I too experienced the same error, but have partial workaround. I have yet to resolve completely, but my theory is how the USG is formatting the RADIUS packet across to the Duo Authentication Proxy (DAP). The authentication string is not being recognized by DAP. I tried with MS-CHAPv2 on and off, I tried with allow_concat=false, and pass_through_all=true, without any change in behavior.
I do have a partial workaround, but must use the USG RADIUS server for the first authentication factor. Good news - I get MFA; Bad news - I can’t use LDAP authentication (yet… , but going to keep trying).
Here is a snippet from my authproxy.cfg file:
[radius_client1]
; IP address of my USG
host=172.31.0.1
; RADIUS Secret from Unifi Controller in section Gateway > RADIUS > SERVER > Secret. This allows DAP to connect to RADIUS on the USG.
secret_protected=
[radius_server_auto3]
client=radius_client1
; Duo.com Application ‘Type: RADIUS’
ikey=*
skey_protected=*
api_host=*
; IP address of Unifi USG interface. This allows the L2TP requests to come from this IP address.
radius_ip_2=172.31.0.1
; RADIUS Secret from Unifi Controller in section Configuration Profiles > RADIUS > Create New RADIUS Profile. This allows the L2TP VPN request to be sent to the DAP server.
radius_secret_protected_2=
factors=auto
failmode=secure
;Need to set a unique port from my other sections. This must match the RADIUS Server profile in screenshot below.
port=1816
This RADIUS Server, is then bound to the L2TP User VPN configuration on the Unifi Controller under VPN > VPN Servers > Type L2TP.
Here is what happens:
- I establish L2TP VPN to USG providing credentials within USG RADIUS Server.
- USG gets the connection request, forwards RADIUS authentication to the DAP.
- The DAP receives the authentication, then forwards primary authentication back to the USG RADIUS server.
- Primary authentication passes, and the DAP proceeds with Duo secondary authentication using push, SMS, etc.
- Connection established!
It works only because the DAP doesn’t need to interpret the RADIUS authentication string from the USG, instead it simply passes it through back to the USG RADIUS server.
It isn’t exactly what we are looking for, but it does allow Duo MFA with my Unifi USG.
