Hi everybody,
I have one problem with VPN L2TP. I created local users on router and I can successfully to connect at VPN L2TP, but I tried to configure NPS from a lot of source and cant make authorization and is written Authentication Failed - Radius Timeout.
Could you please help me please with clear guide how to setup NPS for authentication of users who trying to connect at L2TP ?
Thanks in advance.
I used this one, all is working
https://mivilisnet.wordpress.com/2018/10/01/how-to-integrate-your-mikrotik-router-with-windows-ad/
Hi,
I tried 100% exactly this step on Windows server 2019 and nothing working
Also this link from comments on original article
https://mivilisnet.wordpress.com/2019/02/01/when-mikrotik-vpn-with-nps-authentication-stops-working/
Also doesnt work
Without RADIUS works? Something in Windows Security Events?
Without Radius its work with local users on router
In Event is written : ID 49 The connection request did not match a configured connection request policy, so the connection request was denied by Network Policy Server.
On Mikrotik I have Request and Reject in RADIUS setting
So, Mikrotik is connecting to NPS, but policies not match. The only suggestion is, check all settings thoroughly step by step on both sides, especially on NPS. Or start from scratch.
I Tried to do 10 time from scratch and nothing done. On Radius Client Setting Address IP should be the router IP and not from AD correct ?
On the Conditions → Authentication Methods select “Unencrypted Authentication (PAP/SPAP)” and “Encrypted Authentication (CHAP)” and retest. I have Windows Server 2016 working with Mikrotik Dot1X using RADIUS with PAP and it works well.
Yes I know it’s unencrypted but I’m doing MAC Address authentication on an internal network.
Not helped
You can only do PAP or MSCHAPv2 against AD, there is no way CHAP can work.
The ‘Ignore user dial-in account properties’ box is not ticked in your screenshots. I’m not a Windows expert, but without this I expect you have to apply a policy to the user accounts as the default is not to permit dial-in.
I tried with and without this box and nothing helped
What is on Mikrotik?
all is configured correctly on mikrotik (Radius, ACL) but still receive this log user authentication failed
Sorry, no idea. On Mikrotik my only error was incorrect src-address in radius settings, there should be router’s IP address.