Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Alain_Bensimon
Community Record
58
Posts
9
Kudos
1
Solution
Badges
Sep 4 2022
3:14 PM
in my Montreal DNS server, I have this: I'm pretty sure that If I had a DC in Vancouver, I wouldn't have that issue.
... View more
Sep 4 2022
2:08 PM
well, if I disable the Montreal DNS, Vancouver can only ping IP adresses, no names.
... View more
Sep 4 2022
2:05 PM
well, I assume that since I have my DC and DNS on site, it finds it's route. By the way, if I modify the hosts file of Vancouver's clients, it works, but I would prefer a better way.
... View more
Sep 4 2022
1:54 PM
In have a zone on my domain controller in Montreal. ifs.*****gro.com when Vancouver's clients get their DHCP, one of the name servers is the IP address of that DC, so they are looking into that DNS records and get stuck. If I disable that name server in the DHCP, then the clients go through the Internet with no problem, but then they can't resolve Montreal resourcese's names.
... View more
Sep 4 2022
1:46 PM
I have no clue. I guess it was already there. Anyway, I'm planning to replace that router with an MX68 that I already have ready, but prior to it, I have to ensure that I fix the issue I have in vancouver because the same issue will come in Toronto as well.
... View more
Sep 4 2022
1:16 PM
So I assume that you call working site is Toronto, but no, that is the only static route I have, and it is just made to force the router to use the wan connection and it's gateway. Regarding the MX64, the 66.11.93.166 is the IP address of the Cisco RV220 Gateway of Toronto, and 207.194.41.1 is the gateway address of Vancouver's MX64. I'm just trying to replicate what I did in Toronto.
... View more
Sep 4 2022
10:10 AM
Hello, I'm having the following issue. I currently have 3 sites, Montreal, Toronto and Vancouver. Montreal (our HQ) is equiped with a Meraki MX68, 2 domain controllers (DNS and DHCP 10.69.11.0/24). Vancouver has an MX64 (DHCP 10.69.12.0/24). Toronto has an old Cisco RV220 (DHCP 10.69.10.0/24). I have setup site to site connection between the sites. Montreal DNS is setup in Toronto and Vancouver DHCP. In Montreal, on my DNS server, I have a zone that point to an Azure location. From Montreal, I have no issue, I can get to it without a problem. After I installed the Toronto connection, I realized I couldn't reach the Azure location from there because I don't have a DNS server there. I workaround the isue by creating a static route in the firewall that forced to use the WAN interface to go to the azure location. That worked very good so far. After I've installed the MX64 in Vancouver, I have tried to do the same thing, but unfortunately, the device does not allow to create a route that is not in an existing subnet So currently, I cannot reach my Azure location from Vancouver. I get stuck at my gateway
... View more
Aug 14 2022
3:02 PM
The problem got solved by itself, after an hour it started to work. Thank you.
... View more
Aug 11 2022
7:16 AM
Hello, I have a VPN setup with Radius authentication. My Server has an issue and is unreachable. I have setup the RADIUS on another server that is reachable, and added it in the the Radiuse server section. I still can't connect. How does it work, if it can't reach the first server, is it supposed to try the second one or do I have to delete the first one? Thank you
... View more
Labels:
- Labels:
-
Client VPN
Jan 15 2022
5:17 PM
I have been able to fix the issue. My mistake was to think that if A is connected to B, and B is connected to C, A would be automatically able to use C resources. I had to add the A subnet in the remote subnets of C and it worked.
... View more
Jan 12 2022
5:59 PM
there it is and here is the script I've been using for a couple of years. I've just added 10.69.10.0/24 to the rotes today, but it didn't help. # Path for the phonebook.
$PbkPath = Join-Path $env:PROGRAMDATA 'Microsoft\Network\Connections\Pbk\rasphone.Pbk'
# Update these variables with the actual VPN name, address, and PSK.
$ConnectionName = 'ABC VPN'
$ServerAddress = 'cisco-******-wired-********.dynamic-m.com'
$PresharedKey = '*************'
# If no VPNs, rasphone.Pbk may not already exist.
# If file does not exist, then create an empty placeholder.
# Placeholder will be overwritten when new VPN is created.
If ((Test-Path $PbkPath) -eq $false) {
$PbkFolder = Join-Path $env:PROGRAMDATA "Microsoft\Network\Connections\pbk\"
if ((Test-Path $PbkFolder) -eq $true){
New-Item -path $PbkFolder -name "rasphone.pbk" -ItemType "file" | Out-Null
}
else{
$ConnectionFolder = Join-Path $env:PROGRAMDATA "Microsoft\Network\Connections\"
New-Item -path $ConnectionFolder -name "pbk" -ItemType "directory" | Out-Null
New-Item -path $PbkFolder -name "rasphone.pbk" -ItemType "file" | Out-Null
}
}
# If VPN exists, delete VPN connection so you can build fresh.
Remove-VpnConnection -AllUserConnection -Name $ConnectionName -Force -EA SilentlyContinue
# Adds the new VPN connection.
Add-VpnConnection -Name $ConnectionName -ServerAddress $ServerAddress -DnsSuffix 'int.nomoist.net' -AllUserConnection -TunnelType L2tp -L2tpPsk $PresharedKey -AuthenticationMethod PAP -EncryptionLevel Custom -Force -WA SilentlyContinue
# Sets the VPN connection to split tunnel.
# Comment out for full tunnel.
# Note: Some PCs get angry w/o a short rest to process Add-VPNConnection
Start-Sleep -m 100
Set-VpnConnection -Name $ConnectionName -SplitTunneling $True -AllUserConnection -EncryptionLevel Custom -WA SilentlyContinue
