Problems with VPN tunnel across the internet being unstable, what device can I place between my firewall and the ISP router to plug into and diagnose?

Posted on 2009-05-18
Last Modified: 2013-12-14
I need to monitor our connection over a VPN tunnel between 2 firewalls across the Internet and be able to see if the problem is on the ISP carrier side, any recommendations for network device. I have 2 sonicwall firewalls that connect the 2 offices via VPN tunnel, but the remote office has been having slow connections and freezing up after installing a new Fibre internet connection with Embarq.  When I call them to tell them the circuit is acting flaky, they tell me everything is fine on there equipment it must be on ours.  The only way to prove it is to bypass my firewall and if I do that I disconnect our remote office completely.  Would placing a layer 3 switch in between our firewall and their router allow me to plug a laptop in and run testing, bypassing our firewalls?  Anyone out there that might have a suggestion for me to check on our LANs or firewalls to see if the problem really is on our side.

Thanks, frustrated in Florida
Question by:esmf23it
  • 3
  • 2
LVL 23

Accepted Solution

debuggerau earned 500 total points
ID: 24417407
Any switch that contains port mirroring should allow you to sniff the traffic, however a cheap old hub may do the trick, although limited to 10Meg.

I think you will find it difficult to diagnose the traffic since it is VPN encrypted traffic, rather look at the logs on the firewalls for hints to why it is happening firstly, then move into the routers etc.

Internet VPN's are not rock solid and it might be better to ensure your internet connection is stable on both ends but inserting a monitoring machine in the DMZ and get latency stats out of the pings from remote site. Be even better with SNMP enabled devices and a RMON service.

And then there is the conditions, time of day, certain peak usage, voice or video calls? which all give some incite to the issue..


Author Comment

ID: 24431403
debuggerau, Thanks for the thoughts and insight. I do want to place a machine in the DMZ that is created by putting a switch in between our firewall and the ISP's router.  Embarq (ISP) has assured me that since it is a fibre connection and we don't share the connection that we should have a very stable connection and should not experience peaks in performance.  We have noticed that the real slow downs tend to come in the mid afternoon range. So would you think I can find a hub that would operate at 100mbps?
LVL 23

Expert Comment

ID: 24437763
If you do, please let me know...

Technology moves so quick, they went to switches before the 100Meg was available, so not that I know..

Author Comment

ID: 24445569
I tried to use on of our layer 2 switches to create a VLAN across 3 of the ports. Port 1 plugged the cable from the ISP's router, port 2 plugged into the firewall, plug 3 left available to plug in a computer.  It would not work with the switch, I will try it with the hub next, as soon as I can find one.
LVL 23

Expert Comment

ID: 24446733
layer 2 switch is ok, just as long as it has mirrored port feature...

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Decrypting SSL traffic in wireshark 7 119
Failover VDSL Modems 3 70
Google Authenticator instead of RSA tokens for VPN access? 13 148
Cisco Supervisor upgrade to 2T 3 65
For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
Load balancing is the method of dividing the total amount of work performed by one computer between two or more computers. Its aim is to get more work done in the same amount of time, ensuring that all the users get served faster.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question