Checkpoint VPN - Secureclient connection issues, can't connect to internal LAN. NGX R65 UTM-1 270

MVP Profile

Junos Pulse VPN client install issue – roll back
Everyone can become a victim of hackers who want to steal your personal data and use for illegal purposes. There is no documentation on this subject. Also, if you are using the device tunnel, it is recommended that you not enable the option to use trusted network detection on the user tunnel to avoid the problem of detecting the device tunnel as the internal network. Learn when you want, where you want with convenient online training courses. This creates issues like this.


Get in touch around the world

Thanks for the suggestions, I tried those permutations and a few others. Hopefully Patch Tuesday will bring a present. The Windows 10 Always On VPN device tunnel feature is designed to provide pre-logon network connectivity to support domain logons when cached credentials are not available. It was implemented specifically to provide feature parity with DirectAccess, so Microsoft made the decision to restrict it to Windows 10 Enterprise edition. However a lot of development is going into the native Azure VPN Gateway with regards to increasing user limits and authentication methods.

Yes, you could deploy a third-party appliance, but obviously that adds cost and administrative overhead. We are using split DNS in our environment, this will cause the client to lookup resources through the tunnel. Also for a device tunnel? As long as you use IKEv2 with machine certificate authentication, and you use the built-in Windows 10 VPN client to establish the connection, then yes it should work.

Do you know of any guidance for deploying the Device Tunnel using Intune?. I have successfully deployed the user tunnel this way but it is straight XML.

If I removed the DCs from Device Tunnel then it would connect but no user could authenticate to logon to machine. Also, if you are using the device tunnel, it is recommended that you not enable the option to use trusted network detection on the user tunnel to avoid the problem of detecting the device tunnel as the internal network. Also the Trusted Network Detection makes perfect sense, our vpn name is not resolvable internal so there was no requirement for it.

Is it the same concept? I see no traffic going to the proxy server which is internal. There are two places to define a proxy serer — at the connection level and at the namespace level. Let me know how that works! Thanks Richard, I have that in the vpn profile xml, but it prevents the page from loading. Does the proxy server need to be external facing? Our current proxy setup with DirectAccess is internal only. I assume it is possible to lock down configuration for users so that either you have the tunnel and connect through your corporate infrastructure or you have no internet access at all?

And as you noted, the behavior will be such that the user will have no network access at all unless the VPN connection is established. Can you confirm why we need to run this command? Seems like it bypass NPS authentication by doing this? With out it, you would have to delete all root CAs on the server except your internal CA.

Otherwise your VPN server would accept a client authentication certificate from any of its trusted CAs, which includes many public CAs. Not a good idea at all. We have a setup with both a device and user tunnel in operation. It works well, apart from one fairly major issue and I was wondering if a supported solution had been identified. I can see comments above and I am curious if anyone is experiencing the identical issue.

This seems work well when outside of the corporate network, and the user tunnel automatically connects. These bursts of activity can be minutes apart and seem to continue for as long as the machine is connected to the corporate network.

The user would have to manually connect to the VPN. We are attempting a workaround at the moment. However, we would be very interested in a reliable, supported solution if there happens to be one. Alternatively, you could black hole those DNS queries to prevent client machines from establishing VPN connections when they are on the internal network. That would solve the issue without the need for enabling TrustedNetworkDetection on either the device or user tunnel.

In fact, there are some very compelling reasons to do so as I outlined in this recent blog post: You definitely have options! While testing failover the device tunnel seamlessly reconnects to the other RRAS server but the user tunnel just disconnects and stays that way until I manually connect.

Is there something else I need to configure here? This is because both ports and must be delivered to the same real server, which is challenging because it is UDP. Most ADCs have a way of dealing with this, but it differs depending on the vendor. I see the requirement for clients to establish device tunnels is domain-joined with machine certificates and be running Windows 10 Enterprise.

We have vendors we would like to provide VPN access to from their corporate laptops that belong to an unrelated, untrusted domain. The device tunnel was designed to provide feature parity with DirectAccess, hence the requirement for Windows 10 Enterprise edition.

Although user certificates are the recommended best practice for authentication, it is not a hard requirement. The user would have to enter their credentials the first time, then subsequent connections would not require user interaction. Windows 7 is another story. The user would have to manually establish the connection each time they needed remote access.

I have no idea. I expect it will though. The certificate can be issued by any CA that is trusted. As long as they are issued from a trusted CA it should work assuming the RRAS configuration is correct too, of course. I can communicate with those hosts.

