Always on VPN - Error 809

[Manny-Tech]

Hi,

 

I'm attempting to deploy Always On VPN by following this guide https://4sysops.com/archives/always-on-vpn-directaccess-for-windows-10/ however, when I try to remote in I keep receiving an 809 error "Can’t connect to [connection name]. The network connection between your computer and the VPN server could not be established because the remote server is not responding. This could be because one of the network devices (e.g. firewalls, NAT, routers, etc.) between your computer and the remote server is not configured to allow VPN connections. Please contact your Administrator or your service provider to determine which device may be causing the problem".

 

I have checked all my DNS records externally, I have checked my filter internally to ensure UDP 500 and 4500 is allowed through but I'm just not getting far at all with it. I'm finding it very hard to track down where the problem lies. I can see the traffic reaching our firewall but I'm getting no response back, so I can assume it is either the RRAS or the NPS causing issues, but there is very limited log files.

 

Does anyone have any suggestions?

[richardmhicks]

As a quick test I would suggest testing the VPN connection when you're on the same subnet as the VPN server. This will eliminate any firewalls or routers interfering with the connection. If it works, verify (again) the firewall is allowing inbound UDP 500 and 4500. Check the firewall logs to ensure the traffic is being allowed too. Also, know that IKEv2 packets can sometimes be quite large and will require fragmentation at the IP layer. Some firewalls and routers are configured to block IP fragments by default, however. You may need to enable IKEv2 fragmentation support on the server to make this work. Details here: https://directaccess.richardhicks.com/2019/02/11/always-on-vpn-and-ikev2-fragmentation/.

[Manny-Tech]

Hi @richardmhicks thanks for the advice, I should probably mention that it works internally. So I'm assuming that suggests configuration is correct and the problem appears to be related to when passing through the firewall / router? As an educational institute we don't actually manage our router, do I need to find out whether our router is blocking IP fragments? I assume even if I enable IKEv2 fragmentation that it still won't work unless the router supports IP fragments?

[richardmhicks]

If it works internally that would rule out server or client configuration for sure. In that case it could be a firewall configuration issue such as UDP 500 and/or 4500 not being open, or perhaps the NAT isn't configured correctly (NATing to wrong IP address, for example). It could certainly be fragmentation too. Best way to tell would be to take a network trace on the server. If you see the client begin the connection but not complete it, chances are that its a fragmentation issue. Enabling IKEv2 fragmentation is done on the server side (supported only in Windows Server 2019 though) and forces fragmentation at the IKE layer as opposed to the IP layer. This allows the traffic to pass through firewalls/routers that are blocking IP fragments. No changes required on firewalls/routers at all.

[Manny-Tech]

So use something akin to Wireshark?

[richardmhicks]

Correct. You can install Wireshark on the server, but you could also take a network trace natively using the following command:

 

netsh trace start capture=yes tracefile=c:\capture.etl

 

Once you're done you can stop the trace using the following command:

 

netsh trace stop

 

It will produce an .ETL file that you'll have to open using Microsoft Network Monitor or Message Analyzer. It won't open in Wireshark, unfortunately. :/

 

If you feel comfortable installing third-party software on your server, install Wireshark. I'd recommend removing it when you're done though. If not, netsh will get you the network trace without having to install any software.