topic Re: NAC ADSSO doesn't work in Network Security

NAC ADSSO doesn't work

a.goldstein — Fri, 21 Feb 2020 09:56:26 GMT

Hi there,

I have 1 CAS and 1 CAM. Everything works fine if I use localDB authentication.

I tried to complete SSO AD configuration, from CAM installation guide. SSO service started to work successful. I'm trying to login to the domain - It's ok, I see green kerbtray icon, tickets are ok, but anyway I receive CCA Agent login/password screen.

AD logging looks like: (172.16.13.100 is AD server)

Mar 14, 2008 1:10:00 PM com.perfigo.wlan.jmx.admin.GSSServer loginToKDC

INFO: GSSServer - SPN : [cisco/computer-c.zozo.gov@ZOZO.GOV]

Mar 14, 2008 1:10:00 PM com.perfigo.wlan.jmx.admin.GSSServer buildKDCList

INFO: buildKDCList - KDC-1: computer-c.zozo.gov/172.16.13.100

Mar 14, 2008 1:10:10 PM com.perfigo.wlan.jmx.admin.GSSServer loginToKDC

INFO: GSSServer - KDC(s) : [172.16.13.100]

Mar 14, 2008 1:14:22 PM com.perfigo.wlan.jmx.admin.GSSRetrier$RetrierTask run

INFO: GSSR - Windows SSO is running

Mar 14, 2008 1:19:22 PM com.perfigo.wlan.jmx.admin.GSSRetrier$RetrierTask run

INFO: GSSR - Windows SSO is running

What's may be wrong in my configuration? Local time on CAM, CAS and AD is the same, TCP/8910 in CAS is in listening mode. I opened full IP from * to my AD Server for Unauthenticated Role.

Regards,

Andrey

Re: NAC ADSSO doesn't work

a.goldstein — Fri, 14 Mar 2008 15:35:29 GMT

ooops, I found the problem.

Workstation OS version was w2003server. With w2000wks and XP my configuration is working.

Regards,

Andrey

Re: NAC ADSSO doesn't work

yprasannas — Fri, 30 May 2008 16:27:59 GMT

I am having issue with AD SSO. CAS talks to AD because the service is started.

1. I can login to the domain but the NAC agent displays the window..Windows domain authentication but gives me a username and password window with drop down box as LOCAL DB.

Any help is appreciated.

Re: NAC ADSSO doesn't work

gojericho0 — Mon, 02 Jun 2008 14:19:01 GMT

Have you created an Authentication Server for your AD SSO?

Log on to CAM

User Management -> Authentication Server

Re: NAC ADSSO doesn't work

vinhtran427 — Wed, 11 Jun 2008 02:50:24 GMT

Have you verify User Login Page content setting to include "Available Providers"?

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_pages.html#wp1095025

Re: NAC ADSSO doesn't work

yprasannas — Wed, 11 Jun 2008 13:09:33 GMT

It worked. I was missing the VLAN mapping.

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_auth.html#wp1158789

Re: NAC ADSSO doesn't work

mrSS — Mon, 04 Aug 2008 17:15:08 GMT

hello yprasannas...

We are having the same issue with AD SSO...Loging into the domain is ok, but we set the CCA Agent login/password screen as well...We also configured vlan mapping as well, but no luck...

I noticed vlan mapping fixed your issue, what other things did you do?

Thanks

Re: NAC ADSSO doesn't work

vinhtran427 — Mon, 04 Aug 2008 22:19:42 GMT

Are you running OOB Layer-3 with Real-IP gateway? Are you running 4.1.3? Are you using Certificate Authority? If the answer is yes to all. You may want to review this http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/413/413rn.html#wp74768. Be careful though, you may also need to apply an egress ACL to block trusted vlan from sending TCP-8910 to the FQDN of the OOB-CAS's Untrusted IP. Otherwise, the CCA agent may continue to send TCP-8910 to CAS and process SSO and refresh IP continuously(looping process).

Re: NAC ADSSO doesn't work

mrSS — Tue, 05 Aug 2008 13:47:14 GMT

i answered yes to the first 2...not sure about the certificate authority...ill take a look at the link and update....thanks for the response

Re: NAC ADSSO doesn't work

manfernandez — Tue, 01 Dec 2009 22:53:04 GMT

I am having an issue with Windows Server 2008 Datacenter Core 2 64Bit and AD SSO.

I am getting the “Client not found in Kerberos database (6)” error I confirmed that the customer has the KB951191 hot fix.

TAC is saying it is not supported on Windows 2008 64Bit although their documentation says it IS supported with the new v4.7.1

Anyone else running 2008 64 with issues similar?