topic Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN in SASE and Remote Access

MULTIPLE DOMAINS IN REMOTE ACCESS VPN

spantazis — Wed, 23 Aug 2023 06:05:44 GMT

Hello,

We have a cluster of 6400 firewalls. Client based Remote access VPN is enabled for our remote users.

In the beginning, all our users belonged in one domain (on premise AD, not Azure AD). So we configured rules properly (access roles based on OUs in AD, LDAP Groups, etc) for our remote access users.

However we want users from another domain to participate in the remote access VPN configuration. We created all the previous (access roles based on OUs in the other AD, LDAP Groups, etc) but when we try to enter credentials from the 2nd domain we receive the error "Negotiation with site failed".

Regards,

Ioannis

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

Chris_Atkinson — Wed, 23 Aug 2023 12:45:32 GMT

Do you have multiple LDAP account units configured and what username format are the users attempting to authenticate with?

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

spantazis — Wed, 23 Aug 2023 13:08:22 GMT

We have configured two LDAP account units. The username format is the user logon name in the AD. This works for users located in one of the LDAP account units but not working for the other one.

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

the_rock — Wed, 23 Aug 2023 13:17:50 GMT

Usually, that error negotiation with site failed would refer to IP or fqdn not responding from user's machine. Can you have them try with IP address instead of fqdn and see if same problem is there? Also, check the logs in smart console when they try connetc, it should give some clues.

Andy

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

Daniel_3 — Wed, 23 Aug 2023 13:40:14 GMT

Did you already try the configuration according to these screenshots to include all LDAP directories?

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

_Val_ — Wed, 23 Aug 2023 13:43:43 GMT

It looks like your GW is failing to authenticate the user, check VPN logs on the GW side.

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

_Val_ — Wed, 23 Aug 2023 13:44:31 GMT

Now, show User Directories please

Re: MULTIPLE DOMAINS IN REMOTE ACCESS VPN

spantazis — Fri, 25 Aug 2023 08:02:55 GMT

Hi,

The configuration is the same with screenshots.

I also tried connect to the site with FQDN and IP address.

Also attached the log message from the failed connection, policy action is Key Install.