{"id":326,"date":"2021-11-10T23:11:00","date_gmt":"2021-11-10T21:11:00","guid":{"rendered":"https:\/\/binaryvikings.io\/?p=326"},"modified":"2021-11-10T23:11:47","modified_gmt":"2021-11-10T21:11:47","slug":"unifi-usg-l2tp-vpn-not-working-with-radius-authentication","status":"publish","type":"post","link":"https:\/\/binaryvikings.io\/?p=326","title":{"rendered":"[Unifi] USG L2TP VPN not working with RADIUS Authentication"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

For quite a long time I was unable to connect to my network through VPN on the USG device. Unifi 6.4.54.0, and somewhere since 6.2.x or so.. <\/p>\n\n\n\n

Quick scroll for solution?!<\/strong><\/p>\n\n\n\n

Step-by-step<\/h2>\n\n\n\n

I connected through SSH to the USG to investigate, to see what went wrong when trying to connect. Below, you see the cut out from \/var\/log\/messages<\/strong> when attempting to connect through VPN. (IP and username x’d out).<\/p>\n\n\n\n

tail -15 \/var\/log\/messages<\/code><\/pre>\n\n\n\n
Nov 10 21:03:32 Heimdal xl2tpd[974]: Connection established to 80.xx.xxx.xxx, 59435.  Local: 5857, Remote: 8 (ref=0\/0).  LNS session is 'default'\nNov 10 21:03:32 Heimdal xl2tpd[974]: Call established with 80.xx.xxx.xxx, PID: 2174, Local: 64011, Remote: 3350, Serial: 1\nNov 10 21:03:32 Heimdal pppd[2174]: pppd 2.4.4 started by root, uid 0\nNov 10 21:03:32 Heimdal zebra[758]: interface ppp0 index 22 <POINTOPOINT,NOARP,MULTICAST> added.\nNov 10 21:03:32 Heimdal pppd[2174]: Connect: ppp0 <-->\nNov 10 21:04:05 Heimdal pppd[2174]: rc_send_server: no reply from RADIUS server setup.ubnt.com:1812\nNov 10 21:04:05 Heimdal pppd[2174]: Peer xxxxxx failed CHAP authentication\nNov 10 21:04:11 Heimdal pppd[2174]: Connection terminated: no multilink.\nNov 10 21:04:11 Heimdal zebra[758]: interface ppp0 index 22 deleted.\nNov 10 21:04:11 Heimdal pppd[2174]: Modem hangup\nNov 10 21:04:17 Heimdal kernel: Process 930 (freeradius) has crashed (parent 1 (init) signal 6, code -6, addr 000003a200000066), coredumps disabled\n<\/code><\/pre>\n\n\n\n
As seen it does make a connection, however appears to not get a reply from the RADIUS server, and then proceed to fail CHAP authentication. (Nice crash at the end there, freeradius, by the way).<\/p>\n\n\n\n
…Investigating further into the VPN logs… (IPs x’d out).<\/p>\n\n\n\n
show vpn log<\/code><\/pre>\n\n\n\n
Nov 10 21:03:30 15[IKE] <1> 80.xx.xxx.xxx is initiating a Main Mode IKE_SA\nNov 10 21:03:31 01[IKE] <remote-access|1> IKE_SA remote-access[1] established between 91.xx.xxx.xxx[91.xx.xxx.xxx]...80.xx.xxx.xxx[10.xx.xxx.xxx]\nNov 10 21:03:32 12[IKE] <remote-access|1> CHILD_SA remote-access{1} established with SPIs cddf1472_i 06729c76_o and TS 91.xx.xxx.xxx\/32[udp\/l2f] === 80.xx.xxx.xxx\/32[udp\/59435]\nNov 10 21:04:05 02[IKE] <remote-access|1> closing CHILD_SA remote-access{1} with SPIs cddf1472_i (1548 bytes) 06729c76_o (502 bytes) and TS 91.xx.xxx.xxx\/32[udp\/l2f] === 80.xx.xxx.xxx\/32[udp\/59435]\nNov 10 21:04:05 15[IKE] <remote-access|1> deleting IKE_SA remote-access[1] between 91.xx.xxx.xxx[91.xx.xxx.xxx]...80.xx.xxx.xxx[10.xx.xxx.xxx]\nNov 10 21:04:11 04[KNL] interface ppp0 deleted\n<\/code><\/pre>\n\n\n\n
Establishes connection, but quickly after kills connection and deletes the ppp0 interface. Didn’t feel like a firewall issue at this point.<\/p>\n\n\n\n
So far it looks to be a RADIUS issue, so next log I checked was \/var\/log\/freeradius\/radius.log <\/strong><\/p>\n\n\n\n
sudo tail -25 \/var\/log\/freeradius\/radius.log<\/code><\/pre>\n\n\n\n
Wed Nov 10 20:03:35 2021 : Error: Ignoring request to authentication address * port 1812 from unknown client 13.37.0.1 port 40914\nWed Nov 10 20:03:45 2021 : Error: Ignoring request to authentication address * port 1812 from unknown client 13.37.0.1 port 40914\nWed Nov 10 20:03:55 2021 : Error: Ignoring request to authentication address * port 1812 from unknown client 13.37.0.1 port 40914\n<\/code><\/pre>\n\n\n\n
