Cisco ASA 5510 ADFS

[hmdean]

Hello All,

I am new to this forum & I'm hoping someone can assist me. I'm desperate! :) I'm a novice when it comes to firewalls & my current Cisco ASA 5510 was set up by someone else before I started this new position. We are using the Cisco ASDM 7.6 software.

We have created an ADFS site so that our end users can use SSO for Box Software. Our ADFS works beautifully internally but when we try to set it up for public facing, nothing is working. Clearly I am doing something wrong, but here's the weird thing. We noticed that our external traffic is being routed to our VPN subnet. I feel like what I'm trying to do is simple: when a user goes to Box.com & selects SSO & types in their email address, I need for it to redirect to our ADFS site. It tries to get there but then errors out with "we can't connect to your server."

Can someone please help me get on the right track. At this point, I have myself so confused, I'm not sure what to do anymore.

Thank You In Advance!

[Sheraz.Salim]

What is ADFS and what is SSO can you be more simple and more technical so we can assist you. 

[hmdean]

ADFS: Active Directory Federation Services

SSO: Single Sign-On

Active Directory Federation Services (ADFS) is a Single Sign-On (SSO) solution created by Microsoft. As a component of Windows Server operating systems, it provides users with authenticated access to applications that are not capable of using Integrated Windows Authentication (IWA) through Active Directory (AD).

Developed to provide flexibility, ADFS gives organizations the ability to control their employees’ accounts while simplifying the user experience: employees only need to remember a single set of credentials to access multiple applications through SSO.

Hope this helps.

[Sheraz.Salim]

Thank you.

seem like you have a NAT issue. can you please show us your firewall config. you can hide your public ip address and username/password.

[hmdean]

Are you referring to the running config? The file is very long & I am unsure of what I need to block out. I want to be sure I'm showing the correct information.

Thanks.

[Sheraz.Salim]

ok. can you do packet capture as balaji advise. this would be a useful to start with.

[balaji.bandi]

Make sure you have all the FW rules in place and capture the logs while they click the box.com and see what is dropping and why federation service fail to authenticate.