VPN not prompting for username and password when enabled on Meraki MX64W...?

[JayBlackcreek]

Hello there,

First time posting here!

I have enabled Client VPN on a Meraki MX64W. It has been given a hostname, configured a subnet, configured to use Umbrella to solve host names, create a shared secret, used Meraki Cloud Authentication and configured two users to be authorized for Client VPN. 

However, I create the VPN connection in Windows with the correct settings and hostname, etc. when I click on the VPN, a prompt to enter username and password never appears and then eventually shows an L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer. Windows is running 10 22H2.

Any ideas? Thanks in advance.

Jay

[alemabrahao]

Because you don't use Anyconnect instead of L2TP, it is much more stable and has more options.

You can also try generating the connection through that site.

https://www.ifm.net.nz/cookbooks/meraki-client-vpn.html

[JayBlackcreek]

Ok, I enabled AnyConnect in the portal, downloaded the software and rebooted my computer and the Meraki, and verified internet is working on both. When I open the AnyConnect software and enter the VPN hostname, it says it could not connect to server. Please verifiy connectivity and server access.

[ww]

Is your mx behind a nat internet router?

What does the mx event log report regarding the vpn

[JayBlackcreek]

No it isn't.

[alemabrahao]

Does your MX has a Public IP?

[JayBlackcreek]

Yes it does.

[JayBlackcreek]

Any ideas? I am still struggling and my other network co-workers don't seem to have any idea either.

I have configured the VPN in the Meraki, to use Umbrella DNS server, no WINS servers, the shared secret I know is correct and I am using Meraki Cloud Authentication and users are setup to use the connection. I also gave it its own subnet to use that was not already in use.

When I am in Windows, I enter the hostname exactly as it says, make sure to use L2TP with pre-shared key. Verified the pre-shared key is correct, changed to require encryption and to use an Unencrypted Password (PAP). 

And it still won't work. The error I get is "the L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer." And it never even prompts for any username or password, never even makes it to the login.

The Meraki device is getting a Public IP and AFAIK, there is no other internet routers in front of this.

Any further assistance would be appreciated. Thanks!

[alemabrahao]

Some options for troubleshooting. If possible check It on the Windows Event Viewer.

https://documentation.meraki.com/MX/Client_VPN/Guided_Client_VPN_Troubleshooting/Unable_to_Connect_t...

https://documentation.meraki.com/MX/Client_VPN/Guided_Client_VPN_Troubleshooting/Troubleshooting_Cli...

https://documentation.meraki.com/MX/Client_VPN/Guided_Client_VPN_Troubleshooting/Verifying_a_Success...

Why don't you use Anyconnect instead of L2TP connection?

[JayBlackcreek]

I tried that, it didn't work. It says it can't find the server. I have verified there is internet over there and there's no firewall or third-party router or NAT device that could be interfering.

[JayBlackcreek · Accepted solution]

It turns out that the internet is actually being NATed because we are using a dynamic IP from the ISP as opposed to a static IP and it looks like we will have to use a static IP from the ISP to get the VPN to work.

Thanks everyone for your help.