Users are unable to authenticate to VPN MFA with the VIP Enterprise Gateway

Products

• VIP Service

Issue/Introduction

Users are failing to logon to their VPN.

RAS reports the following: AAA user authentication Rejected: reason = AAA failure

Environment

RAS VPN boxes --> VIP Gateway Radius Authentication --> AD + Symantec Cloud

Cause

An "HTTP Proxy Settings" is configured. The Validation Server logs show the following:

ERROR "2020-11-23 01:02:03.456 GMT+1000"  0.0.0.0 RAS-VPN:1820 0 0 "text=[VSWebServiceClient] Unknown Error. SOAP_RESPONSE[407: HTTP Error. 407 Proxy Authentication Required. Please check the proxy settings.]!" Thread-2156 VSWebServiceClientImpl.cpp

This often occurs when updates or other changes that took place at the HTTP Proxy Server that is rejecting the Proxy Authentication. 

Resolution

1. Investigate the HTTP Proxy Server and resolve the problem there.

2. Configure the firewall to allow VIPEG to connect directly to the internet (this requires deleting the HTTP Proxy Settings from the VIP EGW and restarting Validation Services and Self Service Portal Service)