l2tp over ipsec + radius auth NPS windows 2012

software version is 9.5 and not 9.6 as mentionned above.

Hi nfi,

what do the logs say on the NPS server?

these will point you in the right direction.

post some pics of your current config for the nps and L2TP config

Jason

NPS Logs :

---------------------------------------------------------------

Network Policy Server denied access to a user.

Contact the Network Policy Server administrator for more information.

User:
    Security ID:            DEMO\user1
    Account Name:            user1
    Account Domain:            DEMO
    Fully Qualified Account Name:    exademo.lab/Users/user 1

Client Machine:
    Security ID:            NULL SID
    Account Name:            -
    Fully Qualified Account Name:    -
    OS-Version:            -
    Called Station Identifier:        -
    Calling Station Identifier:        192.168.a.b

NAS:
    NAS IPv4 Address:        -
    NAS IPv6 Address:        -
    NAS Identifier:            l2tp
    NAS Port-Type:            -
    NAS Port:            0

RADIUS Client:
    Client Friendly Name:        ASG
    Client IP Address:            192.168.x.y
Authentication Details:
    Connection Request Policy Name:    Use Windows authentication for all users
    Network Policy Name:        astaro radius policy
    Authentication Provider:        Windows
    Authentication Server:        WIN2K12LAB.demo.lab
    Authentication Type:        MS-CHAPv2
    EAP Type:            -
    Account Session Identifier:        -
    Logging Results:            Accounting information was written to the local log file.
    Reason Code:            66
    Reason:                The user attempted to use an authentication method that is not enabled on the matching network policy.

---------------------------------------------------------------

asg device indicates CHAP error for user1.

below l2tp over ipsec config.

The reason code 66 is your problem, the type of authentication has not been configured on the NPS server, review the NPS server settings.

you can always check all is working by disabling L2TP and enabling pptp, this is not quite so secure, but it would prove whether you can make a connection.

Jason

have you read this?

https://community.sophos.com/kb/en-us/115050

Jason

Hello,

I was not looking at the correct config part.

By default the nps "connection request Policy" named "use Windows authentication for all users" overrides network Policy authentication settings.

I disabled the check box and now the connection works fine.

I should have checked first, thanks for pushing me to the right direction.

Glad you have it sorted now!

Glad you have it sorted now!