topic Re: WSA error after upgrade to 12.0.1-334 in Web Security

WSA error after upgrade to 12.0.1-334

GorgoMoondust — Fri, 26 Jun 2020 11:08:28 GMT

hello,

we got this error every hour after upgrade from 11.8.0-453 to 12.0.1-334:

The Critical message is:

An application fault occurred: ('python2.6_10_amd64_nothr/base64.py b64decode|76', "<type 'exceptions.TypeError'>", 'Incorrect padding', '[egg/ldap_client.py setup_connection_thread|2440] [_coro.pyx coro._coro.sched.with_timeout (coro/_coro.c:11765)|1099] [egg/ldap_client.py setup_connection|2522] [egg/ldap_client.py authenticate_connection|2621] [egg/config_util.py decrypt|55] [python2.6_10_amd64_nothr/base64.py b64decode|76]')

Last message occurred 238 times between Fri Jun 26 11:34:07 2020 and Fri Jun 26 12:33:32 2020.

Product: Cisco S300V Web Security Virtual Appliance

Model: S300V

Version: 12.0.1-334

LDAP and Active Directory test are successfully. everything appear oke.

someone could give us a hint where the error comes from?

regards

Greg

Re: WSA error after upgrade to 12.0.1-334

opryluts — Mon, 29 Jun 2020 09:17:39 GMT

Hi Greg,

Most of times such app fault points to Auth realm configuration issues. Could you please run CLI -> testauthconfig and check if any errors are reported.

Also authentication logs would be helpful here...

If no specific error messages are found, I'd start from deleting auth realm and WSA AD computer object. Then join WSA back to the domain.

Re: WSA error after upgrade to 12.0.1-334

GorgoMoondust — Mon, 29 Jun 2020 10:13:25 GMT

Hi,,

no errors in Authtest, see txt.

no errors in Auth logs.

will try to rejoin Domain.

regards

Re: WSA error after upgrade to 12.0.1-334

opryluts — Mon, 29 Jun 2020 10:50:14 GMT

Yeah, try that:

1. Delete auth realm and commit

2. Delete WSA Computer object from the AD

3. Create auth realm and join WSA to the domain

Re: WSA error after upgrade to 12.0.1-334

GorgoMoondust — Mon, 29 Jun 2020 19:04:16 GMT

rejoined to Domain. error still there...

Re: WSA error after upgrade to 12.0.1-334

opryluts — Tue, 30 Jun 2020 06:51:49 GMT

Thank you for testing that.

I'd advise you to open a TAC case to check the appliance form the backend. Even though app fault points to an authentication-related part of the config seems it is misleading.

Re: WSA error after upgrade to 12.0.1-334

mattc_bab — Tue, 11 Aug 2020 13:37:23 GMT

I had this same issue and was able to resolve it by adjusting the NTP settings.

In my 'testauthconfig' the time skew between WSA and AD server was too great. I updated the NTP settings and after syncing the error was resolved.

Attempting to get TGT...
Warning: Clock skew between WSA 'Tue Aug 11 08:05:12 2020' and AD server 'Tue Aug 11 08:10:14 2020' is too great
Warning: Clock skew between WSA 'Tue Aug 11 08:05:13 2020' and AD server 'Tue Aug 11 08:10:14 2020' is too great
Warning: Clock skew between WSA 'Tue Aug 11 08:05:13 2020' and AD server 'Tue Aug 11 08:10:14 2020' is too great

Checking local WSA time and server time difference...
Warning: Clock skew between WSA 'Tue Aug 11 08:05:13 2020' and AD server 'Tue Aug 11 08:10:15 2020' is too great
Warning: Clock skew between WSA 'Tue Aug 11 08:05:13 2020' and AD server 'Tue Aug 11 08:10:15 2020' is too great
Warning: Clock skew between WSA 'Tue Aug 11 08:05:13 2020' and AD server 'Tue Aug 11 08:10:15 2020' is too great

Re: WSA error after upgrade to 12.0.1-334

GorgoMoondust — Tue, 11 Aug 2020 14:26:50 GMT

hello,

we have no problems with NTP. AD and WSA using the same NTP server, AD is backup NTP for WSA

Auth Test NTP settings passed.

but we got every hour 2 emails with this error:

The Critical message is:

Last message occurred 238 times between Tue Aug 11 15:19:14 2020 and Tue Aug 11 16:18:39 2020.

Product: Cisco S300V Web Security Virtual Appliance

Model: S300V

Version: 12.0.1-334

Serial Number:

Timestamp: 11 Aug 2020 16:18:50 +0200

regards