MX 15.34 beta client VPN

[MIS-Schuyler]

We upgraded an MX64 to the 15.34 beta to test out the new IKEv2 and improved crypto support for site-to-site VPNs, but have run into issues with the client VPN on this version. No Windows 10 (1909 and 2004) clients appear to be able to connect to the client VPN using the traditional L2TP-PSK/IPsec setup for Meraki. When trying to connect, the UI displays the error:

The L2TP  connection attempt failed because the security layer could not negotiate compatible parameters with the remote computer.

In the event log, RasClient logs error 788.

I assume the updated crypto has something to do with it, especially as this error indicates that no compatible crypto suites were negotiated. Am I missing something, or is this a known issue with the beta firmware?

[MIS-Schuyler]

I've now verified this behavior on another MX64, so it doesn't seem to be unique to this network.

[RobertFerguson]

We have an MX100 on 15.34 for IKEv2.  We started experiancing the same issue where 2 client VPN users on the same network attempting to logon to the client VPN on the MX100.   We have an MX84 on the latest stable release of version 14 where this is not a problem.

[GIdenJoe]

Perhaps the MX is now forcing IKEv2 on the clientVPN too with ciphers your windows client doesn’t want to negotiate. A packet capture on ports 500 and 4500 on your WAN interface will show some details.

[RobertFerguson]

Thank you - I've opened a ticket with support.  I will update this string when I have a reply.  According to the packet captures, they can see the second request reaching the MX but not leaving the MX to go to the radius server.   More later.

[GIdenJoe]

I'm pretty sure you can change the cipher options in windows.
I'd have to google it though 🙂

Edit: There was a graphical tool to use for all your VPN's however you can add a single VPN with powershell to use a specific ciphersuite.

Add-VpnConnection -Name "MyVPN" -ServerAddress <VPN_WAN_IP> -TunnelType "L2tp" Set-VpnConnectionIPsecConfiguration -ConnectionName "MyVPN" -AuthenticationTransformConstants SHA196 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup ECP256 -DHGroup Group14

This still needs the psk switch but you get the point.