File copy problems in only 1 direction through IPSec inter-site VPN

filesipsecsite-to-site-vpn

i've a rather strange problem with 2 sites linked by an IPSec inter-site VPN and file transfert from a site to another.

SYNOPSYS (tl;dr) : File transfert via smb/ftp/whatever through ipsec tunnel between both sites works in a direction and not in the opposite; HALP

Complete version :

I have 2 sites, let's name them LUX and TLS, connected through an intersite VPN. Each site has a 100Mb fiber connection. At both ends are 2 Cisco RV320. I've configured an IPSec VPN between these sites, DH level 2, 3DES/SHA1 encryption.

Both sites can ping each other. I can perfectly join my servers via RDP from TLS to LUX and from LUX to TLS. I can browse the network shares that are in TLS from LUX, idem in the other way.

At this point, everything looks perfect.

Let's get in the tricky part.

If i try to copy a file from TLS to LUX, from a network share located in TLS, i have no problem, the file is copied perfectly. If i try to get a file located on a ftp in TLS from LUX (different machine than the one with the net shares), everything works fine too.

Resumé : file transfert TLS–> LUX everything OK

BUT §§

If i try to copy a file from LUX to the share located in TLS, from any machine from LUX, it fails…
If i try to upload a file to the ftp located in TLS (the same that is working when i download), it fails too.
I wanted to install a new AD DC in TLS as a new site connected to LUX, everything went fine until the moment of retrieving the AD database from LUX to TLS.
I get a recording error when i try to save a document opened in LUX from a share located in TLS too.

I tried to bypass the intersite VPN by connecting through a client-server PPTP VPN from my machine in LUX to a server in TLS, everything wentfine, i was able to copy files from LUX to TLS…

Résumé : file transfert LUX–>TLS NOT OK

I suspect the IPSec VPN to be the problem, i checked the MTU, it's set at 1500 and checked it on http://www.letmecheck.it/mtu-test.php and everything is fine.

May i get your help please cause i have lost almost a day on this problem and i won't have a hair left on my day at the end of this day 😀

Best Answer

I answer myself and hope it'll help someone someday.

Rule n°1 : to check your MTU, this site http://www.letmecheck.it/mtu-test.php ain't worth a good "ping -f 1500 hostip".

Rule n°2 : when performing a test to find the good MTU, remember to ping a host located at the other side of the tunnel and not only a website like google or fb :o

Rule n°3 : always remember the bytes taken by the protocol of encapsulation (here IPSec :o)

Long story short, my problem was a MTU problem on the TLS site, i had to put a value of 1410 to solve the issue.

Related Topic