Unable to connect Client VPN

[Mad_Dog_82]

Hi All,

Cisco Meraki Model MX65.

I try to connect VPN from iPhone and Windows 11.

On both devices I get:

Below is the configuration on Windows 11 laptop.

Compared VPN client configuration on Meraki with another device.

VPN account details are correct.

Pre-shared key is correct.

Could you please help to investigate why VPN doesn't connect.

[alemabrahao]

Check the connection properties.

https://documentation.meraki.com/MX/Client_VPN/Client_VPN_OS_Configuration#Windows

[alemabrahao]

You can also check this.

https://documentation.meraki.com/MX/Client_VPN/Guided_Client_VPN_Troubleshooting

[Mad_Dog_82]

Hi @alemabrahao 

I tried VPN Connection Properties as on your screenshot but still the same error.

As I mentioned in the first post there is another Meraki router with identical VPN configuration and Client VPN works like a charm on that router.

Could it be related to the device or Meraki OS being faulty or Client VPN license is absent.

May be some firewall rules should be added?

P.S. I tested Client VPN on another Meraki (same MX65 model) that belongs to the same organization just branch office and was able to connect VPN.

[alemabrahao · Accepted solution]

So the server IP is wrong or this MX is behind a NAT.

[Mad_Dog_82]

Hi @alemabrahao 

I think you may be right.

This looks like the Meraki device behind a provider's router.

In this case can I use dynamic hostname instead or it wouldn't work either?

[Amin_Costa]

Hi @Mad_Dog_82,

I would suggest that your request the provider to configure a port forward on his router to your device using the ports 500 and 4500.

There's another solution that you may use, the Cisco Anyconnect that may be more simple to configure.

Hope that helps.

[Shubh3738]

Server address missing

[PhilipDAth]

If your MX is sitting behind a NATed connection, you'll need an extra registry entry to allow the VPN to work.  I have a VPN config wizard which creates a powershell script.  Run that to configure client VPN on any Windows machines machine you want.  They should make it work.

https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html 

The iPhone - if it is using a carrier doing CGNAT it may never work.

If you want a solution that will work 99.999% of the time, but a licence for Cisco Secure Client (used to be called AnyConnect), and use that instead.

ps. AnyConnect licences are "honesty" based so you can try it out first to verify that it will work.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance