Client VPN - AD Authentication

[Patrik73]

I am struggeling with my Merkai and are trying to setup Client VPN AD Authentication.

I have added

Client VPN: Enabled

Subnet: 10.10.2.0/24

A Shared secret.

Choosen Active Directory

Short domain: my local domainname (name.local)

Server IP: The IP address of my DC

Username: Admin

Password: *******

The MX can ping The IP address of my DC

I have for test purpose created a firewall rule on my DC that allow all traffic inbound and outbound.

Worth mention is that my DC is on another site that is connected to the MX with a Non Meraki VPN.

But the traffic flows fine.

The Client VPN is allowed over VPN

The error I get from the client is Error 691.

 

I have double and tripple checked my username and password and my shared key on the client.

I am not sure what to do now.

[alemabrahao]

@Patrik73, there are some steps that you have to configure before. Take a look ate the documentation:

https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Configuring_Active_Direc...

[Patrik73]

Thanks!
I guess I need that certificate, but the guide is a little to shallow. Al least for me.

Not sure how to create that self-signed certificate on my server. Server 2019.

Would really appreciate a guide. 🙂

[alemabrahao]

Maybe it will help you: https://windowstechpro.com/how-to-install-certificate-services-ad-cs-in-server-2019/

[Patrik73]

Or is it enough to install IIS-role and create the certificate that way?

[alemabrahao]

You need a certificate, either self-signed or a valid certificate.

I always use a self-signed certificate so I prefer to install AD CS, but each case is different.

[Patrik73]

Thank you!
I really appreciate your help.

Guess I will install the AD CS.

I do have a wildcard cert, but that is for my public domain name.

*.name.com

and not my internal domain name

*.name.local

[Patrik73]

I now have setup an CA-server and created a certificate.

Configured Active Directory authentication.

It looks like it can communicate.

I have also added the net in Subnet

And the Audit Policy.

And my certificate seems ok.

But still get errror 691 😞

Getting a little bit frustrated. 

[alemabrahao]

 Your L2TP connect probably is misconfigured. Can you share the configuration on your machine?

[Patrik73]

It seems to work now.

I tried to login with my full login name but then I get Error 691.

When I change to just my username it worked.

But I'n not sure what the groups actually does.

I tried to set some restriction on the group that my testuser is member of, but that doesn't change anything.

Maybe I should go for Radius login instead to be able to restrict access to VPN through AD-group membership.

And then I can activate Azure MFA.

And I'm not sure why I need the certificate, I removed it and the VPN still works.

Guess all I needed to do was to add to the Client VPN settings.

Domain short name

IP to DC

Username

Password

I also removed the subnets from Sites and Services and it still works.

[alemabrahao · Accepted solution]

Group policies don't work for L2TP VPN just for Anyconnect.

The certificate is a requirement if you want to authenticate the users from LAN. Check it out:

The MX will run through the following steps to identify AD group members and apply associated group policies:

1. MX securely contacts the specified Domain Controllers for the AD domain, using TLS
2. MX reads WMI logon events from the DC's security events, to determine which users are logged into which devices.
3. MX binds to DCs using LDAP/TLS to gather each user's AD group membership.
4. Group membership is added to a database on the MX.
5. If a domain user's group membership matches an AD group policy mapping in Dashboard, the MX can apply the associated group policy to the user's computer.

Because the MX is continuously gathering this information from the domain controllers, it is able to accurately apply the policy in real-time whenever a new user logs in.

Note: At this time, the MX does not support mapping group policies via Active Directory for users connecting through the Client VPN.

[Patrik73]

Thank you very much for the help.