The most frustrating branch VPN problems are the half-working ones: ping responds but Remote Desktop freezes after connecting, file copies hang midway, or the tunnel drops for a few minutes every few hours. This guide covers the three most common causes of these problems: MTU, DNS and tunnel instability.
The right troubleshooting order
Before diving into details, work from the bottom up:
- Are Phase 1 and Phase 2 of the tunnel up on both sides?
- Do the networks defined on each side (Traffic Selector or Proxy ID) match exactly?
- Does the route to the remote network go through the tunnel, and does a firewall rule allow the traffic?
- Does the connection work by IP address but not by name? Look at DNS.
- Do small packets get through but large ones don’t? Look at MTU.
MTU: when large packets go missing
The maximum packet size (MTU) on Ethernet is usually 1500 bytes. An IPsec tunnel adds encryption headers to every packet, plus a UDP header when it passes through NAT, and on PPPoE links the MTU is usually 1492. As a result, a user’s 1500-byte packet no longer fits through the path.
Normally, Path MTU Discovery uses an ICMP Fragmentation Needed message to tell the sender to send smaller packets. If a firewall blocks all ICMP messages, that message never arrives and large packets are silently dropped.
To measure it, ping a server at headquarters from a branch computer with the “do not fragment” option:
- On Windows:
ping -f -l 1472 10.10.0.10 - On Linux:
ping -M do -s 1472 10.10.0.10
1472 plus 28 bytes of IP and ICMP headers equals 1500. If you get an error, lower the number until you find the largest size that gets through; the actual path MTU is that number plus 28. To fix the problem:
- Enable MSS Clamping on the tunnel so TCP connections start with smaller packets from the outset. The MSS value is the path MTU minus 40 bytes, and setting it slightly lower gives you a safety margin.
- If your tunnel is route-based, set the tunnel interface MTU based on your measurement.
- Do not block ICMP Fragmentation Needed messages on your firewalls.
MSS Clamping only affects TCP. For UDP traffic, the tunnel interface MTU and the device’s fragmentation behavior are what matter.
DNS: when it works by IP but not by name
- No internal DNS at the branch: If branch users rely on the modem’s or the provider’s DNS, they cannot resolve internal names such as
fs01.company.local. The branch DHCP server must hand out the company’s internal DNS. - Full dependence on headquarters DNS: If the branch’s only DNS server is on the other side of the tunnel, the branch loses internet access too when the tunnel drops. A domain controller or local DNS server at the branch reduces this dependency.
- Sites and Services not configured: If the branch IP range is not linked to the correct site in Active Directory Sites and Services, computers may go to a more distant domain controller and logons become slow.
Recurring tunnel drops
Record the time of each drop and compare the logs from both sides at that exact moment. Common causes:
- Lifetime mismatch: If the Phase 1 or Phase 2 key lifetimes differ between the two sides, the tunnel may drop during rekey; drops at regular intervals usually come from this.
- DPD: Enable Dead Peer Detection on both sides with matching settings so a failed tunnel is rebuilt quickly.
- Public IP changes: If one side does not have a static IP, the tunnel drops every time it changes; a static IP, or at least DDNS, is required.
- Multiple subnets: On some devices, especially with IKEv1, a separate SA is created for each subnet pair, and sometimes only some of the connections drop.
Checklist
- Tunnel status and Traffic Selectors have been checked on both sides.
- Path MTU has been measured with ping and MSS Clamping is configured.
- ICMP Fragmentation Needed is not blocked.
- The branch DHCP hands out internal DNS and the branch is defined in Sites and Services.
- Lifetime and DPD settings match on both sides.
- Drop times are recorded and the tunnel is continuously monitored.
ITPlus724 engineers can troubleshoot the tunnels between your branches and align the settings on both sides for a stable connection.