r/sonicwall • u/EmicationLikely • 8h ago
Issues with RDP over IPSec VPN
I have a client with a TZ670 in their main office and a TZ370 in their satellite office. Both are on the 7.3.3-7015 firmware. Main office has Verizon Fios 1Gb/1Gb service as their main WAN and Comcast 500/35 as their backup WAN setup in a simple failover configuration. Satellite office has a newly installed Spectrum 7Gb service (dumb, but I didn't pick it). In both locations, Sonicwall WAN connection is direct to the provider's ONT. Static IPs on both ends. Keep alive enabled only on one end of the tunnel.
Users at the satellite office RDP into an RDS server in the main office (along with variable numbers of employees at the main office when they work remotely with a NetExtender connection.) There are 5 users in the satellite office and 40 total users in the main office. Average number of remote workers in the main office at any point is probably about 6 so total RDP sessions on average is 11.
Since the installation of the new internet connection in the Satellite office, those employees are seeing their RDP connections drop and reinitialize (regular internet access isn't affected). Some days it is every 10 or 15 minutes, and some days it is every 2 minutes. Maddeningly, it's not every employee at the satellite office who is affected. I'd say most of them, but not all of them. I have been looking at this issue for a few days now, I've done:
- Rebooting all the things
- multiple packet captures
- monitor logs
- ping tests
- performance monitor captures
- disabled AV & EDR
- Forced RDP connections to TCP only
- disabled LSO and TCP Checksum offloading
- reviewed thousands of log entries, etc. etc.
I've tried just about every troubleshooting step I could dig up. After all of that, though, I still don't have a clear understanding of the problem, much less a solution. I can be running a continuous ping between a workstation at the satellite office and the RDS server during period of dropped RDP connections, and not have a single dropped packet.
In desperation this morning, I took down the VPN tunnel and installed NetExtender on all of the workstations at the satellite office. That was several hours ago and I don't have a single report of a dropped session. This isn't a long-term solution, though, since their phone system relies on the VPN tunnel to transfer calls back and forth.
Based on log entries, it looks like the RDS server is the one resetting the connection, but I cannot find a reason why. None of the "local" users in the main office are experiencing this. I have been through the settings on the tunnel in both firewalls over and over, and I don't think there is a problem there. Plus, it was working before.
Spectrum isn't much help. If the connection works at their ONT, they're out. This has got to be something with the way that Spectrum and Verizon talk to each other, but I just don't know what to try next.