<div>
Have you tried using a different VPN client, say the native Windows one? It seems from your description of the problem that the global VPN client is having problems, perhaps due to an update. Even if it isn't compliant with organisation policy it's worth trying, if only to establish where the problem lies.
</div>


<div>
Thanks. &nbsp;I'm not having any luck with the Windows 10 vpn. &nbsp;I get an error about security layer could not negotiate with compatible parameters. &nbsp;Haven't found a solution for that yet. &nbsp;I have shrew soft vpn as well, that I had used in the past for ipsec vpn's on windows 10 to cisco. &nbsp;But I'm not getting that to connect to the sonicwall, either. &nbsp;Do you know of any other vpn clients that work with Sonicwall ipsec?
</div>


<div>
I don't, unfortunately, but I'm surprised that the Windows client barfs with the Sonicwall IPSec. Are you using L2TP?
</div>


<div>
Consider asking employees to actually set the transfer rate at a lower speed, depending on what they need to do reduce the color bit scale from 32 to 16 as an example, speed setting at 512k <br />
<br />
The point to lower the amount of data transmitted<br />
Are the user's connecting to an RDS server, or to their own workstation?<br />
<br />
Disconnect, means the session goes into the trying to reconnect counter? Are you experiencing the same thing?<br />
Are the users attaching local resources beyond clipboard and printers?<br />
<br />
Does the sonicwall reflects retransmission/renegotiati<wbr />on of the VPN
</div>


<div>
They are connecting to their own workstations. &nbsp;The disconnect does go into trying to reconnect on rdp. &nbsp;Their vpns are not dropping, which I have verified while the rdp disconnects. &nbsp;They are not adding additional local resources in rdp settings. &nbsp;I'll have them set the lower speed settings and see if that helps.
</div>


<div>
Do you have visibility on your network consumption of resources.<br />
Are the applications running on the workstation in the office, are high network resource consumer?
</div>


<div>
I'll see what I can find out on that. &nbsp;But this is happening at a few locations, unrelated to each other, with a variety of people/roles. &nbsp;What really gets me is that the user I set to use RDP without the VPN is having great success. &nbsp;With the VPN, same trouble.
</div>


<div>
The issue is whether the VPN resource consumption ....or utilization at the time of the issue, i.e. peeak off-peak use.<br />
RDP within a VPN tunnel. ..firewall/cpu/resource use?
</div>


<div>
I've checked several times during an rdp issue and resource usage on the firewall is minimal
</div>


<div>
do you secure all traffic on the VPN connection meaning all traffic including internet flows through the VPN?<br />
try to reduce the window of the RDP session. try to adjust the WAN speed on the client to 512KB, bit size see if this persist with a lower demand on the network in terms of how much data has to flow back and forth.<br />
<br />
how many simulteneous vpn connection does the firewall support and how many are in use?
</div>


<div>
I was connected for a while this morning with a constant ping to a server. &nbsp;I kept this going on a second monitor while doing my regular work. &nbsp;A couple of times I noticed the pings timing out and checked the firewall and the global vpn client log. &nbsp;The firewall hit 20% on the cpu, not that high. &nbsp;But the log showed: &nbsp;<br />
<br />
<br />
2020/04/20 14:04:56:186 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;&lt;local host&gt; &nbsp; &nbsp; &nbsp;Releasing IP address for the virtual interface (00-60-73-A8-04-DA).<br />
2020/04/20 14:05:07:271 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Sending phase 2 delete for 192.168.0.0/255.255.255.0.<wbr /><br />
2020/04/20 14:05:07:271 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Sending phase 1 delete.<br />
2020/04/20 14:05:07:752 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Starting ISAKMP phase 1 negotiation.<br />
2020/04/20 14:05:10:155 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Starting aggressive mode phase 1 exchange.<br />
2020/04/20 14:05:10:156 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;NAT Detected: Local host is behind a NAT device.<br />
2020/04/20 14:05:10:156 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;The SA lifetime for phase 1 is 28800 seconds.<br />
2020/04/20 14:05:10:156 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Phase 1 has completed.<br />
2020/04/20 14:05:10:213 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Received XAuth request.<br />
2020/04/20 14:05:10:214 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Sending XAuth reply.<br />
2020/04/20 14:05:10:243 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Received XAuth status.<br />
2020/04/20 14:05:10:243 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Sending XAuth acknowledgement.<br />
2020/04/20 14:05:10:243 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;User authentication has succeeded.<br />
2020/04/20 14:05:10:296 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Received request for policy version.<br />
2020/04/20 14:05:10:296 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Sending policy version reply.<br />
2020/04/20 14:05:10:323 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Received policy change is not required.<br />
2020/04/20 14:05:10:323 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Sending policy acknowledgement.<br />
2020/04/20 14:05:10:323 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;The configuration for the connection is up to date.<br />
2020/04/20 14:05:10:354 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Starting ISAKMP phase 2 negotiation with 192.168.0.0/255.255.255.0:<wbr />BOOTPC:BOO<wbr />TPS:UDP.<br />
2020/04/20 14:05:10:354 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Starting quick mode phase 2 exchange.<br />
2020/04/20 14:05:10:410 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;The SA lifetime for phase 2 is 28800 seconds.<br />
2020/04/20 14:05:10:410 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;-IP removed for security- &nbsp; &nbsp; &nbsp;Phase 2 with 192.168.0.0/255.255.255.0:<wbr />BOOTPC:BOO<wbr />TPS:UDP has completed.<br />
2020/04/20 14:05:10:446 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;&lt;local host&gt; &nbsp; &nbsp; &nbsp;Renewing IP address for the virtual interface (00-60-73-A8-04-DA).<br />
2020/04/20 14:05:11:955 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;&lt;local host&gt; &nbsp; &nbsp; &nbsp;The virtual interface has been added to the system with IP address 192.168.0.139.<br />
2020/04/20 14:05:11:979 &nbsp; &nbsp; &nbsp;Information &nbsp; &nbsp; &nbsp;&lt;local host&gt; &nbsp; &nbsp; &nbsp;The system ARP cache has been flushed.
</div>


