Login Failure

[estelamathew]

Hello,

I m not able to login in windows machine NAC is in deployed in layer 2 virtual gateway mode when the switch port is changed to auth vlan it gives me error windows machine cannot log you on domain is not available, when i change the port to access vlan the user is able to login.

The uesr machine is connecting to HP access switch and also NAC and NAM are connected to different HP Core switch and windows AD si connected to cisco switch all my configuration are correct in NAS,where i m missing.

1. i have done the vlan mapping
2. managed subnet
3. static route
   
4. ADSSO service is also started
   
5. policies are open in unathenticated role.

Is it something i m missing.somewhere.

[Tiago Antunes]

Hi,

Assuming that you are doing AD SSO from your description, if the user is not able to login into the domain on the initial windows login screen, then it means the DC is not reachable.

If you add a rule to allow all traffic on the unauthneticated role, is the user able to login into the domain?

If yes, then I would double-check the traffic policies you have configured:

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cas/s_adsso.html#wp1119307.

HTH,

Tiago

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[estelamathew]

Hello Tiago,

I have opened each and every protocol still it says the domain not available but when i change to trusted Access vlan the user is able to login.

In untrusted vlan the user is not able to login.

Thanks,

[Tiago Antunes]

That means for sure that the traffic is not leaving the Clean Access Server.

Either it is being blocked or the VLAN mapping is wrong...

Have you tied the rule "Allow All" ?

Can you show us the VLAN mapping, Managed Subnets, and what is the IP address client is getting?

HTH,
Tiago

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[estelamathew]

Hello Tigos,

Here is the attached,

Can u confirm my other thread of Requirements what i have configured is correct or not???

[Tiago Antunes]

Hi ,

I do not see the Allow All rule i asked you to configure for testing purposes...

Can you please try it?

And what is the IP address the client PC is getting?

HTH,

Tiago

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[estelamathew]

Hello Tiagos,

I have put the static IP on that PC and open all means ???  I have shown the scren shots 5 all is open in unathenticate role in manager and server.

[Eduardo Aliaga]

Please temporarily configure your unauthenticated "traffic rules" to permit all IP traffic and set " Trusted" field to "*:*". That's to test if the login failure is due to traffic rules or not.

Also, are you using DHCP for your PCs? What's your default gateway? It would be very useful to see a network diagram.

You mentioned you're using VG. But are using OOB or inband ? Please notice that OOB doesn't support HP switches. It only supports Cisco

[estelamathew]

Hello,

Do i have to allow WINDOWS AD access vlan's on trusted interface of CAS??????

Also, are you using DHCP for your PCs? What's your default gateway? It  would be very useful to see a network diagram.

i have put the static IP on workstation, DF is the int vlan on core.

You mentioned you're using VG. But are using OOB or inband ? Please  notice that OOB doesn't support HP switches. It only supports Cisco

I m using INBAND Virtual Gateway.

Thanks

[Tiago Antunes]

Hi,

You need to allow the traffic on both directions.

If your PC cannot even login into the domain, then it is for sure something blocking the traffic.

That is why we advised to "allow all" on the unauthneticcated role, to make sure it is/isn't the CAS that is blocking the traffic needed for AD login.

HTH,

Tiago

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

[estelamathew]

Hello Tiagos,

Attached is the screen shot for allow all traffic.I have applied allow all traffic in CCA server>filter>roles>traffic control and also in NAM manager in user roles> traffic control>IP.

Please correct me where i m missing . This issue is pending dear's,Waiting for replies.

Thanks

[estelamathew]

Hello Dears,

I have captured logs from testing PC to wireshark PC,

Attached are the logs from wireshark, trying to login by testing  PC which is in unauthenticate vlan and wireshark pc is also in same vlan capturing packets on same switch both are give static ip with same subnet and still testing pc is not able to login it is giving an error computer cannot log you on because domain XXX is not available.

I can see traffic hitting to DC but no reply from DC to testing PC

1. Testing PC is 10.75.116.141
2. Wireshark PC is 10.75.116.160
3. Primary Domain Controller is 10.75.7.130
4. Secondary Domain Controller is 10.75.7.140

Thanks.

.

[Tiago Antunes]

Hi,

I would then check on the DC why it is not replying...

HTH,
Tiago

--

If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.