However, once the system logs in, the tunnel works fine. Once the user tunnel connects on the same machine I have same setup using OpenVPN no issues], and The other device tunnels remain dormant. I need group policy to apply and network shares to mount on boot. Pulling my hair out trying to fix these 2 issues and have spent way too much time on this project. You might be encountering some of those issues. In my testing it has been working ok so far, but enough others are complaining that I think something might be up.

Would recommend only using it on the device tunnel, if at all. Wish they would get the kinks worked out as I greatly prefer this over some of the alternatives. Thank you for the response! Hi Richard, Great guides as usual, thank you. We get a couple of issues: This never seems to work and we always need to configure manually.

We can se ta general proxy, just not specifically on the dial-up connection. The user tunnel is deployed as the user, albeit with administrative privileges. As for the proxy configuration, you should be able to add that under. You can choose manual or autoconfig. Optionally you can define a proxy server by individual namespace or FQDN under. I have setup the device tunnel on a few physical laptops. It works BUT the device tunnel always crashes after logging on no matter if there is a user tunnel configured or not:.

The Remote Access Connection Manager service terminated unexpectedly. It has done this 1 time s. The following corrective action will be taken in milliseconds: Faulting package-relative application ID:. These files may be available here: Microsoft is working to resolve as we speak.

Hoping to have a fix included in RS4. I tried to follow your step by step procedure to implement the VPN tunnel device but it does not work. For information, I tested the solution in virtual environment without Internet connection. This is not a public IP address. I do not know how to set this parameter. I do not know how to set this parameter in the XML file, can you give me a concrete example please? The client machine would need to be connected to the Internet for this to work.

No need to worry about that if you are using the PowerShell to deploy the profile. How would we add these exceptions? Sounded good in theory. Unusual, because it has worked for me in the past. Are you using the device tunnel also? But after getting the NRPT working, that will be my next and final task before testing with pilot users. So it seems that if I define an external DnsServer tag 1. Definitely not been my experience. Yikes, what a mess judging from the comments here and elsewhere!

Sounds like DirectAccess is still the way to go for the time being…. When we created a successful manual connection we did have connectivity to internal resouces. We used the Microsoft Documentation: We deduced that the issue we were seeing was because of the network configuration we were working on and the fact that when auto connecting we were split tunneling.

We ended up finding this article: We did this and it worked. It is not massively clear from the Always on documentation that this is what you have to do as part of the client config, can you confirm that we are doing the right thing by adding the routes in to the script as your article seems to agree with this?

It strikes me if there was a route issue and the VPN clients needed updated routes adding you would have to re run the scripts and deploy the profile again? You are right, there will be times when you need to define routes to remote internal networks in the ProfileXML.

Hi Richard, Thanks for verifying what we already thought was the case. Perhaps it could even be sponsored by Risual? Indeed, after simulating the internet network, the device tunnel connection works.

Is it possible to configure Full tunneling in tunnel device mode? I configured the ForceTunnel section but it does not work. I want all flows to be routed to the corporate network.

For information, the bug declared in the tunnel device mode after reboot is no longer relevant in the version. Hello Richard, is it possible in tunnel device mode to pass an Internet connectivity so that the tunnel is automatically mounted in the corporate network without Internet.

The idea is to be able to mount a VPN tunnel device mode without Internet connectivity. One can very well imagine to impose the VPN tunnel even in his company. Can we use triggering by DNS names, ie trigger the VPN as soon as there is a network connectivity in the company or outside?

When LockDown is enabled, the device will not be able to access the internet unless the VPN connection is established. Also, all traffic is tunneled over the VPN force tunnel. Is that what you were looking for? This causes an authentication failure on the NPS due to an incorrect certificate being used.

Dialling manually runs in the user context and will connect the tunnel successfully. I logged a call with MS and they have confirmed the bug. This tunnel has been known for some time, and in fact Microsoft has resolved it in the latest update, RS4.

Also, to be clear, the device tunnel only supports IKEv2. You cannot create a device tunnel using SSTP, only user tunnels. On another note is there a way to get the client to automatically reconnect when they lose connection to the RRAS? I thought he was talking about the device tunnel.

As for automatically reconnecting, I would expect the client to reconnect regardless of the cause. If that fails for any reason, it will fall back to SSTP. Curious though, are you able to manually establish an IKEv2 connection? Just tried it after the cumulative update. Yes, I can manually establish an IKEv2 connection. It should automatically choose IKEv2, assuming it is available. However, understand that the default behavior of the VPN client in Windows is to fall back to SSTP, but then subsequent connection attempts will always be made using the last successful protocol.

If that was SSTP, it will be tried first! I was talking about the user tunnel and it does indeed work with If the device tunnel is up, the VPN server terminates the connection as the device is already connected and authenticated with its machine certificate. I logged a call with an MS breakfix team and they confirmed the bug.

