Forum Discussion
CirrostratusF5 with Azure NPS Extensions
Had a quick question. I am working on integrating the F5 with Azure MFA using the Azure Radius NPS extension. I have it all setup according the MS documentation (https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-nps-extension) and from an F5 perspective have the APM policies setup to use the Azure NPS Radius server. The Windows event log message is NPS Extension for Azure MFA: NPS Extension for Azure MFA only performs Secondary Auth for Radius requests in AccessAccept State. Request received for User azure.token with response state AccessReject, ignoring request.
When I try to authenticate a user , I keep getting an “Access Reject” Message no matter what I do. The user is setup and enabled for Azure MFA. I have also tried to use this method where I use the full Azure MFA server and configure it based on the these F5 articles (https://devcentral.f5.com/articles/heres-how-i-did-it-integrating-azure-mfa-with-the-big-ip-19634, https://devcentral.f5.com/articles/how-i-did-it-15-integrating-azure-mfa-with-office-365-20475 ) and if everything is working right then the behavior should be as shown in this video (https://www.youtube.com/watch?v=61juFt3J4Rw&feature=youtu.be)
I am tearing what’s left of my hair trying to get this to work and would appreciate it if you have any insights into how to get this working . My APM policy is as below – the one below is the simple one I am testing.
The One I want to implement in production is as below. Symantec 2FA is Radius based authentication as well.
Would love to hear your opinion on this.
Vitzy_352279Nimbostratus
Hi, we are trying the same setup and getting the exact same error message you are. Any luck with a resolution?
chungyu_16122Altostratus
I have the same issue - works with Cisco ASA but fails with APM
- chungyu_16122
I am guessing you mean the connection request policy - but what about on the network policy?
Where do you define the F5 inbound request IP?
thanks
chung
- boneyard
MVP
have you looked at the replies here, did you try any of it?
R__HickmanGood morning - Did you ever find a solution to this issue?
- boneyard
you are doing exactly the same thing? and i really mean exactly then. else it might be better to start a new question with your specific situation. also mention things like tmos version and such.
Belanger__YvesWe also plan to use Azure MFA. Have you solved your problem?
Yves
jjm1971Altocumulus
Looks to be a solution for this issue here - https://social.msdn.microsoft.com/Forums/en-US/e8b218bf-b9e3-47c5-9a38-85afa536244e/issues-with-f5-vpn-and-azure-mfa-nps?forum=WAVirtualMachinesVirtualNetwork
Had the same issue with the RADIUS authentication failing and saw the same log messages. In my case checking the "unencrypted auth (PAP,SPAP)" option on the network policy fixed this.
Hopefully this is the solution for others having the same issue.
John
