Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About viksep
Community Record
16
Posts
4
Kudos
1
Solution
Badges
Dec 2 2020
1:32 PM
2 Kudos
That's awesome! Cheers everyone! 😃
... View more
Nov 20 2020
8:04 AM
1 Kudo
Hi, I just wanted to say that after a long time troubleshooting this with Cisco Support, we did make some progress and found an issue whereby the connection was being attempted by the highest numbered VLAN that I had - in my case it was one that was not configured for the S2S. After disabling VPN participation for that, we found some WMI errors that indicated a potential issue with the account I was using to connect to the domain. TL;DR, I set up RADIUS instead with NPS and used the MFA extension for Azure on top of it and it's working perfectly.
... View more
Nov 16 2020
12:00 AM
1 Kudo
Thank you, I did originally raise a case and was on the phone for 1 hour and 20 minutes and it seemed like the engineer knew less than I did. I guess I'll try my luck again and hopefully someone else can assist. I appreciate all your attention and suggestions - very many thanks.
... View more
Nov 13 2020
4:26 AM
I've switched the authentication to Active Directory, initiated a VPN session from my client and nothing appeared whilst packet capturing on Interface = Site-Site VPN Only results are when the Interface is set to Internet, like previously.
... View more
Nov 12 2020
9:03 AM
I would initially try turning VPN participation on for the Default VLAN 192.168.128.0 Done this ✔️ You'll need to add this subnet to the permitted list for the tunnel in Azure, to match. Done this also ✔️ I'll switch authentication to Active Directory and try to initiate a new VPN session from my client whilst packet capturing. Thanks.
... View more
Nov 11 2020
6:44 AM
This is my S2S config on Meraki: (image didn't upload)
... View more
Nov 11 2020
6:43 AM
Hi, Once again thanks for your reply. Check that the destination IP address for the AD server lies within the VPN routing. This is my S2S config on Meraki: And here are the subnets from the Meraki that are enabled for the connection on Azure side. Assuming it already is, what I would do is allow all your VLANs access to the VPN, temporarily Would be able to clarify this? Do you mean add any remaining VLANs to the address space mentioned above or here: My S2S outbound firewall looks like this: Once again, I appreciate all the help.
... View more
Nov 11 2020
5:23 AM
I've tried running a packet capture with the following filter expression: dst host 172.16.1.4 This was done across: Internet: --- Start Of Stream --- reading from file -, link-type EN10MB (Ethernet) 13:21:25.555820 e0:cb:bc:2f:12:cd > 8c:90:d3:03:8e:1a, ethertype IPv4 (0x0800), length 90: (tos 0x0, ttl 64, id 30251, offset 0, flags [DF], proto UDP (17), length 76) 5.252.223.106.42162 > 172.16.1.4.53: [udp sum ok] 9376+ A? cloud-meraki-asn.amp.cisco.com. (48) 0x0000: 4500 004c 762b 4000 4011 31fb 05fc df6a E..Lv+@.@.1....j 0x0010: ac10 0104 a4b2 0035 0038 9b9f 24a0 0100 .......5.8..$... 0x0020: 0001 0000 0000 0000 1063 6c6f 7564 2d6d .........cloud-m 0x0030: 6572 616b 692d 6173 6e03 616d 7005 6369 eraki-asn.amp.ci 0x0040: 7363 6f03 636f 6d00 0001 0001 sco.com..... --- End Of Stream --- LAN - no output Site-Site VPN no output Client VPN no output
... View more
Nov 11 2020
1:25 AM
Hi, Thank you for following up. Yes, I've been referring to this: https://documentation.meraki.com/MX/Client_VPN/Client_VPN_Overview This still leaves me wondering about the source IP; I suspect the highest VLAN is used, which maybe changes the way you filter, on any packet captures? Is it included in the VPN config...? When you mean highest VLAN, do you mean the one with the smallest ID? These are mine: The MX IP is 10.0.29.1 For the VPN config 10.0.29.0/24 and 10.40.0.0/24 (this is my VPN subnet) are configured to reach Azure. If I am able to successfully connect from an AP using the Active Directory sign-on from Wireless > Access Control, using the DCs IPs instead of the hostname, would it be a case of the Meraki not being able to resolve the domain? Many thanks again.
... View more
Nov 8 2020
11:10 AM
Hi there, thanks for your response. I ran the packet capture as per your suggestion, however nothing showed on the output. I've chosen the Interface Site-Site VPN because that's how I can resolve to the IP in question (S2S from Meraki to Azure) Still no luck. I've also tried the other interfaces as well with the same result.
