Users randomly rejected when no connection with remote domain controllers

[Rodrigo Abrantes Antunes]

 Hi all,

My institution has multiple AD domain controllers, one for each campus, all
of them respond for the same domain and connect to each other through
internet using a vpn.

One of the servers is located in my campus and freeradius authenticates
directly against this server.

When the vpn is up, everything works as it should but when the vpn is down,
users sometimes can't authenticate.

This seems to be random, users authenticate normally then suddenly can't
and suddenly can again.

When they are rejected I see this in debug:

...
(2535) mschap:    --> --username=gloriasantos
(2535) mschap: Creating challenge hash with username: gloriasantos
(2535) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00}
(2535) mschap:    --> --challenge=2aa82edbd744104d
(2535) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00}
(2535) mschap:    -->
--nt-response=7c9a6934a7363630b270dddeb82ad6f347a54a1ff9fc768c
Child PID 64739 is taking too much time: forcing failure and killing child.
(2535) mschap: ERROR: Failed to read from child output
(2535) mschap: External script failed
(2535) mschap: ERROR: External script says:
(2535) mschap: ERROR: MS-CHAP2-Response is incorrect
(2535) eap_mschapv2:     [mschap] = reject
...

And at this moment, if I try the command "ntlm_auth --username=user
--password=pass" it takes more time than it should and then succeds.

The pid 64739 is ntlm_auth I think.

Everything in freeradius, samba, and dns configuration points to the local
active directory domain controller, but it seems that when vpn is down
something is still trying to contact the remote domain controllers (which
are unavailable).

Any ideas of what might be happening?

Feel free to ask for needed configuration.

Freeradius  3.2.1
Samba 4.17.9-Debian