MX84 RADIUS authentication failing for client VPN

[osvan]

Hello,

Yesterday I noticed that our MX84 event log has been filling up with DC connection errors (unable to connect to domain controller), and the logs on my DCs have been filling up with DCOM error 10036 (The server-side authentication level policy does not allow the user (RADIUS auth user) SID (*****) from address (MX84 IP) to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application).

I've done some Googling, but haven't come up with a working solution yet - any ideas?

I was alerted to the issue when our CEO wasn't able to authenticate with the VPN... NOT good.

[osvan]

For reference, we are running firmware v.15.44 and there are a number of others having the same or similar issue related to recent Windows security updates on domain controllers. In my case the update is KB5005568 which I am unable to uninstall.

There is a relevant thread at Microsoft here which gives more insight into the issue.

Is there any reason to believe the 16.x firmware branch would solve the problem?

[PhilipDAth · Accepted solution]

I think it is related to this update.  You might need to disable the hardening.

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-... 

[osvan]

Thanks for the reply PhilipDAth. I've read that topic and applied the recommended change, and although I am seeing users successfully logged into the VPN, authentication still seems to be hit and miss judging from my MX log (see image below).

MX84 log snippet

From looking at the deployment roadmap at that link, it would seem that this issue will become a real problem when Microsoft makes it impossible to disable that CVE fix in 2022, which isn't that far away.

[alexthegeekiest]

Has there been a proper resolution put into place for this yet?   I chose to disable it on one of my servers while we have the option.  The ability to manually disable it ends in June per the document referenced above: KB5004442 - DCOM hardening 

[PhilipDAth]

I haven't seen anyone having this issue using RADIUS authentication against NPS.  Are you sure you are using RADIUS authentication rather than direct Active Directory authentication?

[alexthegeekiest]

You are absolutely right!  I meant AD authentication..not radius.  Support ticket opened indicates this a MS problem and not a Meraki problem, but come June this could be a bigger issue because the registry fix won't work.

[PhilipDAth]

NPS (Microsoft's RADIUS server) is built into Windows Server and has no additional cost.  Any reason you can't change over to using it?

[alexthegeekiest]

I can certainly do that.  This would remediate this issue then because it is specific to AD authentication?

[PhilipDAth]

Correct.

[osvan]

That's the same solution that I came up with. We have been using RADIUS authentication for months now with no issues. Fortunately, I was just testing AD authentication so switching over wasn't a big deal for me.