Troubleshooting VPN and RADIUS endpoints

If MFA for VPN and RADIUS endpoints is not working, use the troubleshooting points below. In Identity360, MFA for VPN and RADIUS endpoints is configured through a Conditional Access Policy: go to Protection > Conditional Access Policy, and VPN/RADIUS Endpoints is one of the protected endpoints you enable in the policy. By default, the NPS extension logs are stored at C:\Program Files\ManageEngine\Identity360 Cloud NPS Extension\logs, in the idsagent-common.log file.

In this page

• MFA is not prompting, but authentication is successful with primary verification
• Access is denied after installing the NPS extension for MFA
• Access is denied even after successful MFA
• Multiple SecureLink emails are sent, but authentication still fails
• Troubleshooting error codes

1. MFA is not prompting, but authentication is successful with primary verification.

There are multiple possible causes for this issue. Use the steps below to identify and resolve them.

Cause 1: Connectivity issue between Identity360 and the NPS server.

How to check: Look for the error code IDS-4106 in the logs at C:\Program Files\ManageEngine\Identity360 Cloud NPS Extension\logs\idsagent-common.log.

Solution:

• Ensure the NPS server has a stable internet connection with Identity360, then try again.
• If you want users to log in bypassing MFA during connectivity issues, set the BypassConnectionError flag in the customizations.json file to true.

Cause 2: MFA is not enabled in Identity360.

How to check: Go to Protection > Conditional Access Policy, open (or create) the policy that targets your users, and in the Access Protection section click VPN/RADIUS Endpoints. Confirm that MFA authenticators are selected under Protect using (VPN Client Verification or SecureLink Email Verification) with the required number of MFA Authenticators.

Solution: Complete the MFA configuration for the VPN/RADIUS Endpoints endpoint in the policy by selecting a verification method and at least one MFA authenticator, then save the policy.

Cause 3: User is invalid or not licensed for MFA.

How to check:

• Check whether the user exists in Universal Directory > All Users.
• Check whether the user is assigned a license at Settings > Administration > License Management > Manage License > Licensed Users.

Solution:

• Ensure the user is a valid member of your organization in the Universal Directory.
• Confirm that your organization has purchased the Professional Edition of the license subscription.
• Assign an MFA license to the user at Settings > Administration > License Management > Manage License > Unlicensed Users > Assign License.

Cause 4: User is not fully enrolled for the required MFA factors.

How to check: Go to Reports > Universal Directory > MFA Reports > Enrolled Users and check whether the user is enrolled for the MFA factors configured in the policy's VPN/RADIUS Endpoints endpoint.

Solution:

• Ensure the user is enrolled in the VPN MFA factors configured in the policy.
• To deny access to users who have not completed MFA enrollment, enable Deny VPN & RADIUS login for partially enrolled users in the policy's Advanced Settings > Endpoints > VPN/RADIUS Endpoints.

Cause 5: NPS extension is unable to read OTP or TOTP from the RADIUS request.

How to check:

• Check the logs for the message Empty or no challenge from user.
• If VPN Client Verification is selected for the VPN/RADIUS Endpoints endpoint in the policy, ensure that PAP is being used for RADIUS authentication, as non-PAP protocols (EAP or MS-CHAPv2) may cause issues.

Solution:

• VPN Client Verification only supports the PAP protocol. Change the authentication protocol to PAP on both the NPS server and the VPN server.
• Alternatively, switch to SecureLink Email Verification, which works with all RADIUS protocols.

Cause 6: Request is bypassed due to NPS extension filtering based on custom settings.

How to check: Look for the error code IDS-4104 in the logs at C:\Program Files\ManageEngine\Identity360 Cloud NPS Extension\logs\idsagent-common.log.

Solution:

• Ensure the isMFAEnabled flag in C:\Program Files\ManageEngine\Identity360 Cloud NPS Extension\conf\customizations.json is set to true.
• If you have configured connection request or network policies in customizations.json, use Event Viewer to check whether VPN or RADIUS requests meet the defined conditions:
  • Open Event Viewer.
  • Navigate to Custom Views > Server Roles > Network Policy and Access Services.
  • Verify that the validated policy aligns with the configured policies.

2. Access is denied after installing the NPS extension for MFA.

There are multiple possible causes for this issue. Use the steps below to identify and resolve them.

Cause 1: Connectivity issue between Identity360 and the NPS server.

How to check: Look for the error code IDS-4106 in the logs at C:\Program Files\ManageEngine\Identity360 Cloud NPS Extension\logs\idsagent-common.log.

Solution:

• Ensure the NPS server has a stable internet connection with Identity360, then try again.
• If you want users to log in bypassing MFA during connectivity issues, set the BypassConnectionError flag in the customizations.json file to true.

Cause 2: User is not fully enrolled for the required MFA factors.

How to check: Go to Reports > Universal Directory > MFA Reports > Non-enrolled Users and check whether the user appears as not enrolled.

Solution:

• Ensure the user is enrolled for the required VPN MFA factors.
• To temporarily allow login for users who have not yet enrolled in MFA, disable Deny VPN & RADIUS login for partially enrolled users in the policy's Advanced Settings > Endpoints > VPN/RADIUS Endpoints. This does not apply to passwordless authentication.

Cause 3: Incorrect passwordless authentication configuration.

How to check: If the NPS extension was installed before passwordless authentication was enabled in Identity360, the configuration may be incomplete, leading to VPN access issues.

Solution: Enable passwordless verification at Protection > Protection Settings > General > VPN Endpoint (Enable passwordless verification using Identity360), then reinstall the NPS extension to ensure proper configuration.

Cause 4: Access is denied when passwordless authentication is enabled.

How to check:

• Go to Protection > Protection Settings > General and check whether Enable passwordless verification using Identity360 (under VPN Endpoint) is enabled.
• If it is enabled, check whether any of the issues listed under MFA is not prompting, but authentication is successful with primary verification are occurring.

Solution: Follow the corresponding solutions to resolve the issue.

3. Access is denied even after successful MFA.

Cause

When using VPN Client Verification, the RADIUS attributes configured in the network policy of the NPS server are not sent to the RADIUS client, such as a VPN or endpoint server. This can result in incorrect access levels, giving the user too much access, too little access, or no access at all.

Solution

Instead of relying on the NPS server to send RADIUS attributes, enable Send additional RADIUS attributes as a response to the VPN server after successful MFA in the policy's Advanced Settings > Endpoints > VPN/RADIUS Endpoints, and use Configure Attributes to define them. This ensures the correct RADIUS attributes are sent to the VPN server after MFA, so the right access permissions are applied.

4. Multiple SecureLink emails are sent, but authentication still fails.

Cause

The RADIUS client, such as a VPN or endpoint server, is stopping the MFA process due to minimal RADIUS timeout settings.

Solution

Check the RADIUS authentication timeout settings on both the RADIUS client (VPN server or other RADIUS clients) and the RADIUS server (NPS). The timeout should be longer than the MFA session time set for VPN in Identity360, which is Users must complete authentication within [N] mins in the policy's Advanced Settings > Endpoints > VPN/RADIUS Endpoints.

Troubleshooting error codes