Watchguard VPN Issues: Same VPN credentials fail from different user account on same PC.

Posted on 2011-09-06
Last Modified: 2012-05-12
Hi guys,

I have an XP pro machine on a remote site that uses Watchguard Mobile VPN client to establish a connection back to our head office.

It all works perfectly on the existing user account (UserA) except now I have created a new user account (UserB) on the remote PC I cant use  any VPN credentials to establish a VPN connection from the new computer when in UserB's account.

However I can still establish a VPN connection using UserA's VPN credentials when logged into UserA's account, as well as UserB's VPN credentials from UserA's account on the remote PC.

So it would appear that there is some authentication issue withe the new UserB's account on the PC that is preventing the VPN connection from succeeding. It always hangs and fails at the same point. It appears to be when it gets the configuration from the VPN server, but here is a copy of the log.

2011-09-07T12:46:23.452 Launching WatchGuard Mobile VPN with SSL client. Version 11.2.0 (Build 252737)  Built:Dec 21 2009 13:20:49
2011-09-07T12:46:27.686 Requesting client configuration from VPNSERVER:443
2011-09-07T12:46:30.733 FAILED:inflate returned -3
2011-09-07T12:46:32.202 CreateProcess cmd="C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\openvpn.exe" --config client.ovpn --verb 3 --management 1337 --service wgsslvpnc_ExitEvent --management-query-passwords --management-hold
2011-09-07T12:46:34.811 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:38.421 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:42.358 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:46.515 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:50.452 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:54.171 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:57.780 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:01.499 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:05.108 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:08.608 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:12.108 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:15.608 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:19.108 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:22.608 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:26.327 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:30.265 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:34.311 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:38.358 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:42.077 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:45.921 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:45.921 Failed Launch

Any help would be greatly appreaciated.
Question by:defecta
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3

Accepted Solution

defecta earned 0 total points
ID: 36493424
i have since fixed a different problem that means this new VPN connection is no longer needed so other than the sake of my education, I no longer "need" an answer as I have a workaround.
LVL 32

Expert Comment

ID: 36493469
I think you are using extended authentication [Authenticating users with servers like AD/LDAP/RADIUS]; have you added userB to the same group as to which user A belongs; other that I cannot think of anything else that would cause such a behavior.

Please check and update.

Thank you.
LVL 32

Expert Comment

ID: 36493472
Please ahead and close the question; was typing out the response so did not see that you have posted a comment.
What, When and Where - Security Threats from Q1

Join Corey Nachreiner, CTO, and Marc Laliberte, Information Security Threat Analyst, on July 26th as they explore their key findings from the first quarter of 2017.


Author Comment

ID: 36493485
sure thing. but for the sake of practice I would like to ask for clarification.

We are authenticating against AD. Can you explain how in the the scenario you outlined, one account can make VPN connections successfully and the other cant, using the same VPN credentials? Im not following.
LVL 32

Expert Comment

ID: 36493499
Case I:
Let's say you have created a group named Allow_VPN on AD which has userA added as member; but userB is not added as member; on WG when you configure xauth you specify the exact group/user name. I think this is what is happening.

Case II:
If the issue is when you are logging as userA on the local machine [which is not part of AD] you can connect but when you login as userB from same laptop and connect using same VPN credentials then this is something strange.
If there is a change in permissions, userA is power user and userB is not it could be something, but if no then am not sure.
Also, if both users A and B are part of AD then case I might be applicable.

I was only talking about case I and not about case II.

Thank you.

Author Comment

ID: 36493889
Ii have both UserA and UserB members of the AD group that allows VPN access through Watchguard.
Both users are local admin on the remote machine and both are users on the AD domain.

frustrating, oh will. good thing I dont need an answer anymore. Thanks anyway.

Expert Comment

ID: 36545285
It sounds like the Watchguard Mobile VPN client was not working correctly on User Bs account. When it was installed it may have been installed for only one user, instead of under the administrator account. Just a thought.

Author Closing Comment

ID: 36565530
as I mentioned, a different issue in a different user account was requireing me to establish a new VPN connection in a new account but the original issue was resolved leaving me longer requiring a solution to this issue.

Thanks for everyones insights however.

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question