Troubleshooting Client VPN When all Devices Cannot Connect

Troubleshooting steps

1. Verify that your MX is online and accessible over the internet.
2. In the Meraki dashboard, navigate to Security & SD-WAN > Monitor > Appliance status. 
3. Select the Tools tab at the top of the Appliance status page. 
4. Select the Ping appliance button. 
5. Confirm that the MX successfully returns a ping. 

Possible causes

When using two uplink connections, the MX IP address may change when the uplink fails over from primary to secondary. VPN connections configured to use the primary MX IP address would no longer work. 

Troubleshooting steps 

1. Verify that the client VPN is configured to connect to the MX using the correct IP address.
2. In the Meraki dashboard, navigate to Security & SD-WAN > Monitor > Appliance status to confirm the current MX IP address. 

Troubleshooting steps

1. Enable Dynamic DNS on the MX and using the hostname (e.g. ".com") rather than the MX IP address for connecting to the VPN.
2. In the Meraki dashboard, navigate to Security & SD-WAN > Monitor > Appliance status to locate the MX hostname (for example, your-network.dynamic-m.com). 

Troubleshooting steps

1. If the MX is behind a NAT device (for example, an upstream router or ISP modem), the MX uplink IP may have a private IP in the 172.16.X.X, 192.168.X.X, or 10.X.X.X subnet range. Verify that UDP traffic on ports 500 and 4500 is being forwarded to the private uplink IP address of the MX.
2. Verify that no firewall is blocking UDP traffic on ports 500 or 4500.
3. Take a packet capture on the WAN interface of the MX and confirm that traffic from the public IP of the VPN client on UDP ports 500 and 4500 is reaching the MX. 

Refer to the Troubleshooting Client VPN with Packet Captures article for more information. 

Troubleshooting steps 

If receiving authentication errors:

1. Verify that the VPN client is configured with the correct username, password, and shared secret. 

2. If the issue persists, try a different authentication method, such as Meraki Cloud Authentication, RADIUS, or Active Directory. 

Troubleshooting steps 

VPNs require the shared secret to match on the VPN server and client before tunnels can be established.

To view the shared secret:

1. In the Meraki dashboard, navigate to Security & SD-WAN > Configure > Client VPN.
2. Select the IPSec Settings tab and scroll down to Shared secret.
3. Select Show secret and confirm the shared secret matches the pre-shared key used in the VPN client configuration.
4. If the issue persists, try changing the shared secret. As a best practice, the shared secret should not contain any special characters at the beginning or end.