Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,773 questions
Having issue connecting to Azure Point-to-Site VPN connection from MacOS using Azure VPN Client.
Prashanta Shrestha
71
Reputation points
I am not able to initiate a Point-to-Site VPN connection to Azure network. I am using Azure VPN Client on a MacOS. The username and password are accepted but when going through the second-factor authentication ,
I get a window with the following message:
Azure VPN Gateway
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 27,461 Reputation points Microsoft Employee Moderator2023-09-23T03:25:08.1+00:00 Thank you for reaching out.
As per the prompt above do you need to install Microsoft Authenticator app to perform two step authentication?Have you configured AAD authentication for your VPN?
Thank you!
-
Prashanta Shrestha 71 Reputation points
2023-09-23T14:22:55.5+00:00 Thanks for your response.
Yes AAD authentication has been configured for the VPN.
I have Microsoft Authenticator App on my phone and have been using it for two step auth for other services like Microsoft Work Account, Azure Portal.
The two factor step used to work before when logging into VPN using the Microsoft VPN Client app on Mac OS.
Best,
Prashanta
-
ChaitanyaNaykodi-MSFT 27,461 Reputation points Microsoft Employee Moderator
2023-09-26T03:00:38.8466667+00:00 Thank you for getting back.
You can additional troubleshooting steps mentioned below and see if that helps in pin-pointing the issue.
It will help troubleshoot, if you can take a look at the application logs. Application logs can be found from
Settings -> Show Logs DirectoryORUnder folder:
/Users/<CurrentUser>/Library/GroupContainers/UBF8T346G9.group.com.microsoft.AzureVpnMac.shared/LogFilesApplication control plane logs file is named
AzureVpnClient.log. Application data plane OpenVPN protocol level logs filecom.microsoft.AzureVpnMac.PacketTunnel*.log.Please let us know if you are able to locate any errors in the logs. Thank you!
-
Prashanta Shrestha 71 Reputation points
2023-09-28T02:44:03.22+00:00 I looked at the
AzureVPNClient.logand this is the log I get after clicking "connect":09/27/2023 22:33:16 Information Group token flag status: false 09/27/2023 22:33:16 Information getClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac 09/27/2023 22:33:16 Error getKeyChainSecret: Failed to retrieve KeyChain secret. Status code -25300 09/27/2023 22:33:16 Error handleAADClientAuthCachedUser: There is no last used account Username saved in KeyChain for VpnConnection: VNET-IIOT-PROD AAD Auth! 09/27/2023 22:33:16 Information sAcquireTokenInteractivelyNeeded: Account is not saved so interactive login will be needed. 09/27/2023 22:33:16 Error IsAcquireTokenInteractivelyNeeded: No AAD token acquired silently, Interactive login is required! 09/27/2023 22:33:16 Information removeClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac 09/27/2023 22:33:16 Information getClientAuthLoginCredentials: Using account: com.microsoft.AzureVpnMac 09/27/2023 22:33:16 Error getKeyChainSecret: Failed to retrieve KeyChain secret. Status code -25300 09/27/2023 22:33:16 Warning removeClientAuthLoginCredentials: Failed to retrive previously saved ClientAuth: aad secret for Vpn connection: VNET-IIOT-PROD, so no cleanup is needed! 09/27/2023 22:33:16 Information IsAcquireTokenInteractivelyNeeded: Cleared saved AAD auth login account Username from KeyChain as user will need to do interactive login to acquire AAD token. 09/27/2023 22:33:16 Information Acquiring AAD token interactively...After which it presents me with a login form, after putting my username and password it shows this:
Then after clicking Next it shows this, as before:
When I close this window, the following log gets append in
AzureVPNClient.log:09/27/2023 22:39:51 Information Could not acquire AAD Credential Token for User: in acquireTokenInteractively. Error: Optional(User cancelled the authorization session.)The username I am using against the AAD is an External user (also a Work Microsoft Account) invited as guest.
However when I try with the direct user of the AAD tenant, I am able to log in successfully. After the login dialog I get the second-factor challenge and I am able to login. I also had to change the Certificate Information from
DigiCert Global Root G2toDigiCert Global Root CA.Looks like I encounter the problem when trying to use the Guest User.
-
ChaitanyaNaykodi-MSFT 27,461 Reputation points Microsoft Employee Moderator
2023-10-06T03:25:27.8766667+00:00 Apologies for the delay here.
Based on the error above, can you please try reinstalling the Azure VPN Client and importing the configs?
If that doesn't work, to troubleshoot the exact issue I think we will need specialized 1:1 session, where a support engineer can have a screen share session to pin point the issue. If you have a support plan you may file a support ticket, else could you please send an email to azcommunity@microsoft.com with the below details.
Subject : Attn Chaitanya
Thread URL: Link to this thread.
Subscription ID
Please let me know once you have done the same.
Sign in to comment
Sign in to answer