Identity Based Firewall doesn't work using Citrix Published Desktop environment - Page 2

WALTER GROSSENBACHER · ‎07-27-2012

Hi!

We are using the newest release of AD Agent (1.0.0.32.1, built 598). The ASA Firewalls 5520 are having the software release 8.4(3)8 installed.

The problem:

When somebody tries to connect thru the Identity based firewalls from a citrix published desktop environment (PDI) the connection is not possible. Checking the ip-of-user mapping on the firewalls (show user-identity ip-of-user USERNAME) mostly doesn't show the mapping of the USERNAME and the PDI the user is logged in. The user-of-ip mapping of the PDIs IP-address shows mostly other users, which then are used to authenticate the acces thru the firewalls.

What is interesting, that on the AD Agent using "adacfg.exe cache list | find /i "USERNAME"" i can't see the PDIs IP-address neither because it is mapped to another user.

Questions:

Is Citrix Published Desktop environment supported to connect thru Identity based Firewalls?

Anybody knows how AD Agent, Domain Controllers and Firewalls are working together?

On the firewalls with "show user-identity ad-agent we see, the following:

Authentication Port: udp/1645

Accounting Port: udp/1646

ASA Listening Port: udp/3799

Why Cisco does use 1645 and 1646 and not 1812 and 1813?

The Listening Port is used for what purpose?

Remark: we tried the AD Agent modes full- download and on-demand with the same effect.

Thanks for your replies

Walter

Sent from Cisco Technical Support iPad App

WALTER GROSSENBACHER · ‎08-03-2012

Hi Tarik!

I got some output out of the c:\IBF\radiusServer\runtime\logs\localStore. Interesting is the "5400 NOTICE Failed-Attempt" entry. But I can't find the "FailureReason" as described in http://www.cisco.com/en/US/docs/security/ibf/setup_guide/ibf10_log_msgs.html:

2012-08-03 13:52:37.498 +01:00 0057180965 11003 DEBUG RADIUS: Returned RADIUS Access-Reject, IBFVersion=ibf-1.0 (win32), ConfigVersionId=9, Device IP Address=192.168.11.1, Device Port=1025, DestinationIPAddress=0.0.0.0, DestinationPort=1645, RadiusPacketType=AccessRequest, RadiusIdentifier=35, User-Name=192.168.52.97, NAS-IP-Address=192.168.11.1, cisco-av-pair=entity-attr:request=*, cisco-av-pair=entity-attr:entity-id:ip=192.168.52.97, cisco-av-pair=entity-attr:cntl:notify=true, IbfSessionID=s00752/132508682/7488750, SelectedAccessService=Network Access, Response={RadiusPacketType=AccessReject; },

2012-08-03 13:52:37.498 +01:00 0057180966 5400 NOTICE Failed-Attempt: IBF request failed, IBFVersion=ibf-1.0 (win32), ConfigVersionId=9, Device IP Address=192.168.11.1, Device Port=1025, DestinationIPAddress=0.0.0.0, DestinationPort=1645, RadiusPacketType=AccessRequest, UserName=192.168.52.97, Protocol=Radius, RequestLatency=3, NetworkDeviceName=fwa1, User-Name=192.168.52.97, NAS-IP-Address=192.168.11.1, cisco-av-pair=entity-attr:request=*, cisco-av-pair=entity-attr:entity-id:ip=192.168.52.97, cisco-av-pair=entity-attr:cntl:notify=true, IbfSessionID=s00752/132508682/7488750, SelectedAccessService=Network Access, Step=11001 , Step=11017 , Step=15012 , Step=12864 , Step=12866 , Step=11003 , Response={RadiusPacketType=AccessReject; },

2012-08-03 13:52:37.500 +01:00 0057180967 11001 DEBUG RADIUS: Received RADIUS Access-Request, IBFVersion=ibf-1.0 (win32), ConfigVersionId=9, Device IP Address=192.168.11.1, Device Port=1025, DestinationIPAddress=0.0.0.0, DestinationPort=1645, IbfSessionID=s00752/132508682/7488751,

2012-08-03 13:52:37.500 +01:00 0057180968 11017 DEBUG RADIUS: RADIUS created a new session, IBFVersion=ibf-1.0 (win32), ConfigVersionId=9, Device IP Address=192.168.11.1, Device Port=1025, DestinationIPAddress=0.0.0.0, DestinationPort=1645, IbfSessionID=s00752/132508682/7488751,

2012-08-03 13:52:37.501 +01:00 0057180969 15012 DEBUG Policy: Selected Access Service, IBFVersion=ibf-1.0 (win32), ConfigVersionId=9, Device IP Address=192.168.11.1, UserName=10.25.170.248, Protocol=Radius, Time And Date=1343994757, PolicyType=ServiceSelectionPolicy, IbfSessionID=s00752/132508682/7488751, SelectedAccessService=Network Access,

Have a nice Weekend!

Walter

Tarik Admani · ‎08-03-2012

Walt,

Are all authentication requests failing? If not, then we need to see if you can get TAC involved. It seems as if either the ip mapping isnt available on the ADAgent.

However did you get a chance to cross reference the IP mapping at the time this occured?

Thanks,

Tarik Admani
*Please rate helpful posts*

WALTER GROSSENBACHER · ‎08-05-2012

Hi Tarik!

I will make more debugging tomorrow together with a Windows Specialist. I'll inform you about the results tomorrow. What we will do as well is to collect informations to open a TAC case if necessary.

Thanks!

Walter