Re: ASK THE EXPERTS ::: Cisco NAC AD SSO Setup With Tiago Antune

ciscomoderator · ‎06-01-2011

With

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn how about Cisco NAC Appliance Active Directory Single Sign On Setup with Cisco experts Tiago Antunes and Federico Lovison. Tiago Antunes is a customer support engineer at the Cisco Technical Assistance Center in Belgium, where he specializes in solving high-severity issues in wireless networks, network admission control setups, identity based networking and 802.1X setups, and Authentication, Authorization and Accounting solutions. Federico Lovison is a customer support engineer at the Cisco Technical Assistance Center in Brussels, where he has been part of the wireless and AAA team since joining Cisco in 2007. He supports customers on AAA products (Cisco Identity Based Network Services, Secure Access Control Server, and Network Access Control appliance) and wireless products; he also provides training for Cisco engineers on AAA-related subjects.

Remember to use the rating system to let Tiago and Federico know if you have received an adequate response.

Tiago and Federico might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the shortly after the event. This event lasts through June 7, 2011. Visit this forum often to view responses to your questions and the questions of other community members.

bruce.hodge · ‎06-01-2011

Guys,

I have NAC 4.7.2 and I am trying to add a 4507E chassis to our OOB switches.

I have had no luck.

I was asked to do the following

psql -h localhost -U postgres controlsmartdb -c "INSERT INTO supported_switch VALUES ('1.3.6.1.4.1.9.1.1286', 4, ‘Cisco Catalyst 4500 E-Series 4507R+E');"

But we got this error

ERROR: invalid byte sequence for encoding "UTF8": 0x91
HINT: This error can also happen if the byte sequence does not match the encoding expected by the server, which is controlled by "client_encoding".

Any suggestions to get this chassis type into CAM?

Tiago Antunes · ‎06-01-2011

Hi Bruce,

Thanks for your post.

4507E switches is already supported as we can see in Table 11 "Supported Cisco Catalyst 4000/4500 Switches".

So you should not need to do any DB change...

We surelly can help you but i kindly ask you to create a new discussion out of this one which is meant for AD SSO setups.

When creating the new discussion, please let us know what exactly happens when you are trying to add the switch to the CAM. What error messages you get and what is the switch and CAM snmp configuration.

Thanks,

Tiago

bruce.hodge · ‎06-02-2011

Sorry, Tiago,

I have posted it in the Other Security Subjects area as well.

The list you gave me was good but it listed the 4507R-E with an IOS, we have a sup 7 with IOS-XE and it is not supported :-(

Hence the manual add

Thanks Bruce

Thompso7540_2 · ‎06-06-2011

hey Federico and Tiago, can you look at my log and give me clues as to why the ad sso service will not start? This happened after a power outage to the CAS. I have confirmed the ad account/password is correct, and also the clock is properly synced.

09:37:21.715 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4-Encryption

2011-06-06 09:37:21.715 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServerResponse#/10.86.20.25:000000420101a362e1deaadcdc1fb3fac5f7b38ed9e55445f502c18ad25bdd50bb0cd4102bd406480c7beeb9cd051fa2872db87c4b840b2ff954dba9db34f354ea80

2011-06-06 09:37:21.715 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - ***** End UDP Packet Processing *****

2011-06-06 09:37:21.715 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissServer - Sent Response to /10.86.20.25!

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - ***** Begin UDP Packet Processing *****

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServerRequest#/10.86.20.80::EncType = 1:Data=:000000490101378632c2f2aa17189bf73fd8204753b5bc786d6a53139a13a7a04ef01b4b8b28fbcaf8080872f8561d7c295e5869cd0dcc83c2f5bf0abf0edb51ef4a4a92e26b4875b0

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Client OS is WINDOWS_PRO_XP

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissUtil - IP=/10.86.20.80, MAC=18:A9:05:C1:63:01

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing SWISS_OP_SEND_LOGIN_STATUS_V2

2011-06-06 09:37:21.820 -0400 DEBUG com.perfigo.wlan.jmx.admin.UserStatusManager - SWISS - getUserStatus in L3: ip='10.86.20.80', mac='18:A9:05:C1:63:01'

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissUtil - OpLoginStatus: 2097217

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - Cert domain length :21 val =aivab-ccas01.edmc.edu

2011-06-06 09:37:21.820 -0400 DEBUG com.perfigo.wlan.jmx.swiss.SWissHandler - Size of opData= 8 :Value=:002000410a561450

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4-Encryption

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServerResponse#/10.86.20.80:000000430101b23fb0ad6b93aaf8b347c9d5c279ffb5a42cc952350c14fd899db22516b3c9c95f2162b17ba78465f92aeecb61a62ab6c8d5ecf63eb1e20ad4e1282fb3

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - ***** End UDP Packet Processing *****

2011-06-06 09:37:21.820 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissServer - Sent Response to /10.86.20.80!

