USG Flex 200 - L2tp over IPsec with Active Directory group

syraarpe
syraarpe Posts: 7
Friend Collector First Comment
edited September 2022 in Security
Hello there

My USG Flex 200, is running Firmware 5.31

Today I have created from the wizard my L2TP settings with IPsec.

VPN Gateway & VPN Connection works fine, when change the L2TP settings to 'local'


However, change to AD

Its not working.

My test from 'AAA server'
Works fine



And my user/group - When user is not in the Group


And its says 'OK' When i deploy my test user in the Group in Active Directory server


So at this points, everything should be good.

So my settings is this in L2TP.


I have tryed to change "ALLOWED USERS" to Any, but its still the samme error.

The Windows error is code 619.

And the ZyXEL logs is this


Its says the RADIUS is auth-type-reject my login.
But im not using radius?

Is this some kind of a bug in the firmware ?


If i try a unknown username, that does not exsist on the server.
The Radius line will not show up.
Its only shows up, when the user is on the server




I have set this up, on many USG 100-300, but not on a Flex version.
Is there a bug in Flex, or did i miss something ? 

Accepted Solution

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,278  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    The local ID should be the IP address of USG FLEX 200.
    Besides, select "Optional Encryption" and "PAP" on Windows.

All Replies

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,278  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    On USG FLEX 500 (FW: 5.31), L2TP VPN is able to be established using AD group user. Here are the configuration and test result for your reference. 
    To check the symptom on your device, please send the remote access of USG FLEX 200 and one AD account/password to me in private message.  :)

    User on AD server: test1
    Group user on AD server: AD_test_group
    Group user name on USG FLEX: vpn_test

     
  • Zyxel_Emily
    Zyxel_Emily Posts: 1,278  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    The local ID should be the IP address of USG FLEX 200.
    Besides, select "Optional Encryption" and "PAP" on Windows.

Security Highlight