Network Access using Cisco ASA Firewall and Radius Server (IAS) - Windows 2003
scenario: user asaias should authenticated radius server user sends
requests computer/laptop/vpn client. below test scenario
where authentication sent manually cisco asa firewall.
it seems user name format not accepting. tried different ways.
but user denied access. various user names formats tried
mentioned below.
user name : asaias (user member of ntsprod domain)
active directory / radius server : ntsdc01 (172.19.107.254)
domain : ntsprod.com
keane-kamco-asa> - working @ cisco asa firewall session
test 1
login as: kamco
kamco@172.19.107.7's password:
type or '?' list of available commands.
keane-kamco-asa> en
keane-kamco-asa# test aaa authentication rasgrp host 172.19.107.254
username: asaias
password: *******
info: attempting authentication test ip address <172.19.107.254> (timeout: 12 seconds)
warning in server system event
error: authentication server not responding: unknown
event type: warning
event source: ias
event category: none
event id: 2
date: 2/6/2008
time: 11:59:41 am
user: n/a
computer: ntsdc01
description:
user asaias@ntsprod.com denied access.
fully-qualified-user-name = ntsprod\asaias
nas-ip-address = 172.19.107.7
nas-identifier = <not present>
called-station-identifier = <not present>
calling-station-identifier = 000.000.000.000
client-friendly-name = pix
client-ip-address = 172.19.107.7
nas-port-type = virtual
nas-port = <not present>
proxy-policy-name = use windows authentication users
authentication-provider = windows
authentication-server = <undetermined>
policy-name = <undetermined>
authentication-type = pap
eap-type = <undetermined>
reason-code = 16
reason = authentication not successful because unknown user name or incorrect password used.
in windows server 2003, attributes have been edited user authentication getting failed.
to configure attribute manipulation
1. open internet authentication service.
2. in console tree, click connection request policies.
where?
• internet authentication service (local)/connection
request processing/connection request policies
3. in details pane, right-click policy want configure, ,
then click properties.
4. click edit profile.
5. on attribute tab, specify find , replace rules radius attributes.
to remove realm (example: @example.com) identity may originate, type @example.com in find box, , leave contents of replace box blank.
find : @ntsprod.com
replace :
to replace user principal name (upn)(user@domain.com) format of universal naming convention (unc)(domain.com\user) format, type (.*)@(.*) in find box, , type $2\$1 in replace box.
find : (.*)@(.*)
replace : $2\$1
to replace domain\user specific_domain\user, type (.*)@(.*) in find box, , type specific_domain\$2 in replace box.
find : (.*)@(.*)
replace : ntsprod\$2
find : (.*)\(.*)
replace : ntsprod\$2
find : (.*)\\(.*)
replace : ntsprod\$2
to convert user name upn name, example, change user user@domain.com, type $ in find box, , type @domain.com in replace box.
find : $
replace : @ntsprod.com
source used editing above attribute info :
http://support.microsoft.com/kb/317588
what think should turn on logging on side - try find out how domain controller seeing this... perhaps can see credentials getting passed, , perhaps clear formatting.
Windows Server > Security
Comments
Post a Comment