When trying to connect the Access Manager client to the SRX, the status connection result message shows 'Authentication failure: Incorrect Credentials'.

This article is a part of the Dynamic VPN Resolution Guide:  KB17220 - Troubleshoot Dynamic VPN client that is not working [juniper.net] .

Unless otherwise noted these steps apply to all versions of Dynamic VPN. Any steps which apply to a specific version will note which versions the step applies to.

Symptoms:

• Dynamic VPN (Access Manager) client is not connecting to the SRX.  The Connection Status in the Juniper Networks Access Manager window reports the Connection Result:  'Authentication failure: Incorrect Credentials':

• You followed the steps in KB17232 - Dynamic VPN Client status is 'Disconnected' [juniper.net] , and it referred you to this article.
• You followed the steps in KB17335 - [Dynamic VPN] Access Manager client gets 'Authentication Failure: Incorrect Credentials' error (using RADIUS Authentication) [juniper.net] , and it referred you to this article.

 This error message occurs in the following situations:

• The username or password (both case sensitive) has been entered incorrectly.
• The user's username does not match the username configured

Is the SRX running Junos 10.4 and above?

• Yes - Continue with Step 2
  
• No - Local authentication is not supported for the 'Dynamic VPN Configuration' portion on the SRX running Junos 10.3 and below.  For tips on using Free RADIUS to configure authentication, refer to KB17337 [juniper.net] . (The other option is to upgrade to Junos 10.4 and use local authentication).

  Run the command show access profile . Is the username (including capitalization) configured in the access profile the same as the username being entered?

• Yes - Continue with Step 3
  
• No - Have the user re-enter the username making sure capitalization matches what is configured. If still unable to authenticate continue with Step 3 .

  Enter a new password for the user trying to authentication. (i.e. user1):

root@srx# set access profile dyn-vpn-access-profile client user1 firewall-user password 1234

 If still unable to authenticate, set authentication traceoptions and look over the debug log for clues as to why the authentication is failing:

user@srx# set system processes general-authentication-service traceoptions flag all
user@srx# commit
user@srx# clear log authd

[Have user attempt to connect and login again]

user@srx> show log authd



  Review the output of the authd file.  Look for the username that is unable to connect.  Below are samples of the debug output for that you can compare yours to:

DEBUG OUTPUT EXAMPLE OF A BAD PASSWORD:
May 23 01:35:26 ###################################################################
May 23 01:35:26 ########################### AUTH REQ RCVD #########################
May 23 01:35:26 ###################################################################
May 23 01:35:26 Auth-FSM: Process Auth-Request for session-id:9248704806234225010
May 23 01:35:26 Framework: Starting authentication
May 23 01:35:26 authd_advance_module_for_aaa_request_msg: result:0
May 23 01:35:26 Authd module start
May 23 01:35:26 Local : authd_local_start_auth: got params profile=dynamic-vpn-users, username=MyUser
May 23 01:35:26 Local : start authd_local_lookup
May 23 01:35:26 Local : profile user-auth-profile found
May 23 01:35:26 Local : client MyUser found
May 23 01:35:26 Local : password mismatch for client MyUser
May 23 01:35:26 authd_auth_module_start: Error in calling the radius start_auth
May 23 01:35:26 AUTHEN - module(password) return: FAILURE
May 23 01:35:26 Framework: auth result is 4. Performing post-auth operations
May 23 01:35:26 Framework: result is 4.
May 23 01:35:26 authd_auth_send_answer: conn is 101a780 result is 4, cookie=6 sub-id=9248704806234225010 rply_len=28 num_tlv_blocks=0
May 23 01:35:26 authd_auth_aaa_msg_destroyauth_aaa_msg: 0xe0006c
May 23 01:35:26 authd_write_conn: response is 0x101a7dc, total len is 28 and sent is 0
May 23 01:35:26 authd_write_conn: response is 0x101a7dc, wrote 28 bytes


