"Login denied, unauthorized connection mechanism, contact your admin"

[Chess Norris]

Hello,

A customer reports that a newly created remote access VPN user fails to connect successfully and that the user is receiving the following error message: "Login denied, unauthorized connection mechanism, contact your administrator".

The authentication process through Cisco ISE and DUO proceeds normally, including MFA OTP entry, but the connection is denied afterward.

When troubleshooting I noticed that this specific group-policy is not being assigned by ISE as expected, unlike other group-policies.

Anyone have any idea on how I can troubleshoot this issue further?

Thanks

/Chess

[Rob Ingram]

Hi @Chess Norris if the connection is not receiving the correct group-policy, does the connection match all the conditions in the  ISE authorisation rule? Can you provide a screenshot of the ISE rule you expect the connection to match and the output of the live log for the session that failed to receive the correct policy?

[Chess Norris]

@Rob Ingram Yes, the connection seams to match the conditions in the autorization rule and I can see the hitcounts increasing on that specific rules. Here are som screenshots of the rule and from the livelog.

[Rob Ingram · Accepted solution]

@Chess Norris so the user hits the same rules as other user that do receive the group-policy? I assume this user is connecting using the same profile configuration and protocol (ipsec or ssl) as the other working users?

Can you enable the aaa radius debugs, log in as the user and provide the output for review.

[Chess Norris]

I was able to find the issue after enable the radius debug.

The group policy object was created, but it was not added under the Remote Access advanced TAB. Once added there, the group-policy was assigned correctly. 

/Chess