I had OpenVPN set up for me using the AWS OpenVPN Appliance and Windows Active Directory Authentication. Everything was working great, and then we had a disaster, and we lost our Domain Controller. I rebuilt it all from scratch, and we were back. Then I tried to reconfigure OpenVPN, and I can't connect. I always get the session timeout error (the snippet from capi.log is attached). Here is what I did in the Domain Controller:
Added Network Policy Role (Active services and features)
Configured the Radius client (used elastic IP of our OpenVPN appliance)
Created a shared secret (tried both manual and Generated -- neither worked after matching them up in the web admin console)
Created a new group in Active Directory and added myself as a user (I'm an admin on that machine)
Configured the network policy (windows groups condition, MS-CHAP2-v2 constraint/allow user to connect with negotiating, defaults for everything else)
Note that in the web gui, MS-CHAP2-v2 was selected. I'd also tried in the DC to select other options as well -- made no difference
Made sure that network policy was at the top of the list
Logged into the web admin gui as admin
Changed the shared secret to match what I put in the DC (as I said, I tried manual ones and generated ones -- neither worked)
Saved the settings
Updated the running server
I still had the old tray app, so I just did the same thing as always -- right click, go to my saved address, and say Connect. It always fails. capi.log snippet attached.
How can I get this working? ---- Thanks
Not sure file upload worked. If not:
2014-09-02 07:25:36-0700 [HTTPChannel,36,127.0.0.1] *** API CALL f=xmlrpc_GetPreferences args=[] kw={} ret={'proxy_auto': False, 'exec_admin_domain': '', 'update_base_url': '
http://swupdate.openvpn.net/updates', 'log_append': False, 'enable_xd_proxy': True, 'basic_client': False, 'auth_allow_cache_pw': True, 'restrict_domain': '*', 'proxy_auth_allow_basic': True, 'trust_group': '', 'proto_force': '', 'allow_ssl_v2': False, 'connect_timeout': 60, 'implicit_elevation': False, 'exec_user_domain': '*', 'universal_sessions_are_global': False, 'reroute_dns_partial': False, 'verb': '', 'proxy_auth_allow_save_pw': True, 'user_may_trust_cert': True, 'silent_update': False, 'route_nopull': False, 'enable_connect': True, 'notify_update': True, 'user_hostspec': '*', 'allow_web_import': True}
2014-09-02 07:25:36-0700 [HTTPChannel,37,127.0.0.1] *** API CALL f=xmlrpc_LocalUserContext args=[True] kw={} ret={'user': u'Frank', 'user_is_admin': False}
2014-09-02 07:25:36-0700 [HTTPChannel,38,127.0.0.1] *** API CALL f=xmlrpc_TrackActiveProfiles args=[True] kw={} ret='sess_TrackActiveProfiles_7CUbb5rtTs4g5GED_3'
2014-09-02 07:25:36-0700 [HTTPChannel,39,127.0.0.1] *** API CALL f=xmlrpc_UpdateStatus args=[] kw={} ret={}
2014-09-02 07:25:36-0700 [HTTPChannel,40,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_TrackActiveProfiles_7CUbb5rtTs4g5GED_3', 10] kw={} ret=[{'timestamp': 1409667936, 'state': 'add_profile', 'profile_id': u'54_183_123_154_dynamic_p4449', 'type': 'PROFILE'}]
