topic Re: Unable to authenticate to AD in Network Access Control

Unable to authenticate to AD

krishanmistry — Sun, 10 Mar 2019 22:57:19 GMT

I have a ACS SE running 4.2 and a remote agent also running 4.2, I am using peap authentication and am unable to authenticate to Active directory, I can authenticate using a local account on the ACS, which tells be that the certificate are configured correctly,.

The error message that I am getting on the ACS server is:

Authen session timed out: Challenge not provided by client.

Has anyone come across this problem before and do they know of a solution.

Many Thanks

Re: Unable to authenticate to AD

Jagdeep Gambhir — Thu, 03 Jul 2008 19:11:22 GMT

Please increase the radius timeout on the AP and share the result. Command to increase the timeout on device

Radius-server timeout .

Regards,

~JG

Do rate helpful posts

Re: Unable to authenticate to AD

krishanmistry — Thu, 03 Jul 2008 19:19:49 GMT

Hi jgambir

I have two WiSM blades deployed, I have increase the advanced eap timeout value to 20 seconds and still no luck.

Thanks

Re: Unable to authenticate to AD

Jagdeep Gambhir — Thu, 03 Jul 2008 19:27:29 GMT

Increase the loggin level to full,

acs--->system configuration---->service control--->.full

Please send cswinagent logs from remote agent after recreating the issue.

You need to go to on server where remote agent is installed.

Here is the location of the logs

C:\Program Files\Cisco\CiscoSecure ACS Agent\CSWinAgent\Logs

Re: Unable to authenticate to AD

krishanmistry — Thu, 03 Jul 2008 19:31:59 GMT

Thanks, I will try that first thing tomorrow morning, and will let you know that outcome.

Re: Unable to authenticate to AD

krishanmistry — Fri, 04 Jul 2008 15:54:24 GMT

Hi jgambir

I managed to resolve the issue today, it turned out that the customer have two domains running. The Customer is a college and have one domain for students and a second for staff and Admin, when we first start testing we we using a student machine and credentials on the Staff domain.

This leads to my second question, can you use a single ACS to authenticate against two different domains, I personally dont think this will be possible, do you know of a way or do I need a ACS SE per domain.

Many Thanks

Re: Unable to authenticate to AD

Jagdeep Gambhir — Fri, 04 Jul 2008 16:05:12 GMT

It can authenticate with Multiple domain with a condition of having two way trust.

If there is no two way trust then we would need acs in each domain and have proxy configured.