2011-06-06 09:37:21.832 -0400 ERROR com.perfigo.wlan.jmx.adsso.GSSServer - Unable to start server ... Password has expired - change password to reset (23)

2011-06-06 09:37:21.832 -0400 DEBUG com.perfigo.wlan.jmx.BeanServerWrapper - BeanServerWrapper - invoke: DefaultDomain:type=com.perfigo.wlan.jmx.admin.ServerInfo:startSSOServer:DURATION=548

2011-06-06 09:37:21.860 -0400 TRACE

7f2c3cc92b78466e1ca6ab1546f98ec2

2011-06-06 09:37:26.270 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4

2011-06-06 09:37:26.270 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Client OS is WINDOWS_PRO_XP

2011-06-06 09:37:26.270 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissUtil - IP=/10.86.20.56, MAC=18:A9:05:B5:0F:1C

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing SWISS_OP_SEND_LOGIN_STATUS_V2

2011-06-06 09:37:26.271 -0400 DEBUG com.perfigo.wlan.jmx.admin.UserStatusManager - SWISS - getUserStatus in L3: ip='10.86.20.56', mac='18:A9:05:B5:0F:1C'

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissUtil - OpLoginStatus: 2097153

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - Cert domain length :21 val =aivab-ccas01.edmc.edu

2011-06-06 09:37:26.271 -0400 DEBUG com.perfigo.wlan.jmx.swiss.SWissHandler - Size of opData= 8 :Value=:002000010a561438

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4-Encryption

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServerResponse#/10.86.20.56:000000460101f77fcd8a77b3d46a199e95ab3df9afca506e0bbe825191d8fca0074db2cd6a1c434f2d0fba8093d726975bcbcf446ce05f84d4d548aafc1d7fe91a41e569d8ef

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - ***** End UDP Packet Processing *****

2011-06-06 09:37:26.271 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissServer - Sent Response to /10.86.20.56!

2011-06-06 09:37:26.458 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - ***** Begin UDP Packet Processing *****

2011-06-06 09:37:26.458 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServerRequest#/10.86.20.79::EncType = 1:Data=:000000470101c48a6e96078571ee40e21dda6ae962409f5b1172b0b1489d80a0fa4bb46c55414ee17e436cbce9f901c682e1bdd4528475cbfa6d6ae06a0bcc3efe324d0915f0ff

2011-06-06 09:37:26.458 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4

2011-06-06 09:37:26.458 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Client OS is WINDOWS_PRO_XP

2011-06-06 09:37:26.458 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissUtil - IP=/10.86.20.79, MAC=18:A9:05:B5:0F:1F

2011-06-06 09:37:26.458 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing SWISS_OP_SEND_LOGIN_STATUS_V2

2011-06-06 09:37:26.459 -0400 DEBUG com.perfigo.wlan.jmx.admin.UserStatusManager - SWISS - getUserStatus in L3: ip='10.86.20.79', mac='18:A9:05:B5:0F:1F'

2011-06-06 09:37:26.459 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissUtil - OpLoginStatus: 2097153

2011-06-06 09:37:26.459 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - Cert domain length :21 val =aivab-ccas01.edmc.edu

2011-06-06 09:37:26.459 -0400 DEBUG com.perfigo.wlan.jmx.swiss.SWissHandler - Size of opData= 8 :Value=:002000010a56144f

2011-06-06 09:37:26.459 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServer: Doing RC4-Encryption

2011-06-06 09:37:26.459 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - SWissServerResponse#/10.86.20.79:000000410101e4883fb9f515107b3743471a439a8394be8874d312e0e2166129a83be6e81c4a1bb11e6bd65f7b3a051b47c7f8665e5f6cbb3a3daf2081b6f917a7

2011-06-06 09:37:26.459 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissHandler - ***** End UDP Packet Processing *****

2011-06-06 09:37:26.459 -0400 TRACE com.perfigo.wlan.jmx.swiss.SWissServer - Sent Response to /10.86.20.79!

