RasClient (Always On VPN) returning error code 5

Question

One of our vpn clients (which was working successfully with Always On VPN) reported that vpn is connecting anymore. No one else is reporting the same issue.

Event Viewer on client shows:

CoId={3BE59FC6-9EED-0001-2712-E73BED9ED601}: The user domain\username dialed a connection named PA_AlwaysOnVPN which has failed. The error code returned on failure is 5.

Logs on Network Policy Server show that the user has been allowed connection, and Event Viewer on RAS server shows the event as:

RoutingDomainID- {00000000-0000-0000-0000-000000000000}: CoID={E8F89131-25DC-CB24-E98E-181802040EE5}: The user user@keyman connected on port VPN2-499 on 11/10/2020 at 07:17 and disconnected on 11/10/2020 at 07:17. The user was active for 0 minutes 0 seconds. 0 bytes were sent and 3284 bytes were received. The reason for disconnecting was administrative settings or explicit request. The tunnel used was WAN Miniport (IKEv2). The quarantine state was .

Trying to connect with rasphone.exe on the client, shows message as:

Applying configured settings

Error 5: Access denied

While rasdial command on same machine shows:

Connecting to PA_AlwaysOnVPN...
Verifying username and password...
Registering your computer on the network...Access is denied.

Any ideas what's going on please

Answer 1

Update....

This morning installed Hyper-V Manager on the effected machine and vpn connection is staying in the "Completing Connection" stage

RAS server shows the client as connected and an IP address has been assigned....

Yet, Get-NetIPConfiguration shows that the VPN virtual NIC's address is 169.254.0.80 so the issue seems to be that the virtual nic is not registering the IP address.

If I try to manually disconnect the VPN connection, it stays in the disconnecting state, while still showing as connected in RAS server. If one manually disconnects the session directly from RAS server, the machine still stays in the disconnecting state

Eventviewer shows error returned 631

Answer 2

@David Spiteri Hi,

Thank you for posting in Q&A! Apologize for the late reply!

> VPN server event 20272:The reason for disconnecting was administrative settings or explicit request. The tunnel used was WAN Miniport (IKEv2).

This Event normally regarding Maximum ports for IKEV2 connection.
Did the current user exceed the maximum number of IKEV2 connection? You can manually change the Maximum ports for IKEV2 connection. The number of available ports should be between 0 and 30000.
In addition, actual limit is network/hardware/performance based. The limiting factors for concurrent VPN connections will be the capacity of the hardware and the number of available IP addresses available to assign to VPN clients.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Thanks for your answer, however it is not an issue from RAS side. The number of ports and IP addresses available is far more than needed.

It is more of a local issue as I have posted this morning in the Updated section.