Solved

Watchguard VPN Issues: Same VPN credentials fail from different user account on same PC.

Posted on 2011-09-06
8
3,761 Views
Last Modified: 2012-05-12
Hi guys,

I have an XP pro machine on a remote site that uses Watchguard Mobile VPN client to establish a connection back to our head office.

It all works perfectly on the existing user account (UserA) except now I have created a new user account (UserB) on the remote PC I cant use  any VPN credentials to establish a VPN connection from the new computer when in UserB's account.

However I can still establish a VPN connection using UserA's VPN credentials when logged into UserA's account, as well as UserB's VPN credentials from UserA's account on the remote PC.

So it would appear that there is some authentication issue withe the new UserB's account on the PC that is preventing the VPN connection from succeeding. It always hangs and fails at the same point. It appears to be when it gets the configuration from the VPN server, but here is a copy of the log.

2011-09-07T12:46:23.452 Launching WatchGuard Mobile VPN with SSL client. Version 11.2.0 (Build 252737)  Built:Dec 21 2009 13:20:49
2011-09-07T12:46:27.686 Requesting client configuration from VPNSERVER:443
2011-09-07T12:46:30.733 FAILED:inflate returned -3
2011-09-07T12:46:32.202 CreateProcess cmd="C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\openvpn.exe" --config client.ovpn --verb 3 --management 127.0.0.1 1337 --service wgsslvpnc_ExitEvent --management-query-passwords --management-hold
2011-09-07T12:46:34.811 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:38.421 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:42.358 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:46.515 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:50.452 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:54.171 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:46:57.780 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:01.499 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:05.108 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:08.608 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:12.108 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:15.608 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:19.108 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:22.608 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:26.327 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:30.265 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:34.311 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:38.358 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:42.077 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:45.921 Error: connect() failed. ret = -1 errno=10061
2011-09-07T12:47:45.921 Failed Launch

Any help would be greatly appreaciated.
0
Comment
Question by:defecta
  • 4
  • 3
8 Comments
 

Accepted Solution

by:
defecta earned 0 total points
ID: 36493424
i have since fixed a different problem that means this new VPN connection is no longer needed so other than the sake of my education, I no longer "need" an answer as I have a workaround.
0
 
LVL 32

Expert Comment

by:dpk_wal
ID: 36493469
I think you are using extended authentication [Authenticating users with servers like AD/LDAP/RADIUS]; have you added userB to the same group as to which user A belongs; other that I cannot think of anything else that would cause such a behavior.

Please check and update.

Thank you.
0
 
LVL 32

Expert Comment

by:dpk_wal
ID: 36493472
Please ahead and close the question; was typing out the response so did not see that you have posted a comment.
0
 

Author Comment

by:defecta
ID: 36493485
sure thing. but for the sake of practice I would like to ask for clarification.

We are authenticating against AD. Can you explain how in the the scenario you outlined, one account can make VPN connections successfully and the other cant, using the same VPN credentials? Im not following.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 32

Expert Comment

by:dpk_wal
ID: 36493499
Case I:
Let's say you have created a group named Allow_VPN on AD which has userA added as member; but userB is not added as member; on WG when you configure xauth you specify the exact group/user name. I think this is what is happening.

Case II:
If the issue is when you are logging as userA on the local machine [which is not part of AD] you can connect but when you login as userB from same laptop and connect using same VPN credentials then this is something strange.
If there is a change in permissions, userA is power user and userB is not it could be something, but if no then am not sure.
Also, if both users A and B are part of AD then case I might be applicable.

I was only talking about case I and not about case II.

Thank you.
0
 

Author Comment

by:defecta
ID: 36493889
Ii have both UserA and UserB members of the AD group that allows VPN access through Watchguard.
Both users are local admin on the remote machine and both are users on the AD domain.

frustrating, oh will. good thing I dont need an answer anymore. Thanks anyway.
0
 
LVL 9

Expert Comment

by:Brian
ID: 36545285
It sounds like the Watchguard Mobile VPN client was not working correctly on User Bs account. When it was installed it may have been installed for only one user, instead of under the administrator account. Just a thought.
0
 

Author Closing Comment

by:defecta
ID: 36565530
as I mentioned, a different issue in a different user account was requireing me to establish a new VPN connection in a new account but the original issue was resolved leaving me longer requiring a solution to this issue.

Thanks for everyones insights however.
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now