Troubleshooting MX Client VPN Connection Attempts

Last updated
Save as PDF

This article provides potential causes as to why the MX is not receiving the Client VPN connection attempt and how to troubleshoot them with packet captures.

Overview

This article describes potential causes and troubleshooting steps for why a Cisco Meraki MX WAN appliance is not receiving a Client VPN connection attempt. Use packet captures to help diagnose the issue.

Troubleshooting MX client VPN connectivity issue

The MX is not receiving connection attempts from the client device.

Troubleshooting steps

Method 1. Event log review

Review the event log and confirm that the connection attempt is not reaching the MX.

In the Meraki dashboard, navigate to Network-wide > Event log
Select security appliances from the drop-down menu at the top of the page
In the Event type include field, enter All Client VPN and select Search
Review the results for Client VPN Negotiation events from the public IP address of the client

If the connection attempt is not reaching the MX:

Confirm that UDP ports 500 and 4500 are not blocked on the client network
- Check the access control and firewall settings upstream of the client
Verify that UDP ports 500 and 4500 are not blocked upstream of the MX
Test connectivity between the public IP of the client and WAN IP of the MX with a ping to validate that the peers can communicate over the internet

Method 2. Using packet capture

A packet capture can confirm that the connection attempt is not reaching the MX. Refer to the Troubleshooting Client VPN with Packet Captures for more information.

Start the packet capture on both the MX WAN and Client VPN interface before an attempting to connect to Client VPN
On MX WAN capture, filter for the requesting client’s public IP address
Review the results for any traffic reaching the MX WAN

If no packets are reaching the MX:

Confirm that UDP ports 500 and 4500 are not blocked on the client network
- Check the access control and firewall settings upstream of the client
Verify that UDP ports 500 and 4500 are not blocked upstream of the MX
Test connectivity between the public IP of the client and WAN IP of the MX with a ping to validate that the peers can communicate over the internet