Forti Client VPN issues

[mellatron]

Only recenlty moved over to Virgin from BT for the faster speeds, wish I had researched the VPN issues first!

Keep getting disconnected from a workplace VPN. Have the Gig1 package with a Hub 4. Have tried it as a stand alone router and in modem mode connecting to a TP Link Archer AX72. All computers connect via CAT 6. Both configurations produce the same results, constant dissconnections.

I've had 3 engineers visit as customer services keep sending the wrong team out to correctly bury the cable from the street up the drive (original instalation has left it trailing across the front door for everyone to trip over). While these instal engineers have been visiting scratching their heads at the terrible cable run wondering why they have be sent over to fix it (they don't lift slabs) I've had them test the line, no issues found.

Cheers in advance

3.0 Downstream channels

Channel Frequency (Hz) Power (dBmV) SNR (dB) Modulation Channel ID

25	331000000	2.2	36.6	QAM256	25
1	139000000	7.2	36.4	QAM256	1
2	147000000	6.8	36.4	QAM256	2
3	155000000	6.9	36.6	QAM256	3
4	163000000	6.3	36.6	QAM256	4
5	171000000	5.7	36.6	QAM256	5
6	179000000	5.2	36.6	QAM256	6
7	187000000	5.1	36.4	QAM256	7
8	195000000	4.7	36.6	QAM256	8
9	203000000	4.3	36.4	QAM256	9
10	211000000	3.8	36.4	QAM256	10
11	219000000	3.8	36.4	QAM256	11
12	227000000	3.5	36.4	QAM256	12
13	235000000	3.7	36.4	QAM256	13
14	243000000	3.9	36.6	QAM256	14
15	251000000	4.2	36.4	QAM256	15
16	259000000	4.2	36.6	QAM256	16
17	267000000	4	36.6	QAM256	17
18	275000000	3.6	36.6	QAM256	18
19	283000000	3.5	36.6	QAM256	19
20	291000000	3.4	36.6	QAM256	20
21	299000000	3.6	36.4	QAM256	21
22	307000000	3.4	36.6	QAM256	22
23	315000000	3	36.6	QAM256	23
24	323000000	2.5	36.4	QAM256	24
26	339000000	1.6	36.6	QAM256	26
27	347000000	1.3	36.4	QAM256	27
28	355000000	0.9	35.8	QAM256	28
29	363000000	0.7	35.6	QAM256	29
30	371000000	0.9	36.4	QAM256	30
31	379000000	1.3	36.4	QAM256	31

3.0 Downstream channels

Channel Lock Status RxMER (dB) Pre RS Errors Post RS Errors

25	Locked	36.609653	0	0
1	Locked	36.386890	0	0
2	Locked	36.386890	0	0
3	Locked	36.609653	0	0
4	Locked	36.609653	0	0
5	Locked	36.609653	0	0
6	Locked	36.609653	0	0
7	Locked	36.386890	0	0
8	Locked	36.609653	0	0
9	Locked	36.386890	0	0
10	Locked	36.386890	0	0
11	Locked	36.386890	0	0
12	Locked	36.386890	0	0
13	Locked	36.386890	0	0
14	Locked	36.609653	0	0
15	Locked	36.386890	0	0
16	Locked	36.609653	0	0
17	Locked	36.609653	0	0
18	Locked	36.609653	0	0
19	Locked	36.609653	0	0
20	Locked	36.609653	0	0
21	Locked	36.386890	0	0
22	Locked	36.609653	0	0
23	Locked	36.609653	0	0
24	Locked	36.386890	0	0
26	Locked	36.609653	0	0
27	Locked	36.386890	0	0
28	Locked	35.779911	0	0
29	Locked	35.595078	0	0
30	Locked	36.386890	1	0
31	Locked	36.386890	0	0

3.1 Downstream channels

Channel Channel Width (MHz) FFT Type Number of Active Subcarriers Modulation (Active Profile) First Active Subcarrier (Hz)

159

96

4K

1880

QAM4096

759

3.1 Downstream channels

Channel ID Lock Status RxMER Data (dB) PLC Power (dBmV) Correcteds (Active Profile) Uncorrectables (Active Profile)

159

Locked

37

-5.7

1702266

213

[legacy1]

VPN should work fine in modem mode.

Maybe the other end if blocking you? does Wireshark show traffic in two way direction?

change DNS to 194.168.4.123, 194.168.8.123 or 1.1.1.1, 8.8.8.8 or 9.9.9.9

[mellatron]

Thanks for the reply. I originally had the tp link link router running using the cloud flare DNS, 1.1.1.1.

Will try a wireshark test and revert back to modem mode using the suggested DNS addresses.

[mellatron]

Appologies for the late reply. Ended up having to go into the post house to edit as the VPN connection was so unreliable. Randomly the connection had less drop outs when I took my third party router out of the equation which I tried with both the Google and Cloud Flare DNS.

Wireshark was unfortunatly a bit beyond me. I've been assured by the tech / I.T teams that there is no blocking going on from their end.

Is there anything else I can try, I get the usual reply from Virgin on the phone that they've sent something to the router to fix the issue, of course there's no change.

[jbrennand]

Is your 3.1 down channel still "low" power ? Should really be between -6dBmV and +10dBmV.

General wisdom on here over the years is that to sort VPN issues once and for all... you put the Hub into modem mode and use your own better quality router that has been designed to work properly with VPN's - unlike the VM Hub.

[mellatron]

Thanks John, will switching back to modem mode. Much prefer at least having some form of QoS settings on the TP link even if it isn't total bandwidth control. Could I be mising something in how I'm setting up this router other than adding a preferred DNS?

The power is currently at -6.9. This did get flagged during a recent phone call, hopefully the engineer that's visiting this week will be able to fix that. 

[jbrennand]

Setting up your own router is straightforward - see here
_____________________________________________

Switch on and set up your own router/Mesh unit (in its settings) with the WAN port set to be in Dynamic/Automatic IP or DHCP (& Nat) mode, it may be pre-set that way anyway.

Then, disconnect all cables from your new router (or Mesh first unit) and switch it off and unplug it.

Then, put the VM Hub into modem mode ( https://www.virginmedia.com/help/virgin-media-hub-modem-mode ) and wait for the base light to turn magenta/purple (on a Hub3 - but not on a Hub4!).

Once it’s in modem mode, the VM hub “MUST” then be powered off.

Switch your router on and make sure it’s fully initialised (leave 5 min) and then put in the ethernet cable from its WAN port to the VM hub (any port will do).

NOW… power up the VM hub and wait 5-10 minutes for The Hub to initialise and and you should get a connection. Use the recommended App to connect any other Mesh units to the first one. This order only needs to be done the first time you connect the router to the VM hub. You might also set the SSID and key/password on the new router/Mesh to match that on the HUB so when you swap over, all your wireless devices should just connect automatically.

[mellatron]

Thanks, that's what I'd done. I read somewhere about Mac cloning but that was regarding a Hub 2, can't find the post again now.

[mellatron]

New job, same old problems. Using a different VPN clinet to remote in to an edit suite. Have Virgin hub in modem mode, using a TP link router, changed DNS to Google. Had an engineer round to increase the downstream power. On the Giga connection but can barely do a thing when a VPN is connected.

How is it acceptable for Virgin to get away with this in today's world?!

[legacy1]

---

@mellatron wrote:

New job, same old problems. Using a different VPN clinet to remote in to an edit suite. Have Virgin hub in modem mode, using a TP link router, changed DNS to Google. Had an engineer round to increase the downstream power. On the Giga connection but can barely do a thing when a VPN is connected.

How is it acceptable for Virgin to get away with this in today's world?!

---

If you put the VPN on router for all your connections it can be slow your speed can be slow due to the remote end.