topic Cisco ACS 5.3.0.40 and tacacs authentication against AD accounts in Network Access Control

Cisco ACS 5.3.0.40 and tacacs authentication against AD accounts

humphres1 — Mon, 11 Mar 2019 03:28:58 GMT

We have successfully deployed a new ACS 5.3 which we use to do tacacs authentication against switches using an AD identity store. This all works fine. What we have found however is that when we type the incorrect password for an AD account (once), this immediately locks out the account on AD despite having a policy of three failed attempts before lockout (configured AD end). We are thinking the ACS is sending multiple authentication requests to AD for a single tacacs login request at the switch end if authentication fails and thereby reaching the three attempts very quickly if the password is incorrect. Ideally we only want the ACS to try once per request.

We have searched everywhere for a configurable item on the ACS for how it deals with a failed password authentication request but can only find an advanced option under the identity section of the service policy we use for tacacs, but this is set to Reject if authentication fails - nothing to define how many times to try.

can anyone explain if this is the default action the ACS takes when trying to authenticate against AD identity store (multiple attempts if auth fails) or if this can be configured only to try once per request?

thanks for any insight regarding this

Cisco ACS 5.3.0.40 and tacacs authentication against AD accounts

jrabinow — Thu, 30 May 2013 10:38:24 GMT

Please ensure that have latest patch for ACS 5.3 installed. There are some fixes related to active directory that I think are relevant to this specific case. Latest patch is 5.3.0.40.9

I think relevant CDETS is CSCtz03211 ACS 5.3 sends multiple authentication attempts to Active Directory

In any case there were seevral important Active Dierctory related fixes included in patches for 5.3 and these are recommended for operation with Active Directory

Cisco ACS 5.3.0.40 and tacacs authentication against AD accounts

humphres1 — Thu, 30 May 2013 10:44:00 GMT

brilliant, thanks for the response, we will try the patch.

thanks again.