FTD & Anyconnect vpn

[blackswans]

Hi,

We are using FTD and using its web management. We created a realm and anyconnect configuration is done. When I try to connect from anyconnect we get "login failed" error. How can we check which active directory OU group its checking? Which logs should we check?

Thanks.

[Rahul Govindan]

When you create an AD realm on FDM and add it to the VPN config, it essentially creates a aaa-server config like on the ASA as seen below:

aaa-server AD host 192.168.1.1
server-port 389
ldap-base-dn dc=domain,dc=com
ldap-scope subtree
ldap-login-password *****
ldap-login-dn administrator@domain.com
server-type auto-detect

You should be able to run "debug ldap 255" on the CLI to see debug logs when testing. This should look like the regular LDAP debugs on the ASA as seen here:

https://community.cisco.com/t5/security-documents/remote-access-vpn-on-asa-authentication-using-ldap-server/ta-p/3144864