Remote VPN access LDAP Server Group DC authentication issues

[sergio2025]

We have a Cisco ASA 5500 series firewall, and have been using LDAP for VPN authentication in a Windows 2016 domain controller.
In remote Access VPN, AAA Server Groups we have a LDAP server group using LDAP protocol with three DC to authenticate the remote VPN users. Only the first Domain controller pass the Test and authenticates the users; the other two domain controllers in the group fail the Test and are not authenticating users.

The other two DC are up and running and replicating properly, the DCs are talking to each other in the local network. The service account being used is active.

I've tested ldap.exe with a Windows computer in this domain and works good connecting to all DCs.

=> I have Cisco ASDM 7.9(2) 152 Software version to connect to ASA 5515 Security appliance; I know this is EOL. 

As part of the troubleshooting I run Tests in ASA's CLI interface which Fail with error code (DC02 and DC02):

test aaa-server authentication LDAP host 10.10.##.## username myserviceaccount password "Mypassword@890"

INFO: Attempting Authentication test to IP address (10.10.##.##) (timeout: 12 seconds)
ERROR: Authentication Rejected: Unspecified

==> Note: service account and IP address renamed for security purposes.

=> This is the one passing (DC01) for the same test command above, but using DC01's IP address instead:

INFO: Attempting Authentication test to IP address (10.10.##.###) (timeout: 12 seconds)
INFO: Authentication Successful

So, after exhausting multiple local troubleshooting efforts, I'd like to ask if some one out there has an input that may help to to fix this issue?

Thank you for your kind response to this matter.

[sergio2025 · Accepted solution]

This solution worked well for my case:

Set the following settings

AAA-Server Edit - ASDM ASA5515

Then Test in CLI with this command:

test aaa-server authentication LDAP host 10.10.##.## username myldapsvcacct password "<mypassword>"

Note: actual service-acct-name and password replaced for security reasons.

Test successful. 

Prior to that:

Server Type was: Autodetect

Scope was: Single level

Naming Attribute field was blank.

Login DN was Ok; No change here same for password and everything else in such dialog window.

Therefore, by setting such settings the authentication is successful.

I hope this helps others in the same or similar situation.

-SM

Additional References:

Minkumar

https://community.cisco.com/t5/security-knowledge-base/remote-access-vpn-on-asa-authentication-using-ldap-server/tac-p/5302086#M9252

Jatin Katal

https://community.cisco.com/t5/network-access-control/asa-ldap-auth-error-authentication-rejected-memory-error/td-p/2347344