AOVPN Client disconnection issue

Mahesh Aralelemath 386

Hi,

We have some clients which are getting disconnected from AOVPN Server.
During the issue reported there were other clients in connected state and working fine.
There is no issue observed from server performance, event log and NIC status.
While checking in client end, we could only able to find the below event. Just trying to understand what could be the issue to disconnect VPN tunnel. Pls note that during the issue internet was working fine in client machine. Its just a VPN tunnel got disconnected.

Event ID: 20227
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: XXXX
Description:
CoId={45C90BBA-545B-44FB-8DC0-9563301171DC}: The user SYSTEM dialed a connection named AOVPNTEST which has failed. The error code returned on failure is 868.

Kindly suggest if any findings.

Regards
Mahesh

4 answers

Candy Luo 12,656 Reputation points Microsoft Vendor

2020-08-27T02:51:43.207+00:00

Hi ,

>>We have some clients which are getting disconnected from AOVPN Server.
>>The error code returned on failure is 868.

Will those VPN clients reconnect after disconnecting? Will they keep disconnecting status?

As far as I know, error code 868 always indicates a problem that the name of the remote access server did not resolve.

Can you resolve the VPN server name to an IP address? In Control Panel > Network and Internet > Network Connections, open the properties for your VPN Profile. The value in the General tab should be publicly resolvable through DNS.

Here is an article talking about how to troubleshooting VPN client connection issue, you might have a look:

https://learn.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy-troubleshooting#always-on-vpn-client-connection-issues

Best Regards,

Candy
Please sign in to rate this answer.
Mahesh Aralelemath 386 Reputation points

2020-08-27T06:44:50.72+00:00

Hi Candy,
Yes, we tested these points.
VPN Server name resolve to Public IP and reachable, in fact its connecting from same client however issue is observed intermittently.
Because of this behavior experienced by business leader, they are not comfortable to consider the AOVPN for all business users.
Is there any better way to monitor such issues...

Regards
Mahesh

Candy Luo 12,656 Reputation points Microsoft Vendor

2020-08-27T08:11:48.89+00:00

Hi Mahesh,

If general troubleshooting steps didn't work, we need to trace VPN traffic to find the cause. Tracing and monitoring logs should be necessary in such case.

Unfortunately, analysis of network traffic is beyond our Q&A platform support level. If this issue is urgent, I would suggest you open a case with Microsoft to get an efficient solution:

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Best Regards,

Candy

Mahesh Aralelemath 386 Reputation points

2020-08-27T15:13:01.32+00:00

Hi All,

Just wanted to share the RRAS config details and check if these makes any contribution for client disconnection issue....pls suggest.

Candy Luo 12,656 Reputation points Microsoft Vendor

2020-08-28T06:11:34.857+00:00

Hi ,

Due to the limited environment, we didn't have much clients to test in our lab. You might try to configure SA value mentioned by Richard:

Use 28800 (8 hours) for the SALifeTime value and leave the SADataSizeForRenegotation at 102400 (100 MB).

For your reference:

https://directaccess.richardhicks.com/2018/12/10/always-on-vpn-ikev2-security-configuration/

Best Regards,

Candy

Mahesh Aralelemath 386 Reputation points

2020-09-03T08:59:06.5+00:00

Hi Candy,

We did this change to match the SALifetime value as mentioned in article but this is not helping anything.
We are still seeing disconnect issue from couple of users and while checking observed that System event id: 868 but this takes me to DNS name resolution which is not correct.
During the issue its observed that internet connection is stable and user is well connected to MS Teams.
Only issue observed is for VPN connection or applications running over VPN tunnel.
Is there any other reason for this behavior?
Any thoughts on Symantec or any other agent causing such issue? Do we any similar experience observed?

