Meraki

Dennoh · ‎Apr 1 2021

Update: The client was getting to the MX but was failing to complete the IPsec negotiation. We ended up disabling and reenabling the domain user account in AD and it worked. Turns out disabling and enabling stuff can sometimes be a fix.

Dennoh · ‎Mar 25 2021

@CptnCrnch here is the log. Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: failed to begin ipsec sa negotiation. Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: no configuration found for 71.58.172.3. Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA deleted 50.251.93.129[4500]-71.58.172.3[4500] spi:ad6965d1e1ee391c:50753a6a5b2dda65 Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA expired 50.251.93.129[4500]-71.58.172.3[4500] spi:ad6965d1e1ee391c:50753a6a5b2dda65 Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: purged IPsec-SA proto_id=ESP spi=3934531562. Mar 25 11:49:17 Non-Meraki / Client VPN negotiation msg: IPsec-SA established: ESP/Transport 50.251.93.129[4500]->71.58.172.3[4500] spi=3934531562(0xea842fea) Mar 25 11:49:17 Non-Meraki / Client VPN negotiation msg: IPsec-SA established: ESP/Transport 50.251.93.129[4500]->71.58.172.3[4500] spi=4838986(0x49d64a) Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA established 50.251.93.129[4500]-71.58.172.3[4500] spi:ad6965d1e1ee391c:50753a6a5b2dda65 Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: invalid DH group 19. Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: invalid DH group 20. Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: received broken Microsoft ID: MS NT5 ISAKMPOAKLEY Mar 25 11:49:08 Non-Meraki / Client VPN negotiation msg: failed to begin ipsec sa negotiation. Mar 25 11:49:08 Non-Meraki / Client VPN negotiation msg: no configuration found for 71.58.172.3.

Dennoh · ‎Mar 25 2021

@CptnCrnch It's a radius authentication so on the user profile in DC; under "Dial-in' Tab "Control access through NPS Policy" is ticked.

Dennoh · ‎Mar 24 2021

We have a built-in Windows VPN connection to a Meraki MX Firewall with Radius authentication. All other users are on Windows 10 and can connect to the VPN except one particular user only, whose VPN connection suddenly stopped working. Keep getting below error when we try to connect to the VPN. The user Domain\user dialed a connection named XXX VPN which has failed. The error code returned on failure is 718. Verified the user credentials are correct. Reset the user password, retried the connection; got the same error. Successfully connected to the VPN using my credentials on the user laptop. Tried to connect using the user credentials on my laptop; got same error. Re-created the VPN on user laptop; same error. In our DC server, verified user has "Control access thru NPS Network Policy" checked. Removed and re-added user to VPN security group in DC ,re-tested and got same error. Verified the msRadiusServiceType attribute for the user in DC is <not set> Appreciate any suggestions.

Dennoh · ‎Nov 3 2020

@CN Thank you for your response. Both CNAMES point to the same MX/Public IP ,so the clients are sharing a single subnet to connect to the VPN.

Dennoh · ‎Oct 29 2020

We have build-in windows VPN to a Cisco/Meraki Firewall and we have configured the windows clients to connect using hostname instead of the public IP address. Some clients connect to vpn1.xyz.com and some other users to connect to vpn2.xyz.com. On the dashboard(Network-Wide>Clients), we can only view the IP addresses & MAC Addresses associated with the Client VPN sessions. Is it possible to view the clients that are connected to each hostname instead?

Meraki

Community

About Dennoh

Dennoh

Community Record

Badges

Re: VPN Client Connection Fails with error 718

Re: VPN Client Connection Fails with error 718

Re: VPN Client Connection Fails with error 718

VPN Client Connection Fails with error 718

Re: View Client VPN Sessions with hostname

View Client VPN Sessions with hostname

Re: VPN Client Connection Fails with error 718