topic Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot in SASE and Remote Access

Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Sat, 29 Nov 2025 13:27:10 GMT

Hello everyone,

I have a Remote Access VPN implementation configured with MFA authentication. The issue I’m facing is that the authentication fails when I connect using my home Internet Service Provider’s network.

The error message shows an App registration that doesn’t exist in my Azure tenant and isn’t linked to any Identity Provider configured in my Management Server.

However, when I connect using my mobile hotspot, the authentication works perfectly, and the URLs correspond to the current Identity Provider configured on the gateway.

Could this behavior be related to how the ISP handles IP assignment (NAT, CGNAT, etc.)?
Is there any known limitation or recommendation regarding authentication flows behind carrier-grade NAT or similar configurations?

Thanks in advance for any insight or suggestions.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

the_rock — Sun, 30 Nov 2025 15:45:31 GMT

Definitely could be related to that. Do you have any relevant logs/errors that could help us?

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Sun, 30 Nov 2025 17:45:36 GMT

I'm not sure about the root cause, but what puzzles me is the different behavior between the two connectivity methods. When I connect through my ISP, the authentication flow seems to reference information that no longer exists, which is why the login fails.

When I use my mobile hotspot, the authentication works correctly and points to the current Identity Provider configuration.

As an additional note, my environment is running R81.20 with JHF Take 119.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

the_rock — Sun, 30 Nov 2025 17:47:29 GMT

That got me thinking...so, if it references something that does NOT exist any longer, can you check Guidbedit and see if you can find it there? If so, just delete it and install policy, test again.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

kamilazat — Mon, 01 Dec 2025 07:52:32 GMT

I also wanted to ask another question additional to what @the_rock asked. Does a policy installation without any changes have any kind of effect when the authentication doesn't work, i.e when on ISP network?

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 11:09:46 GMT

I also installed the policy both with and without acceleration, and I couldn’t find any trace of the old object.

What I don’t understand is: if the issue were related to that old reference, what connection would it have with using one Internet service versus the other?

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

kamilazat — Mon, 01 Dec 2025 11:14:28 GMT

Some of the connections in the connections table can get deleted and recreated upon policy installation, which may help if any connection gets 'stuck' in the table. Just wanted to check 🙂

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 11:59:37 GMT

Do you know whether the EntryID and Replay URLs are being called by the client or by the Gateway?
Is there any cache-related file or something similar that can be cleared?

Thank you very much for your comments.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

the_rock — Mon, 01 Dec 2025 12:02:10 GMT

I could be mistaken, but I believe entryID is called by the client and reply URL by the gateway.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

PhoneBoy — Mon, 01 Dec 2025 17:49:11 GMT

Does the host part of the URLs for the Identity Provider configuration contain an IP or an FQDN?
If an IP, perhaps there's a routing issue upstream.
If it's an FQDN, ensure DNS resolves the same in both places.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

Duane_Toler — Mon, 01 Dec 2025 20:02:30 GMT

As @PhoneBoy noted, when you're on your home network, check the URLs and the hostnames used for the SAML connection. Do 'nslookup' locally on your PC/Mac to verify if the names are resolving to the correct locations. Do the same when you're connected to your mobile hotspot. Compare the differences and that might give you some insight. CGNAT can play weird tricks, for sure. You might even be having DNS re-write taking place by your ISP, such as if you subscribe to some ISP-managed "security filtering" service or whatever. Likewise, are you using some other "VPN" service like Nord, etc.? These things can get in the way, too (and they aren't really doing what you think they are).

Be sure to check your Identity Provider object to make sure it's configured as you expect, including the XML metadata from the SAML provider. If you have a cluster, or multiple Remote Access VPN gateways in the community, then check each of them to be sure they are configured the same.

If all else fails, and you have access to the gateway, you can run a VPN debug to see what's happening under the surface.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 21:24:56 GMT

I'm using a non-FQDN IP address. Will the client have any logs that could help me understand what's happening?

It works with the same IP address using the username and password method.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

Duane_Toler — Mon, 01 Dec 2025 21:30:13 GMT

So your SAML VPN portal URL (in gateway properties -> VPN clients -> SAML) is an IP address (https://192.0.2.1/saml-vpn) ?

Are you able to post a screenshot of what happens in your client, or browser, after the SAML connection happens and redirects to your Identity Provider? Feel free to scrub any specific identifying info if you must.

Do you know if your home ISP has a content filtering service they are using for your web traffic?

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 21:51:09 GMT

I don't know, I don't think so

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

Duane_Toler — Mon, 01 Dec 2025 21:54:13 GMT

Go to http://mysignins.microsoft.com and make sure you aren't accidentally logged into another Azure tenant (or Office365 account, or Azure Portal... whichever is relevant for you). I see this often myself when I have a browser tab logged into some other customer's account. I have to logout of all those first to make sure the cookies and sessions are removed.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 21:59:12 GMT

That ID belongs to an identity provider that was created at some point but is no longer in AZR and also not in the Gateway

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 22:17:15 GMT

If I use that ID for the URLs in Azure, I get a 500 error.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

the_rock — Mon, 01 Dec 2025 22:44:50 GMT

Then its definitely wrong, but Im wondering if there is a way to confirm 199% it works on CP side...let me check.

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 22:46:58 GMT

Jhf 118 sorry

Re: Remote Access VPN with MFA – Authentication fails on ISP network but works with mobile hotspot

AOBELAR — Mon, 01 Dec 2025 22:59:14 GMT

same PC and same client