Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About Dennoh
Dennoh
Here to help
Member since Oct 29, 2020
Apr 1 2021
Community Record
6
Posts
0
Kudos
1
Solution
Badges
Apr 1 2021
6:15 AM
Update: The client was getting to the MX but was failing to complete the IPsec negotiation. We ended up disabling and reenabling the domain user account in AD and it worked. Turns out disabling and enabling stuff can sometimes be a fix.
... View more
Mar 25 2021
8:53 AM
@CptnCrnch here is the log. Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: failed to begin ipsec sa negotiation. Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: no configuration found for 71.58.172.3. Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA deleted 50.251.93.129[4500]-71.58.172.3[4500] spi:ad6965d1e1ee391c:50753a6a5b2dda65 Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA expired 50.251.93.129[4500]-71.58.172.3[4500] spi:ad6965d1e1ee391c:50753a6a5b2dda65 Mar 25 11:49:37 Non-Meraki / Client VPN negotiation msg: purged IPsec-SA proto_id=ESP spi=3934531562. Mar 25 11:49:17 Non-Meraki / Client VPN negotiation msg: IPsec-SA established: ESP/Transport 50.251.93.129[4500]->71.58.172.3[4500] spi=3934531562(0xea842fea) Mar 25 11:49:17 Non-Meraki / Client VPN negotiation msg: IPsec-SA established: ESP/Transport 50.251.93.129[4500]->71.58.172.3[4500] spi=4838986(0x49d64a) Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: ISAKMP-SA established 50.251.93.129[4500]-71.58.172.3[4500] spi:ad6965d1e1ee391c:50753a6a5b2dda65 Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: invalid DH group 19. Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: invalid DH group 20. Mar 25 11:49:16 Non-Meraki / Client VPN negotiation msg: received broken Microsoft ID: MS NT5 ISAKMPOAKLEY Mar 25 11:49:08 Non-Meraki / Client VPN negotiation msg: failed to begin ipsec sa negotiation. Mar 25 11:49:08 Non-Meraki / Client VPN negotiation msg: no configuration found for 71.58.172.3.
... View more
Mar 25 2021
6:19 AM
@CptnCrnch It's a radius authentication so on the user profile in DC; under "Dial-in' Tab "Control access through NPS Policy" is ticked.
... View more
Mar 24 2021
7:45 PM
We have a built-in Windows VPN connection to a Meraki MX Firewall with Radius authentication. All other users are on Windows 10 and can connect to the VPN except one particular user only, whose VPN connection suddenly stopped working. Keep getting below error when we try to connect to the VPN. The user Domain\user dialed a connection named XXX VPN which has failed. The error code returned on failure is 718. Verified the user credentials are correct. Reset the user password, retried the connection; got the same error. Successfully connected to the VPN using my credentials on the user laptop. Tried to connect using the user credentials on my laptop; got same error. Re-created the VPN on user laptop; same error. In our DC server, verified user has "Control access thru NPS Network Policy" checked. Removed and re-added user to VPN security group in DC ,re-tested and got same error. Verified the msRadiusServiceType attribute for the user in DC is <not set> Appreciate any suggestions.
... View more
Nov 3 2020
12:58 PM
@CN Thank you for your response. Both CNAMES point to the same MX/Public IP ,so the clients are sharing a single subnet to connect to the VPN.
... View more
Oct 29 2020
8:36 AM
We have build-in windows VPN to a Cisco/Meraki Firewall and we have configured the windows clients to connect using hostname instead of the public IP address. Some clients connect to vpn1.xyz.com and some other users to connect to vpn2.xyz.com. On the dashboard(Network-Wide>Clients), we can only view the IP addresses & MAC Addresses associated with the Client VPN sessions. Is it possible to view the clients that are connected to each hostname instead?
... View more
My Accepted Solutions
| Subject | Views | Posted |
|---|---|---|
| 12723 | Apr 1 2021 6:15 AM |
© 2024 Cisco Systems, Inc.
