Windows 10 VPN – L2TP/IPSec With Certificate

vpn

I keep unsuccessfully connecting to a VPN and get the following message: The L2TP connection attempt failed because the security layer encountered a processing error during the initial negotiations with the remote computer.

I triple checked to make sure all of my login information, address and related were correct. I also made some changes to the adapter settings to allow different protocols. I am using CHAP version 2. Previous to the change in adapter settings, it failed anyway.

Any help would be appreciated.

Thanks.

Best Answer

Perhaps this blog entry could help. #3 below fixed this issue for me:

Incorrect pre-shared key: Solution: Ensure that the pre-shared secret is configured correctly on the client machine. It must match between the MX and the client.
Firewall blocking VPN traffic to MX: Solution: Ensure UDP ports 500 (IKE) and 4500 (IPsec NAT-T) are being forwarded to the MX and not blocked. If traffic cannot reach the MX on these ports, the connection will timeout and fail.
IKE and AuthIP IPsec Keying Modules disabled: Solution: This occurs most often when 3rd party VPN software has been installed and disables the IKEEXT service. This can be re-enabled by navigating in Windows to Control Panel > Administrative Tools > Services. Find the service named “IKE and AuthIP IPsec Keying Modules” and open it. Change the Startup type to “Automatic”. it may be necessary to remove the 3rd party VPN software.

In my case, I didn't have to uninstall any third party VPN software.

Related Solutions

Networking – Remote Access error 789

It can be a protocol incompatibility (AES/3DES, etc).

Check the firewall settings
UDP port 500 and 4500 should be NATed and 1701 forwarded
Run services.msc as administrator.
Find “IKE and AuthIP IPsec Keying Modules” and “IPsec Policy Agent” Check the status, right click to “restart” if it states “started” If the “started” option is disabled, enable it.
Right click and scroll down and click on Properties Select the “Startup type” and change it to “Automatic” and save Restart your VPN and it should work smoothly now as the protocol settings should reset to default
If that does not work, you will have to manually set the encryption method for both server and clients so they are compatible.

Windows – Can’t connect to L2TP IPsec VPN from Windows 10 but it works with macOS High Sierra

That error message probably means that there is some level of connection between Windows and the Ubiquiti but they failed to find a common encryption method. For phase1 (key exchange) Windows (version 1803) is proposing the following encryption methods (in this priority order):

SHA1 + AES-CBC-256 + ECP384
SHA1 + AES-CBC-128 + ECP256
SHA1 + AES-CBC-256 + MODP2048
SHA1 + 3DES-CBC + MODP2048
SHA1 + 3DES-CBC + MODP1024

For phase2:

SHA1 + AES-CBC-256
SHA1 + AES-CBC-128

Make sure the Ubiquiti can accept one of these proposals so try to set the phase1 and phase2 proposals on the Ubiquiti to something like this.

set vpn ipsec ike-group FOO0 lifetime 86400
set vpn ipsec ike-group FOO0 proposal 1 dh-group 14
set vpn ipsec ike-group FOO0 proposal 1 encryption aes256
set vpn ipsec ike-group FOO0 proposal 1 hash sha1
set vpn ipsec esp-group FOO0 lifetime 43200
set vpn ipsec esp-group FOO0 pfs disable
set vpn ipsec esp-group FOO0 proposal 1 encryption aes128
set vpn ipsec esp-group FOO0 proposal 1 hash sha1

I would also enable NAT-Traversal too:

set vpn ipsec nat-traversal enable

I do not really know Ubiquiti but maybe this helps.

Best Answer

Related Solutions

Networking – Remote Access error 789

Windows – Can’t connect to L2TP IPsec VPN from Windows 10 but it works with macOS High Sierra

Related Question