GRE packets are dropped by ICF

[Mark Smit]

Hi all,

I have the following problem: I have a VPN connection to an office network.
I have ICF (Internet Connection Firewall, Windows XP SP2) enabled. I have a
direct internet connection, no router or anything. The GRE packets of the
VPN connection are allowed by ICF. However, at one time or another (no
specific moment), ICF starts dropping the packets for an unknown reason (as
shown by the pfirewall.log file). This causes the VPF connection to become
unresponsive, and I have to reconnect manually to get my connection back. I
have the impression it's related to traffic, because there are days that I
can work the whole day without a problem, on other days the problems start
after several minutes.

The only workaround I have found so far is to temporarily switch off ICF.
ICF has no settings for GRE packets, only TCP and UDP. Apparently GRE
packets are filtered automatically.

Is there any way to override this behaviour, or anything else I might want
to test or change?

Thanks,

Mark Smit.

 

[Leythos]

Is there any way to override this behaviour, or anything else I might want
to test or change?

I hate to put it this way, but get a router that supports VPN or a
firewall that supports VPN, ICF is not the way to go for commercial
services.

 

[Mark Smit]

I hate to put it this way, but get a router that supports VPN or a

firewall that supports VPN, ICF is not the way to go for commercial
services.

It may be the American way to just rush out and buy something haphazerdly, I
like to find out what's wrong and understand what's happening first.

 

[Leythos]

It may be the American way to just rush out and buy something haphazerdly, I
like to find out what's wrong and understand what's happening first.

Nothing American about it - although I'm American, it's about time/money
and getting something that you know works so that you don't have to
waste your own time and company time.

What you can use ICF in some cases, it's not the sure-fire method, one
that is highly stable (as you have seen) and the hardware to do it
properly, especially in a business, is relatively cheap. By the time you
get to the point where you abandon ICF you will have spent more money in
time than it cost to do it like the professionals do the first time.