Two VPN connections from home network at the same time -> problems

[vrapp]

I noticed that if I connect by VPN (L2TP/IPsec with pre-shared key, native Windows 10) to the company network (Sophos device) from the laptop; then do the same from the desktop PC; then on the desktop initiate remote desktop connection to my work computer, then in 15-20 seconds remote desktop stops responding. This never happens if only one client is connected. Wondering what gives.

 

[L&LD]

Ask your work IT department. They may have it set like that (only one connection per user).

 

[vrapp]

No, they did not (because it's actually myself). And the connection does get established successfully, no denials, but then it freezes.

 

[elorimer]

I'll be interested in what you find out. Not clear it has anything to do with Merlin, but I know if you make two VPN connections into one of the server instances you can throw the Asus router WAN into an unrecoverable configuration, requiring a factory reset.

 

[vrapp]

I'll be interested in what you find out.

If someone gives a hint what to look at, I will be happy to try.

 

[vrapp]

Here's one piece of information that may be related. I opened support ticket with Sophos, the maker of our firewall, and they collected diagnostic logs, and noticed the following in the log of L2TP VPN when this was taking place

xl2tpd[10330]: check_control: Received out of order control packet on tunnel 4 (got 4, expected 5)
xl2tpd[10330]: handle_packet: bad control packet!
xl2tpd[10330]: check_control: Received out of order control packet on tunnel 4 (got 5, expected 6)
xl2tpd[10330]: handle_packet: bad control packet!
xl2tpd[10330]: check_control: Received out of order control packet on tunnel 4 (got 6, expected 7)
xl2tpd[10330]: handle_packet: bad control packet!

which looks like the reason. They escalated the ticket within Sophos.

 

[vrapp]

Sophos admitted that it's their problem.

Sophos Known Issues list

NC-84171
We can not connect multiple L2TP connections behind the same NAT'd device.

Example:-
There are 2 Windows clients behind a NAT'ed device over which the clients are connecting to XG using L2TPoIPSec. The tunnels are established fine, but there is an issue with the traffic. Say ping traffic from Windows1 is working for some seconds and then dropped and Windows2 will not see ping response while ping is working from Windows1 and vice-versa.