In here, there’s a match for several “Error: Ignoring request to authentication address * port 1812 from unknown client 13.37.0.1 port XXXXX” – any high-port.<\/p>\n\n\n\n
As it appears, it is ignoring the request, due to the fact that it does not know the client.<\/p>\n\n\n\n
Going back to the RADIUS<\/strong> page on the controller web UI, you can see the Configure clients section for whole network<\/strong> is indeed “not supported right now”<\/em>. Doing a bit of good old Googlin’ narrowed it down to 2 solutions. One more silly than the other.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Solution 1<\/strong><\/h2>\n\n\n\n
… from UI-Team https:\/\/community.ui.com\/questions\/USG-L2TP-issue-Authentication-Failed\/17ecd602-5c95-4b35-8dd6-7fcacbfd892c#answer\/88d832b6-3a68-490c-a3bb-d70b5fdbf29c<\/a><\/p>\n\n\n\n
First off, this post confirms that there is indeed an issue configuring RADIUS using New Settings<\/em>. The steps below will disable the RADIUS server, but the Clients tick box will be enabled after re-enabling the RADIUS server.<\/p>\n\n\n\n
Suggestion is to SSH to the controller and type in the following commands:<\/p>\n\n\n\n
mongo localhost:27117\/ace\ndb.setting.deleteOne({\"key\":\"radius\"})\nexit<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
This throws an error on my server, as I’m using an older version of MongoDB. Try the below code for removing if you get the same:<\/p>\n\n\n\n
db.setting.remove({\"key\":\"radius\"})<\/code><\/pre>\n\n\n\n
Reloading the page and re-enabling the RADIUS server, we get the following:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
… and more importantly – it worked.<\/p>\n\n\n\n
Solution 2<\/h2>\n\n\n\n
…this is my favorite (and “silly”). https:\/\/community.ui.com\/questions\/L2TP-with-USG-Radius-not-working\/4e82b542-f165-4356-ba52-d419f29722f8#answer\/bec569d7-7947-407b-b43c-d5534107587d<\/a><\/p>\n\n\n\n
Open eg. Chrome. Right-click on the checkbox in Clients<\/strong> and click Inspect<\/strong>.<\/p>\n\n\n\n
Navigate to the part where it says disabled<\/strong> – mark it and delete it.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The checkbox will now be clickable – click it and remember to click the green APPLY CHANGES <\/strong>button.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
For giggles you can run the following command when you attempt next connection to double verify your connection:<\/p>\n\n\n\n
sudo tail -f \/var\/log\/freeradius\/radius.log<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
For quite a long time I was unable to connect to my network through VPN on the USG device. Unifi 6.4.54.0, and somewhere since 6.2.x<\/p>\n","protected":false},"author":1,"featured_media":243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","footnotes":""},"categories":[24,13,25],"tags":[],"class_list":["post-326","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network","category-support","category-ubiquiti"],"_links":{"self":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts\/326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=326"}],"version-history":[{"count":4,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts\/326\/revisions"}],"predecessor-version":[{"id":336,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/posts\/326\/revisions\/336"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=\/wp\/v2\/media\/243"}],"wp:attachment":[{"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/binaryvikings.io\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}