We had to update our security for CPI compliance last week. We changed our VPN to AES128 and DH group 14. Since then I cannot connect my android phone to the VPN. I am told by Meraki that some devices do not support DH 14. Is there a way I can connect my S7 to the VPN?
-
After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.
Cannot connect to company VPN
- Thread starter Jeremy Robertson
- Start date
I am the network admin at work. I am the guy, that is why I am asking if anyone else has had issues with compatibility on the android connecting to DH group of 14 and how they resolved it.
Upvote
0
Is it any Android devices that can't connect, or just this Galaxy S7? Does Cisco give you any specifics, as to which Android devices or versions that doesn't support DH?
Last edited:
Upvote
0
I only have two S7's and neither will connect. I have a colleage that has an iPhone and she can connect without issue.
This is the responce from Meraki support
"Hello
Thank you contacting Cisco Meraki Technical Support.
I understand you are facing an issue with respect to client vpn.
AES128 and DH group to 14 was configured. However, it be a scenario where the change it may have a negative impact on the ability for different devices to connect to the client VPN if they are not compatible with that DH group. If any devices they try to connect to the client VPN do not support DH group 14, they will be unable to connect. we cas
Please let me know if you have any questions"
This is the responce from Meraki support
"Hello
Thank you contacting Cisco Meraki Technical Support.
I understand you are facing an issue with respect to client vpn.
AES128 and DH group to 14 was configured. However, it be a scenario where the change it may have a negative impact on the ability for different devices to connect to the client VPN if they are not compatible with that DH group. If any devices they try to connect to the client VPN do not support DH group 14, they will be unable to connect. we cas
Please let me know if you have any questions"
Upvote
0
OK, so after re-reading that Meraki support response I got the sense that a) I'm guessing it really wasn't an answer to your original query at all and b) there's a 'English is not they're primary language' issue but even that aside just going by intent it was more about using verbage as a misdirection.
That said, instead of DH 14, any chance you can bump that up to DH 19 or more and see how that works out? DH 14 being the original 'modulus' Diffie-Hellman as opposed to newer 'elliptic-curve' Diffie-Hellman, at this time ECDH is more prevalent than the original DH.
https://community.cisco.com/t5/security-documents/diffie-hellman-groups/ta-p/3147010
https://arstechnica.com/information...rstand-primer-on-elliptic-curve-cryptography/
That said, instead of DH 14, any chance you can bump that up to DH 19 or more and see how that works out? DH 14 being the original 'modulus' Diffie-Hellman as opposed to newer 'elliptic-curve' Diffie-Hellman, at this time ECDH is more prevalent than the original DH.
https://community.cisco.com/t5/security-documents/diffie-hellman-groups/ta-p/3147010
https://arstechnica.com/information...rstand-primer-on-elliptic-curve-cryptography/
Upvote
0
That is a great read, really helps. I thought since it worked with DH 5 that the device must not support DH 14 but if I understand correctly I can raise the DH group to maybe 19 and it should work?
Upvote
0
Well, I'm just assuming it will work given how dated DH 14 is at this point. Note that primer article is from 2013, which predates the release of those 'problematic' Galaxy S7 phones (early 2016). So my assumption is based on supposition for the most part.
Another clue to this puzzle is I rely on Signal Private Messenger as my texting messaging app, which also uses ECDH -- which I recall was working fine on an even more dated Galaxy S3 back in its day (released in 2012).
https://en.wikipedia.org/wiki/Signal_Protocol
Upvote
0
BEST TECH IN 2023
We've been tracking upcoming products and ranking the best tech since 2007. Thanks for trusting our opinion: we get rewarded through affiliate links that earn us a commission and we invite you to learn more about us.
Smartphones
Best Android Phones
See All- Google Pixel 8 Pro Check Price
- Samsung Galaxy S23 Ultra Check Price
- Samsung Galaxy Z Fold5 Check Price
- Google Pixel 8 Check Price
- Samsung Galaxy S23 Check Price
Upcoming
See All
Best iPhones
See All- Apple iPhone 15 Pro Max Check Price
- Apple iPhone 15 Pro Check Price
- Apple iPhone 15 Plus Check Price
- Apple iPhone 15 Check Price
- Apple iPhone SE (2022) Check Price
Upcoming
See AllTablets
Best Tablets
See All- Samsung Galaxy Tab S9 Ultra Check Price
- Apple iPad Pro (2022) Check Price
- Apple iPad Air (2022) Check Price
- Apple iPad Mini (2021) Check Price
- Microsoft Surface Pro 9 Check Price
Upcoming
See AllLaptops
Best Laptops
See All- Apple Macbook Pro Check Price
- Apple Macbook Air (2023) Check Price
- Dell XPS 13 Check Price
- Acer Chromebook Spin 714 Check Price
- Dell Alienware m18 (2022) Check Price
Upcoming
See AllTelevisions
Best TVs
See All- Samsung The Frame TV Check Price
- Samsung Neo QLED 4K QN90C Check Price
- LG G3 OLED Check Price
- LG A2 OLED Check Price
- ROKU Plus Series Check Price
- Samsung S90C OLED Check Price
- SunBriteTV Veranda 3 Check Price
Upcoming
See AllGame Consoles
Best Game Consoles
See All- Nintendo Switch OLED Check Price
- Microsoft XBOX Series X Check Price
- Sony Playstation 5 Check Price
- Microsoft XBOX Series S Check Price
- Nintendo Switch Lite Check Price
Upcoming
See AllWearables
Best Wearables
See All- Oura Ring 3 Check Price
- Apple Watch Series 9 Check Price
- Google Pixel Watch 2 Check Price
- Samsung Galaxy Watch 6 Classic Check Price
- Fitbit Inspire 3 Check Price
- Amazfit Amazfit Band 7 Check Price
- Apple Watch SE Check Price
- Apple Watch Ultra 2 Check Price
