Failure of Auth RADIUS for PPTP on IOS

Hello

We use a Cisco 1721 router to complete Microsoft's PPTP connections. When the local use of the user-data base on the router, everything works.

However with the RADIUS authentication, Setup fails.

Even if the router IOS"" get a "Access-accept" the RADIUS, but still he abandoned the client connection.

This is the track

+++++++++++++++++++++++++++++++++++++++

RADIUS: Send to unknown id 10 10.10.1.20:1812, Access-Request, len 138

1w2d: RADIUS: authenticator 82 C6 16 85 6th 2F C0 - 00 00 00 00 00 00 00 00 D8

1w2d: RADIUS: username [1] 20 'xxxxxx '.

1w2d: RADIUS: vendor, Microsoft [26] 16

1w2d: RADIUS: MSCHAP_Challenge [11] 10

1w2d: RADIUS: 82 16 85 6th 2F C6 [? / n]

1w2d: RADIUS: vendor, Microsoft [26] 58

1w2d: RADIUS: MS-CHAP-response [1] 52 *.

1w2d: RADIUS: NAS-Port [5] 6 1

1w2d: RADIUS: NAS-Port-Type [61] 6 virtual [5]

1w2d: RADIUS: Type of Service [6] 6 box [2]

1w2d: RADIUS: NAS-IP-Address [4] 6 10.10.1.37

1w2d: RADIUS: receipt id 10 10.10.1.20:1812, Access-Accept, len 119

1w2d: RADIUS: authenticator ED 11 24 75 81 89 B4 E6 - 68 63 CC 25 BA E0 0E 13

1w2d: RADIUS: Framed-Protocol [7] 6 PPP [1]

1w2d: RADIUS: Type of Service [6] 6 box [2]

1w2d: RADIUS: [25] in class 32

1w2d: RADIUS: 3 b 00 05 0E 00 00 01 37 00 01 0 a 0 a 01 14 and 01 C3 [;? 7?]

1w2d: RADIUS: F3 0C EA 95 B9 06 00 00 00 00 00 00 [?]

1w2d: RADIUS: vendor, Microsoft [26] 40

1w2d: RADIUS: MS-CHAP-MPPE-Keys [12] 34 *.

1w2d: RADIUS: vendor, Microsoft [26] 15

1w2d: RADIUS: MS-CHAP-DOMAIN [10] 9 "ARKLOW".

1w2d: RADIUS: response (10) could not decipher

++++++++++++++++++++++++++++++++

Parts are important config like below

===========================================

radius of group AAA of ppp use-RADIUS authentication

VPDN enable

!

VPDN-Group 1

! PPTP by default VPDN group

Description of Tunnels PPTP termination

accept-dialin

Pptp Protocol

virtual-model 1

renegotiation of LCP always

adjusting IP mtu

interface virtual-Template1

IP unnumbered FastEthernet0

no ip redirection

No keepalive

peer default ip address pool dialin_pool

PPP mppe 128 encryption

use-radius of PPP authentication chap, ms-chap pap

!

IP local pool dialin_pool 10.10.3.51 10.10.3.100

==========================================

OK, you get it now in your debugging:

RADIUS: Response (20) could not decipher

It is an indication that do not match your ray keys. I suggest remove and re-add the key on both devices. When you add it back on the router make sure that you just cut and paste it, cause this can add extra spaces at the end which become part of the key. Enter it manually on both devices and see what you get.

Tags: Cisco Security

Similar Questions

  • Is RV320 - possible to use the RADIUS for the users of PPTP VPN?

    We replace a Draytek with a RV320 router and have trouble with the last step which is the VPN configuration. We currently have our VPN users defined in a RADIUS server, and the Draytek check credentials against this. However, the RV320 doesn't seem to work in the same way - the server RADIUS is configured but VPN users cannot connect. There is nothing in the system log to indicate if there is a problem connecting to the RADIUS server, or if the router is even able to use RADIUS for PPTP connections. Adding a user manually allows PPTP connection so I don't know the PPTP settings on the client are correct, and that the PPTP on the RV320 server is functional and configured correctly.

    RADIUS authentication should not work for users of PPTP then I could set them up manually, except that the web interface of RV320 has a restriction on the length of usernames - it seems to allow only 11 characters, where I would need to have user names up to about 15 characters for some of our remote users. Why the RV320 have such a length short maximum username?

    Dan

    Dan,

    I got the feedback from the engineering group. Even if she has the RADIUS as a drop-down option, the PPTP server only supports local user database authentication. I was wrong in my first answer. They confirmed THAT SSLVPN & Easy VPN will support RADIUS but not installing PPTP.

  • Changing of PSK auth RADIUS

    Hey all.

    My WLC 5508 is running with a dozen of AP, even if the driver is passed using pre-shared keys.  The plan should now migrate authentication Radius for our internal network... we will still use PSK in our vendor/visitor SSID.

    So 1 WLAN is internal access... 2 WLAN is internet access only.

    I'm confused the WLAN 1 configuration to do as you wish.  I would like to as authentication to hit our Radius Server, that points to AD to the user accounts.  If the user is in the AD, they are good to go.

    So in the Wlan 1 configuration screens, I can go to the Security section and select the AAA server and enter the ip address of the Radius server.  How can I activate layer 2 security now?

    I can certainly choose WPA/WPA2, adding my WPA2 AES encryption method.  However, the main methods available are confusing me, even after hours of reading.  I can't use PSK and CCKM I know the least.  The only other option is 802.1 x. s the option I should use?  If I'm trying to auth against a Radius Server without the use of certificates, is it still eligible as a process of EAP?

    I hope that my way of thinking aloud had a meaning.  It is a great learning curve for me.

    Thank you

    Mike

    Hello

    What you use is 802. 1 x authentication and point the authenticationi Radius Server, if using Windows Server, you can use the IAS service if using Cisco is known under the name of ACS. Or there is new the WLC can connect directly to the AD...

    This example configuration is with EAPfast using LDAP (AD).

    http://www.Cisco.com/en/us/products/ps6366/products_configuration_example09186a008093f1b9.shtml

  • What is a good VPN for Mac and iOS client?

    I want to identify a strong product of VPN for Mac and iOS.  I want something that is easy to install and maintain, and it's effective.

    Thank you

    This depends a lot on what you're trying to accomplish. Can elaborate you on why you think you need?

  • WRT320N - support for PPTP and L2PT DCHP?

    Hello, I bought this router and facing the problem - how to establish an internet connection. My ISP supports only DHCP for PPTP and L2TP, it gave me the URL (vpn.corbina.net and tp.corbina.net). I found a topic in a local forum with an explanation how to establish an internet connection with the same ISP, but for wrt610n. The basic configuration page is the same for these two routers, but my router is not working, nor with L2TP or PPTP settings. It is unable to connect to both servers, and that's all. With 'ping', I found the IP addresses of these servers.

    Currently I use wl520gc from asus, and it supports DHCP for vpn and have no problem with it.

    Maybe you have some ideas how to solve this problem.

    Ok. I found the error, I have not found correctly the server ip. Now I know, everything works.

    Thanks for help. Sorry for the inconvenience. Good day.

  • How do I put 4 different RADIUS for the same element?

    I work with a rectangle and I need to set the radius of the top left corner at 100 and 10 other 3 corners.

    Hello

    Unfortunately, this is not possible. You can have two different RADIUS for corner, to the same rectangle. You can only activate/RADIUS for each corner. But if they are enabled, all the corner will have the same RADIUS.

  • With the help of several radius for authentication servers

    Hello.

    I want to install a PPTP to my router and I wonder if it is possible to use windows multiple IAS servers on a Cisco router?

    The scenario is that I have more than one business using this PPTP connection and they all have their own advertising on their own VLAN, I would like the router to forward the authentication request containing the username and password for all IAS of Windows servers that I specify or go through them one at a time until it receives an awnser.

    Is this possible?

    Best regards Tommy Svensson

    Tommy,

    This is not possible because if a radius server receives a user name, it will be simple rejection the user and send this response to the Cisco router. The radius Protocol is not throw or send any message to warn the router that the user is not present in its database.

    I know that with ACS that if a username has been sent with a special domain can proxy communication on the acs server and the Cisco router based on the user name.

    I hope this helps.

    Tarik

  • iPhone keeps asking for password hotmail (iOS 10)

    Hello

    I had this problem since upgrading to iOS iOS 10 9. I have 3 accounts hotmail on the iphone, once I get the password it will work properly for a period of time (usually one day) and then ask for passwords with a message indicating an error has occurred and iOS needs approval from hotmail again.

    I noticed that this often happens when I wake up in the morning and I haven't used the iPhone for a few hours. This problem never arose on iOS 9. I've recently updated the iPhone 6 7 and the problem persists.

    Is this a bug of iOS 10? I also tried to delete all my accounts and adding them again without success. My accounts do not use a two-step verification.

    I am currently using iOS on iPhone 10.0.2 7

    Hotmail is notoriously buggy.  For years.  Have you tried their forum for iOS 10 compatibility issues?  There may be suggestions from there.

    Best,

    GDG

  • Searching for pictures of iOS 10 works is not as expected

    I have updated to a couple of my iOS devices (iPhone 6 and iPad Air) iOS 10, actually 10.1 public beta 1 now, but find the results obtained in the search of my library of ~ 5000 photos and videos quite modest.

    I very rarely get the images I'm looking for, if any.

    For example, 'find my photos from the Netherlands' Returns none so I have 122 in my library.

    The research of the city of Delft (that is the Netherlands) returns a single result, which, ironically, shows a screen indicating the word "Delft" on a local train.

    I wonder if there is the possibility of re-indexing of the library or the device can be done on a Macintosh, but I'm afraid user ios do not have such a luxury for now.

    In my troubleshooting process I spent from Italian to English, since this might be a reason for poor search results. But things have not changed.

    Of course, if I ask "Find my photos of the mountains" (or dogs by the way) I get decent results this image recognition works though, not much luck with geotags.

    Any idea?

    / P

    Wow!

    The answer to this question of mine has been overwhelming... (I'm kidding)

    In the meantime, FYI Apple has released the iOS 10.0.2 update that solves the problem of geotags.

    I can now find my photos from the low countries (or Switzerland or India also) and get the correct results.

    Nice

    / P

  • How to disable mirroring for airplay in IOS 10?

    I would use Airplay the old-fashioned way, where I can use it without mirroring (audio and video playback) - anyone have any ideas?  For example, mirroring works well in all applications (i.e. NFL app).  I can't get the audio to work and not the video.

    Hello chimidon,

    Welcome to Apple Support communities.

    I see that you want to use Airplay the old way of streaming audio and video, where you can use it without mirroring. I use a lot of Airplay on my iPhone. So I know how it is important to ensure that you are able to use it without any problem.

    iOS 10 includes only the mirroring option in the control center. So, sliding up to open the Control Center allows you to mirror of your iPhone at a connected device Airplay. If you want Airplay from a specific application, the app must have the Airplay feature, and you need to activate Airplay from within the application itself. When you open an application, look for it icon to launch the Airplay and then select your Airplay device.

    All the best.

  • Why Apple ID work for the devices iOS and Yosemite... .but not for iCloud?

    Recently, I upgraded to Yosemite. So I was forced to change my PWD for Apple ID.  I have AN AppleID account. After having changed the PWD, other requested change upgrade iOS devices, and all the work.

    UNLESS iCloud refuses to accept my new Apple ID... All other devices, updates work fine with the new PWD AppleID...

    What is the problem with iCloud?

    How can I force it to accept the Apple that accept all other devices/systems ID?

    Jim B

    Have you tried the signature to iCloud and then again?

    What to do after changing Apple ID or password - email address

  • Qosmio F60 - 11F - problem of failure of HARD drive for the 3rd time

    Hello

    My Toshiba Qosmio F60 - 11(f) does not continue 6 months with me until a HARD disk failure that happens with the same massege (failure of HARD drive on disk0 hard to predict Intel SMART)

    I took my laptop to the service center for 3 times now, and I would like to fix this kind of problem for good and do not reproduce.

    Qosmio F60 - 11F
    Serial number: 6A093786H
    E-mail: [email protected]

    Thank you

    Hello

    The HARD drive may begin to malfunction because it s a part not reusable.
    I'm not very well why the HARD drive starts to malfunction in these times early in any case the party m can be replaced very easily and usually you don t we had to send the laptop to the ASP.

    Get in touch with an ASP and ask compatible HARD drive. If it s covered by the warranty, you should get so much for free, otherwise you will need to purchase these parts.

    However, here you can check how to replace the HDD:
    * Qosmio F60 HDD *.
    + http://aps2.toshiba-tro.de/kb0/CRU07030A0000R01.htm+

    welcome them

  • iPhone keeps asking for privacy permissions ios 9

    Hello!

    I have a problem with my new iPhone 6s, that I was not able to solve. My iPhone keeps asking privacy permissions to access my photos, my sites, my cameras, etc. even if I have already authorized this specific application. I tried to reset the location & privacy setting generally as suggested in many forum of discussion, but it couldn't fix the problem. Can you help me please?

    Fabrizio

    -What are you talking about?

    Some applications will be asked to use your site as long as the application is running. An application is considered as "in use" when using it actively in the foreground, or when used in the background, which will show the status bar.

    Other applications will be asked to access your location, even when the application isn't running. When you authorize an application should always use your location, iOS will remind you that the apps are able to use your location when an application uses your location in the background.

    Which is copied from here.

    Privacy and location for iOS Services 8 and iOS 9 - Apple Support

  • Close-up on iTunes Radio AND Search Suggestions MAY NOT BE RESTRICTED for CHILDREN on iOS 9.2.1 AND IS UNSAFE FOR CHILDREN

    Hello

    Even when I block everything under 'Settings' and 'Général' and 'Restrictions', my children can still access content inappropriate through "Spotlight Search Suggestions" on the search bar on my iPhone or see inappropriate suggestions illustrations Album and research through "iTunes Radio.  These two parts of UNLOCKED iPhone need to be blocked.  Please Apple, help my children and I have a secure environment on my iPhone without interference from portions of UNLOCKED the iPhone iOS.  Please do not many of us have to go to a national broadcasting network to announce that the iPhone IS NOT safe for CHILDREN and cannot NOT BE SMALL.

    I guess you have to monitor the activities of your children yourself.

  • Failure 0 x 61000031 for HP Deskjet 3520 printer?

    I'll put up my HP Deskject 3520 for the first time. Configuration information that I indicate that I am supposed to connect the HP printer, install the print cartridges and then turn it on. The printer display reads "printer failure 0 x 61000031 ' there is a problem with the printer or ink system. Turn the printer off, then on. If you continue to receive this message, contact HP.

    I tried to turn the printer off and turning back on it (both connected to the computer with a USB cable and not). I always get the error message. The printer gives me even the screen to try a print test, calibrate, cartridges etc. When I try to lift the lid to check the cartridges, the printer indicates that the ink cartridge door is open, but it does not move the cartridges where I can take a peak at them. I just bought this printer today. Am I right in thinking that I should just take it back to the store and exchange for a new one?

    Given that the error occurs regardless of whether the USB cable is connected to my computer and that I myself never even at the stage where I could wireless configuration, I kind of doubt that it is important what operating system I use. However, if it's important, I use 64-bit Windows 7 Home Premium with Service Pack 1.

    Hi polkadotorchid,

    The error is caused by the mechanism of cartridge which is stuck to its original position.

    Is it possible to manually move this mech postiion home cartridge toward the center of your printer?

    If you are unable to move freely, you will need to call our technical support at the 800-474-6836. If you do not live in the United States / Canada region please click the link below to get help from your region number.

    http://www.HP.com/cgi-bin/hpsupport/index.pl

Maybe you are looking for