Definitely update us if Microsoft provides a workaround or fix. Also, the behavior you describe where the VPN client always prefers the protocol used during the last successful connection attempt is expected and by design.

The connection will succeed, but there is no traffic in the tunnel and Windows 10 client sets the network as Private profile. If manually update the network profile to be a domain network it will work perfectly. Have you had any issues load balancing with Citrix Netscaler? If you can connect at all, the load balancer is likely configured correctly. I want to implement the trigger of the tunnel device as soon as a network connectivity is detected not necessarily an Internet connection.

Is there a possibility of to bypass the Internet detection NCSI so that the tunnel is mounted automatically inside or outside the company? Not to my knowledge. However, it might be possible to spoof NCSI and point it to itself so that it is always detects an Internet connection. I have no idea what sort of unintended consequences that would bring, but it might be interesting to experiment with!

I would like to enable Trusted Network Detection for both the user and device tunnels but am currently unable to do so as the user tunnel never connects.

I would like to delete the VPN connection but it is impossible via the get-vpnconnection -alluserconnection remove-vpnconnection -force. Access is denied and yet I am well connected with pstools with the localsystem account. Do you have an idea? However, you should be able to delete the connection once it is stopped. Let me know what happens! I had difficulty deleting the device tunnel as well.

I found that rebooting the PC then quickly disconnecting the connection, then delete the connection, finally removed it. Even after disconnecting the network cable, disconnection via the rasdial command is not possible, as well as deletion. Thank you for your help. As stated in my previous posts, even with a card offline, deleting the network card is impossible. I have not done any testing with lockdown mode.

However, I have no experience with the lockdown configuration. You should be able to delete the connection, of course. I read that this and direftive only works with a wireless connection see link https: It should work with any physical adapter on the device, both wired and wireless.

If detected, the VPN will not initialize. Hello, I tested the directive mondomauine. In the documentation it is stated that the tunnel is always mounted whatever the situation. That is, the device tunnel is not compatible with the suffix-based trigger.

TrustedNetworkDetection works for both the user and device tunnels. However, the VPN connection is automatically mounted. It should match exactly. In the eventviewer of the client I can see he is contacting the ISP dns servers and not the internal ones. How can I get this to work? It is not uncommon to see the client try to register with external DNS servers.

However, it will register with internal DNS servers too. Have a close look at the event logs both on the client and server. Perhaps they will yield some clue as to why it is failing. I had the issue that the ras service was crashing every reboot. So I updated to Windows 10 and the ras service was not crashing anymore. The checkbox register dns under ipv4 dns settings is checked now with Windows 10 it was not checked.

So if you use device tunnel — I recommend version …. Hopefully an easy resolution. I have joined 2 x Windows 10 VMs both Pro and Ent to the domain, got a computer certificate on them, created the XML and PS1 files, ran the ps1 file, specifying the xml in the command line ran as system using psexec -i -s and the device tunnel shows up connected great result.

I then log out and attempt to log in as any other domain user, and it says the domain is not available, yet as soon as I log in with cached credentials, it comes up connected again. The Device Tunnel does not appear in the UI, so that is normal.

However, it should provide pre-logon connectivity to allow users without cached credentials to authenticate. There were some known issues in v, but those were resolved in Curious…do you see the device tunnel going down when you log off? If it is established, it should stay up regardless who is logged on, if anyone. I find that there are not many logs for VPN connections. How does troubleshooting work if there are not many logs?

If I use the -AllUserConnection parameter it complains about not being able to find it in the phone book. It does for me. I have to assume that somewhere else they specify the device and not the user URI. It all worked apart from the AllUserConnection setting.

In my experience it has been entirely stable. I would like to see if it is possible to have in addition to the tunnel device, the user tunnel on the same laptop.

Can you send me the. Another question, is it mandatory to have the NAP server when mounting a user tunnel based on machine certificates for IKE?

I thank you in advance. They are essentially the same as the Microsoft scripts, just modified slightly. I just send my email address in your personal box.

If I understand correctly, contrary to Windows , the tunnel device So, can also be installed on the version of Windows 10 pro ? The device tunnel is supported only on Windows 10 Enterprise edition clients that are joined to a domain. If connected manually, both work perfectly. Provisioning for both is through InTune MDM, using custom profile for device tunnel, and a predefined template for the user tunnel, with our EAP section.

All of this works perfectly — once the client attempts to connect. Initially, when testing just the device tunnel with trusted network detection turned on, it connected more reliably, and seemed to be happier to initiate its auto connection.

