We value your privacy

We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies.

Customize Consent Preferences

We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below.

The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... 

Always Active

Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

No cookies to display.

Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

No cookies to display.

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

No cookies to display.

Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.

No cookies to display.

Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns.

No cookies to display.

Loading

Entra Remote Network to Draytek 2860n Failure

Luke SmithMicrosoft

This article details the configuration issues with a Draytek 2860n VPN into Microsoft Entra.

Issue

You try to connect your Draytek 2860n but receive the below error in the logs:

2023-10-17 18:36:26 [IPSEC][L2L][1:EntraVPN][@xxx.xxx.xxx.13] IKE link timeout: state linking
 2023-10-17 18:36:14 ## IKEv2 DBG : IKE SA #9760:STATE_IKESA_I is going to be deleted, delete its CHILD SA #9761:STATE_PARENT_I2
 2023-10-17 18:36:14 ## IKEv2 DBG : INFORMATIONAL : Receive IKEv2 Delete IKE SA request from xxx.xxx.xxx.13, deleting #9760
 2023-10-17 18:36:14 ## IKEv2 DBG : IKESA inR2 : Can’t decrypt message
 2023-10-17 18:36:14 ## IKEv2 DBG : Missing payload : IKEv2_NP_v2SA+0x1840
 2023-10-17 18:36:14 ## IKEv2 DBG : Received IKEv2 Notify [12345]
 2023-10-17 18:36:14 ## IKEv2 DBG : Recv IKEv2_AUTH[35] Reply msgid 1 from xxx.xxx.xxx.13, Peer is IKEv2 Responder
 2023-10-17 18:36:14 ## IKEv2 DBG : #9760 IKE SA Established, REPLACE after 21375 seconds
 2023-10-17 18:36:14 ## IKEv2 DBG : IKESA inR1_outI2 : Create CHILD SA #9761, IKE SA is #9760
 2023-10-17 18:36:14 ## IKEv2 DBG : NAT_T Lookup : Peer is behind NAT
 2023-10-17 18:36:14 ## IKEv2 DBG : IKESA inR1_outI2 : Receive Notify IKEv2_NAT_DETECTION_DESTINATION_IP[16389]
 2023-10-17 18:36:14 ## IKEv2 DBG : IKESA inR1_outI2 : Receive Notify IKEv2_NAT_DETECTION_SOURCE_IP[16388]
 2023-10-17 18:36:14 ## IKEv2 DBG : Received IKEv2 Notify IKEv2_NAT_DETECTION_DESTINATION_IP[16389]
 2023-10-17 18:36:14 ## IKEv2 DBG : Received IKEv2 Notify IKEv2_NAT_DETECTION_SOURCE_IP[16388]
 2023-10-17 18:36:14 ## IKEv2 DBG : Recv IKEv2_SA_INIT[34] Reply msgid 0 from xxx.xxx.xxx.13, Peer is IKEv2 Responder
 2023-10-17 18:36:13 ## IKEv2 DBG : IKESA outI1 : Create IKE SA #9760 Profile Index 1
 2023-10-17 18:36:13 Dialing Node1 (EntraVPN) : xxx.xxx.xxx.13
 2023-10-17 18:36:13 Re-dial L2L[1], ifno: 10, status: 0 from WEB…

Reason

Reason for the failure is because the device is unable to decrypt the key. This might be because cypher suites are not be supported. – Currently working with Draytek to understand how this can be resolved.