Some remote users on Xfinity, Spectrum, and Videotron cannot connect to our Cisco or Fortigate VPNs. Turning off the home connection's Advanced Security feature appears to restore access. What should we check to find out why?
Why would home ISP security block our VPN connections?
Answers
Start with the Advanced Security logs or alerts on an affected connection. They may show the destination and the reason it was blocked. One possibility is that the VPN gateway's IP address or hostname has been flagged by a reputation or threat filter.
Collect the alert details and send them to the ISP for review. If there is a way to allow the specific gateway, that may be preferable to leaving the whole security feature disabled.
Reply to this answer
Check whether the VPN itself is failing to connect or whether it connects but internal names stop resolving. Those can look similar to a user.
On an affected Windows machine, compare the DNS servers shown by ipconfig with what the VPN is supposed to provide. An IPv6 address from the home router showing up as DNS could be a clue. Rebooting the router and then the computer is a reasonable test, but it would not establish the root cause by itself.
Reply to this answer
What protocol are the affected clients using? IKE and IPsec traffic could be handled differently from an SSL VPN. Compare the client and gateway logs with the home security alerts before assuming the ISP is blocking VPNs in general.
Also check what your VPN platform and firmware actually support before trying a different protocol. SSL VPN support is being removed from some products.
Reply to this answer
The timing across several providers is curious, but it does not prove they share a security service or all made the same change. The common factor could also be the gateway address or how its traffic is classified.
Compare affected and unaffected connections against the same gateway, and note the provider, gateway address, protocol, and any block reason. That should give you something concrete to take to the providers.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions