topic Keith,Appreciate the response in Network Access Control

Context Directory Agent server 2012R2

Daniel Sandstrom — Mon, 11 Mar 2019 03:58:25 GMT

Hi,

Win server 2012R2 is not offically on the supported list for Contex Directory Agent ( CDA ) , anyone tested this setup ?

I have been following the Installation guide for 2012 : http://www.cisco.com/en/US/docs/security/ibf/cda_10/Install_Config_guide/cda_install.html but I the server stays red in the CDA gui. No error messages in the log though.

CDA is patch1 and CDA user is within the Domain Admin group and necessary priv changes according to the installation document is in place ( registry key ownership etc,) , firewall on the server has been temporarily disabled.

Just wanted to see if there is anyone who got the combination CDA/2012R2 running and/or when there will be an official patch to CDA to add 2012R2 support.

Re: Context Directory Agent server 2012R2

Jatin Katyal — Tue, 08 Oct 2013 09:59:39 GMT

I guess, you should ask this query either in firewall or web security appliance community

I was looking around and as per installation guide. The Cisco CDA 1.0 supports the following Active Directory versions:

• Windows Server 2003

• Windows Server 2003 R2

• Windows Server 2008

• Windows Server 2008 R2

~BR
Jatin Katyal

**Do rate helpful posts**

Re: Context Directory Agent server 2012R2

Daniel Sandstrom — Wed, 09 Oct 2013 06:15:23 GMT

CDA 1.0 patch 1 adds support for server 2012 ( 2012R2 is not supported officially it seems like ).

Context Directory Agent server 2012R2

Artem Chubar — Mon, 13 Jan 2014 09:08:00 GMT

Maybe someone knows ETA or any news regarding CDA in combination with 2012 R2 domain controllers?

Context Directory Agent server 2012R2

jhubel005 — Wed, 15 Jan 2014 18:32:37 GMT

I verified I also have the same problem connecting to 2012R2 after upgrading CDA to Patch 1 from a non-patch CDA connecting to a retired 2008R2 box. The Status icon under Active Directory Servers is red.

I verified the netsh commands, DCOM settings, WMI settings were all reconfigured on the new 2012R2 DC without any progress.

Context Directory Agent server 2012R2

Daniel Sandstrom — Fri, 21 Feb 2014 14:51:36 GMT

Patch 2 was released during February , anyone tested against 2012 R2 ? Can't find anything specific in the release notes..

Context Directory Agent server 2012R2

jhubel005 — Fri, 21 Feb 2014 17:06:34 GMT

Thanks for the notification on the new release. After installing Patch 2 this morning, the connection to my 2012R2 DC did not turn green from the previous red. I tried removing the connection and re-adding without any luck either. Another thing I tried was the NTLMv2 setting even though I have GPO “Network security: LAN Manager authentication level” set to “Send LM & NTLM - use NTLMv2 session security if negotiated.”

I can't get it to work, and you’re right that 2012 R2 isn’t specifically supported with this release based on the release guide missing specific mention of it and the fact that it doesn't show up under the "What's new in Cisco CDA" section as 2012 does for Patch 1. I'm disapointed in the slowess to support this OS. Waiting for the next patch...

Context Directory Agent server 2012R2

newhorizonslondon — Tue, 25 Feb 2014 14:58:47 GMT

I agree Jeremy. I am also very surprised to see that there is no support for CDA to work with Server 2012 R2.

Same issue here.. I have

keith_gajeski — Thu, 24 Apr 2014 13:09:33 GMT

Same issue here.. I have opened a case with TAC, and they stated that it's in development, but it's known not to work. There is a "work around", but I'm still debating if it something I want to do. You basically need to configure event log forwarding for event ID 4768 (Kerberos authentication), to another DC that is running one of the supported versions of Windows server. I'm going to test it if I can find better documentation on the web somewhere.

Also opened case with TAC,

paul_1234 — Tue, 06 May 2014 20:45:51 GMT

Also opened case with TAC, had asked for ETA for fix or some documentation for the log forwarding work-around. TAC couldn't provide either.

Keith, did you have any luck with the log forwarding work-around?

Paul,I decided that it was

keith_gajeski — Tue, 06 May 2014 20:56:23 GMT

Paul,

I decided that it was not in the best interest of my company. Mostly because I would be adding another dependancy with having to forward the logs to another server, and then adding that server to the CDA. For now I just installed a 2012 (non R2) domain controller. I'm really torn, because I would have loved to have used the latest group policy that R2 had to offer. I was given a time frame of about a year for a fix, which is really unreasonable, but there's not a thing I can do about it.

Keith,Appreciate the response

paul_1234 — Tue, 06 May 2014 21:11:02 GMT

Keith,

Appreciate the response. We're stuck between a rock and a hard place.... just implementing CX with CDA, however also in the process of upgrading all DCs to 2012 R2 which will be completed in a few weeks. Had really wanted to use passive auth feature, so will be testing log forwarding concept.

Thanks - Paul

Paul,Did you ever get the

Adam Perry — Tue, 03 Jun 2014 19:29:43 GMT

Paul,

Did you ever get the event log forwarding to work with the CDA? I was attempting to go this route also, however i cant get the CDA to see the forwarded events.

For testing, I have a domain with two 2012 R2 DC's and one 2012 DC. My server 2012 DC is also the collector for the event logs from the other two 2012 R2 servers. The forwarded events are showing up in the collector, however they are not showing up as user-IP mappings on the CDA. The only devices that show up in the User-IP mappings on the CDA are the devices that authenticated to the 2012 DC.

Thanks

Adam,No we didn't have any

paul_1234 — Tue, 03 Jun 2014 19:57:51 GMT

Adam,

No we didn't have any luck with the log forwarding, opted to use active auth with NTLM for now. Waiting on Cisco for the fix.

HiDid someone checked the

aharon-n — Tue, 01 Jul 2014 12:37:53 GMT

Did someone checked the access also from the ASA to the 2012R2 server?

This doesn't work as well.

I opened a case and they

aharon-n — Mon, 07 Jul 2014 14:27:51 GMT

I opened a case and they refer me to bug CSCun10631.

(CDA doesn't support 2012R2).

the good news is that a new patch (3) should be release this month (July) and will include support.

The bug search states fixed

keith_gajeski — Tue, 08 Jul 2014 15:55:55 GMT

The bug search states fixed as of yesterday. I do not see the download avaiable yet though.

https://tools.cisco.com/bugsearch/bug/CSCun10631

Hi allDoes anyone have a clue

tto — Mon, 14 Jul 2014 13:03:36 GMT

Hi all

Does anyone have a clue as to when a fix is released to this problem.

Best regards

Tex Tofte

Enhancement CSCun10631 is now

csaxena — Mon, 28 Jul 2014 05:35:15 GMT

Enhancement CSCun10631 is now verified. We will have support for Windows 2012 R2 with release of CDA v1 patch 3.

That's great, any idea when

paul_1234 — Mon, 28 Jul 2014 19:56:51 GMT

That's great, any idea when will it be released?

Not seeing it Cisco's CDA link:

http://software.cisco.com/download/release.html?mdfid=283123066&flowid=22661&softwareid=284724387&release=CDA&relind=AVAILABLE&rellifecycle=&reltype=latest