Problem to NPS Extention authentication with azure AD

Question

Problem to NPS Extention authentication with azure AD

Mohammad Moeini 46

Hi
I have a problem with NPS extension, I have a Mikrotik and NPS server that host on azure environment I want users connect to Mikrotik over L2TP VPN and authenticate with Azure AD with MFA
I plan everything like this URL
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#troubleshooting
But when I approve application authenticator notification I can't login and got error "the connection was terminated because the remote computer did not respond in the timely manner "
and log in event viewer is that:
NPS Extension for Azure MFA: NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User ---------@--------.com with response state Discard, ignoring request.

thanks for your helps

Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2022-11-01T09:09:23.223+00:00

@Mohammad Moeini Apologies for the delay in answering this post. As I understand you are facing issues with NPS Extension authentication with Azure AD.

In your case, I see you are authenticator app for MFA, what happens if you use authentication via phone number does it work ? Is this a new setup ?

Also can you try these steps to check if you are able to connect to VPN after primary authentication is done.

Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters registry key as a backup.
Delete the registry values for “AuthorizationDLLs” and “ExtensionDLLs”, not the Parameters key.
Restart the Network Policy Service (IAS) service for the changes to take effect
Determine if primary authentication for VPN is successful.

Once you have verify the primary authentication is working, user is able to connect to VPN, re-import the registry values for the extension DLLs and restart the NPS service.

We need to review AzureMFA event logs as well Logs are located under Applications and Services Logs\Microsoft\AzureMFA

Also let me know if we can connect offline to troubleshoot further on this.

Your answer

Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2022-11-01T09:09:23.223+00:00

@Mohammad Moeini Apologies for the delay in answering this post. As I understand you are facing issues with NPS Extension authentication with Azure AD.

In your case, I see you are authenticator app for MFA, what happens if you use authentication via phone number does it work ? Is this a new setup ?

Also can you try these steps to check if you are able to connect to VPN after primary authentication is done.

Export the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AuthSrv\Parameters registry key as a backup.
Delete the registry values for “AuthorizationDLLs” and “ExtensionDLLs”, not the Parameters key.
Restart the Network Policy Service (IAS) service for the changes to take effect
Determine if primary authentication for VPN is successful.

Once you have verify the primary authentication is working, user is able to connect to VPN, re-import the registry values for the extension DLLs and restart the NPS service.

We need to review AzureMFA event logs as well Logs are located under Applications and Services Logs\Microsoft\AzureMFA

Also let me know if we can connect offline to troubleshoot further on this.

Share via

Problem to NPS Extention authentication with azure AD

Your answer