AlwaysOn VPN

[Bankesy]

Good afternoon,

 

I have no experience with AlwaysOn VPN, I just know we have always had the one I inherited and largely it has always worked as expected until now. I cannot think of any recent changes but now when we connect to the user tunnel from client devices we get the following error:

 

IKE failed to find valid machine certificate.

 

I don't really know where to begin with troubleshooting this so if anybody has any ideas please throw them at me.

 

Thanks

[lmrogers]

Sounds like the VPN is using machine certs to auth the connection but has not been able to renew the machine cert. You can check the local certs on the machine and see if there is one that has expired. You should then have a CA somewhere with some templates so have a look around in the CA and see what certs it should be issuing. I have also seen this where the machines are managed through Intune and use SCEP profiles to get certs, again could be something in that profile that might need looking at if the machine is not picking up a new cert.

[Bankesy]

@Imrogers

 

I've had a look on the client and can see the cert, looks fine but you have just reminded me that I think my predecessor did have some Intune policies for the VPN so I'm going to look there.

 

I can see the name of the CA but I don't exactly know where that is if that makes sense.

 

Thanks

[3s-gtech]

The device certs only last so long, then have to be renewed. Mine are yearly. Here's my guide:

 

Getting IKEv2 certificate errors, so clients can't connect?  This is the renewal process for AoVPN certs and needs to be done yearly.  

The AoVPN server itself does not auto-renew its certificate - certname.domain. This is issued by the CA, which is good enough for this purpose as it doesn't need a valid chain.  On the AoVPN server, open certlm from a run dialog. This should open the Local Computer store. 

Navigate to Personal/Certificates. Right click on certname.domain, select All Tasks and choose Request Certificate with New Key or Advanced Operations --> Request New Certificate with the same key.  
Go through the wizard, and for the additional info needed select the (Subject name:) Common name as certname.domain and the (Alternate name:) DNS as certname.domain, click on Add to select these.  
Complete the wizard with Enroll. Delete the old cert (keep a copy if you want). 
In RRAS console, right-click on the server name and click Properties. Select Security tab and under SSL Certificate Binding select the new certname.domain cert in the list. 
Restart the RRAS server through the RRAS console. 
Clients should now be able to connect.

Edited March 18, 2025 by 3s-gtech

[lmrogers]

Was the cert valid or had it expired?

 

I remember sometimes those messages could be misleading so it might also be worth having a look in the Event Viewer for the errors when trying to connect

 

Always On VPN Authentication Failure After February 2025 Security Update | Richard M. Hicks Consulting, Inc. - this is slightly different but might be worth checking as well

 

Always On VPN – Basic Deployment Guide – Jon's Notes - This might help with understanding the setup of AOVPN a bit more.

[Bankesy]

@3s-gtech @Imrogers

 

Might be onto something here, I've found the cert exactly where you described in certlm on the AOVPN server (it expired a few days ago) but regardless of which renew option I choose I get an error telling me that an enrollment policy server cannot be located.

 

Thanks

[3s-gtech]

CA online and working? You may need to do the request manually if it's not working straight through certlm.

 

https://community.spiceworks.com/t/need-help-reissuing-server-certs-with-internal-ca/942529/11

 

If you're past the renewal grace period you may need to just request a new cert from your CA.

[slugshead]

Which server has your CA installed, check that's running (It might be on a DC if you've ever had anything RM).

 

That will have a template certificate published that AOVPN needs, these get published to AD.

 

You should have a group policy in place to auto renew that certificate on your devices. If that's not working, open certlm, go to the right store, right click, request new, pick from template, find the AOVPN one and next next next and you're done.

 

I've recently setup AOVPN up from scratch, so it's all still quite fresh

 

Verify your templates against this

 

https://learn.microsoft.com/en-us/windows-server/remote/remote-access/tutorial-aovpn-deploy-create-certificates

 

You can also verify the AOVPN profile, from powershell use - Get-VPNCnnection -AllUserConnection

[slugshead]

I've had a few come down with some errors this week. 

 

Fixed it with...

 

netsh winsock reset

[Space_Munkey]

I just renewed our certs yesterday after a failed attempt last week.

 

One thing I will say is write yourself a guide once you have it figured out and when renewing in future, if your servers are VMs - take a snapshot!

 

The mistake I made was not snapshotting, broke the certificates (still not sure how) and panicked (...only a little bit, I swear!), tried recovering a snapshot from backup, broke it, which somehow deleted the entire VM and ended up having to restore the entire server from backup so that staff who were off sick could get back online 🤣

 

Not my proudest moment but at least I learnt how to recover an entire VM from backup.