Hi,
We have bumped into a problem. We are using a /24-address-pool for SSL VPN Clients. However, we have checked the "Allow multiple concurrent connections per user" enabled.
Now it seems that we have run out of addresses, as multiple addresses are assigned to each user.
In the logfiles (live log) from "User auth deamon":
: id="3006" severity="info" sys="System" sub="auth" name="Trying 10.45.111.161 (adirectory)"
: id="3006" severity="info" sys="System" sub="auth" name="could not set object for : ALREADY_IN_USE_OBJECT"
: id="3006" severity="info" sys="System" sub="auth" name="failed to set object"
From SSL VPN log:
LZO compression initialized
: Control Channel MTU parms [ L:1556 D:140 EF:40 EB:0 ET:0 EL:0 ]
: Data Channel MTU parms [ L:1556 D:1450 EF:56 EB:135 ET:0 EL:0 AF:3/1 ]
: Local Options hash (VER=V4): 'a4f12474'
: Expected Remote Options hash (VER=V4): '619088b2'
: TCP connection established with 87.118.***.yyy:55024
: TCPv4_SERVER link local: [undef]
: TCPv4_SERVER link remote: 87.118.***.yyy:55024
: 87.118.***.yyy:55024 VERIFY OK: depth=1, /C=***/L=***/O=******/CN=*****_VPN_CA/emailAddress=admin@mydomain.com
: 87.118.***.yyy:55024 VERIFY OK: depth=0, /C=**/L=***/O=*****/CN=/emailAddress=username@mydomain.com
: 87.118.***.yyy:55024 TLS: Username/Password authentication succeeded for username '
: 87.118.***.yyy:55024 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
: 87.118.***.yyy:55024 Data Channel Encrypt: Using 128 bit message hash 'MD5' for HMAC authentication
: 87.118.***.yyy:55024 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
: 87.118.***.yyy:55024 Data Channel Decrypt: Using 128 bit message hash 'MD5' for HMAC authentication
: 87.118.***.yyy:55024 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
: 87.118.***.yyy:55024 [] Peer Connection Initiated with 87.118.***.yyy:55024
: username/87.118.***.yyy:55024 MULTI: no free --ifconfig-pool addresses are available
: username/87.118.***.yyy:55024 PLUGIN_CALL: plugin function PLUGIN_CLIENT_CONNECT failed with status 1: /usr/lib/openvpn-auth-aua.so
: /87.118.***.yyy:55024 WARNING: client-connect plugin call failed
: /87.118.***.yyy:55024 Connection reset, restarting [0]
: TCP/UDP: Closing socket
: Re-using SSL/TLS context
: LZO compression initialized
I tried to turn off the "Allow multiple concurrent connections per user"
When I look at the list of active remote access users, I can now see users (about 70) with multiple ip-addresses assigne, many of them have 2 and 3 addresses assigned. My theory is that I'm all out of addresses in the pool, hence the "MULTI: no free --ifconfig-pool addresses are available" message.
The user can log on to the user portal using the ad credentials, so I don't think it is a authentication problem
So my question is:
How can I "flush" the dhcp-lease table for the remote access ssl vpn-users?
Any suggestions are appreciated [:)]
Kenneth
This thread was automatically locked due to age.
