protocol. As such it has a sophisticated technique
> for determining how fast a line is and confirming that all packets were
> received correctly before sending any more. So when your PC or a server
> sends data, a process takes place by which TCP sends a little data, waits
> for a response, sends a little more, waits for a response, and speeds up the
> transmission by sending more data each time, until a packet is dropped. At
> that point it has learned the capabilities of the circuit and will send data
> at the optimized rate. You can see this when you do a large file transfer
> and you see the data transfer rate slowly getting faster and faster till it
> reaches a certain point where it stabilizes.
>
> What happens on a satellite is that the response from the remote site takes
> a very long time, due to satellite latency. The sending device thinks it is
> running on a string between two cans or a piece of barbed wire, so
> throughput is very low. To combat this, broadband satellite providers
> either accelerate or spoof the TCP control header information so that the
> sending device can transmit at full speed. They intercept the TCP control
> headers and respond to them locally. The spoofing or acceleration software
> knows the satellite throughput capabilities and can control the ACK
> responses to optimize use of the available bandwidth.
The problems lies more in the fact that the optimization can not be done
because the headers (IP headers) is encrypted , if only the payload
could be encrypted then performances would get higher. So what is really
needed is a payload only encryption. (that is one of the solutions)
>
> When you take your TCP/IP data an put it in a VPN, what generally happens is
> that the data (encrypted or not) is wrapped in a UDP packet. UDP is a spray
> and pray protocol. There are no acknowledgments, there are no guarantees.
not true , even though you used the term GENERALLY, the most common case
show you statement to be biased. IPSEC and PPTP to name a few are not
using UDP packets , IPSEC uses AH and ESP and PPTP uses GRE.
Even though protocols like OPENVPN or VTUN or many others use UDP to
encapsulate IP. it is not the most common way of building VPN.
> There is no way to spoof or accelerate it. So now your VPN packet must go
> across the link, get unwrapped, and only at that point can the TCP control
> information be responded to - so the benefits of TCP spoofing or
> acceleration are completely lost.
That is more like what is happening.
>
> As indicated below, a common requirement for many VPNs is having a static IP
> address, and you can get this with the DW BE - see www.skycasters.com
> however, throughput will max out at about 70 Kbps per session with VPNs, and
> there is little that can be done about it without some buy-in from your IT
> department. Workarounds include client-based and standalone TCP
With OpenVPN I do 400Kbps
> acceleration appliances and client software such as provided by Mentat; or
> using SSL-based VPNs such as provided by Neoteris. SSL is carried in TCP,
> not UDP, so TCP Acceleration or spoofing still works. A company called
> Encore Networks http://www.encorenetworks.com has an interesting product
> called BANDIT that uses something called SLE or selective layer encryption
> that can provide a solution by encrypting the data, but it doesn't wrap the
> packet in UDP so the original TCP control information is retained. It
> requires an appliance on both sides of the connection. It can work with
> client-based VPNs by terminating them in the local appliance and setting up
> a new SLE VPN to the headquarters. The problem with all of these is that you
> have to convince your IT dept to help implement a solution.
His best bet would be to use Opensource software. there is an old
protocol called SKIP that also does work pretty well over Direcway.
Also Mentat works only if you are using Gateway to Gateway (Mentat to
Mentat) boxes AFAIK
So unless one has extra money to spend on this kind of hardware
then I suggest they stick to Opensource since all it requires in
investment is time for the setup.
>
> Depending on what you need the VPN for and the number of people on satellite
> who need to be supported, an SSL- VPN is probably the easiest to implement.
> Tell your IT dept. it can also be used as a platform for extranet partners.
> The Neoteris solution limits access to specific applications on specific
> servers, unlike an IPSec VPN that grants access to the entire LAN.
VOne also does this (http://www.v-one.com) but this is a very silly way
of handling security IMHO.
--
--
===============================================================
Christophe Prévotaux
===============================================================
Christophe Prévotaux
have a try at openvpn.sf.net , it does work quite well for me
W. Scholz
<c.prevotaux@nospam_hexanet.fr> wrote:
>Dans l'article <7g7p7b...@www.cablemodemhelp.com>, Frank Davis a écrit :
>> Has anyone out there been successful in getting a VPN connection to work?
>>
-------------snip-------------
>> Can anyone make a suggestion?
>>
>>
>
>have a try at openvpn.sf.net , it does work quite well for me
I just tried it and got only a DNS error ...
Werner
W. Scholz
Frank Davis
This is pretty amazing support!
Thanks.
More questions:
The suggestion of trying open source VPN would of course be very
interesting.