Tiago Antunes · ‎06-07-2011

Hi Bryan,

From the log messages:

2011-06-06 09:37:21.832 -0400 ERROR com.perfigo.wlan.jmx.adsso.GSSServer - Unable to start server ... Password has expired - change password to reset (23)

It looks like the password has expired...

I would check if indeed the password has expired, or simply change the passowrd, mark the checkbox to "password never expires" and re-run ktpass.

HTH,

Tiago

--

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

ciscomoderator · ‎06-07-2011

The step by step configuration guide ... (Rating: 5) - May 25, 2011 1:17 AM by Tiago Antunes

Re: ASK THE EXPERTS : Learn about Cisco NAC Appliance Active Directory Single Sign On Setup

The step by step configuration guide is available at:

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cas/s_adsso.html.

You can configure Cisco NAC Appliance to automatically authenticate Agent users who are already logged into a Windows domain. AD SSO allows users logging into AD on their Windows systems to automatically go through authentication and posture assessment without ever having to log in via the Agent.

You can configure AD SSO for all deployment types (L2/L3, In-Band/Out-of-Band). For OOB, client ports are put on the Auth VLAN first prior to Windows domain authentication.

When the Clean Access Server is configured for AD SSO, the general sequence is as follows:

Windows User and the CAS both have an account on the Active Directory server.
User logs onto Windows AD (or uses cached credentials).
Credentials are sent to the AD. The AD authenticates and gives a Ticket Granting Ticket (TGT) to the user.
- The NAC Agent on the client machine asks the Windows user for a Kerberos Service Ticket (ST) from AD, so that the NAC Agent can communicate with the CAS.
- The client requests a Service Ticket from the AD.
- The AD sends the new ST to the client and the client provides this ST to the NAC Agent.
- The NAC Agent presents this ST to the CAS as part of the authentication process to establish communication with the CAS.
The CAS sends back packets and mutually authenticates the client as part of the ADSSO process.
The CAS uses this information to sign the client onto Cisco NAC Appliance and hence SSO authentication takes place.
For additional user role mapping (for authentication and posture assessment), an LDAP lookup server with attribute mapping can be configured.

ciscomoderator · ‎06-07-2011

Hey Tiago - Where in the support logs ... (Rating: 0) - May 26, 2011 9:04 AM by Bryan Thompson

Hey Tiago - Where in the support logs are the SSO entries located? I am trying to troubleshoot the service not starting, it happened after we had a power outage and the nac server lost communication to the manager. I have 4.7.2, and was not able to find the entry "The log file of interest on the CAS is /perfigo/logs/perfigo-redirect-log0.log.0."

Thanks,

Bryan

ciscomoderator · ‎06-07-2011

Hi Bryan, you can find ... (Rating: 5) - May 26, 2011 12:07 PM by Federico Lovison

Hi Bryan,

you can find information about the service not starting on the CAS on the nac_server.log (for CAS release 4.5 onwards), that you can find either by downloading the support logs from the CAS GUI (https:///admin/) or by directly connecting via SSH to the CAS.

The file is at:
/perfigo/access/tomcat/logs/nac_server.log

In order to get enough details to troubleshoot the problem, set the log level to "trace" (CCA General logging & AD SSO Communication) before reproducing the problem, then collect the support logs or read the file from the CLI, as described here:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cas/s_admin.html#wp1041372

The usual reasons for the service not starting are:
- CAS clock out of sync with the AD domain controller(s);
- verify that you used the correct syntax and version of the KTPass command based on the version of your Domain Controllers and Client OS

You can refer to the following document to check the KTPass command version required for different Windows Server versions:
http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/agntsprt.html#wp66672

Other info about troubleshooting the AD SSO service not starting on the CAS can be found here:
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080884229.shtml#start

I hope this helps.

