MX84 RADIUS authentication failing for client VPN

SOLVED
osvan
Just browsing

MX84 RADIUS authentication failing for client VPN

Hello,

 

Yesterday I noticed that our MX84 event log has been filling up with DC connection errors (unable to connect to domain controller), and the logs on my DCs have been filling up with DCOM error 10036 (The server-side authentication level policy does not allow the user (RADIUS auth user) SID (*****) from address (MX84 IP) to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application).

 

I've done some Googling, but haven't come up with a working solution yet - any ideas?

 

I was alerted to the issue when our CEO wasn't able to authenticate with the VPN... NOT good.

1 ACCEPTED SOLUTION
PhilipDAth
Kind of a big deal

3 REPLIES 3
osvan
Just browsing

For reference, we are running firmware v.15.44 and there are a number of others having the same or similar issue related to recent Windows security updates on domain controllers. In my case the update is KB5005568 which I am unable to uninstall.

 

There is a relevant thread at Microsoft here which gives more insight into the issue.

 

Is there any reason to believe the 16.x firmware branch would solve the problem?

PhilipDAth
Kind of a big deal

Thanks for the reply PhilipDAth. I've read that topic and applied the recommended change, and although I am seeing users successfully logged into the VPN, authentication still seems to be hit and miss judging from my MX log (see image below).

 

MX84 log snippetMX84 log snippet

 

From looking at the deployment roadmap at that link, it would seem that this issue will become a real problem when Microsoft makes it impossible to disable that CVE fix in 2022, which isn't that far away.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels