topic ASA, random AAA authentication problems. in Network Access Control

[SOLVED]ASA, random AAA authentication problems.

dan.sellberg — Mon, 11 Mar 2019 00:00:43 GMT

Hi there,

I have 2 ASA 5520 (v. 8.21) in a active/standby failover configuration.

VPN users are autenticated against the MS-AD through LDAP. For the most part this works well. Occasionally I'm having problems with new users in the AD. If I run a test I keep getting "User was not found". This can happen days after the account was created still. In some cases it never seems to work. The accounts I create exists on the same OU level as all the other accounts that are working.

Any hints or tips would be much appreciated.

//Dan

Re: ASA, random AAA authentication problems.

Javier Henderson — Wed, 17 Mar 2010 13:24:40 GMT

I would look at packet captures of the LDAP traffic between the ASA and the LDAP server, and compare working and non-working examples, to see if there are any differences on the queries sent by the ASA.

If all of the queries look the same, the problem would seem to be on the AD side.

ASA, random AAA authentication problems.

dan.sellberg — Fri, 02 Sep 2011 07:45:34 GMT

Forgot to update on this.

It turns out it was a configuration error. Older AD accounts had the same account name and pre-windows 2000 account name. The name standard changed and our AAA setup was looking at the wrong paramater which caused problems with newer accounts.