MX100 Client VPN Now Blocking SSH

[soundman353]

Hello All,

I tried to SSH into a few machines over the Client VPN today, all of them have timed-out. It was working earlier this week and no firewall changes between now and then. Any ideas?

Shawn

[CptnCrnch]

I'd take a closer look at my logs and possibly start a Trace for these kind of connections.

[DarrenOC]

Hi @soundman353 

@As @CptnCrnch says try running a packet capture on the MX100 outbound interface. Run the output through Wireshark and it should give you a good idea of what’s going on.

[soundman353]

I did Wireshark run on the Client VPN, MX LAN and the Core Switch. I see the traffic on the Client VPN capture but no where else. Every request is answered with a retransmit from the all of the devices I am trying to SSH.

[CptnCrnch]

Strictly speaking, you connections are getting back a Reset / RST. Sounds like there is no service listening...

Is this a trace on the client or where did you capture?

[soundman353]

I can SSH to the any of the end points from within the LAN, so there is services listening.

It was the on the MX Client VPN via the Meraki dashboard.

[CptnCrnch]

Anything else between clientband SSH server? Your trace clearly shows that connection resets are being returned, so there has to be some device that does this. Normally some kind of firewall.

Without further knowledge about the setup, we can only guess...

[soundman353]

The only firewall (other than hosts firewalls) is the Meraki MX100. I will power cycle the unit tonight and see if that clears everything.

[soundman353 · Accepted solution]

The reboot fixed the issue.

[PhilipDAth]

If a reboot fixed it - then there is a software issue on the MX.

I'd be looking at doing a firmware upgrade.

[soundman353]

It is at the highest stable firmware.

[PhilipDAth]

You can either be patient and wait for the next release, or try the stable release candidate ...

[soundman353]

Since it's happening again, I think I will try the stable release.

[soundman353]

I applied the Stable Release candidate firmware, and the problem seems to be solve.