The next error I want to take a look at is the error 13801.
And this is specific to IKEv2 connections.
In this scenario, it's almost always a certificate issue,
but it might not always be what you expect.
Let's generate a connection, and let's see this failure in action.
And so you'll see simply it just returns IKE
authentication credentials are unacceptable.
The most common cause of a 13801 error is a misconfiguration of
the server certificate on the VPN server.
So here we are on our VPN server,
and I'm going to open up the local computer certificate store.
And here I want to take a look at the certificate that I use for my VPN server.
This is my public server certificate.
This is a remote desktop certificate.
This is the certificate that I'm using for IKEv2. And if I double‑click on
this, one of the things that you'll notice is that it is issued to the
server's host name and not the public host name.
So the public host name is just simply vpn.richardhicks.net
in our examples. And here the certificate,
although it's valid and trusted and configured
correctly, has the wrong host name.
So this is essentially a host name mismatch of sorts, but it manifests
itself fundamentally as an IKE authentication error. And this can also
happen in a couple of other scenarios.
For example,
you could just simply be using the wrong host name in your VPN configuration on
the client, and so that can also lead to the same problem.
So now I've corrected the certificate issue.
Now you'll see that the certificate has the correct host
name. But also understand that there are some other things
that can cause the 13801 as well.
It's not uncommon for there to be certificate chain issues on the server.
If any of the root or intermediate certificates are missing from the VPN server,
that can cause a 13801. It's also possible that the root
or intermediate certificates are not in the appropriate
stores on the endpoint as well.
So be sure to check the client configuration there.
Also,
the one last thing I want to make mention of here is that
certificate revocation lists, or CRLs, if they have expired, those certainly can cause 13801 messages too.