We have successfully deployed a new ACS 5.3 which we use to do tacacs authentication against switches using an AD identity store. This all works fine. What we have found however is that when we type the incorrect password for an AD account (once), this immediately locks out the account on AD despite having a policy of three failed attempts before lockout (configured AD end). We are thinking the ACS is sending multiple authentication requests to AD for a single tacacs login request at the switch end if authentication fails and thereby reaching the three attempts very quickly if the password is incorrect. Ideally we only want the ACS to try once per request.
We have searched everywhere for a configurable item on the ACS for how it deals with a failed password authentication request but can only find an advanced option under the identity section of the service policy we use for tacacs, but this is set to Reject if authentication fails - nothing to define how many times to try.
can anyone explain if this is the default action the ACS takes when trying to authenticate against AD identity store (multiple attempts if auth fails) or if this can be configured only to try once per request?
thanks for any insight regarding this
