Mac standalone Endpoint VPN - Negotiation with site failed

[Howard_Gyton]

Hi,

We have a Mac user, personal machine, running E89.20 standalone VPN for Mac.  We are using 2FA with MS Azure as our identity provider.

When this user tries to connect, it stalls and eventually reports that negotation with the site failed.  We've tried both Safari, and Chrome, and get the same result.  On a hunch, as I think we had this with another user a while back, I asked them to create another local user account, sign in to that, and re-test.  And that works.

The suspicion at the time was that some other program was getting loaded first, and blocking a port that Endpoint VPN is using.  I've had a dig around with netstat, and the only port I can readily identify is TCP/7778.  The output of that command doesn't look much different when run under either user.

We also made sure that all login items were disabled except for Endpoint VPN, hoping that it would load before whatever the other program is that may or may not be blocking it attempts to load.

Does anyone have any hints on this or have come across this before?

Howard

[PhoneBoy]

There should be an option in the VPN client to collect debugs.
I suggest reviewing those, possibly in consultation with TAC.

[Howard_Gyton]

Thank you, wll do!

[po153]

Did you get it fixed? As I start getting the same problem for MAC users.

[Howard_Gyton]

Nothing solid back from our support partner yet.  We did have a remote session only to confirm what was happening.

Our user has two choices:

1. Spend a week or more, and several remote sessions with CP R&D trying to find out what is occuring.

2. Spend 5 minutes creating a new user profile, and porting all their data across to this new profile, where it will work.

I like 2 from an expediency point of view, but given that this has happened already once if not twice before I would like to get to the bottom of it.

[po153]

On my end it is the same all works fine on R81.20 and on Recommended release R82 multiple issues with mfa, currently TAC is playing with timeouts but to be honest this is disaster based that this release has 2 years comparing to other security vendors which I never had such issue.

[Howard_Gyton]

We don't have a fix yet, and we are waiting for the end user to be available to cooperate with a TAC case.  So far the only workaround we have is to create a new user profile, and in that profile it works.  Fallback is to migrate all user data into the new profile, then delete the problematic one.