L2TP Connection Attempt Failed

[Dawson]

Hello,
We had a VPN set up by our ISP (SaskTel).  We have a laptop that we want to connect to the VPN, by a person who's not in town.  The person does use Starlink as their ISP.  I have added the information to the laptop and have succesfully on many networks around our community via Wifi.  One at my house, my co-workers house, our shop and another shop in town.

However, when she takes the laptop back home to work remotly this error keeps popping up and I cannot seem to get it to work while she's back at home.  I am at a total loss.

[Mloraditch]

CGNAT (which Starlink uses) and L2TP is often problematic. 

Officially they don't support L2TP:
https://www.starlink.com/support/article/aa5aecf3-e97c-e84e-3f87-8d2ecdfde857

[Main10ence]

Hello @Dawson,

Please ensure that the remote ISP device is configured to forward 500/4500 downstream to the laptop. 

You can also validate by running a Wireshark packet capture on the wireless interface of the laptop while attempting the client VPN connection.

[Mloraditch]

I should add that I'd recommend getting Secure Client (AnyConnect) licensing and switching to that. It's not that expensive and should work with most any ISP situation

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance

[thaack]

If you open up event viewer and look at rasman logs, what does it say the connect fail code is?

[PhilipDAth]

My first suggestion - buy some AnyConnect licences and change across to using that.  Much better.

If you want to continue using the Microsoft client VPN, try using my wizard to create a PowerShell script to configure it.  It sets some registry keys which makes it more likely to work through NAT.

https://ifm.net.nz/cookbooks/meraki-client-vpn.html

[thaack]

This - AssumeUDPEncapsulationOnContextSendRule reg edit was my main suggestion.