Hi
After connecting through our VPN software (MUVPN by Watchguard - V7.3) remotely, users are experiencing slow logon times when returning to the office. After entering network credentials, the logon box hangs at 'Applying Computer Settings' for around 10-15 minutes. MUVPN deploys a 'deterministic network enhancer' which has a patch available to supposedly fix this issue (http://www.deterministicn
All clients are running fully patched XP SP2, with both wired and wireless access to the corporate LAN.
I've just discovered that stopping, then disabling the NLA service & rebooting resolves the latency issue - However, this isn't a particularly nice fix as the users in question are constantly connecting to various networks to establish their internet connection - and Microsoft insist that this service is a necessity for the smooth running of such changes. (As well as optimising GPO deployment).
Has anyone out there experienced similar issues? If so, what fixes have you applied? Is the disabling of the NLA service the only way we can overcome the latency?
Many thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I see what you're saying and it's quite feasible that DNS information is being cached, but a logoff/logon script won't cure the slow login.
What pitfalls are there to permanently disabling the NLA service? I've just read an article on Vista - apparently NLA has been 'dramatically improved' in this version of Windows - is this Microsoft's way of admitting a problem in XP and prior?
>>"a logoff/logon script won't cure the slow login."
Wasn't suggesting that but you had said restarting the NLA service resolved the problem. Not a good solution, but once logged on, running the stop/start script should fix it for the next logon, from the same location.
I don't know if the NLA service has to be run. I have read different articles on that. My "opinion" from what I have read is unless you are using ICS (Internet Connection Sharing) you can turn it off. Can't hurt to give it a try. Worst case scenario somebody can't connect.
However, I think we are confusing cause and effect. I think turning off NLA is dealing with the symptoms. I have never heard of a problem with this service, though in XP I don't think it does much, so the real problem may be something else. The NLA service is closely tied to the NIC driver, TCP/IP, and IPSec (the MUVPN client). Are all laptops similar units? If not it probably rules out the driver. If they are I would update the NIC driver first. If that doesn't resolve I would look to the MUVPN client. What version of the client are you using? Do you have an older one you can try?
For the record, I have never had a problem as you describe, with NLA and MUVPN. I have had problems with laptops occasionally, especially IBM, not reseting their TCP/IP configuration if not powered off.
Ok, I'm with you. Sorry - I missed out the fact that restarting the NLA service doesn't fix the slow logon - if you disable it, then restart, it logs in fine - however, if you boot with the service enabled, you experience the latency.
We don't use ICS, so disabling it permanently might be our only option.
The client version is MUVPN V7.3 and the safenet soft remote V is 10.3.5 Build 6. we don't have any older versions that we can roll back to I'm afraid - Although I can certainly see your thinking here!
The laptops are all Dell 400 series - mostly 420's. I'll try changing the NIC driver on one of the affected machines and see if that helps.
Many thanks - I'll post next week when I've had a chance to update the driver.
If you wanted to give it a try I have a copy of version 6.11 MUVPN. It's for the SOHO series. I think it's compatible, but can't confirm that. I don't see it a a licensing violation for me to supply you with an earlier client, where you have licensed hardware with current client.
Let us know how it goes with the drivers.
Have a good weekend.
--Rob
No joy with the upgrade of the NIC I'm afraid.
As we have users that don't have the problem outlined above, I'm reluctant to try an older version of the software. I think in the mean time, I'll disable the NLA service on the affected machines and hope for the best.
If I do happen to stumble across a more suitable solution, I'll be sure to let you know.
Many thanks for your help on this matter - much appreciated.
Nathan
Business Accounts
Answer for Membership
by: RobWillPosted on 2007-03-29 at 12:36:15ID: 18819137
Sounds like the machines are retaining the old DNS server information. Is that possible? Restarting the NLA service would likely reset that, so it is possible. Are they shutting down their laptops, or just going into stand-by? Shutting down should force re-assignment.
Using the wrong DNS or even having another as the alternative will cause very slow logons.
Short term solution might be to create a batch file for the user's to put on their desktop to restart NLA, but they would still have that initial slow logon
net stop "Network Location Awareness (NLA)"
net start "Network Location Awareness (NLA)"
exit