VPN client problems

tuanpham
Conversationalist

VPN client problems

Hi.

I have a MX 250, and I set up VPN Client-server with authentication via AD server.

Some users can not connect VPN, I followed this link https://documentation.meraki.com/MX/Client_VPN/Troubleshooting_Client_VPN  but users still have not connect VPN to MX.

 

These are log on my MX and window client:

Annotation 2018-12-28 134020.jpgCapture.PNG

 

I don't understand why ISAMKP-SA has been deleted after IPsec-SA established.

7 REPLIES 7
PhilipDAth
Kind of a big deal

Here is the client VPN trouble shooting guide for error 809:

https://documentation.meraki.com/MX/Client_VPN/Troubleshooting_Client_VPN#Windows_Error_809

 

It is also often caused by the CPE that the user is connecting from behind.  You can try getting them to upgrade the firmware on the CPE that they use.

I have followed this guide https://documentation.meraki.com/MX/Client_VPN/Troubleshooting_Client_VPN#Windows_Error_809 but client vpn still couldn't connect to MX.

 

I don't understand about log on MX. Can you explain to me why ISAMKP-SA has been deleted?

 

Thank you.

PhilipDAth
Kind of a big deal

Does the MX have a public IP address directly on its WAN interface, or is it sitting behind something else doing NAT?

Hi Philip,

 

The MX has two IPs public. And my window client still connect with OPEN vpn but it can not connect vpn to the MX.

PhilipDAth
Kind of a big deal

Oh, you have another VPN installed on the same machine?  Try uninstalling that.  Quite a few VPN clients break the native VPN sub-system in Windows.

PhilipDAth
Kind of a big deal

>The MX has two IPs public

 

To be clear; it has a public IP address configured on each of its WAN interfaces

Hi Philip,

 

I have two WAN, and I setup load-balancing. Each of WAN interfaces has a public IP.  When window client could not connect MX, I was trying another vpn such as OPENVPN, before that Client had no other vpn app.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels