VPN failures cluster into four categories, and the fastest diagnosis comes from identifying the category before changing anything. Work through these checks in order — each one eliminates an entire class of cause.
1. Establish the failure mode
- Authentication rejected → credential or MFA problem (category A)
- Connects then drops after a fixed interval → keepalive/NAT problem (category B)
- Connects but no traffic flows → routing or split-tunnel problem (category C)
- Client cannot reach the gateway at all → path or DNS problem (category D)
Category A — authentication
Confirm the account is not locked and the password has not expired. If MFA is in use, check the token time drift — TOTP codes fail silently when the device clock is more than 30 seconds out.
# Check lockout and password expiry in one callGet-ADUser -Identity jsmith -Properties LockedOut, PasswordExpired, PasswordLastSet | Select-Object SamAccountName, LockedOut, PasswordExpired, PasswordLastSetCategory B — drops on an interval
A connection that drops after exactly the same interval every time is a NAT translation timeout somewhere on the path, usually a home router with a UDP timeout shorter than the tunnel keepalive.
Lower the client keepalive to 20 seconds, or switch the tunnel transport from UDP to TCP 443 where the concentrator supports it.
Category C — connected but no traffic
Print the client routing table and confirm the destination network is actually routed into the tunnel. Split-tunnel policies that were edited recently are the usual suspect.
# Windowsroute print | findstr 10.0.# macOS / Linuxnetstat -rn | grep 10.0.Escalation criteria
Escalate to the network team with the category letter, client OS and version, and the exact timestamp of the last failure — the concentrator logs rotate quickly and the timestamp is what makes the session findable.
Was this article helpful?
97% of 1,700 readers found it useful