12.5 Configuring Integration with OpenVPN

These instructions will help you to configure integration of Advanced Authentication Appliance Edition with the OpenVPN virtual appliance to refuse non-secure passwords in OpenVPN connection.

The advanced authentication in OpenVPN is represented on the following diagram.

To get started, ensure that you have:

  • OpenVPN v2 appliance (version 2.0.10 was used to prepare these instructions)

  • Advanced Authentication v5 appliance with the already configured repository

Configure the Advanced Authentication RADIUS server:

  1. Open the Advanced Authentication Admin Interface.

  2. Go to the Events section.

  3. Open properties of the Radius Server event.

  4. Set the Radius Server event to the ON mode.

  5. Select one or more chains from the list of Used chains (make sure that they are enabled and set to the users group in the Chains section).

  6. Add a Client, enter an IP address of the OpenVPN appliance, specify a secret, confirm it and set the Enabled option.

  7. Click the Save button in the Client string. Click the Save button at the bottom of the Events view to save changes.

Configure the OpenVPN appliance:

  1. Open the OpenVPN Access Server site.

  2. Go to the Authentication - RADIUS section.

  3. Enable the RADIUS authentication.

  4. Select PAP authentication method.

  5. Add an IP address of the Advanced Authentication v5 appliance and enter the secret.

If you have one Used chain selected in the Radius Server settings, to connect to OpenVPN, please enter the <repository name>\<username> or only <username> if you have set the default repo name in Policies - Login options section of the Advanced Authentication v5 appliance.

If you have multiple Used chains selected, to connect to OpenVPN, in the username field after the entered <username> and space you need to enter a Short name of the necessary chain (the Short name can be selected in Chains section of the Advanced Authentication v5 appliance).

Please note that some of the available authentication methods require correct time on the OpenVPN appliance. You can sync the time of the OpenVPN appliance using the following commands:

/etc/init.d/ntp stop
/usr/sbin/ntpdate pool.ntp.org

12.5.1 User Account Locks After Three Successful Authentications with SMS AP to OpenVPN

Issue Description:

We are using SMS authentication method to connect to OpenVPN. But after 3 successful authentications the user account was locked by OpenVPN.

Solution:

This problem is not related to Advanced Authentication. OpenVPN supposes each attempt of challenge response (request of additional data in chain) as an error.

The solution is to change acceptable number of failures. Check the Authentication failure lockout policy article for more information.