Access Server: “TLS Error: incoming packet authentication failed” when pfSense connects using TLS Auth

Overview

When a pfSense OpenVPN client attempts to connect to Access Server using TLS Auth, the connection may fail. Access Server may report a TLS control-channel authentication error similar to this:

TLS Error: incoming packet authentication failed from [AF_INET]x.x.x.x:5779 (via [AF_INET]172.31.1.54%[undef])'

Cause

This error can occur when the Auth Digest Algorithm configured in pfSense doesn’t match the digest expected by the Access Server TLS Auth configuration.

Resolution

In the reported configuration, changing the pfSense Auth Digest Algorithm from SHA256 to SHA1 resolved the connection failure.

To update the setting in pfSense:

1. Sign in to the pfSense Web UI.
2. Navigate to VPN → OpenVPN.
3. Select the Clients tab.
4. Edit the OpenVPN client configuration used to connect to Access Server.
5. Locate Auth Digest Algorithm in the cryptographic settings.
6. Change Auth Digest Algorithm from SHA256 to SHA1.
7. Select Save and apply the changes.
8. Restart or reconnect the OpenVPN client.

After making the change, verify that the client connects successfully and that Access Server no longer reports this error:

TLS Error: incoming packet authentication failed

Important: Use SHA1 only when required for compatibility with the Access Server configuraiton. The authentication digest settings must match on both sides of the connection. SHA1 is a legacy algorithm and shouldn't be selected as a general troubleshooting workaround.

If you have additional questions or encounter an issue, submit a support ticket.