topic Re: Authentication Failure Code for Cisco ACS in Network Access Control

Authentication Failure Code for Cisco ACS

soebeginner — Fri, 21 Feb 2020 19:05:57 GMT

Hi,

Understand that there's Failure Code 24408 for failed login attempt due to wrong password for AD account.

24408: User authentication against Active Directory failed since user has entered the wrong password

Is there any failure code I can look at for similar instance but for failed logins on local accounts instead?

Thanks!

Re: Authentication Failure Code for Cisco ACS

balaji.bandi — Wed, 22 May 2019 06:38:32 GMT

Look this information :

24408 User authentication against Active Directory failed since user has entered the wrong password

=========================================================================
Authentication failure gainst AD due to account is disabled
=============================================

Re: Authentication Failure Code for Cisco ACS

soebeginner — Wed, 22 May 2019 07:29:18 GMT

Hi Balaji,
Thanks for the reply.
Yup, thats for account against Active Directory.
What if the account is a local account (i.e. not available in Active Directory) for instance, username=admin? Does it share the same code 24408? Or is there other failure code for local accounts?
Thanks!

Re: Authentication Failure Code for Cisco ACS

Sathiyanarayanan Ravindran — Wed, 22 May 2019 19:34:58 GMT

If the account is configured on the ACS for login. That time you will get a error code as below.

Message Text	Failed-Attempt: Authentication failed
Failure Reason	22040 Wrong password or invalid shared secret

Re: Authentication Failure Code for Cisco ACS

soebeginner — Thu, 23 May 2019 04:02:37 GMT

Hi Sathiya,

Thanks!
How about those accounts configured on the devices and that logins for the devices is send to cisco acs? e.g. failed login for admin account configured on firewall.

Re: Authentication Failure Code for Cisco ACS

Sathiyanarayanan Ravindran — Thu, 23 May 2019 19:22:05 GMT

If TACACS is configured as a 1st priority and local as fall back. The error message would be 22056 Subject not found in the applicable identity store(s).

If Local as 1st priority and tacacs as second, The authentication will get drop at switch/Firewall. You won't get any logs on ACS.

Re: Authentication Failure Code for Cisco ACS

Kush — Wed, 09 Oct 2019 11:35:48 GMT

Hello sir,

On ACS 5.8 patch 9 when we try to enable password hashing for local users on ACS authentication fails on secondary server with same error message 22040 wrong password on invalid shared secret.

Verified the password and shared secret.

Authentications work fine on primary server with hashing enabled for local users.

Tried to change the sec to primary and encountered the same issue.

Could you please share your insights.