Does this mean that my IT guys have to install and administer this
different software for me?…..I may be able to persuade them, if I
understand you correctly.
Frank
Christophe Prévotaux
> Frank Davis wrote:
>
> This is pretty amazing support!
> Thanks.
> More questions:
> The suggestion of trying open source VPN would of course be very
> interesting.
> Does this mean that my IT guys have to install and administer this
> different software for me?…..I may be able to persuade them, if I
> understand you correctly.
I understand , I am afraid that the answer is :
Yes they would have to run OPENVPN on a gateway.
which is easily done, and is installable in under 10 minutes
configuration is very easy to do , personnally I use it under FreeBSD
and NetBSD. Plus it is very easy to secure for your firewall
administrator since it uses only 1 UDP port
The only thing that is required on your side is to have a Unix
machine acting as your workstation or your gateway (FreeBSD,NetBSD
,OpenBSD,Linux, Solaris etc...)
W. Scholz
<c.prevotaux@nospam_hexanet.fr> wrote:
>Dans l'article <260s7b...@www.cablemodemhelp.com>, Frank Davis a écrit :
>> Frank Davis wrote:
>>
>> This is pretty amazing support!
>> Thanks.
-----------snip---------------------
>configuration is very easy to do , personnally I use it under FreeBSD
>and NetBSD. Plus it is very easy to secure for your firewall
>administrator since it uses only 1 UDP port
>
>The only thing that is required on your side is to have a Unix
>machine acting as your workstation or your gateway (FreeBSD,NetBSD
>,OpenBSD,Linux, Solaris etc...)
But don't forget that with FreeBSD and so on you have instead of INTEL
the DEVIL inside ... Yesterday was his birthday and as I fear him more
than anything else in the world I write this here to warn some people
who are maybe not fully aware of wht the are doing if they install
FeeeBSD and all those demons including even the chief (the one with
the red hat, Mr. Adolf Hitler).
Werner
Ricky Nelson
Christophe Prévotaux
What thruput are you getting ?
Dans l'article <9e9d3eaade64908f...@news.teranews.com>, Ricky Nelson a écrit :
--
===============================================================
Christophe Prévotaux
===============================================================
Terry Campbell
I too have 2-way DirectPC at home & a workplace with a Cisco VPN. I'm
also on the Network staff and have been frustrated for the past 12+
month attepting to get VPN functioning for myself. Pretty bad when
everyone EXCEPT IT has VPN ;-)
Yesterday, we made a change on our VPN Concentrator (Cisco 3000)and
opened up NAT-T to improve connections for a client. The NAT-T change
also made a difference for me. Previous to NAT-T, I would
authenticate to VPN, but could do nothing - all IP pings would die and
not return. NOW, I authenticate and can make IP & WINS connections to
the computers in the office. We use VNC to remote control our servers
and I'm now able to VNC through the VPN. I previously had to make a
connection using WebEx technology to remote control my desktop and
then make the Server connection! What a HUGE step forward. Also, I
have excellent connection speeds - NOT the slow boat connection that
others have predicted in the News Group. Of course, it's only been
functional for a few hours - who knows what challenges will be
presented down the road.
Now - for more information on the NAT-T. It can be found on the Cisco
3000 VPN Concentrator in Configuration -> System -> Tunneling
Protocols -> IPSec -> NAT Transparency -> Check boxes there. We are
accepting IPSec over TCP (1st option box) and IPSec over UDP (2nd
option box)
Good luck. I hope that NAT-T makes the difference for you. I know
that I'm delighted to finally be able to work from home quickly and
effectively.
Terry
fjd0_R...@aol.com (Frank Davis) wrote in message news:<7g7p7b...@www.cablemodemhelp.com>...
> Has anyone out there been successful in getting a VPN connection to work?
>
> I have CISCO VPN for my work.
> I am very happy to finally have some decent high speed internet here in my
> country home. Unfortunately, I can not use this to connect to my office
> in town as they of course have a very nice VPN system. It does work great
> on phone line but is just too slow to be effective. I was looking forward
> to the benefits of the high speed download when connecting to work, but it
> seems VPN is not supported by DirecPC. I have learned that the community
> of users of a product, quite often have solutions?.
j248932...@yahoo.com
I'm having the same problem with accessing a Cisco PIX. It may connect
for a day or so, then stop working for a day or so, then start working
again. At first I used the Cisco VPN client then switched to the PPTP
client in XP which seemed to help, but after a few days it failed
again. Checking when it fails, pinging the PIX results in round-trip
times of over 1 second. Did you have to tweak any parameters in tcp/ip
to get it to connect?
On 1 May 2003 07:39:54 -0700, terryc...@earthlink.net (Terry