Kind Regards,
Federico

--
If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.

ciscomoderator · ‎06-07-2011

Thanks - i checked the log file and my ... (Rating: 0) - May 26, 2011 12:19 PM by Bryan Thompson

Thanks - i checked the log file and my problem might be obvious.

com.perfigo.wlan.jmx.adsso.GSSServer                - GSSServer - created login context ...javax.security.auth.login.LoginContext@1e8b91a
2011-05-26 10:55:09.532 -0400 ERROR com.perfigo.wlan.jmx.adsso.GSSServer               - Unable to start server ... Password has expired - change password to reset (23)
2011-05-26 10:55:18.136 -0400 WARN   org.apache.commons.httpclient.HttpMethodBase       - Going to buffer response body of large or unknown size. Using getResponseBodyAsStream instead is recommended.

i am asking our server group to check out the account.

ciscomoderator · ‎06-07-2011

I got Windows Server ... (Rating: 0) - May 26, 2011 12:19 PM

By Prasanth Mathews

I got Windows Server 2008 R2 (64 bit) with SP2. I ran KTPass on this.

The command I used

ktpass.exe /princ nacsso/EU-EUMAS-DC1.EU.EUMAS.NET@EU.EUMAS.NET /mapuser nacsso /pass * /out c:\nacsso.keytab /ptype KRB5_NT_PRINCIPAL -crypto All

But i cannot start the SSO service in the NAC. I have attached part of the log showing the error. The username and password in the CAS server is right. Checked many times

Please Advise

ciscomoderator · ‎06-07-2011

Hi Prashant, The error seen in ... (Rating: 5) - May 26, 2011 1:36 PM by Federico Lovison

Hi Prashant,

The error seen in the logs is:

2011-05-26 15:24:01.025 +0300 ERROR com.perfigo.wlan.jmx.adsso.GSSServer - Unable to start server ... Pre-authentication information was invalid (24)

I understand that you checked the password many times, however, this error is usually seen when the "nacsso" user password doesn't match between the CAS and the domain account.

Please share also some info about the user config on the AD side, for instance the exact username and the other options for that user.

Make sure you follow the procedure described here:

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cas/s_adsso.html#wp1174556

In case this user account may have some incorrect setting that cannot be spotted following the above procedure, I would also suggest to create a new user on AD, run again KTpass and configure this new user on the CAS.

I hope this helps!

Regards,

Federico

ciscomoderator · ‎06-07-2011

Dear Experts, The Server is ... (Rating: 0) - May 26, 2011 10:47 PM by Prasanth Mathews

Dear Experts,

The Server is actually Windows Server 2008 R2 (64bit) with SP1. Is ADSSO supported on this?

I had edited in the CAS /perfigo/access/tomcat/conf/krb.txt and /perfigo/access/bin/starttomcat

After editing and restarting the CAS server, the CAS server acess page shows" Service is temporily Unavailable"

This commands are needed to allow other encryptions right?

Regards

Prasanth Mathews

ciscomoderator · ‎06-07-2011

Hi Prashant, Editing the files ... (Rating: 5) - May 27, 2011 1:56 AM by Tiago Antunes

Hi Prashant,

Editing the files /perfigo/access/tomcat/conf/krb.txt and /perfigo/access/bin/starttomcat only applies to Windows 2008 servers running in 2003 functional level. Is this your case?

I am asking this because the ktpass command you run is meant for Windows 2008 server in full funtional level.

As for the ktpass command, please note that the DC part should be in lower case.

This is how you should run the command if you have 2008 servers running full funtional level:

ktpass -princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso -pass PasswordText -out c:\newadsso.keytab -ptype KRB5_NT_PRINCIPAL -crypto All

Please note the upper case and lower case letters.

In this situation, you do not edit any file on the CAS.

If you have 2008 servers at 2003 funtional level, then you need to run the ktpass like this:

ktpass -princ newadsso/[adserver.]domain.com@DOMAIN.COM -mapuser newadsso -pass PasswordText -out c:\newadsso.keytab -ptype KRB5_NT_PRINCIPAL

And then yes, edit the files.

So i would advise you to make sure what funtinal level you have, revert the krb.txt and starttomcat files to original, make sure the CAS boots, delete the ad user account, create a new one, run the ktpass properly, and so on.

HTH,

Tiago

--

If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

ciscomoderator · ‎06-07-2011

Dear Prashant, Windows Server ... (Rating: 0) - May 27, 2011 2:09 AM by Federico Lovison

Dear Prashant,

Windows Server 2008 R2 (64-bit) is supported on NAC 4.8.x, using KTpass version 6.1.7600.16385, as seen on this table:

http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/agntsprt.html#wp177323

I hope this helps.

Regards,

Federico

ASK THE EXPERTS: Cisco NAC AD SSO Setup With Tiago Antunes and Federico Lovison