Always On VPN

[lmrogers]

Afternoon,

 

Last week I had some servers fail and had to migrate the CA over to a new server. This was fine and has been working fine. I had to reconfigure the Intune NDES connector to point to this new server but once this was done new certs were being issued to devices through Intune and the VPN (profile deployed through Intune) was working fine.

 

This morning though all VPN connections are giving the error:

 

"The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify username and password may not match the authentication method configured in your connection profile."

 

It is currently setup to use a user cert on the laptops to authenticate the users, RADIUS is doing the authentication on the RAS server and the NPS policies have not changed nor has the VPN profile.

 

I have gone through everything I can think of and am still getting the same issue.

 

Has anyone got any ideas?

 

Cheers

[computer_expert]

Run pkiview.msc on your CA server. Do you get any red crosses? If you do, this should give a good idea of where to start looking. Edited May 11, 2020 by computer_expert

[lmrogers]

Run pkiview.msc on your CA server. Do you get any red crosses? If you do, this should give a good idea of where to start looking.

 

So in there I can see that DeltaCRL Location #1 and Location #2 have expired. and location 1 is seemingly pointing to the old CA server.

 

How can I resolve that and would that impact the VPN connection?

 

Thanks,

[computer_expert]

That will be the issue. The server cannot verify what certificates have been revoked so it will reject all certs even if still valid.

 

For the expired CRLs, you should be able to generate new CRLS by opening Certification Authority, expanding your CA, right-click Revoked Certificates , click All Tasks , and then click Publish (do the same for delta crl too)

 

I think the incorrect location is something to to with the CA Exchange certificate.

 

Edit - yes, incorrect location is to do with the CA exchange cert having the old location: https://itcallswin.blogspot.com/2016/01/pkiview-ocsp-location1-error.html

 

Don't forget to update the AIA and OCSP (if you use it) locations in the CA properties before doing the stuff in the link above - https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-cdp-and-aia-extensions-on-ca1

Edited May 11, 2020 by computer_expert

[lmrogers]

That will be the issue. The server cannot verify what certificates have been revoked so it will reject all certs even if still valid.

 

For the expired CRLs, you should be able to generate new CRLS by opening Certification Authority, expanding your CA, right-click Revoked Certificates , click All Tasks , and then click Publish (do the same for delta crl too)

 

I think the incorrect location is something to to with the CA Exchange certificate.

 

Edit - yes, incorrect location is to do with the CA exchange cert having the old location: https://itcallswin.blogspot.com/2016/01/pkiview-ocsp-location1-error.html

 

Don't forget to update the AIA and OCSP (if you use it) locations in the CA properties before doing the stuff in the link above - https://docs.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-the-cdp-and-aia-extensions-on-ca1

 

Thanks, I have now resolved the issues in pkiview and that is now showing as everything is OK but I still have the same issue when trying to connect to the VPN. Do I need to give it any time at all?

[computer_expert]

Have a look at the CRL locations on the NPS server certificate. If it has the old location, you'll need to revoke and reissue the NPS server certificate. I'm not sure if you need to do the same for a user certificate or not (I don't use AO VPN or user based certificates yet).

[lmrogers]

Have a look at the CRL locations on the NPS server certificate. If it has the old location, you'll need to revoke and reissue the NPS server certificate. I'm not sure if you need to do the same for a user certificate or not (I don't use AO VPN or user based certificates yet).

It would appear that I was just being impatient. Thank you for your help! Much appreciated!

[computer_expert]

It would appear that I was just being impatient. Thank you for your help! Much appreciated!

 

Good to hear it's working again. PKI can be a complex beast and stop a lot of things working when it breaks.