If Always On VPN began reporting “connected” without creating a usable tunnel after the September 8, 2026 Windows 11 update, install the newest cumulative update for your Windows release. Microsoft-hosted reports say out-of-band KB5129195 restored affected device and user tunnels on Windows 11 24H2 and 25H2; Windows 11 26H1 has separate VPN resiliency fixes in KB5124006 and the latest cumulative packages.
What broke after the September updates
The clearest field report concerns Windows 11 24H2 security update KB5124008, released on September 8, 2026. Deployments using IKEv2 with automatic SSTP fallback could stop making the fallback attempt. The VPN client might therefore display a connected state even though no working tunnel existed.
As an Amazon Associate I earn from qualifying purchases.
A Microsoft-hosted Q&A describes the reported RasClient sequence before the update as event 20223 for IKEv2, followed almost immediately by 20222 for SSTP and then 20225. After KB5124008, the SSTP attempt reportedly disappeared. These are deployment reports, not a Microsoft engineering statement identifying a specific Windows Filtering Platform, driver or certificate defect.
Recommended Free Tools
Microsoft’s 26H1 release-health material lists other September regressions, including Remote Desktop Services instability, but does not list Always On VPN as a separate known issue. That distinction matters: the AOVPN symptom is documented in a Microsoft-hosted community report rather than an official release-health entry naming AOVPN.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Which Windows update addresses the problem?
| Windows release or package | Date | What the evidence shows |
|---|---|---|
| Windows 11 24H2 KB5124008 | September 8, 2026 | Security update associated with reported AOVPN IKEv2-to-SSTP fallback failures. |
| Windows 11 24H2 and 25H2 KB5129195 | September 14, 2026 | Microsoft Q&A participant reported that installing this out-of-band update restored device and user Always On VPN tunnels. |
| Windows 11 26H1 KB5124012 | September 8, 2026 | 26H1 security update; its release-health page documents other issues but does not separately identify AOVPN. |
| Windows 11 26H1 KB5129194 | September 14, 2026 | Out-of-band package that Microsoft says resolved the documented Remote Desktop Services issue. |
| Windows 11 26H1 KB5124006 | September 22, 2026 preview | Microsoft’s Network notes say it improves VPN process resiliency and recovery. |
KB5129195 is the practical recovery package reported for 24H2 and 25H2 AOVPN deployments. For 26H1, install the latest cumulative update offered for the device rather than assuming a 24H2 KB applies. KB5124006’s official wording is: “This update improves resiliency and recovery from potential VPN process-related background issues that can cause processes to stop responding.”
What to do on an affected PC
- Identify the Windows release and installed update. Open Settings > System > About and note whether the device is on 24H2, 25H2 or 26H1. In Settings > Windows Update > Update history, record the installed cumulative-update KB number. Do not use the 24H2 package mapping for a 26H1 device.
- Install the newest cumulative update. Use Settings > Windows Update and select Check for updates. Organizations can deploy the release through Windows Update for Business, or obtain the matching package from the Microsoft Update Catalog. Microsoft recommends taking the latest update available for the specific Windows release.
- Restart and test both tunnel types. After installation, restart the device if Windows requests it. Test a device tunnel before sign-in and a user tunnel after sign-in. A successful status should correspond to access to resources that require the VPN, not merely a “connected” label in the client.
- Check the profile’s protocol behavior. Confirm whether the Always On VPN profile uses automatic protocol selection and expects IKEv2 to fall back to SSTP. If the SSTP attempt is absent from RasClient events, the symptom matches the Microsoft-hosted report more closely than a simple authentication or routing failure.
- Escalate with evidence. Capture the Windows version, installed KB, profile protocol settings, RasClient event sequence and whether device, user or both tunnels fail. This lets an administrator distinguish an update regression from a separate certificate, firewall, DNS or network problem.
Temporary profile workarounds
The Microsoft-hosted Q&A includes deployment-specific reports of forcing SSTP or changing the profile’s fallback strategy. Such changes can keep a rollout operating when the current cumulative update cannot be deployed immediately, but they are community workarounds, not documented Microsoft guidance. Test them against your authentication, performance and security requirements, and remove the temporary constraint after the supported update is installed.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
When forcing SSTP may help
If IKEv2 succeeds only far enough to produce a misleading connected state and SSTP is known to work in the environment, an SSTP-only profile can bypass the missing fallback attempt. It also changes the transport behavior for every connection, so treat it as a controlled emergency measure rather than a universal fix.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why automatic fallback matters
Profiles that rely on automatic selection are sensitive to whether the client retries the alternate protocol. Before KB5124008, the reported sequence showed that retry; afterward, the sequence stopped after IKEv2. A profile change can alter that behavior, but it does not repair the underlying Windows component.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Should you uninstall KB5124008?
Removing the September security update may appear to restore the pre-update behavior, but it also removes security and quality fixes. It is not the preferred long-term remedy when KB5129195 or a later cumulative update is available. Use the current package for the installed Windows release, and reserve rollback decisions for an organization’s documented incident process when no deployable update can be used.
What Microsoft has and has not confirmed
- Microsoft-hosted operational reports connect some 24H2 Always On VPN failures with KB5124008 and report recovery after KB5129195.
- Microsoft officially describes VPN process resiliency improvements in the 26H1 KB5124006 notes.
- No cited Microsoft page establishes a definitive internal root cause, such as a particular network-driver, filtering-platform or certificate change.
- No authoritative Microsoft figure states how many devices or what percentage of deployments were affected.
- The October 14, 2026 change-log entry for a 26H1 Remote Desktop issue involving non-administrators and Administrator protection is separate from this VPN behavior.
How to interpret a “connected” status
For this incident, the status label alone is insufficient. Verify the RasClient events and test access through the private resources that the tunnel is supposed to carry. If the expected IKEv2 event is followed by no SSTP attempt, compare the device’s update state and profile design with the September 8 regression pattern before changing certificates or replacing the VPN infrastructure.
Quick Recap
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
