VPN connection to ASDK failed on 1902

[misainat]

Error: you are able to RDP to the box with the credentials, I could not get the VPN connection to work with that username/password combination

[bganapa]

Unfortunately this is broken on ASDK build of 1902 and later. The problem is not with your username and password combination (if you haven't already figured that out), but rather with a change to the protocol used for the P2S connection.
To work around this problem you need to do the following.
Change the settings on the host
First you’ll need to make changes to the auth protocol used on the ASDK server side.
RDP to the ASDK host.
Open an elevated PowerShell session, logging in as the AzureStack\AzureStackAdmin using the password you provided at Deployment time.
Run the following commands.

netsh nps set np name = "Connections to Microsoft Routing and Remote Access server" profileid = "0x100a" profiledata = "1A000000000000000000000000000000" profileid = "0x1009" profiledata = "0x5"
restart-service remoteaccess -force

Modify the client side connection script
The easiest way to do this is to make changes directly to the C:\AzureStack-Tools-master\connect\azurestack.connect.psm1 script module.
Modify the Add-AzsVpnConnection function to change the AuthenticationMethod parameter from MsChapv2 to EAP.

$connection = Add-VpnConnection -Name $ConnectionName -ServerAddress $ServerAddress -TunnelType L2tp -EncryptionLevel Required -AuthenticationMethod Eap -L2tpPsk $PlainPassword -Force -RememberCredential -PassThru -SplitTunneling

Change the Connect-AzsVpn function to from using rasdial @ConnectionName $User $PlainPassword to using rasphone as EAP requires interactive logon.

rasphone $ConnectionName

Save your changes and then re-import the azurestack.connect.psm1 module.
Follow the instructions in the https://docs.microsoft.com/en-us/azure/azure-stack/asdk/asdk-connect#set-up-vpn-connectivity article.
When you go to connect to the ASDK via VPN, you should connect by navigating to Network & Internet Settings | VPN rather than connecting from the taskbar to ensure that you are prompted for credentials (see image below).

I sincerely apologize for the frustration this has caused! I'm working on getting this inlcuded in the release notes, fixed in later builds and the tools updated.

[bganapa]

The fix will be part of 1904 release

[mclgoerg]

bganapa Thank you for your update.
I just updated our ASDK to 1904 and still have the VPN issue.
The following values are set (they seem correct):

Network policy configuration:
---------------------------------------------------------
Name             = Connections to Microsoft Routing and Remote Access server
Profile attributes:
Name                                    Id          Value
---------------------------------------------------------
NP-Allowed-EAP-Type                     0x100a      "1A000000000000000000000000000000"
NP-Authentication-Type                  0x1009      "0x5"

I have changed the AuthenticationMethod from MsChapv2 to EAP and now the VPN connection works, BUT the interactive login is a big step backwards. Is there a solution for this?

[bganapa]

Marcel Goergens (@mclgoerg) I understand its terrible that it needs interactive login. We haven't found a solution that does not require a interactive login. I am reaching out to few folks here, if we can find a better solution. misainat can you please update the script for the needed changes?

[bganapa]

PR - #507

[bganapa]

For Azure Stack versions 1903 or earlier, please use the code from the tag PRE-1904. For the Azure Stack version 1902 and 1903, the work around mentioned in this issue is needed

[bganapa]

The PR is merged. The master branch is good for 1904 and 1904 plus releases