Creating Client VPN Endpoint failing through CLI and Powershell


I'm trying to create a new Client VPN Endpoint either through the CLI or Powershell and I'm getting the same error for both - "An internal error has occurred"

Here are the calls I'm trying (changed arn, Id's, and ip's to protect the innocent):

$authOption = New-Object 'Amazon.EC2.Model.ClientVpnAuthenticationRequest'
$authOption.Type = "string"
$authOption.ActiveDirectory = New-Object 'Amazon.EC2.Model.DirectoryServiceAuthenticationRequest'
$authOption.ActiveDirectory.DirectoryId = "d-0000000cc99"
$createVpnResponse = New-EC2ClientVpnEndpoint -ClientCidrBlock "" -ServerCertificateArn "arn:aws:acm:us-east-1:999999999999:certificate/9999999a-9999-9999-9999-999999999999" -AuthenticationOption $authOption -DnsServer @("", "") -Description "Client VPN for employees to connect into the VPC." -ConnectionLogOptions_Enabled $false -Verbose


aws ec2 create-client-vpn-endpoint --client-cidr-block --server-certificate-arn arn:aws:acm:us-east-1:999999999999:certificate/9999999a-9999-9999-9999-999999999999 --authentication-options "Type=string,ActiveDirectory={DirectoryId=d-0000000cc99}" --connection-log-options "Enabled=false" --dns-servers "" "" --description "Client VPN for employees to connect into the Corp VPC."

This is the error I keep getting:

New-EC2ClientVpnEndpoint : An internal error has occurred
At C:\Batch\AWS_CreateVPN.ps1:19 char:22
+ $createVpnResponse = New-EC2ClientVpnEndpoint `
+                      ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Amazon.PowerShe...nEndpointCmdlet:NewEC2ClientVpnEndpointCmdlet) [New-EC2ClientVpnEndpoint], InvalidOperationException
    + FullyQualifiedErrorId : Amazon.EC2.AmazonEC2Exception,Amazon.PowerShell.Cmdlets.EC2.NewEC2ClientVpnEndpointCmdlet

Does anyone have any ideas on what the issue is? I think I had the CLI version working in the past but today I updated to the latest version of the AWS Tools for Windows to get the Powershell cmdlets and now nothing is working. I'm not sure if I'm missing something or if it's an issue with the cmdlet/cli or on the AWS end. I am able to create the VPN through the console.

asked 4 years ago20 views
1 Answer

Not needed anymore. Billing is done by active associations so we decided not to create a new Endpoint and are just creating the association as needed instead which works great.

answered 4 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions