I have a problem that is beginning to drive me crazy, any help is much appreciated.
We have a RRAS Windows 2016 Server running in our DMZ. All our laptops are Windows 10 1607 or 1703. We are using IKEv2 Protocol which uses a computer certificate for authentication.
A number of laptops repeatedly disconnect from Always on VPN but on the other hand some remain connected just fine. This morning for example myself and three other colleagues were connected to the same Wi-Fi Access Point, three of us were working fine and
remained connected but my other colleague continuously kept getting disconnected. We are seeing this happen a lot and I really need to find the root cause of this problem. It's been tried and tested on numerous Wireless networks (In a few of our offices and
many user's home networks and mobile hotspots).
What I've tried and found so far;
- Updated wireless drivers on laptops and updated BIOS
- Installed latest Windows updates on laptops and RRAS Server
- Re-install Always On VPN Profile
- 'Forget' wireless networks on the laptops
- Even though we use IKEv2 I found a few forums posts that mention issues when the VPN is behind a NAT, and so I modified the registry on a couple of affected laptops as follows;
create a new DWORD value called "AssumeUDPEncapsulationContextOnSendRule" under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent" and set it to "2"
What I have noticed is a reoccurring log in event viewer both on the client and server.
On the clients I see: The user dialed a connection named "" which has been terminated. The reason code return on termination is 829. A Google search of this returned that 829 is an (ERROR_LINK_FAILURE). I'm almost certain it's not the wireless
connection as we have laptops connected to the same wireless network in the same small room, and some get the problem and some not.
On the server side I've found something that I think may be related but I don't understand the log well enough. If possible could someone shed some light on what the following means? It's in the RASTAPI.LOG which can be found in C:\Windows\Tracing.
07-11 10:57:34:438: RasTapiCallback: lineDropped. port VPN2-449, id=0xffffffff
[6368] 07-11 10:57:34:438: RasTapiCallback: Idle Received for port VPN2-449
[6368] 07-11 10:57:34:438: RasTapiCallback: changing state of VPN2-449. 5 -> 1
[6368] 07-11 10:57:34:438: RasTapiCallback: lineDeallocateCall for VPN2-449,hcall = 0x8da00a0
[6368] 10:57:34: SyncDriverRequest: Oid(CloseCall), devID(1), reqID(2bb2), hCall(000000000000007B)
[5840] 07-11 10:57:34:438: PortTestSignalState: DisconnectReason = 2
[7876] 07-11 10:57:34:453: DeviceListen: Changing State for VPN2-449 from 1 -> 2
[7876] 07-11 10:57:34:453: DeviceListen: Changing Listen State for VPN2-449 from 4 -> 2
In particular why is it changing state? What do the state numbers 1,2,4 & 5 mean? What does DisconnectReason=2 mean?
I will be grateful of any help please.