DEBUG OUTPUT EXAMPLE OF a Username not matched (Again note case sensitivity):
May 23 02:17:32 ###################################################################
May 23 02:17:32 ########################### AUTH REQ RCVD #########################
May 23 02:17:32 ###################################################################
May 23 02:17:32 Auth-FSM: Process Auth-Request for session-id:9248704814823564895
May 23 02:17:32 Framework: Starting authentication
May 23 02:17:32 authd_advance_module_for_aaa_request_msg: result:0
May 23 02:17:32 Authd module start
May 23 02:17:32 Local : authd_local_start_auth: got params profile=dynamic-vpn-users, username=MYUSER
May 23 02:17:32 Local : start authd_local_lookup
May 23 02:17:32 Local : profile user-auth-profile found
May 23 02:17:32 Local : client MYUSER NOT found
May 23 02:17:32 authd_auth_module_start: Error in calling the radius start_auth
May 23 02:17:32 AUTHEN - module(password) return: FAILURE
May 23 02:17:32 Framework: auth result is 4. Performing post-auth operations
May 23 02:17:32 Framework: result is 4.
May 23 02:17:32 authd_auth_send_answer: conn is 101a780 result is 4, cookie=8 sub-id=9248704814823564895 rply_len=28 num_tlv_blocks=0
May 23 02:17:32 authd_auth_aaa_msg_destroyauth_aaa_msg: 0xe0006c
May 23 02:17:32 authd_write_conn: response is 0x101a7dc, total len is 28 and sent is 0
May 23 02:17:32 authd_write_conn: response is 0x101a7dc, wrote 28 bytes


DEBUG OUTPUT EXAMPLE OF A SUCCESSFUL AUTHENTICATION, i.e. username and password matched:
May 23 00:46:41 ###################################################################
May 23 00:46:41 ########################### AUTH REQ RCVD #########################
May 23 00:46:41 ###################################################################
May 23 00:46:41 Auth-FSM: Process Auth-Request for session-id:9248704797644257541
May 23 00:46:41 Framework: Starting authentication
May 23 00:46:41 authd_advance_module_for_aaa_request_msg: result:0
May 23 00:46:41 Authd module start
May 23 00:46:41 Local : authd_local_start_auth: got params profile=dynamic-vpn-users, username=MyUser
May 23 00:46:41 Local : start authd_local_lookup
May 23 00:46:41 Local : profile user-auth-profile found
May 23 00:46:41 Local : client MyUser found
May 23 00:46:41 Local : passwords matched
May 23 00:46:41 authd_auth_module_start: Error in calling the radius start_auth
May 23 00:46:41 AUTHEN - module(password) return: SUCCESS
May 23 00:46:41 Framework: auth result is 1. Performing post-auth operations
May 23 00:46:41 (authd_update_session_options) num_tlv_blocks:0
May 23 00:46:41 Framework: Initialising response list
May 23 00:46:41 Framework: Updating session timeout (9999999) in response for user 'MyUser' from profile 'dynamic-vpn-users'
May 23 00:46:41 Framework: Updating idle timeout (10) in response for user 'MyUser' from profile 'dynamic-vpn-users'
May 23 00:46:41 Framework: length of first client-group if already present = 0
May 23 00:46:41 Framework: result is 1.
May 23 00:46:41 authd_auth_send_answer: conn is 101a780 result is 1, cookie=4 sub-id=9248704797644257541 rply_len=2944 num_tlv_blocks=2
May 23 00:46:41 authd_auth_send_answer,tlv_begin:101d120 tot_tlv_buf_len:16 num_tlv_blocks:2
May 23 00:46:41 sess_timeout: 9999999
May 23 00:46:41 idle_timeout: 10
May 23 00:46:41 authd_auth_send_answer, rply_len:2960
May 23 00:46:41 authd_auth_send_answer: conn is 101a780 response is 1021000 result is 1, cookie = 4 rply_len:2960 num_tlv_block = 2
May 23 00:46:41 authd_auth_aaa_msg_destroyauth_aaa_msg: 0xe0006c
May 23 00:46:41 authd_write_conn: response is 0x101a7dc, total len is 2960 and sent is 0
May 23 00:46:41 authd_write_conn: response is 0x101a7dc, wrote 2960 bytes


  If the problem is still not resolved after completing the steps above, collect the information listed in KB21781- [SRX] Data Collection Checklist - Logs/data to collect for troubleshooting [juniper.net] , along with the debugs captured above, and open a case with your technical support representative or with the RADIUS server vendor as appropriate.