We have one user at our company who can’t login to VPN. The web UI and mobile SSL VPN client both give him authentication errors.
The Firebox SSL client says “Could not download the configuration from the server. Do you want to connect using the most recent configuration?” If I select no, it fails authentication and if I select yes, it acts like it’s going to connect but hangs at “PUSH_REQUEST (status=1)” and then fails.
On the firebox, I can go to test the server connection with my username, my other admin’s user name, etc and all test successfully but this other guy, when testing his connection, it gives the error
"Connect to server: Ok (connected to x.x.x.x)
Log in (bind): Failed (user [email protected] is not authenticated[Internal error: stay too long on one state.])"
He hasn’t changed his password in a few weeks and it’s not set to expire. This weekend, I manually reset it to the same password he’s been using.
He’s in the VPN AD permissions group and he can login to everything we can think of with his domain credentials on the domain itself. The firebox is the only thing that doesn’t seem to like his account and I have no idea why.
On the web UI, if I select domain login from the drop down, it says invalid credentials. I manually created him an account on the firebox-DB server and added him to the SSL VPN users group with that firebox-db account and if if I select firebox-db authentication, his account works but I don’t know how to tell the Watchguard SSL VPN client or Open VPN (which also works for me and others but not him) how to authenticate to Firebox-DB. There is not a dropdown box for this.
I’ve checked in the Mobile VPN settings on the firewall in Authentication and his firebox-db account is there and checkbox enabled.
I guess I have 2 questions with this. What could I look at for his account specifically that would be causing domain authentication to fail when he can authenticate everywhere else on our network?
And second, is there a way to tell the watchguard VPN client to use the firebox-db authentication first?
On the authentication server settings, I see our domain at the top and then the firebox-db under that. If I move firebox-db above the domain, do users who have been authenticating via domain credentials who don’t have a firebox-db user account fail their login or does the VPN client know to move on to the next authentication server?
… I would guess if you have active support WG can take a look. Just give them read only support access. Sometimes it could be something simple as a check box that needs to be checked or UN-checked. Also might want to do a stare and compare with a working account and see if something is different with his account.