topic Re: Cisco NAC AD SSO in Network Security

Cisco NAC AD SSO

sanjeev3090 — Fri, 21 Feb 2020 12:15:46 GMT

Hi,

I need help with configuring CASUser Account for NAC AD SSO in a multidomain enviorment.

We have two child domain (based on region) say A & B. We have created the casuser account in domain A. If a user from Domain A login, everything works fine and they are authenticated.

But the problem starts if some one from domian B tries to login - they are authenticated by AD (checked through kerbtray and net time \set (can't see ticket for casuser account)....the NAC agaent keeps on prompting for username & password.

Domain: Windows 20003

Domain functional level: Windows 2000 native

Cisco NAC Agent: Version : 4.8.0.32

Re: Cisco NAC AD SSO

wkamil123 — Fri, 25 Feb 2011 15:10:00 GMT

Which domain is the master? The domain in site A&B are Windows 2000 native?

Do you configure kerbtray only on master domain?

Kamil

Re: Cisco NAC AD SSO

wkamil123 — Fri, 25 Feb 2011 15:10:09 GMT

Which domain is the master? The domain in site A&B are Windows 2000 native?

Do you configure kerbtray only on master domain?

Kamil

Re: Cisco NAC AD SSO

sanjeev3090 — Sun, 27 Feb 2011 09:43:06 GMT

Hi Kamil,

Thanks for your response.

I guess you are quering about the KTpass command as kerbtray is just a tool to display the ticket information.

Both A & B are child domains as we don't have any user accounts in root domain. The CAS user account was created in domain A (having multiple DC's in both domain A & B) and we ran the ktpass command for the CASUSER account in domain A. Everything works fine for users created in domain A.

Our requirement is that when user in domain B are visiting domain A, they can be authenticated as well through NAC.

Re: Cisco NAC AD SSO

wkamil123 — Sun, 27 Feb 2011 10:51:49 GMT

Hi Sanjeev,

I was implemented the Cisco NAC in a multi domain environment and works fine until the customer add third AD server on Windows 2008.

Do you verify that the created user CASUSER is visible on domain B?

The CASUSER in my opinon must be created on root domain and will be broadcasted to domains A&B.

Do you used LDAP user mapping to roles?

Do you tested that was created user in domain B and verify in site A? It's the simple test for what you want to do.

Which version Cisco NAC have you got?

Kamil