Tuesday, August 14, 2007
Posted on Tuesday, August 14, 2007 3:17:51 PM (Mountain Daylight Time, UTC-06:00)  Comments [3] | 
Categories: Security

cisco I've been doing some work for a client and in order to connect to their system, I need to use a Cisco VPN client. I ran into some problems, and after asking Google about it, really did not find anything useful. So - for the sake of others who may run into this - here's what happened.

After installing the VPN client on my main development workstation, I noticed that connections to other servers on our LAN were slow. Really slow. 30-60 seconds to connect, and the same time to list files in a folder. Essentially I could not use my workstation to do anything on my LAN. This is a problem because nearly everything I work with in enterprise system development is NOT on my workstation - the database, ArcGIS Server, Visual Studio Templates, AzMan etc.

We eliminated problems with my domain account by having other users log into my system, and having me log into other systems. Anyone who logged into my box experienced this same behavior. If I logged into another box, connections to LAN resources were just fine. The problem was isolated to my Windows XP workstation (SP2). 

I un-installed the Cisco VPN client, only to find that the problem did not go away. I tried to restore my system to a previous check point, but that failed (regardless of how far back I chose to go). From here, I turned to our IT group and after a lot of remoting into my box, it was determined that re-paving the box was likely the solution.

While that system was being re-built, I still had to address my client's needs. So I installed the same Cisco VPN client on my notebook and tried to connect via wireless with little success. After some calls to the client's IT group, apparently this VPN client does not jive with wireless - no specifics, just "use the LAN". Since the Ethernet adapter on my notebook is toasted, I warily installed the VPN client on yet another workstation. As soon as it was installed, I experienced exactly the same behavior as on my workstation - exceptionally slow LAN connectivity. Thinking I had just signed up another workstation for re-paving, I tried using system restore, and this time it worked.

I then went back to my notebook and tried accessing LAN resources - and it too has the very slow LAN access. Three out of three - I think I can say that it's the Cisco software! I can live with this on my notebook since I don't do any development with it - mainly presentations and research type coding. I was able to dig up an old USB to Ethernet converter, got hooked into Ethernet, and am working away on my client's system. Getting files to my notebook has devolved into sneaker-net +USB-drive fun and games. And my main workstation is up and running again (still need to install ArcGIS Desktop et al)

Solutions

I don't have any solution that keeps the VPN client on the box. Maybe upgrading, but in talking to others, it sounds like you need to keep the client and server sides of the VPN in synch, so that may not be an option.

  1. Un-install the VPN client if at all possible - dedicated an old PC for VPN access if you can.
  2. Try doing a system restore in Windows XP - restore to a date prior to installing the Cisco VPN client.
  3. Failing that, you're looking at a re-format & re-install your OS. Have fun!

Some stuff for Google...

Software Version: Cisco VPN Connection 4.8.01.0300, Windows XP SP2
Keywords: Slow LAN Windows file share network mounted drives

Tuesday, August 14, 2007 10:30:37 AM (Mountain Daylight Time, UTC-06:00)
FWIW, I'm using Cisco VPN Client 4.6.01.0019, and I have not experienced any performance problems.

--Rich
Rich Ruh
Friday, August 17, 2007 11:11:24 AM (Mountain Daylight Time, UTC-06:00)
One characteristic of Cisco VPN client is that security policy is set by the remote connector. In many situations the policy is to force all tcp/ip traffic through the VPN client. The alternative is to only direct the remote network address space through the VPN client, but for security reasons, many organizations do not allow that, especially with Windows-based client PCs.

This causes a problem if the local LAN has essential services (e.g. network printer) that are not accessible while VPN is active. I can see where this would be a problem for developers with a development server hosting needed platforms such as Arc Server and so on.

I use Cisco VPN on linux and Windows to connect to the office. The Windows connection is across a wireless network in my home office and I have not experience any problems with that set up.
Brad Smith
Sunday, August 19, 2007 1:30:13 PM (Mountain Daylight Time, UTC-06:00)
I'm using Cisco VPN on Computer A that belongs to a home network. I found that even when the connection was inactive I couldn't access the networked printer on Computer A from Computer B. I found disabling the 'Stateful Firewall (always on)' option from the help menu solved the problem. Maybe it will work for you too...
David B.
Comments are closed.