Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 26 subscribers
  • Views 3897 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN AD authentication not working but accepted in AD security log

Saugeen Shores Help Desk

Hi

New XG user, not using AD for firewall rules, just VPN authentication at this time.

Running latest 18 code on XG210.

I cannot use the authentication for user portal, nor SSL VPN.

Locally created users can access user portal and vpn just fine.

I have not enabled OTP for now to simplify things.

The authentication>Servers AD setup has everything filled out and the connection test succeeds with a green backgrounded text box.

I then setup the services to use that AD for user portal and SSL VPN.

I ran the import wizard on the active directory server and imported a group called VPN-Users, which my user "testuser" belongs to.

I can authenticate into the domain with that user ok.

When I try and authenticate with the "testuser" in the user portal, it says login failed in red.

When I check the logs in the XG, it says this:
"User testuser failed to login to MyAccount through AD,Local authentication mechanism because of wrong credentials".

I even tried setting the AD authentication as the default for the firewall, not just the user portal, no change.

On the AD server logs, it shows it authenticated just fine with the "workstation" being the firewall IP on the LAN side when trying to go to the user portal.

So the user is going to the AD server, it says password matches, but then the XG denies it.

Any ideas?



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for providing screenshots of the AD configuration from your firewall. 

    The issue was with the search queries; it was configured wrong at Autnetication > Servers > Active Directory > Search Queries. 

    For Example, for the domain "Sophos.com," the search query should be "dc=sophos,dc=com"

    Thanks,

Reply
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for providing screenshots of the AD configuration from your firewall. 

    The issue was with the search queries; it was configured wrong at Autnetication > Servers > Active Directory > Search Queries. 

    For Example, for the domain "Sophos.com," the search query should be "dc=sophos,dc=com"

    Thanks,

Children
No Data