Hi,<br><br>Do you have check your NPS Logs ? (in your Windows 2008 Server ?)<br><br><div class="gmail_quote">On Mon, Mar 25, 2013 at 4:18 PM, Vipan Kapur <span dir="ltr"><<a href="mailto:v.kapur@ibtimes.com" target="_blank">v.kapur@ibtimes.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
I am able to ping the Raduis server (Microsoft) from the firewall and able<br>
to ping the firewall from the Radius server. When I try to connect using an<br>
AD account, I get the following on the firewall.<br>
<br>
2013-03-25 11:05:15 info IKE <a href="http://198.228.194.124" target="_blank">198.228.194.124</a>: XAuth login failed for<br>
gateway GW-DIALUP-VPN, username r.neal, retry: 0, timeout: 0.<br>
2013-03-25 11:05:15 warn Primary 10.50.100.12, backup1 , and backup2<br>
servers failed.<br>
2013-03-25 11:05:15 warn Active Server Switchover: New requests for<br>
<div class="im">Microsoft server will try Primary from now on.<br>
</div>2013-03-25 11:05:15 warn Active Server Switchover: New requests for<br>
<div class="im">Microsoft server will try Backup2 from now on.<br>
</div>2013-03-25 11:05:14 warn Active Server Switchover: New requests for<br>
<div class="im">Microsoft server will try Backup1 from now on.<br>
</div>2013-03-25 11:05:12 info IP address 10.50.101.14 is released from<br>
0026088ff9ed.<br>
2013-03-25 11:05:12 info IP address 10.50.100.71 is assigned to<br>
0026088ff9ed.<br>
2013-03-25 11:05:11 info IP address 10.50.100.71 is assigned to<br>
0026088ff9ed.<br>
2013-03-25 11:05:08 info IP address 10.50.101.14 is assigned to<br>
0026088ff9ed.<br>
2013-03-25 11:05:06 warn Trying primary server 10.50.100.12.<br>
2013-03-25 11:05:03 info Rejected an IKE packet on ethernet0/2 from<br>
<a href="http://198.228.194.124:34633" target="_blank">198.228.194.124:34633</a> to <a href="http://209.66.114.182:4500" target="_blank">209.66.114.182:4500</a> with cookies 42a0918ad450522c<br>
and 10d48403d7ae665b because A Phase 2 packet arrived while XAuth was still<br>
pending.<br>
2013-03-25 11:05:03 info IKE 198.228.194.124 Phase 1: Completed<br>
<div class="im">Aggressive mode negotiations with a 28800-second lifetime.<br>
</div>2013-03-25 11:05:03 info IKE 198.228.194.124 Phase 1: Completed for<br>
user <a href="http://client.corporate.com" target="_blank">client.corporate.com</a>.<br>
2013-03-25 11:05:03 info IKE<198.228.194.124> Phase 1: IKE responder<br>
has detected NAT in front of the remote device.<br>
2013-03-25 11:05:03 info IKE<198.228.194.124> Phase 1: IKE responder<br>
has detected NAT in front of the local device.<br>
2013-03-25 11:05:03 info IKE 198.228.194.124 phase 1:The symmetric<br>
<div class="im">crypto key has been generated successfully.<br>
</div>2013-03-25 11:05:03 info IKE 198.228.194.124 Phase 1: Responder<br>
starts AGGRESSIVE mode negotiations.<br>
<br>
I am attaching my firewall config as well as the Shrew Client config file.<br>
I hope someone will be able to assist me resolving the issue.<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:vpn-help-bounces@lists.shrew.net">vpn-help-bounces@lists.shrew.net</a><br>
[mailto:<a href="mailto:vpn-help-bounces@lists.shrew.net">vpn-help-bounces@lists.shrew.net</a>] On Behalf Of Kevin VPN<br>
Sent: Sunday, March 24, 2013 9:25 PM<br>
To: <a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
Subject: Re: [vpn-help] VPN not working with Radius and windows 2008<br>
<br>
On 02/27/2013 01:11 PM, Vipan Kapur wrote:<br>
> Hello there!<br>
><br>
> I hope you can help me, I have setup VPN access using the article<br>
> <a href="http://www.shrew.net/support/Howto_Juniper_SSG" target="_blank">http://www.shrew.net/support/Howto_Juniper_SSG</a> but I cannot connect<br>
> using the Radius server. I can only connect if I create a user<br>
> account on the firewall, but I don't want to do that for all the users.<br>
><br>
> The firewall shows the following:<br>
><br>
> 2013-02-27 13:04:26 info IKE <a href="http://198.228.192.58" target="_blank">198.228.192.58</a>: XAuth login failed for<br>
> gateway GW-DIALUP-VPN, username v.kapur, retry: 0, timeout: 0.<br>
> 2013-02-27 13:04:26 warn Primary 10.50.100.12, backup1 , and backup2<br>
> servers failed.<br>
> 2013-02-27 13:04:26 warn Active Server Switchover: New requests for<br>
> Microsoft server will try Primary from now on.<br>
> 2013-02-27 13:04:26 warn Active Server Switchover: New requests for<br>
> Microsoft server will try Backup2 from now on.<br>
> 2013-02-27 13:04:25 warn Active Server Switchover: New requests for<br>
> Microsoft server will try Backup1 from now on.<br>
> 2013-02-27 13:04:17 warn Trying primary server 10.50.100.12.<br>
<br>
Hi Vipan,<br>
<br>
These messages look to me like your Juniper is unable to contact the RADIUS<br>
server. I'm assuming "Microsoft server" is your Windows 2008 RADIUS server.<br>
<br>
If your device is unable to communicate with the RADIUS server, it obviously<br>
would be unable to verify credentials that come from that server.<br>
<br>
_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<a href="https://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">https://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
</div></div><br>_______________________________________________<br>
vpn-help mailing list<br>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<a href="https://lists.shrew.net/mailman/listinfo/vpn-help" target="_blank">https://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
<br></blockquote></div><br>