Cisco Community
English
Register
We're here for you! LEARN about free offerings and business continuity best practices during the COVID-19 pandemic
Register
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

622
Views
0
Helpful
0
Replies
rodmunch999
rodmunch999 Beginner
Beginner
‎05-29-2012 09:49 PM
‎05-29-2012 09:49 PM

ACS v5.2 and LDAP: Active Directory Accounts not being disabled after a number of failed attempts.

Hi

     We have a v5.2 ACS which is authenticating against Windows Active Directory using secure LDAP. The authentication is working fine. However, there is an issue with disabling the account after a number of failed attempts. The Active Directory policy is set to disable the account after 5 failed attempts. This policy doesn't work if the authentication comes from the ACS. We can have many consecutive failures on an AD account and it does not get disabled.

It looks like that after the ACS does a bind to the LDAP server all the traffic that comes from the ACS is seen by Active Directory as a query. So all authentications from users whether they authenticate or not are just queries and it doesn't log failed authentications.

Has anyone out there managed to successfully enforce this kind of policy using ACS and LDAP?

Any advice would be appreciated

Cheers

BTW: The authentications mainly come from Network Devices and not servers.

Labels:
0 Helpful
Reply
Latest Contents
DMZ to Hyper-V Host to VM (double nic routing) issue
Created by machine23 on 03-31-2020 12:42 PM
0
0
0
0
Hello All , My end goal is to get access to a webserver from outside which is hosted on the VM on hyper-vbut the VM in my hyper-v can't ping my DMZ-ASA nor can my DMZ-ASA ping my VM but the hyper-v host can ping the ASA and back.DMZ-ASA has inside in... view more
Web Security - what capabilities does it provide and how can...
Created by ben.greenbaum on 03-30-2020 01:41 PM
0
0
0
0
Threat Response integrates with Cisco's Web Security Appliance (WSA) to provide visibility into web-bourne threats. By adding a Web Security or SMA Web module to Threat Response, investigators will be able to search for domains, URLs, and file hashes th... view more
VPN Load-Balancing
Created by Francesco Molino on 03-28-2020 04:45 PM
0
5
0
5
Hi everyone,   I was helping some friends and they were trying to solve a scalable VPN issues, specially these days with the pandemic situation. I recommended to implement ASA VPN Load-Balancing. This will allow to keep 1 FQDN for all RA-VPN users an... view more
Alcatel 8068S VPN configuration with FTD 6.4
Created by fthiel92 on 03-28-2020 03:48 PM
1
5
1
5
Purpose of this article is to share our experience during that Covid-19 period where we were able to successfully setup a VPN configuration for remote worker using Alcatel 8068S phones with FTD 2110 running 6.4.0.8.I would like to thank all of my colleagu... view more
Downloadable URL-Redirect ACL with ISE
Created by howon on 03-27-2020 02:33 PM
2
5
2
5
For additional advanced ISE related Tips, please visit Advanced ISE tips to make your deployment easier document   Downloadable URL-Redirect ACL with ISE If you have ever configured central web authentication with ISE you understand that it requires... view more
CreatePlease to create content
Discussion
Blog
Document
Video
Content for Community-Ad
Spotlight Awards- February 2020

Follow our Social Media Channels