jalvillar
Having issue where DUO auth is randomly requiring re-auth when ChromeOS client has any type of streaming load on network.
general websurfing is fine, but when load is put on the clients (from anywhere) they will get re-auth requests every 2 to 5 minutes.
Latest versions of chrome and happens on varies chromeos devices (pixle, hp, acer).
if ignore the duo re-auth, the client get tunnel shut down, but the chromeos will show as still connected.
reneg-sec in the server.conf is set to 36000 (10 hrs)
keepalive is set to 5 600
can't see any other places were re-auths would be setup on the server.
TinCanTech
jalvillar
thanks will revise this post per the how to
j
jalvillar
Hello
New here, running an ubuntu 14.04.5 LTS in AWS with Openvpn
Issue: we have macOS and ChromeOS clients. with ChromeOS clients we find that when connected and doing general web surfing all works ok. The moment they start to run any applications while on the VPN that streams content (TalkDesk, Hangouts, Youtube, music) they will get frequent DUO push re-authentication requests. If ignored the tunnel will stop traffic and yet still show on client as connected. This is latest versions of ChromeOS stable on various hardware solutions provided by (HP, Google, Acer)
The macOS devices are not affected by this issue.
here is the server config
[oconf]
;local a.b.c.d
port 1194
;proto tcp
proto udp
tmp-dir /etc/openvpn/tmp
;dev tap
dev tun
;dev-node MyTap
ca keys/ca.crt
cert keys/server.crt
key keys/xxxx.key
crl-verify crl.pem
dh keys/dh2048.pem
server 10.8.0.0 255.255.254.0
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;push "route 10.0.0.248 255.255.255.255"
;push "route-gateway 10.0.0.1"
push "route 10.150.0.0 255.255.0.0"
push "route 10.200.0.0 255.255.0.0"
push "route 10.120.0.0 255.255.0.0"
push "dhcp-option DNS 10.150.0.2"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;learn-address ./script
;push "redirect-gateway def1"
push "redirect-gateway"
;push "dhcp-option DNS 10.8.0.1"
;push "dhcp-option WINS 10.8.0.1"
;client-to-client
;duplicate-cn
keepalive 5 600
;keepalive 5 15
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
;comp-lzo
;max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 4
;mute 20
plugin /usr/lib/openvpn/plugins/defer_simple.so /usr/lib/openvpn/plugins/okta_openvpn.py
reneg-sec 36000
[/oconf]
Here goes a client ONC file config
[oconf]
{
"NetworkConfigurations": [ {
"GUID": "{openvpn20160204}",
"Name": "%Company%",
"Type": "VPN",
"VPN": {
"Type": "OpenVPN",
"Host": "%address.com%",
"OpenVPN": {
"ServerCARef": "{cacert}",
"ClientCertType": "Pattern",
"ClientCertPattern": {
"IssuerCARef": [ "{cacert}" ]
},
"Port": 1194,
"IgnoreDefaultRoute": true,
"Proto": "udp",
"RenegSec": 0,
"SaveCredentials": false
}
}
} ],
"Type": "UnencryptedConfiguration",
"Certificates": [ {
"GUID": "{cacert}",
"Type": "Authority",
"X509": "-----BEGIN CERTIFICATE-----
[/oconf]
Any suggestions greatly appreciated.
jalvillar
Hello
New here, running an ubuntu 14.04.5 LTS in AWS with Openvpn
Issue: we have macOS and ChromeOS clients. with ChromeOS clients we find that when connected and doing general web surfing all works ok. The moment they start to run any applications while on the VPN that streams content (TalkDesk, Hangouts, Youtube, music) they will get frequent DUO push re-authentication requests. If ignored the tunnel will stop traffic and yet still show on client as connected. This is latest versions of ChromeOS stable on various hardware solutions provided by (HP, Google, Acer)
The macOS devices are not affected by this issue.
here is the server config
[oconf=]
;local a.b.c.d
port 1194
;proto tcp
proto udp
tmp-dir /etc/openvpn/tmp
;dev tap
dev tun
;dev-node MyTap
ca keys/ca.crt
cert keys/server.crt
key keys/xxxx.key
crl-verify crl.pem
dh keys/dh2048.pem
server 10.8.0.0 255.255.254.0
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
;push "route 10.0.0.248 255.255.255.255"
;push "route-gateway 10.0.0.1"
push "route 10.150.0.0 255.255.0.0"
push "route 10.200.0.0 255.255.0.0"
push "route 10.120.0.0 255.255.0.0"
push "dhcp-option DNS 10.150.0.2"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;learn-address ./script
;push "redirect-gateway def1"
push "redirect-gateway"
;push "dhcp-option DNS 10.8.0.1"
;push "dhcp-option WINS 10.8.0.1"
;client-to-client
;duplicate-cn
keepalive 5 600
;keepalive 5 15
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
;comp-lzo
;max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 4
;mute 20
plugin /usr/lib/openvpn/plugins/defer_simple.so /usr/lib/openvpn/plugins/okta_openvpn.py
reneg-sec 36000
[/oconf]
Here goes a client ONC file config
[oconf=]
{
"NetworkConfigurations": [ {
"GUID": "{openvpn20160204}",
"Name": "%Company%",
"Type": "VPN",
"VPN": {
"Type": "OpenVPN",
"Host": "%address.com%",
"OpenVPN": {
"ServerCARef": "{cacert}",
"ClientCertType": "Pattern",
"ClientCertPattern": {
"IssuerCARef": [ "{cacert}" ]
},
"Port": 1194,
"IgnoreDefaultRoute": true,
"Proto": "udp",
"RenegSec": 0,
"SaveCredentials": false
}
}
} ],
"Type": "UnencryptedConfiguration",
"Certificates": [ {
"GUID": "{cacert}",
"Type": "Authority",
"X509": "-----BEGIN CERTIFICATE-----
[/oconf]
Any suggestions greatly appreciated.