# If you need parameters to add metrics or for IPv6 subnets, open Powershell and run:
# get-help add-vpnconnectionroute -full
# This will give the full list of valid parameters for Add-Vpnconnectionroute and
# instructions for using them.
# Adds the route for the interesting subnet
# $RouteList is an array of interesting subnet(s) with CIDR mask
# Split tunnels must have at least one route.
# Comment out for full tunnel.
$RouteList = @('10.0.1.0/24', '10.1.0.0/16', '10.2.0.0/16' , '192.168.254.22/32' , '10.69.10.0/24')
Foreach ($Destination in $RouteList)
{
Add-Vpnconnectionroute -Connectionname $ConnectionName -AllUserConnection -DestinationPrefix $Destination
}
# Load the RASphone.pbk file into a line-by-line array
$Phonebook = (Get-Content -path $PbkPath)
# Index for line where the connection starts.
$ConnectionIndex = 0
# Locate the array index for the [$ConnectionName] saved connection.
# Ensures that we only edit settings for this particular connection.
for ($counter=0; $counter -lt $Phonebook.Length; $counter++){
if($Phonebook[$counter] -eq "[$ConnectionName]"){
# Set $ConnectionIndex var since $counter only exists inside loop
$ConnectionIndex = $counter
break
}
}
# Starting at the $ConnectionName connection:
# 1. Set connection to use Windows Credential (UseRasCredentials=1)
# 2. Force client to use VPN-provided DNS first (IpInterfaceMetric=1)
# Setting the IpInterfaceMetric to 1 will force the PC to use that DNS first.
# Some companies have local domains that overlap with valid domains
# on the Internet. If VPN-provided DNS can resolve names on the local domain,
# then end user PC will get the correct IP addresses for private servers.
# Otherwise, the PC will use a public DNS resolver.
for($counter=$ConnectionIndex; $counter -lt $Phonebook.Length; $counter++){
# Set RASPhone.pbk so that the Windows credential is used to
# authenticate to servers.
if($Phonebook[$counter] -eq "UseRasCredentials=1"){
$Phonebook[$counter] = "UseRasCredentials=0"
}
# Set RASPhone.pbk so that VPN adapters are highest priority for routing traffic.
# Comment out if you don't want to try VPN-provided DNS first.
elseif($Phonebook[$counter] -eq "IpInterfaceMetric=0"){
$Phonebook[$counter] = "IpInterfaceMetric=1"
break
# IpInterfaceMetric comes after UseRasCredentials, so break will cancel
# our loop once we're done with it.
}
}
# Save modified phonebook overtop of RASphone.pbk
Set-Content -Path $PbkPath -Value $Phonebook
# Create desktop shortcut using rasphone.exe.
# Provides a static box for end users to type user name/password into.
# Avoids Windows 10 overlay problems such as showing "Connecting..." even
# after a successful connection.
# Create a desktop shortcut
$WScriptShell = New-Object -ComObject WScript.Shell
$Shortcut = $WScriptShell.CreateShortcut("$env:Public\Desktop\Polygon VPN.lnk")
$ShortCut.IconLocation = "C:\WINDOWS\system32\SHELL32.dll, 135"
$Shortcut.TargetPath = "rasphone.exe"
$Shortcut.Save()
# Prevent Windows 10 problem with NAT-Traversal (often on hotspots)
# See https://documentation.meraki.com/MX/Client_VPN/Troubleshooting_Client_VPN#Windows_Error_809
# for more details
$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Services\PolicyAgent"
$name = "AssumeUDPEncapsulationContextOnSendRule"
$value = "2"
New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType DWORD -Force | Out-Null
... View more
Jan 12 2022
2:22 PM
100% sure. and my issue is not to connect to the VPN, it works fine. I just can't access the remote site to site vpn, but I can access all my network resources through the vpn.
... View more
Jan 12 2022
2:17 PM
None of these updates are installed on my computers.
... View more
Jan 12 2022
1:16 PM
No rules at all.
... View more
Jan 12 2022
10:58 AM
the 10.69.11.0/24 is the local office where the MX-64 is located. I don't need a route, I already have access. My VPN is split tunnel.
... View more
Jan 12 2022
10:27 AM
you mean here?
... View more
Jan 12 2022
9:32 AM
2 Kudos
This is not related to my problem. all clients successfully connect to the VPN. You should create anotre case.
... View more
Jan 12 2022
8:08 AM
I Have a site to site VPN setup (10.69.10.0/24) in my MX-64 (10.69.11.99) and a client VPN (subnet 10.69.69.0/24). I can access all remote resouces from the office where the MX-64 is located. When I connect through the VPN, I have access to all local resources, but I can't access the remote resources of the site to site VPN. I have added the route in the client VPN configuration. I can see in the routes of the computer I can't ping or access the remote resources. When I made a tracert, I reach the MX-64 and nothing further Thank you.
... View more
Labels:
- Labels:
-
Auto VPN
-
Client VPN
Jan 6 2021
12:36 PM
4 Kudos
Thank you.
... View more
Dec 15 2020
12:51 PM
@PhilipDAth Thank you.
... View more
Dec 15 2020
12:13 PM
1 Kudo
@PhilipDAth I've created the Radius server and selected the appropriate group. It works like a charm. Thank you for your help.
... View more
Dec 15 2020
10:45 AM
@PhilipDAth I have no experience with radius. Can I create on an existing server, or do I need a dedicated one?
... View more
Dec 15 2020
6:02 AM
Hello, I use Active Directory authentication for VPN access on my MX64. It works fine, and users can authenticate. I would like to restrict the VPN access to an OU or a group of users. Is it possible?
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 8053 | Jan 15 2022 5:17 PM |
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 4 | 2113 | |
| 2 | 8512 | |
| 2 | 2155 | |
| 1 | 2792 |
© 2024 Cisco Systems, Inc.
