topic Then I would suggest that you in Network Security

FireSight/User Agent Error: [2201] - Report login information from IP to IP failed after TIME [A call to SSPI failed, see inner exception.]

jude — Tue, 12 Mar 2019 13:04:28 GMT

We have a FireSight system with one version 5.4.0.5 Virtual Data Center and several ASA devices. We installed some User Agents to get user logon/logoff information from MS AD servers, and encountered 2 problems:

1) All User Agent servers (window server 2008R2/64/SP1 and Windows server 2012R2) report error 2201. They can pull logon info from AD server correctly and export correct user map, can communicate with Virtual Data Center, but just cannot send data to it. Meanwhile, one User Agent on Windows 2008 STD/SP2 server works perfectly. Have tried 3 other servers, 2 User Agent versions, en-us regional settings, and 2 .Net versions. Nothing changed.

2) We prefer to have only 1 User Agent but 1 User Agent supports 5 DC servers at max. So we configured one central AD server to subcribe security logs from all AD servers successfully to its event log folder 'Forwarded Events', and configured the User Agent to pull data from this central AD server. The User Agent does pull logons, but only from events folder 'Windows Logs - Security', never from 'Forwarded Events'. Is the User Agent designed to read from 'Windows Logs-Security' only?

[2201] - Report login information from USER-AGENT-SERVER to 10.xx.xx.xx failed after 07/14/2016 9:08:55 AM. [A call to SSPI failed, see inner exception.].

This is known issue.

yogdhanu — Thu, 14 Jul 2016 03:22:21 GMT

This is known issue.

Please uninstall the Microsoft update

KB3161606 and KB3161608

Upon closer inspection, the issue appears to be a specific change to the default Cipher Suites:

https://support.microsoft.com/en-us/kb/3161639

There is bug created for this.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva32331

Rate if helps.

yogesh

Thanks yogdhanu for the right

jude — Thu, 14 Jul 2016 04:49:22 GMT

Thanks yogdhanu for the right answer. I uninstalled KB3161606 and it works fine now.

Do you know whether the User Agent pulls logons from "Windows Logs - Forwarded Events"?

Hi

yogdhanu — Thu, 14 Jul 2016 06:05:33 GMT

User agent reads AD events 4624 logon events.

Rate if helps

Yogesh

Thanks but I meant something

jude — Thu, 14 Jul 2016 07:15:24 GMT

Thanks but I meant something else:

My User Agent reads event type 4624 from "Security" (local DC server events) correctly, but seems it doesn't read event type 4624 from "Forwarded Events" (subscribed events from other DC servers). Is it designed to do so, or is there any wrong configuration with my event forwarding?

"Windows, for DH suites has a

Justin Schwilling — Mon, 01 Aug 2016 17:56:01 GMT

From the alternate workaround wording in the bug info:

"Windows, for DH suites has a minimum key length set to 1024, which appears to lead to this issue. You can work around this by changing this to support 512-bit key length."

512-bit really? I assume an update is in the works for this?

Hello

dszendol — Wed, 03 Aug 2016 12:50:08 GMT

Hello

Changing the windows register like it is described in bug workaround helped for me.

The host restart was not necessary.

Cisco fix this nasty bug in

ilukeberry — Wed, 24 Aug 2016 07:25:39 GMT

Cisco fix this nasty bug in User Agent!!!! I got hit by the same bug!!! FirePOWER 6.0.1.1 & Windows Server 2012 R2!!! I had to uninstall whole patch roll-up to get User Agent working again. Registry hack didn't work for me.

I've just been hit by this

craig-allen — Sun, 28 Aug 2016 23:26:35 GMT

I've just been hit by this bug as well... several hours later I find this thread.

I applied registry fix to Windows 2008 R2 hosting SFUA server & reboot for good measure. Updates to FMC restored.

When can we expect an update to User Agent? Reducing the cipher levels to 512 is not a fix!

Ok...so what do you do if you

avanvooren1 — Fri, 23 Sep 2016 16:36:54 GMT

Ok...so what do you do if you have this issue, and do NOT find either of these updates applied in my Windows Server 2012r2?

Then I would suggest that you

Dennis Perto — Fri, 23 Sep 2016 16:57:31 GMT

Then I would suggest that you go with the solution where you manually change the diffie hellman parameters in the windows registry.

I did that to 4 servers without problems today 🙂

Microsoft replaced the

beborre01 — Mon, 10 Oct 2016 20:55:26 GMT

Microsoft replaced the patches with new ones. Check and see if you have either 3172614 or 3172605.

KB3161606 - https://support.microsoft.com/en-us/kb/3172614

KB3161608 - https://support.microsoft.com/en-us/kb/3172605

I did registry hack and it

ilukeberry — Wed, 02 Nov 2016 16:15:51 GMT

I did registry hack and it worked for a while, now it died again!!!! when do you plan to fix this?!?!?! i'm on FP 6.0.1.2.

Okay i guess if you have

ilukeberry — Thu, 03 Nov 2016 08:47:23 GMT

Okay i guess if you have 3172614 the registry hack doesn't work anymore. You NEED to uninstall 3172614 to get this working again with registry hack.

I mean c'mon Cisco how long do we have to wait to get this permanently fixed??!?!

Uninstalling 3172614 worked

Flarkus — Thu, 15 Dec 2016 19:13:39 GMT

Uninstalling 3172614 worked for me. If anyone from Cisco is listening, you REALLY need to fix this.

Same here. It stopped on the

Justin Schwilling — Wed, 11 Jan 2017 18:54:51 GMT

Same here. It stopped on the 2012 servers again

This is now FIXED in

ilukeberry — Fri, 20 Jan 2017 10:51:38 GMT

This is now FIXED in FirePOWER 6.0.1.3 🙂