topic R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix VPN users in Firewall and Security Management

R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix VPN users

Attiq786 — Mon, 07 Dec 2020 15:33:46 GMT

Hi All,

I Updated 5800 Gateway to R80.40. VPN Clients could VPN in and authenticate via AD and OTP through Citrix portal but after sometime, everyone on Citrix will be kicked out and if they login again, all of them will get the same error "Invalid username and password"

Now if you reboot the gateway, then they can authenticate fine but only for a while, may be 15 minutes and then the same error appears if they try to login.

Disabling SecureXL resolved the issue.

Template creation stops at the exact rule which is responsible for client authentication to AD.

It almost seems like the previous Kerberos Ticket is carried forward by SecureXL and authentication fails.

I want to understand if Templates are disabled at that same rule, what else SecureXL is doing that users are getting invalid username or password error when SecureXL is enabled. Something different in R80.40 may be?

Re: R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix V

PhoneBoy — Tue, 08 Dec 2020 19:31:21 GMT

If disabling SecureXL "solves" any issue, the TAC should be involved.
Meanwhile, what is the precise rule you’re referring to?

Re: R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix V

Attiq786 — Wed, 09 Dec 2020 00:09:20 GMT

Thanks for your reply. TAC case is raised already. I was thinking may be someone else might have the same issue with R80.40.

The rule allows remote client addresses to contact AD. services include Kerberos as well in that rule.

Re: R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix V

PhoneBoy — Wed, 09 Dec 2020 01:33:42 GMT

A screenshot would be helpful

Re: R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix V

Attiq786 — Wed, 09 Dec 2020 19:18:47 GMT

Here is the screenshot please.

Re: R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix V

PhoneBoy — Wed, 09 Dec 2020 20:53:36 GMT

Nothing in that rule should disable SecureXL that I’m aware of, but could be wrong.
The TAC SR in PM may be helpful.

Re: R80.40 Gateway- AD Authentication error - "Invalid username and password" for Citrix V

Attiq786 — Wed, 13 Jan 2021 13:19:23 GMT

Hi All,

the issue was resolved after installing HFA take 89 - something in base R80.40 image that would prevent SecureXL working as it should.