RADIUS Rejects Authentication Attempts for Mobile VPN with SSL

Applies To: Cloud-managed Fireboxes, Locally-managed Fireboxes

When you configure Mobile VPN with SSL to authenticate users with a RADIUS server, the Firebox forwards authentication requests to that server and relies on the RADIUS response to allow or deny access. If the RADIUS server returns an Access-Reject response, the Firebox rejects the authentication attempt, and the user cannot connect to the VPN.

Symptoms

When the RADIUS server returns an Access-Reject response, you might notice these symptoms:

  • Some users cannot connect to the VPN despite valid credentials and group membership.
  • Firebox admd log messages show that the RADIUS server rejected the authentication attempt. The log messages include Access-Reject and msg_id="1100-0005". Example: admd Authentication of SSLVPN user [user@RADIUS] from x.x.x.x was rejected, received an Access-Reject response from the (x.x.x.x) server msg_id="1100-0005".

Diagnostic Steps

  1. Search the Firebox authentication log messages for an Access-Reject response for the affected user.
  2. Optionally, to identify the cause of the rejection, capture RADIUS packets and inspect the RADIUS server debug log messages.
  3. Verify that the user credentials are correct.
  4. Confirm that the shared secret configured on the Firebox exactly matches the shared secret configured on the RADIUS server.

Possible Causes and Solutions

Possible Cause Solution
The user entered incorrect credentials in the Mobile VPN with SSL client. Confirm that the user has the correct user name and password. If necessary, reset the password in the user database that the RADIUS server uses.
The shared secret between the Firebox and the RADIUS server does not match.

Update the shared secret on the Firebox or the RADIUS server so that the shared secret matches exactly. For more information about how to update the shared secret on the Firebox, go to:

Locally-Managed: Configure RADIUS Server Authentication

Cloud-Managed: Add an Authentication Domain to WatchGuard Cloud

Related Topics

How RADIUS Server Authentication Works

Troubleshoot Mobile VPN with SSL

About Mobile VPN with SSL