[vpn-help] 116996 - vfilter/vflt error causing random disconnects

[Service Desk]

I wasn't able to find a way to create an account on the shrew.net ticket system, so I joined the mailing group instead.

We have a client who is having trouble staying connected to our Juniper ISG. Only this client is affected, and based on the trace utility IKEd logs,

Client's O/S windows 7 64 bit
Shrew version: 2.1.7 (latest stable)
IPSEC based VPN w/ preshared key

Any more information you need please let me know. I have been testing this client's VPN connection from another PC running windows XP and it has been working fine. I am using the same version of the shrew.net dialer. I should also mention that this user has a cisco VPN dialer using SSL authentication, which is working fine.

So it looks like the problem starts when the ACK packet comes back to the client and the ShrewSoft IM Filter Driver fails (vflt device attach failed). (vfilter.sys) I've been googling for vfilter.sys and have seen a lot of complaints of BSOD 's for windows 7 users.


Below is the sequence from the logs:


10/11/10 19:47:47 ii : sending peer DPDV1-R-U-THERE notification
10/11/10 19:47:47 ii : - 192.168.2.10:4500 -> x.x.x.x:4500
10/11/10 19:47:47 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 19:47:47 ii : - data size 4
10/11/10 19:47:47 >= : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 19:47:47 >= : message ef7335ab
10/11/10 19:47:47 ii : processing informational packet ( 92 bytes )
10/11/10 19:47:47 =< : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 19:47:47 =< : message 32e0338a
10/11/10 19:47:47 ii : received peer DPDV1-R-U-THERE-ACK notification
10/11/10 19:47:47 ii : - x.x.x.x:4500 -> 192.168.2.10:4500
10/11/10 19:47:47 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 19:47:47 ii : - data size 4
10/11/10 19:47:54 !! : vflt device attach failed
10/11/10 19:47:55 !! : vflt device attach failed
10/11/10 19:47:56 !! : vflt device attach failed
10/11/10 19:47:57 !! : vflt device attach failed
10/11/10 20:04:05 ii : sending peer DPDV1-R-U-THERE notification
10/11/10 20:04:05 ii : - 192.168.2.10:4500 -> x.x.x.x:4500
10/11/10 20:04:05 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:05 ii : - data size 4
10/11/10 20:04:05 !! : vflt device attach failed
10/11/10 20:04:11 !! : get_vfwd - failed to obtain valid route ( dest 192.168.2.10 )
10/11/10 20:04:11 !! : no arp entry for src : 192.168.2.10
10/11/10 20:04:11 >= : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:11 >= : message d66e7846
10/11/10 20:04:11 !! : get_vfwd - failed to obtain valid route ( dest 192.168.2.10 )
10/11/10 20:04:11 !! : no arp entry for src : 192.168.2.10
10/11/10 20:04:11 !! : get_vfwd - failed to obtain valid route ( dest 192.168.2.10 )
10/11/10 20:04:11 !! : no arp entry for src : 192.168.2.10
10/11/10 20:04:12 ii : vflt device attached
10/11/10 20:04:26 ii : sending peer DPDV1-R-U-THERE notification
10/11/10 20:04:26 ii : - 192.168.2.10:4500 -> x.x.x.x:4500
10/11/10 20:04:26 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:26 ii : - data size 4
10/11/10 20:04:26 >= : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:26 >= : message df989eb9
10/11/10 20:04:30 ii : sending peer DPDV1-R-U-THERE notification
10/11/10 20:04:30 ii : - 192.168.2.10:4500 -> x.x.x.x:4500
10/11/10 20:04:30 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:30 ii : - data size 4
10/11/10 20:04:30 >= : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:30 >= : message e90fa7f3
10/11/10 20:04:33 ii : sending peer DPDV1-R-U-THERE notification
10/11/10 20:04:33 ii : - 192.168.2.10:4500 -> x.x.x.x:4500
10/11/10 20:04:33 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:33 ii : - data size 4
10/11/10 20:04:33 >= : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:33 >= : message 598affb6
10/11/10 20:04:35 ii : sending peer DPDV1-R-U-THERE notification
10/11/10 20:04:35 ii : - 192.168.2.10:4500 -> x.x.x.x:4500
10/11/10 20:04:35 ii : - isakmp spi = 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:35 ii : - data size 4
10/11/10 20:04:35 >= : cookies 1051e60ee7dfb05b:b33f19a972df18bd
10/11/10 20:04:35 >= : message 8745f560
10/11/10 20:04:36 !! : tunnel DPD timeout for peer x.x.x.x:4500


Any ideas?


-          James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.shrew.net/pipermail/vpn-help/attachments/20101115/ff1a3815/attachment-0001.html>