Regards
Mahesh
Sign in to comment
sysadminjames 126 Reputation points

2020-09-04T10:08:35.07+00:00

Do you see a security event log from the public IP of the users when they fail to connect?
Please sign in to rate this answer.
Mahesh Aralelemath 386 Reputation points

2020-09-04T12:59:24.34+00:00

Hi James,
Couldn't see anything in security events both in Server and client.
Wondering how to trace this...even not able to simulate in my machine but its troubling some important business user.

Regards
Mahesh

Mahesh Aralelemath 386 Reputation points

2020-09-10T17:46:30.913+00:00

Hi All,

Just to let you all know that, ticket is opened with MS support team and logs are being shared from last two days but no progress yet. Just thinking to update the build to 2004 and latest Sept 3rd update.
Let me know if any one tried and share your experience.

https://support.microsoft.com/en-us/help/4571744/windows-10-update-kb4571744

•Addresses an issue that prevents Always On VPN (AOVPN) from automatically reconnecting when resuming from Sleep or Hibernate.
•Addresses an issue that causes AOVPN user tunnels to use an incorrect certificate.
•Addresses an issue with AOVPN that occurs when user and device tunnels are configured to connect to the same endpoint.
•Addresses an issue that causes VPN apps to stop working in some cases when they attempt to enumerate VPN profiles.

Regards
Mahesh

sysadminjames 126 Reputation points

2020-09-15T07:17:05.6+00:00

We are trialling 2004 and that update in our Test OU and so far so good, seen a notable improvement on the waking from sleep issue.

Are you looking at a user tunnel or device ?

Mahesh Aralelemath 386 Reputation points

2020-09-15T08:06:38.797+00:00

Hi
We have Device tunnel in our environment.
We also did 2004 with patch released on 3rd Sept in one Surface2 system but after that AOVPN stopped to connect automatically sometimes.
Still ticket is going on with MS.

Regards
Mahesh

sysadminjames 126 Reputation points

2020-09-29T23:36:07.287+00:00

Mahesh,

Can you share any updates on this one?

Mahesh Aralelemath 386 Reputation points

2020-09-30T06:07:10.313+00:00

Hi,

As per the last trace and observation, MS mentioned that there is a packet loss and client is not receiving responses to all requests. Its also found that Server is responding to all client request.
Now its really open ended that where the problem is...still looking for it and issue is so intermittent that we are not able to capture when it happens.

Regards
Mahesh
Sign in to comment
Nitin Kumar 1 Reputation point

2021-01-21T05:31:24.757+00:00

Hi @Mahesh Aralelemath ,

Did you manage to find the root cause of the issue ?
I have just implemented always on VPN in our environment and currently testing with pilot users.
Experienced the same issue randomly with event logs on the server saying: " The reason for disconnecting was administrative settings or explicit request. The tunnel used was WAN Miniport (IKEv2). The quarantine state was. "

Thanks,
Nitin
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Mahesh Aralelemath 386 Reputation points

2021-01-21T06:19:38.11+00:00
Hi Nitin,

Gradually this is under control now but there is no single solution as direct to this issue.
In our case, below are some points followed to streamline.

Observed some disconnection issue at firewall and fixed with the help of vendor/Firewall Team. This is more of holding the session in Firewall rather than force disconnection.

Update the Windows with latest patches where Sleep issue was also addressed - KB4577062

IKEv2 fragmentation

AOVPN provides better experience on Windows 2019 specially for IKEv2.

All these personal experience
Please sign in to rate this answer.
Nitin Kumar 1 Reputation point

2021-01-27T00:37:12.853+00:00

Thanks for your prompt reply @Mahesh Aralelemath ,

Windows 10 is fully patched and latest version, cannot use IKEv2 fragmentation as I am running RRAS on Server 2016. Can I please confirm what exactly was the behaviour on the firewall and if you mean idle timeout was increased. What type of firewall are you guys using ? I am using a Palo Alto Firewall.
The issue has become worse since I implemented better IKEv2 security as per below Richard Hicks article.

https://directaccess.richardhicks.com/2018/12/10/always-on-vpn-ikev2-security-configuration/

Thanks,
Nitin
Sign in to comment