topic Re: 24403 user authentication against active directory failed in Network Access Control

24403 user authentication against active directory failed

rhuel.phils — Sat, 10 Mar 2018 05:18:00 GMT

Guys,

We suddenly have issue with our authentication, on live logs we always get 24403 user authentication against active directory failed , BUT as per checking in External Identity Source we able to do Test User and it was SUCCESS. We double check also our AD, no issue.

Anyone have encounter same issue? I have attached some screenshot.

Re: 24403 user authentication against active directory failed

hslai — Sat, 10 Mar 2018 06:12:12 GMT

Please enable DEBUG on Active Directory to logging level TRACE and check ad_agent.log. If needed, engage Cisco TAC to troubleshoot further.

Re: 24403 user authentication against active directory failed

Craig Hyps — Sun, 11 Mar 2018 15:02:53 GMT

Sometimes you may get an indication of failure by reviewing the remaining steps in the Authentication Details log (full value not displayed in screenshot), but certainly the debug logs will provide much deeper detail as Hsing-Tsu suggested.

Re: 24403 user authentication against active directory failed

rhuel.phils — Mon, 12 Mar 2018 02:35:44 GMT

Will there be impact if i change the settings, like reboot of service & etc.? whats the difference between TRACE & WARN?

The ad_agent.log which directory I can find it?

Re: 24403 user authentication against active directory failed

hslai — Tue, 13 Mar 2018 01:39:32 GMT

With debugging on, ISE produces more log files. It's ok to debug for a short while and it would not affect ISE services in general. TRACE is the most detailed logging in most of ISE components.

To access ad_agent.log, you may do one of the following:

ISE admin web UI > Operations > Troubleshoot > Download logs > [ISE-node-name] > Debug Logs
ISE admin CLI > Issue: show logging application ad_agent.log

Re: 24403 user authentication against active directory failed

rhuel.phils — Wed, 28 Mar 2018 08:14:18 GMT

Thanks hslai ... I will try that