VPN Authentication - OSX

[FCFC]

Hi all

Bit of an odd one ive come across.

Multiple Mac users who previously were able to connect and authenticate a vpn connection are now unable to do so. All users are required to go via a DUO server and authenticate against our DC. The issue has only just started to happen. Strangely if a user logs into the domain via a PC they are then able to connect their VPN on Mac via DUO.

Clearly this is impractical given most of the vpn users are remote and in varying locations.

Im just wondering whether anyone has seen this behaviour before.

I have been setting up Mac users and VPNS fro several years now and never come across anything like this

All advice greatly appreciated  

[Mloraditch]

What client? Secure Client or built in? What do the logs say is happening? This sounds more like some sort  of account setup issue where maybe something isn't happening until the log into the pc, but need more detail if we are to help. 

[FCFC]

Hi

Thanks for getting back.

Users are woking on Mac OSX, using the built in VPN service, LT2P IPSec

There are no logs on the Meraki to look at as we down even get that far.

Its worth noting that all users have been able to connect and authenticate on every occasion up until today.

I agree re the logging into the PC, but why? Ive never come across anything like that before. Im pretty sure something must have changed but im at a loss as to what it might be

[Mloraditch]

How do you mean you don't get that far? Has support indicated they don't even see the attempt? If so you have some sort of client side issue.

[alemabrahao]

I suggest you use a secure client.

[FCFC]

Im not sure I know what you mean

Whats more secure than using MFA against a domain controller?

[alemabrahao]

I'm suggesting you to use the anyconnect instead of L2TP client.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance

It's much better.

[FCFC]

Got it, that is a definate consideration going forward, as for now I need to figure out this issue.

Appreciate you getting back to me

[alemabrahao]

The is a interesting information.

https://duo.com/docs/macos?utm

[PhilipDAth]

Has there been any recnetly applied Meraki MX firmware upgrades?

Has there been any recently Apple updates applied to your machines?

What is actually happening?  Do users get a username password/prompt?  Do you get a Duo push?  What does the Duo authentication log say in the Duo portal?

Where does it go wrong in the process?  Are you getting any error message?