Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 2986 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

RADIUS MFA and VPN

Christian136

Hey,

we set up a RADIUS Server for MFA login with a OTP token.
If i put the Radius Server to User Portal login, i type in my AD credentials and in the next step the access challenge comes up for the OTP token. Everything is fine.
But this is not working with the SSL VPN client. There is this error : Gui > Error parsing dynamic challenge string

Anyone implement a MFA login for SSL VPN and can help?

Best regards,
Christian



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to LuCar Toni

    we made an update but it is still not working.
    Now i can download the client but the client doesnt ask for the second Faktor from the Radius Server. 
    In user portal the MFA is working.

  • 0 in reply to Christian136

    Client log files:

    AUTH: Received control message: AUTH_FAILED,CRV1:R:1-

    5.5.2021, 08:13:22 SSL Handshake: CN=SophosApplianceCertificate_CXXXXXXXXXXXB, TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
    ⏎5.5.2021, 08:13:22 Session is ACTIVE
    ⏎5.5.2021, 08:13:22 Sending PUSH_REQUEST to server...
    ⏎5.5.2021, 08:13:22 EVENT: GET_CONFIG ⏎5.5.2021, 08:13:23 Sending PUSH_REQUEST to server...
    ⏎5.5.2021, 08:13:25 Sending PUSH_REQUEST to server...
    ⏎5.5.2021, 08:13:25 EVENT: DYNAMIC_CHALLENGE CRV1:R:1-rthgtfhtrhztrhjtrzjztjrzutjztjtzjtjt0=:dggdgdgegertgZW 
    5.5.2021, 08:13:25 EVENT: DISCONNECTED ⏎5.5.2021, 08:13:25 AUTH_FAILED
    ⏎
  • 0 in reply to Christian136

    Hi, I have the same problem with v 18 MR5. It seems that Radius Challenge is arriving malformed to the openvpn client. 

    It should be compose by 4 field separeted by : 

    From openvpn code

    /* expected: str = "E,R:challenge_id:user_b64:challenge_str" */

    Did you have solved?