VPN3000 Radius authentication sunddenly starts failing

[silk]

Hello,

I have a couple of VPN 3000 configured to perform RADIUS Authentication on a CS ACS server.

The authentication usually works fine, then sunddenly starts to fail with this messages:

208 02/01/2005 17:12:09.010 SEV=4 AUTH/15 RPT=34

Server name = 10.9.34.28, type = RADIUS,

group = none (global server), status = Not-in-service

210 02/01/2005 17:12:13.960 SEV=4 AUTH/15 RPT=35

Server name = 10.9.34.29, type = RADIUS,

group = none (global server), status = Not-in-service

After some time the authentication start working again as the server is, by vpn3000's mind, back in service.

I have no other errors but these.

The 2 concentrators are on the same LAN and when one starts failing, the other may work fine with the ACS and/or vice versa.

The ACS servers are of course in service and in good health.

Do you have any clues?

Thanks in advance.

[thomas.chen]

Is there any indication in the authentication server logs as to whether or not it got the requests ?

[mjolin1963]

We had a similar issue..also 2 VPN 3000s authenticating against a Cisco ACS server.

We could ping the ACS server from either concentrator, but a test login from the concentrator to the ACS would fail. Since we're about to replace our ACS server, we worked around the problem by switching the authentication type on the the user accounts on the ACS from NDS to NT/Win2k authentication rather than do more extensive troubleshooting. Users are also able to reliably authenticate using NTdomainname/username instead of just their NDS username.

Our issue was largely contained to one specific user group, although others were intermittently having the issue as well.

The ACS showed failure attempts that were essentially password failures.

We've got 2 VPN 3015 concentrators running 4.0.1 software.

[silk]

The problem was solved by configuring authentication servers in groups instead of using the global servers.

Weird since I read that people has exactly the opposite problem...