... View more
Nov 7 2020
3:47 AM
Hey, Thanks for your response. I've set the config on Security & SD-WAN > Active Directory but the Event Logs show: Unable to connect to Domain Controller I'm not sure, especially as I can telnet from behind the MX to both of the servers I added on port 3268. Very puzzled right now... Not sure how the connection is failing when I can test it fine from an AP that's on the network.. Do you know if I am missing something obvious?
... View more
Nov 5 2020
12:07 PM
Sure, On Security & SD-WAN > Active Directory: I've gone with Authenticate users with Active Directory. You can see the details here: The status part spins for a few seconds then doesn't indicate anything else - i.e if it was successful or not. Having said that, I found that on the Wireless menu (we have a couple of MR42 APs) there's an option under Access Control > Splash page > Sign-on with Active Directory, it gives me an option to add servers and test the connectivity which seems to have worked, so I'm not sure if the AD setup within the firewall just doesn't indicate accurately when it hasn't established the connection and / or if there's a way to view any logs / errors. Hope this clarifies things. Many thanks.
... View more
Nov 5 2020
8:44 AM
Hi, I am trying to authenticate users with Active Directory (primarily for Client VPN). My Active Directory resides in Azure and I've created the S2S VPN from the Meraki to it and the connection works without any issues. From behind the VPN, I can reach both domain controllers in Azure and telnet to the required ports. However when try to add a server on the Meraki dashboard, the status doesn't seem to indicate that the connection was successful and from what I've seen, there's no way to get any additional information as to why it couldn't connect? E.g. credential or network issue. Can anyone suggest anything else or perhaps advise on what I could be doing wrong / haven't considered? I appreciate any input in advance. Many thanks.
... View more
Sep 11 2019
10:03 AM
Hi ByronC, Thanks for your response. I am indeed looking to authenticate via another method, RADIUS or Active Directory, not Meraki Cloud. I've gone as far as setting up the DAP on a server within the network perimeter but I am unsure of the requirements: e.g. if I set the auth method to Active Directory, if I still need a RADIUS server configured and if so, how would I go about proceeding with that setup. Many thanks.
... View more
Sep 9 2019
2:22 AM
H everyone, We have an MX64 and the Client VPN is set for authentication with Meraki cloud and the users setup. I'm trying to set up 2FA via Duo Security but I have some questions: 1) I set up the DAP with the following config: [radius_client]
host=X.X.X.X
secret=XXXXXXXXXXX
[radius_server_auto]
ikey=XXXXXXX
skey=XXXXXXXXXX
api_host=XXXXXXXXX
radius_ip_1=XXXXXXXX
radius_secret_1=XXXXXXXXX
client=radius_client
port=1812
failmode=safe Am I missing configuration for Active Directory in order to authenticate? I've read this document regarding the RADIUS setup but I am confused when it comes to 'configuring RADIUS clients to use it for authentication'. Which client am I supposed to configure? I am little confused 😕 https://duo.com/docs/radius Currently, we have the windows 10 VPN tool setup to the Client VPN endpoint and the only authentication is the stored username and password. I am not sure how to point this endpoint to the DAP. Any help will be greatly appreciated.
... View more
Sep 5 2019
8:34 AM
Hi, We have an MX64 and the Client VPN is set for authentication with Meraki cloud and the users setup. I'm trying to set up 2FA via Duo Security but I have some questions: 1) I set up the DAP with the following config: [radius_client]
host=X.X.X.X
secret=XXXXXXXXXXX
[radius_server_auto]
ikey=XXXXXXX
skey=XXXXXXXXXX
api_host=XXXXXXXXX
radius_ip_1=XXXXXXXX
radius_secret_1=XXXXXXXXX
client=radius_client
port=1812
failmode=safe Am I missing configuration for Active Directory in order to authenticate? I've read this document regarding the RADIUS setup but I am confused when it comes to 'configuring RADIUS clients to use it for authentication' https://duo.com/docs/radius Currently, we have the windows 10 VPN tool setup to the Client VPN endpoint and the only authentication is the stored username and password. I am not sure how to point this endpoint to the DAP. Any help will be greatly appreciated.
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 11035 | Nov 20 2020 8:04 AM |
My Top Kudoed Posts
© 2024 Cisco Systems, Inc.