<div>
DHCP is relayed to a server on site. &nbsp;The IP lease time is 8 hours
</div>


<div>
check whether the POlicy for VPN connection renewal is different from the settings on the VPN side.key length and duration of session?<br />
3600, 8 hours?
</div>


<div>
Key lifetime is 28800 and session timeout is 60 minutes
</div>


<div>
not sure I've seen such a large session timeout windows not sure whether that has any baring on the issue.<br />
Often, one would not want to have that wide of a window of the VPN remaining connected with no activity flowing through.<br />
<br />
during VPN key you have about a 30 second window where no traffic can pass which on the RDP connection will show up as a disconnect.
</div>


<div>
After countless troubleshooting steps, sonicwall tickets, etc I have decided to give up on this and move on. &nbsp;I replaced a TZ300 with a TZ600 to see if perhaps the max specs were a bit inflated by sonicwall, but it changed nothing. &nbsp;I've tried different versions of the vpn client, firmware, ssl vpn, etc but nothing changed. &nbsp;I tried any and every setting I could find but to no avail. &nbsp;I tried alternatives to rdp but they had the same result. &nbsp;Pings would also drop out so that wasn't the issue. &nbsp;I had a few people quit using the vpn client and gave them straight rdp through port forwarding and it worked fine. &nbsp;This is not a secure solution, so I put it to an end after a week. &nbsp;<br><br>Thank you all for your help in troubleshooting.&nbsp; I'll spend no more time on this.
</div>


<div>
Your issue is that your Refresh phase 1 and phase 2 is the same 28800 seconds.<br />
Usually phase 1 is hourly, 3600 sec., while the other is 28800<br />
<br />

<pre><code class="code-10 nolinks" id="code-20-43096950-1"><span>2020/04/20 14:05:10:155      Information      -IP removed for security-      Starting aggressive mode phase 1 exchange.</span>
<span>2020/04/20 14:05:10:156      Information      -IP removed for security-      NAT Detected: Local host is behind a NAT device.</span>
<span>2020/04/20 14:05:10:156      Information      -IP removed for security-      The SA lifetime for phase 1 is 28800 seconds.</span>
<span>2020/04/20 14:05:10:156      Information      -IP removed for security-      Phase 1 has completed.</span>
<span>2020/04/20 14:05:10:213      Information      -IP removed for security-      Received XAuth request.</span>
<span>2020/04/20 14:05:10:214      Information      -IP removed for security-      Sending XAuth reply.</span>
<span>2020/04/20 14:05:10:243      Information      -IP removed for security-      Received XAuth status.</span>
<span>2020/04/20 14:05:10:243      Information      -IP removed for security-      Sending XAuth acknowledgement.</span>
<span>2020/04/20 14:05:10:243      Information      -IP removed for security-      User authentication has succeeded.</span>
<span>2020/04/20 14:05:10:296      Information      -IP removed for security-      Received request for policy version.</span>
<span>2020/04/20 14:05:10:296      Information      -IP removed for security-      Sending policy version reply.</span>
<span>2020/04/20 14:05:10:323      Information      -IP removed for security-      Received policy change is not required.</span>
<span>2020/04/20 14:05:10:323      Information      -IP removed for security-      Sending policy acknowledgement.</span>
<span>2020/04/20 14:05:10:323      Information      -IP removed for security-      The configuration for the connection is up to date.</span>
<span>2020/04/20 14:05:10:354      Information      -IP removed for security-      Starting ISAKMP phase 2 negotiation with 192.168.0.0/255.255.255.0:BOOTPC:BOOTPS:UDP.</span>
<span>2020/04/20 14:05:10:354      Information      -IP removed for security-      Starting quick mode phase 2 exchange.</span>
<span>2020/04/20 14:05:10:410      Information      -IP removed for security-      The SA lifetime for phase 2 is 28800 seconds.</span>
</code></pre>
</div>


<div>
Thanks, I just changed it and will see how it goes. &nbsp;The VPN wizard is what set 28800. &nbsp;But then again, the sonicwall site to site vpn wizard also sets aggressive mode when it should be main mode. &nbsp;
</div>


<div>
Changing on the firewall, the policy on the client side hs to be updated to match.
</div>


<div>
<div class="content wysiwyg-content">
I have several locations with sonicwall firewalls. &nbsp;Each location has several people working remotely, using remote desktop while connected via global vpn client. &nbsp;All of the locations are complaining of frequent disconnections from RDP. &nbsp;The VPN itself is not losing connection. &nbsp;<br />
<br />
Some of the time it's due to internet speed/latency issues, but most of the time these disconnects don't make any sense to me. &nbsp;<br />
<br />
One user has a sonicwall firewall at her home office with a site-to-site VPN and never had this issue. &nbsp;But now that her location has a dozen people connecting on remote access VPN's she is suffering the same problem with RDP.<br />
<br />
I set up a couple of users with RDP direct through the sonicwall without the VPN, and they rarely get disconnected. &nbsp;When I switch them back to the VPN, they get disconnected frequently again.<br />
<br />
I set up a few people with SSL VPN and they have the same issue.<br />
<br />
This issue is spread out among multiple towns and different internet providers. &nbsp;Again, I know internet usage is a bit overutilized right now, but that doesn't seem to be the cause of this problem.<br />
<br />
What they all have in common is that they are all connecting to SonicWall firewalls (TZ 300, TZ500, etc). &nbsp;I did make sure each one has enough licenses to cover the VPN's. &nbsp;This happens even when only a few people are connected.<br />
<br />
Does anyone know what will fix this issue?
</div>
</div>


I have several locations with sonicwall firewalls.  Each location has several people working remotely, using remote desktop while connected via global vpn client.  All of the locations are complaining of frequent disconnections from RDP.  The VPN itself is not losing connection.  

Some of the time it's due to internet speed/latency issues, but most of the time these disconnects don't make any sense to me.  

One user has a sonicwall firewall at her home office with a site-to-site VPN and never had this issue.  But now that her location has a dozen people connecting on remote access VPN's she is suffering the same problem with RDP.

I set up a couple of users with RDP direct through the sonicwall without the VPN, and they rarely get disconnected.  When I switch them back to the VPN, they get disconnected frequently again.

I set up a few people with SSL VPN and they have the same issue.

This issue is spread out among multiple towns and different internet providers.  Again, I know internet usage is a bit overutilized right now, but that doesn't seem to be the cause of this problem.

What they all have in common is that they are all connecting to SonicWall firewalls (TZ 300, TZ500, etc).  I did make sure each one has enough licenses to cover the VPN's.  This happens even when only a few people are connected.

Does anyone know what will fix this issue?

RDP Disconnects over SonicWall Global VPN

Remote access may refer to the connection to a data-processing system from a remote location, for example through a virtual private network remote desktop software, terminal emulation, or the activation of features of a business telephone system from outside the business's premises.

Remote Access

Hardware-based firewalls provide more sophisticated protection for inbound and outbound traffic than the simple Windows software firewall or the basic NAT firewalls found in routers. These devices implement techniques such as stateful packet inspection, deep packet inspection, and content filtering; and may include built-in antivirus and anti-malware protection.

Hardware Firewalls

A virtual private network (VPN) is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or travelling users access to a central organizational network securely. VPNs encapsulate data transfers using secure cryptographic methods and other security mechanisms to ensure that only authorized users can access the network and that the data cannot be intercepted.