Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
spantazis
Explorer

MULTIPLE DOMAINS IN REMOTE ACCESS VPN

Hello,

We have a cluster of 6400 firewalls. Client based Remote access VPN is enabled for our remote users.

In the beginning, all our users belonged in one domain (on premise AD, not Azure AD). So we configured rules properly (access roles based on OUs in AD, LDAP Groups, etc) for our remote access users.

However we want users from another domain to participate in the remote access VPN configuration. We created all the previous (access roles based on OUs in the other AD, LDAP Groups, etc) but when we try to enter credentials from the 2nd domain we receive the error "Negotiation with site failed". 

Regards,

Ioannis

0 Kudos
7 Replies
Chris_Atkinson
Employee Employee
Employee

Do you have multiple LDAP account units configured and what username format are the users attempting to authenticate with?

CCSM R77/R80/ELITE
0 Kudos
spantazis
Explorer

We have configured two LDAP account units. The username format is the user logon name in the AD. This works for users located in one of the LDAP account units but not working for the other one. 

0 Kudos
the_rock
Legend
Legend

Usually, that error negotiation with site failed would refer to IP or fqdn not responding from user's machine. Can you have them try with IP address instead of fqdn and see if same problem is there? Also, check the logs in smart console when they try connetc, it should give some clues.

Andy

0 Kudos
Daniel_3
Contributor

Did you already try the configuration according to these screenshots to include all LDAP directories? Screenshot 2023-08-23 153655.pngScreenshot 2023-08-23 153819.png

 

0 Kudos
_Val_
Admin
Admin

Now, show User Directories please

0 Kudos
spantazis
Explorer

Hi,

The configuration is the same with screenshots.

I also tried connect to the site with FQDN and IP address.

Also attached the log message from the failed connection, policy action is Key Install.

0 Kudos
_Val_
Admin
Admin

It looks like your GW is failing to authenticate the user, check VPN logs on the GW side.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events