> Source: [sk121801](https://support.checkpoint.com/results/sk/sk121801)

# sk121801 - "Authentication Failed" in SNX when using custom realms in Mobile Access / SNX traffic does not hit correct rule

| Property | Value |
|----------|-------|
| Solution ID | sk121801 |
| Date Created | 2017-12-04 |
| Last Modified | 2023-09-06 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * In R77.30 when authenticating to Mobile Access portal using a custom realm, which is created via GuiDBedit, LDAP users may fail to connect to SNX with an error "Authentication Failed" - even though authentication to the portal using that realm succeeds.
* Since R80.10, SNX user able to authenticate, however traffic does not hit relevant policy, therefore it is dropped on clean up rule.

## Cause

**Legacy policy:**   

The SSL Network Extender will use the "*ssl_vpn* " realm's *UserLoginAttr* value. So if a user logs in to the portal, using the custom realm, with a different user login attribute that doesn't match the one set for the "*ssl_vpn*" realm, the authentication with SNX will fail.

**Example:**

ssl_vpn's *UserLoginAttr* is set to *sAMAccount*

Custom_Realm's *UserLoginAttr* is set to u*serPrincipalName*

User authenticates in the portal using Custom_Realm with "user@domain.com".

The authentication is successful since the value for user matches the realm's UserLoginAttr.

When he tries to connect to SNX however, the UserLoginAttr will be sAMAccount which doesn't match the user's input.

Hence, "Authentication Failed" is displayed.  

**Unified Policy:**   

Authentication flow is the same, however, 'vpn' realm will be used instead, since IDA blade is involved.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content