SM client install fails with "An error occurred while attempting to fine network"

[MFuchs]

Hi !

We set up a new Windows 2019 domain controller and wanted to install the SMAgent (3.1.1) on this machine.

Now the setup fails with the following error:

Network connectivity is give, nothing is filtered.

I wrote a packet trace and saw that the client connects to ios.meraki.com and presents a user-certificate from the local CA.

This causes an Encrytion Alert and terminates the session, thus resulting the SMClient noch to connect.

We discovered that windows authenticates with the certificate of the user.

So we logged on with a service user and installed the SMClient and entered the network id which now worked fine, BUT:

The client does not show up in the clients pane in the dashboard.

Does anyone have any idea on how to install the client correctly or how to get around this issue ?

[GreenMan]

Devices enrolled into Systems Manager appear (for MDM purposes) primarily under Systems Manager > Monitor > Devices, within the relevant SM network in your Dashboard.   Your device would only appear under Network-wide > Clients if it's a Combined network and it is physically plugged into a Meraki switch managed in the same Network.   The latter functionality would essentially have no  relationhip to SM specifically.

[MFuchs]

Yes, you're right.that's what i meant.

But the devices / servers do NOT appear there...

as it they would not register...

[BlakeRichardson]

@MFuchs have you checked the windows firewall settings? 

[MFuchs]

Windows Firewall is deactivated. 
mad unmentioned above I can see the traffic flow on the gateway firewall and also took a trace. 
i think it’s some kind of cert-auth-problem

or else … no traffic-flow Problem …

[MFuchs · Accepted solution]

It turned out to the following issue:

when the user has a user-certificate, it is used by the meraki agent as the authentication against ios.meraki.com.

So the Agent fails when trying to find the network:

Transport Layer Security
TLSv1.2 Record Layer: Encrypted Alert

Using a windows user that does NOT have a user-cert (as a service user for the meraki agent) for installing and adding the agent to the network works as expected and after a short while (and when you have sufficient licenses left) the client appears in the dashboard after a short while.