Unify L2TP VPN issues ... please help.

[thecomputerguy]

I have a client who has a USG. There is one remote user, and they were getting tired of the lag using LogMeIn so I said, "Hey! No problem! We'll just setup L2TP in the USG! then you'll be able to access the server share directly! And! I'll have you RDP into your workstation at the office so you can access Quickbooks!"

After some fiddling around I was able to get the L2TP connection up, using all basic settings found in this video:

Essentially....

1.) Enable Radius (w/ Secret Passcode)
2.) Create Radius user
3.) Create remote user VPN (w/ Pre-Shared Key)

Added the AssumeUDPEncapsulationContextOnSendRule registry edit and off we go.

Everything was working great, she was super happy with everything until it just stopped working, and it has stopped working multiple times, and the only way I am able to resolve it is to login to the USG, delete her Radius user, turn the Radius server off, delete the Remote User VPN and then set it all back up again, with identical settings. Make no changes to the VPN client, and then bam it connects again (for who knows how long).

This morning she texted me she couldn't connect with this error (AGAIN):



I get into my office and I can connect fine with no issue, so I tell her there must be something wrong with her network and I'd come out with my laptop after verifying I can connect to the VPN from my office, then try to connect to the VPN with my laptop on your network.

I go out there, my laptop also can't connect, so I'm thinking ok well it's definitely something with the network. We reboot everything, still no go. I get back to my office and now my laptop and my desktop can't connect to the VPN. WTF?

So I delete her Radius user, turn the Radius server off, delete the Remote User VPN and then set it all back up again, with identical settings. Make no changes to the VPN client, and then bam everyone can connect again.

I have verified that re-creating the Radius user is not enough to fix the issue, but I have not been able to verify if deleting the user and then turning off the radius server then back on again fixes it. I have always gone the extra step of deleting the Remote User VPN as well.

 

[Markverhyden]

What are the IP's? As in destination (the office), origination(end user), and the VPN DHCP scope. Also it helps to look at the logs on both ends when a connection attempt is being made.

 

[YeOldeStonecat]

I wasn't too impressed with the lack of reliability of the Unifi gateways VPNs. I see you rebooted everything, but I'd run into similar issues on the couple of clients I tried it on. The quick fix was to reboot the USG.

I'm assuming...latest firmware?

 

[Sky-Knight]

I repeat... the fix to L2TP is to STOP USING L2TP! It's an utterly atrocious ancient protocol that does nothing but generate tickets.

The problem you're facing is a router at the endpoint you're dealing with isn't handling L2TP correctly. And no... you can't fix it. Only way around it is to stop using garbage ancient protocols that won't handle modern Internet connectivity.

 

[YeOldeStonecat]

Ubiquiti started the process of adding Wireguard VPN.....hopefully that will work well. Not sure when it will be completed and available...I did read that it's in the firmware but not in the Unifi controller yet.

 

[Sky-Knight]

Ubiquiti started the process of adding Wireguard VPN.....hopefully that will work well. Not sure when it will be completed and available...I did read that it's in the firmware but not in the Unifi controller yet.

That would be huge.

 

[nlinecomputers]

I am not convinced that you have a reliable connection at the main office. Logmein is very tolerant of even really slow connections. VPNs don't like flaking connections no matter who the vendor is.

 

[PNW-ITGUY]

I am not convinced that you have a reliable connection at the main office. Logmein is very tolerant of even really slow connections. VPNs don't like flaking connections no matter who the vendor is.

I haven't had any issues with Unifi gear, especially with any VPN's. A slow connection on the users end will mess with any VPN for any vendor. I've dealt with that a lot! The end users that live in the boonies on satellite internet or a super slow laggy centrylink connection, always have issues.

 

[Sky-Knight]

Wireguard, and OpenVPN both tolerate a heck of a lot more connection instability than IPSec/L2TP.

But yes, frame loss is very much a bad thing, and will cause the OP's symptoms. L2TP needs all its frames, and it needs them to arrive in order. It freaks out when there are problems on the connection on either side.