With the user tunnel though, the device tunnel would disconnect as soon as it connected, presumably due to the trusted network detection. However, there have been some issues reported when TrustedNetworkDetection is configured on the user tunnel. Is that configured in your deployment? Also, there are numerous issues related to the device tunnel, most of which have been fixed in However, I am still hearing reports and experiencing it myself of issues with unreliable device tunnel connectivity.

With that, there may still be some things that are broken with the device tunnel in On user logout, the device tunnel should then reconnect itself quietly. Checking this seems to make it connect automatically, at least a few times, but then stops doing it reliably if the machine is moved around different networks.

Clicking connect works no problem. Thanks for the feedback. Great to understand what others are experiencing. Testing without user tunnel atm. Ok, just making sure. Have a close look at routing tables and metrics. Easy to get tripped up there. Hi Richard, Your advice and write-ups are really great.

I was wondering if you have tested a Device tunnel with Split tunneling disabled, aka ForceTunnel? Typically I deploy the device tunnel for access only to a few restricted machines for the sole purpose of authenticating user logons.

If I understand correctly, the tunnel device is also supported in professional version since Windows 10 ? Register in DNS set on user tunnel, so machine should be reachable. With device tunnel connected, share access to servers the device tunnel has access to , works properly, no issues at all. With just user tunnel connected, shares do not work. Other internal resources are available, everything is pingable, RDP works, etc. SMB 3 shares do not work.

The smartcard certificate used for authentication has expired. Please contact your system administrator. The attempted logon is invalid. This is either due to a bad username or authentication information. Any thoughts on this? Yes, and the tunnel connects successfully — all other resources work, just not SMB shares…. Why, I have no idea.

Must be missing something. And everything other than smb shares works over user tunnel. Huh, so, progress, but also confusion. Learned a little bit more. Looks like similar issue from the past. Tested what they suggested, removing the cert based credential from credential manager this is the Azure Confitional Access cert , and the shares work perfectly. So Windows appears to be trying to use this cert to authenticate to the SMB shares. Not sure how to stop it doing that though!

If I use the InTune wizard and create a profile there, it does work — correct cert is selected and shares are accessible. Does anyone at MS test this stuff???? Basically, when using Azure Conditional Access with the user tunnel, an ent CA cert needs to be selected based on issuer hash and EKU for use by Kerberos…without this, the Azure CA issued cert will be used, and Kerberos auth will fail with all kinds of funny errors.

When capitalization and syntax is not exact, cert selection does not work — the VPN cert is used and Kerberos is broken. For this reason it was desirable to use a custom XML, but defining the correct cert proved difficult as indicated above. I finally figured out the capitalization by pulling it out of a reg key when using the InTune template.

With it ticked, it does connect promptly, but that box seems to get unticked periodially. Anyone know how to programatically set that?

What does not, is hibernating a laptop as many of our users routinely do , and resuming on a non-corp connection, or having the machine go to sleep and then wake up on the same connection. Thinking of adding task scheduler job to add my own connect triggers….

Perhaps run a scheduled task trigger by an event? Yes, the XML file is sometimes sensitive to case. For example, true works, True does not.

Sounds like you found another scenario in which case matters. Thanks for sharing that information! Hopefully Microsoft is addressing some of these challenges. Contact your Network Security Administrator about installing a valid certificate in the appropriate Certificate Store. Have you ever encountered this problem?

Hi Richard, great stuff on your site! Do you know of a way to prevent local users access via the device tunnel? Hello Jason Thank you very much for your answer. I have another question. I will definitely comeback. Also visit mmy homepage; best vpn service. Exploring in Yahoo I eventually stumbled upon this website. I such a lot without a doubt will make sure to do not put out of your mind this web site and provides it a look regularly.

Your email address will not be published. No This mode is the vanilla way of IPSec by the book. Make sure that the firewall administrator at the current location makes sures that the following ports are opened outbound: My recommendations Since there are a number of ways to configure the VPN client and the central firewall, which one should we use?

I would say that you should choose from the below, in given order: Migrate to AnyConnect if possible! Make sure that the central firewall is configured with NAT-traversal as explained above.

There is an extra overhead in encapsulating the end user traffic in yet another layer of TCP-sessions. But if you want to use TCP, use port because it is already entered by default in the vpn client. Use the client without transparent tunneling. You use GRE and will never get the client to work from behind a firewall. July 4, at July 12, at August 8, at August 17, at August 10, at December 16, at October 28, at Leave a Reply Cancel reply Your email address will not be published.

Visualize this and you see something that looks like a hairpin. The picture below should be self-explaining. Click it for a larger version.

What's New in E80.83