2014-09-02 07:25:36-0700 [HTTPChannel,41,127.0.0.1] *** API CALL f=xmlrpc_ProfileProperties args=['54_183_123_154_dynamic_p4449'] kw={} ret={'hash': 'ab31ebe53f69f11442dfeddfe2c99e139e155b6ead8281e92617367ec88aa4b7', 'name': u'54.183.123.154/Dynamic', 'global': True, 'portal_url': u'
https://54.183.123.154/', 'host': u'54.183.123.154', 'owner': u'Frank', 'org': u'OpenVPN Technologies, Inc.', 'type': ['dynamic'], 'id': '54_183_123_154_dynamic_p4449', 'access_allowed': True}
2014-09-02 07:25:41-0700 [HTTPChannel,43,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_TrackActiveProfiles_7CUbb5rtTs4g5GED_3', 10] kw={} ret=[{'type': 'PROFILE', 'state': 'connect', 'profile_id': '54_183_123_154_dynamic_p4449', 'cookie': 'TRAY_CLIENT_RnJhbms=_Z2vnTXoI', 'timestamp': 1409667941}]
2014-09-02 07:25:41-0700 [HTTPChannel,43,127.0.0.1] *** API CALL f=xmlrpc_Connect args=[{'new_only': True, 'cookie': 'TRAY_CLIENT_RnJhbms=_Z2vnTXoI', 'profile_id': '54_183_123_154_dynamic_p4449', 'type': 'dynamic', 'non_interactive': False}, ['STATE', 'PASSWORD', 'ACTIVE', 'CERT_APPROVAL', 'INFO', 'CONNECTED_USER', 'FATAL', 'SCRIPT', 'CHALLENGE', 'DELETE_PENDING', 'NOTIFY', 'RSA_SIGN', 'CONNECT_TIMEOUT', 'BYTECOUNT'], {}] kw={} ret='sess_54_183_123_154_dynamic_p4449_UjdqovbCX58rqSt6_1'
2014-09-02 07:25:41-0700 [HTTPChannel,45,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_54_183_123_154_dynamic_p4449_UjdqovbCX58rqSt6_1', 10] kw={} ret=[{'status': 'need', 'timestamp': 1409667941, 'need': ('username', 'password'), 'type': 'PASSWORD', 'auth_type': 'Dynamic'}]
2014-09-02 07:25:47-0700 [HTTPChannel,46,127.0.0.1] *** API CALL f=xmlrpc_SubmitCreds args=['sess_54_183_123_154_dynamic_p4449_UjdqovbCX58rqSt6_1', {'username': 'fsiegel', 'password': '[redacted]', 'static_response': 'None'}, 'Dynamic', True] kw={} ret=None
2014-09-02 07:26:47-0700 [-] DynamicClientBase: Unable to obtain Session ID from u'54.183.123.154', port(s)=443: XML-RPC: Connection timeout: client/dyncli:90,internet/defer:744,python/failure:338,client/dyncli:128,internet/defer:744,python/failure:338,client/asxmlcli:107,client/asxmlcli:100,internet/defer:744,python/failure:338,client/asxmlcli:129,internet/defer:744,python/failure:338,client/asxmlcli:196,client/asxmlcli:180 (pyovpn.xml.xmlclibase.Timeout)
2014-09-02 07:26:47-0700 [-] *** API CALL f=xmlrpc_Poll args=['sess_54_183_123_154_dynamic_p4449_UjdqovbCX58rqSt6_1', 10] kw={} ret=[{'timestamp': 1409668007, 'info_type': u'pyovpn.xml.xmlclibase.Timeout', 'type': 'INFO', 'severity': 'error', 'value': u"Unable to obtain Session ID from u'54.183.123.154', port(s)=443: XML-RPC: Connection timeout"}]
2014-09-02 07:26:47-0700 [-] *** API CALL f=xmlrpc_Poll args=['sess_TrackActiveProfiles_7CUbb5rtTs4g5GED_3', 10] kw={} ret=[{'timestamp': 1409668007, 'state': 'disconnect', 'profile_id': '54_183_123_154_dynamic_p4449', 'type': 'PROFILE'}]
2014-09-02 07:26:47-0700 [HTTPChannel,59,127.0.0.1] *** API CALL f=xmlrpc_Poll args=['sess_54_183_123_154_dynamic_p4449_UjdqovbCX58rqSt6_1', 10] kw={} ret=[{'timestamp': 1409668007, 'type': 'DELETE_PENDING'}]
