Meraki

Community
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 

About osvan

Re: MX84 RADIUS authentication failing for client VPN

by in Security & SD-WAN
‎Feb 21 2022 6:57 AM
‎Feb 21 2022 6:57 AM
That's the same solution that I came up with. We have been using RADIUS authentication for months now with no issues. Fortunately, I was just testing AD authentication so switching over wasn't a big deal for me. ... View more

Re: MX84 RADIUS authentication failing for client VPN

by in Security & SD-WAN
‎Oct 27 2021 1:24 PM
‎Oct 27 2021 1:24 PM
Thanks for the reply PhilipDAth. I've read that topic and applied the recommended change, and although I am seeing users successfully logged into the VPN, authentication still seems to be hit and miss judging from my MX log (see image below).   MX84 log snippet   From looking at the deployment roadmap at that link, it would seem that this issue will become a real problem when Microsoft makes it impossible to disable that CVE fix in 2022, which isn't that far away. ... View more

Re: MX84 RADIUS authentication failing for client VPN

by in Security & SD-WAN
‎Oct 27 2021 11:22 AM
‎Oct 27 2021 11:22 AM
For reference, we are running firmware v.15.44 and there are a number of others having the same or similar issue related to recent Windows security updates on domain controllers. In my case the update is KB5005568 which I am unable to uninstall.   There is a relevant thread at Microsoft here which gives more insight into the issue.   Is there any reason to believe the 16.x firmware branch would solve the problem? ... View more

MX84 RADIUS authentication failing for client VPN

by in Security & SD-WAN
‎Oct 27 2021 8:19 AM
‎Oct 27 2021 8:19 AM
Hello,   Yesterday I noticed that our MX84 event log has been filling up with DC connection errors (unable to connect to domain controller), and the logs on my DCs have been filling up with DCOM error 10036 (The server-side authentication level policy does not allow the user (RADIUS auth user) SID (*****) from address (MX84 IP) to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application).   I've done some Googling, but haven't come up with a working solution yet - any ideas?   I was alerted to the issue when our CEO wasn't able to authenticate with the VPN... NOT good. ... View more
Labels:
© 2024 Cisco Systems, Inc.