topic Re: Capsule Connect version 1.600.64 - authentication problem in Mobile

Capsule Connect version 1.600.64 - authentication problem

Hrvoje_Brlek — Mon, 07 Sep 2020 12:33:28 GMT

Hi,

Today a new version of Capsule Connect (v1.600.64), for iOS was released, and we are having problems with authentication. Apparently the new app introduced the multi-factor authentication as obligatory. We deploy our configuration through MDM to our users (more than 1000 users). Users with older app versions have no problems, but users with new version cannot connect without "manual" user interaction.

For the deployment in the older versions we used Custom Data Fields in the MDM profile. The most important was the authMethod which was set to Certificate (image below), and works flawlessly on older app versions. On new app version it doesn't work.

Can you help me finding the appropriate Custom Data Field to use with the new multi-factor authentication? What key-pair value am I supposed to use? There is none described in the Admin Guide.

These below are the fields I am talking about. I need a value for the auth parameter to make it use the multi-factor authentication option !

Thanks

Re: Capsule Connect version 1.600.64 - authentication problem

Raman_Arora — Tue, 08 Sep 2020 15:15:59 GMT

We are also on the same boat. Have you raised ticket with CP TAC?

Re: Capsule Connect version 1.600.64 - authentication problem

Kim_Moberg — Tue, 08 Sep 2020 16:17:48 GMT

Did you remove allow older legacy vpn client in gateway object - vpn - authentication?.. enable it because It solved my issue with Capsule connect failing about multiple authentication methods.

Re: Capsule Connect version 1.600.64 - authentication problem

Raman_Arora — Tue, 08 Sep 2020 18:01:05 GMT

Its enabled already.

Re: Capsule Connect version 1.600.64 - authentication problem

Hrvoje_Brlek — Tue, 08 Sep 2020 20:21:34 GMT

Hi, we have opened a TAC case, I'll keep you updated.

Re: Capsule Connect version 1.600.64 - authentication problem

Hrvoje_Brlek — Tue, 08 Sep 2020 20:27:16 GMT

Yes, we did, but that is not the problem we are facing.

The VPN is working fine, but human interaction is needed to configure the appropriate certificate and get it working. Deployment through MDM and automation is not working, and that is where the problem lies.

Re: Capsule Connect version 1.600.64 - authentication problem

Raman_Arora — Tue, 08 Sep 2020 21:00:14 GMT

Issue on our side as below:

We have Cert + LDAP configured via DB tool, and users on version 1.600.54 are able to connect without any issues! Users with newer version are not able to connect and getting error “this authentication operation is not supported “

Aside what I have did is below:

Clicked on Settings under vpn > Authentication and Unchecked “allowed new clients use legacy auth”

And configured Cert + Username/password for new clients

When I do this , then getting Access Denied

Re: Capsule Connect version 1.600.64 - authentication problem

Kim_Moberg — Wed, 09 Sep 2020 04:07:50 GMT

Due to EA program I was not able to find root issue to this problem with TAC.

I did find something interesting between the jumbo hotfixes.
I was asked to upgrade from r80.40 take 67 to 77 and none of these takes accepts the latest Capsule connect client. When I downgraded the JHF to take 45 it worked again.

i managed to get username/password authentication to work on capsule connect after changing the vpn settings ‘allow newer clients to use legacy authentication’

Re: Capsule Connect version 1.600.64 - authentication problem

Raman_Arora — Wed, 09 Sep 2020 10:38:21 GMT

any inputs from CP TAC on Deployment through MDM for auth type to cert +username?

On App store, i can see capsule connect have been removed.

Re: Capsule Connect version 1.600.64 - authentication problem

Chris_Atkinson — Wed, 09 Sep 2020 22:24:37 GMT

I've brought this thread to the attention of the relevant area, more to follow.

Please refer: sk169222

Re: Capsule Connect version 1.600.64 - authentication problem

Raman_Arora — Wed, 09 Sep 2020 13:23:45 GMT

It is fixed . We are able to push it from MDM as well.

On MDM, Add another key as below:

key : realm

Value : name of the realm (added Under gateway Properties > VPN Clients > Authentication > Multiple Authentication Client Settings > edit the Display Name ((Certificate + Username Password) in my case). You will find Name under General Properties. Cert_Username_Password

In my scenario, added as below:

key: relam

value: Cert_Username_Password

Push the config to your test device.

It is working thereafter.