Client VPN

[Patrik73]

Hello!

I have a problem with Client VPN.

We are using Meraki Cloud authenticating.

Computer are AD-connected and the users login with their AD-account on the computer.

firstname.lastname@domain.local

The VPN-accounts are registered to their mail-address.

firstname.lastname@domain.com

We are mapping the drives with GPO, so when they start their computers at home there is a red cross over the drives.

Then they connect with VPN and try to open the drive and gets an error.

Microsoft Windows Network: The local device name is already in use

I have found that if I change their username for VPN to the same they have in the domain then it works.

But that name isn't mail enabled because we use domain.local as name.

Is there anyway to solve this without having to change my UPN in my domain?

[alemabrahao]

Have you tried configuring the Wins Server?

Is there a possibility to use your Local AD to authenticate instead of the Meraki Base?

[Patrik73]

Hi and thanks for reply.

I have no problem ping netbios name of servers FQDN name when connected with VPN.
In the Windows VPN connection I have added the DNS-suffix.

Yes, that's one way to go.

Setup either AD-authentication or Radius-server.

But I Cannot change it right now and would really like to know if this is solvable or not.

Of course I can change their accounts on Meraki Cloud to match their AD-account, but it wont be mail-enabled so we then must hand them their username and passwords manually.

Or add the public domainname as an UPN-domainname in the local AD and change all users domain.

But would really like to fix this without doing that, at least for now.

[alemabrahao]

As far as know, the only way is to use the same domain name or map it by IP instead of name.

[Patrik73]

Thanks again!

Not sure mapping to IP will solve it, but I will give it a try. 🙂

[PhilipDAth · Accepted solution]

I am very rough on this now - but the issue is because Windows uses VPN credentials by default to access other Windows resources.

This may not be 100% right, but will get you pretty close.  You need to edit the Windows phone book via a text editor:
%ProgramData%\Microsoft\Network\Connections\Pbk\rasphone.pbk
And change UseRasCredentials to 0.

If that doesn't work, Google UseRasCredentials.

[Patrik73]

Thank you!
That seems to work.

Not sure I will implement it though. 🙂

But at least now I know what the problem is.

Maybe AD authentication or Radius is what I need to plan for.

[PhilipDAth]

You can try using my client VPN wizard to create a powershell script to configure the VPN.  I don't think it has the same issue.

https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html 

You can also use the more advanced client VPN, AnyConnect.  It doesn't have the issue, either.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance 

[Mantach]

Hi Patrik,

I'm having the same problem, however my VPN client windows don't have the Windows phone book.

What was the most effective practice for you?

[PhilipDAth]

Did you try my cookbook above to generate a powershell script to create the VPN connection?

[Mantach]

Not yet, VPN connection is there but the only challenge is the mapped drives.

[Patrik73]

We skipped that part with the phonebook and instead went for Radius-server for a while.

But soon after we went for radius with AnyConnect. 🙂