Caveats Associated with Release 1.0.2.29 Table 6 lists  the open caveats in NCS Release 1.0.2.29 Table 6 Open  Caveats  ID Number Caveat Title CSCtr57972 The UDI information from CLI and NCS UI does not match. Symptom: The UDI information obtained from  CLI does not match what appears in the NCS GUI. The CLI value is not correct for  licensing or identifying the NCS. Conditions: Any CLI command that displays  the UDI of the virtual machine is displaying the incorrect value. Workaround: Only use the UDI displayed in  the GUI for licensing or identifying the NCS. I'm trying with the last 1.1.1.24, without sucess too. ... View more

Same issue, NCS 1.1 ... View more

I get the same error, in AD Agent this collect works fine. (same user) ... View more

I re-imaged w 7.0.7(4) and all it's ok (only Radius not). Before update i used 7.0.6(4) and Authentication Radius works fine. ... View more

Unfourtnetly to fix this issue Unresponsive, i did this procedure: http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliimage.html#wp1032373 All configuration was lost and after re-image IPS start UP and OK, but the problem with radius continues Step 1 Log in to the ASA. Step 2 Enter enable mode: asa> enable Step 3 Configure the recovery settings for AIP-SSM: asa# hw-module module 1 recover configure Note If you make an error in the recovery configuration, use the hw-module module 1 recover stop command to stop the system reimaging and then you can correct the configuration. Step 4 Specify the TFTP URL for the system image: Image URL [t ftp://0.0.0.0/ ]: Example: Image URL [t ftp://0.0.0.0/ ]: t ftp://10.89.146.1/IPS-SSM-K9-sys-1.1-a-5.0-1.img Step 5 Specify the command and control interface of AIP-SSM: Port IP Address [0.0.0.0]: Example: Port IP Address [0.0.0.0]: 10.89.149.231 Step 6 Leave the VLAN ID at 0. VLAN ID [0]: Step 7 Specify the default gateway of the AIP-SSM: ateway IP Address [0.0.0.0]: xample: Gateway IP Address [0.0.0.0]: 10.89.149.254 Step 8 Execute the recovery: asa# hw-module module 1 recover boot ... View more

I did inside asa these commands: hw-module module 1 recover configure and hw-module module 1 boot, after re-image its ok. Now the problem is w Radius authentication, look the log. This feature was ok before update to last version.. evStatus: eventId=1328710491220984018 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: sshd     appInstanceId: 27584   time: 2012/02/08 18:47:22 2012/02/08 16:47:22 GMT-03:00   syslogMessage:     description: Illegal user ciscoworks from 172.16.100.9 evStatus: eventId=1328710491220984019 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: pam_tally     appInstanceId: 27613   time: 2012/02/08 18:47:22 2012/02/08 16:47:22 GMT-03:00   syslogMessage:     description: pam_tally: pam_get_uid; no such user ciscoworks evStatus: eventId=1328710491220984020 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: sshd     appInstanceId: 27613   time: 2012/02/08 18:47:34 2012/02/08 16:47:34 GMT-03:00   syslogMessage:     description: pam_radius_helper: Authentication failed evStatus: eventId=1328710491220984021 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: sshd(pam_unix)     appInstanceId: 27613   time: 2012/02/08 18:47:34 2012/02/08 16:47:34 GMT-03:00   syslogMessage:     description: check pass; user unknown evStatus: eventId=1328710491220984022 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: sshd(pam_unix)     appInstanceId: 27613   time: 2012/02/08 18:47:34 2012/02/08 16:47:34 GMT-03:00   syslogMessage:     description: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=apl16 evStatus: eventId=1328710491220984023 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: sshd     appInstanceId: 27584   time: 2012/02/08 18:47:36 2012/02/08 16:47:36 GMT-03:00   syslogMessage:     description: error: PAM: Authentication failure evStatus: eventId=1328710491220984024 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: pam_tally     appInstanceId: 27626   time: 2012/02/08 18:47:36 2012/02/08 16:47:36 GMT-03:00   syslogMessage:     description: pam_tally: pam_get_uid; no such user ciscoworks evStatus: eventId=1328710491220984025 vendor=Cisco   originator:     hostId: IPS_JLLE_2     appName: monitor     appInstanceId: 359   time: 2012/02/08 18:47:43 2012/02/08 16:47:43 GMT-03:00   healthAndSecurity:     description: Heartbeat     healthStatus: green     securityStatus:       virtualSensor: vs0 ... View more

This was the best configuration in my case. The user in ADGENT must have registered with the correct permissions, I would not have a DOMAIN ADMIN for that, but without much success in updates of the mappings. Now everything is ok! ... View more

I found this log in ut.log: 2012/01/16 10:17:59 main MESSAGE DBConnection: Created new Database connection [hashCode = 3089045] Calling default Subnet to SubnetData Map Size :57 2012/01/16 10:18:06 main MESSAGE DCRDevWrapper: Closing DCRProxy 2012/01/16 10:18:08 EvalTask-vmpsadmin-04 ERROR CafAuthSession: snmp value exception com.cisco.nm.lib.snmp.lib.SnmpValueException: Illegal Access. OCTET STRING being accessed as Integer. 2012/01/16 10:18:08 EvalTask-vmpsadmin-04 ERROR EvalPair: java.lang.NullPointerException java.lang.NullPointerException at com.cisco.nm.ani.server.vmpsadmin.VmpsAdminSMFGetIdentityInfo.fetchAuthSessionTable(VmpsAdminSMFGetIdentityInfo.java:235) at com.cisco.nm.ani.server.vmpsadmin.VmpsAdminSMFGetIdentityInfo.apply(VmpsAdminSMFGetIdentityInfo.java:66) at com.cisco.nm.ani.server.framework.EvalSMFApply.apply(EvalSMFApply.java:101) at com.cisco.nm.ani.server.frontend.EvalPair.apply(EvalPair.java:108) at com.cisco.nm.ani.server.frontend.EvalTask.run(EvalTask.java:51) at java.lang.Thread.run(Thread.java:662) 2012/01/16 10:18:08 EvalTask-vmpsadmin-10 ERROR CafAuthSession: snmp value exception com.cisco.nm.lib.snmp.lib.SnmpValueException: Illegal Access. OCTET STRING being accessed as Integer. 2012/01/16 10:18:08 EvalTask-vmpsadmin-10 ERROR EvalPair: java.lang.NullPointerException java.lang.NullPointerException at com.cisco.nm.ani.server.vmpsadmin.VmpsAdminSMFGetIdentityInfo.fetchAuthSessionTable(VmpsAdminSMFGetIdentityInfo.java:235) at com.cisco.nm.ani.server.vmpsadmin.VmpsAdminSMFGetIdentityInfo.apply(VmpsAdminSMFGetIdentityInfo.java:66) at com.cisco.nm.ani.server.framework.EvalSMFApply.apply(EvalSMFApply.java:101) at com.cisco.nm.ani.server.frontend.EvalPair.apply(EvalPair.java:108) at com.cisco.nm.ani.server.frontend.EvalTask.run(EvalTask.java:51) at java.lang.Thread.run(Thread.java:662) ... View more

http://blog.pbmit.com/asa_identity_fw2 - Inactive and stale user IP mapping entries seem to remain on the ASA unless being cleared manually. (OMFG!) - Once a user becomes inactive (ie. idle timer expired), he will not be evaluated by any identity ACL rules, during which time he may be denied by subsequent ACL rules, until his next domain re-login , or a manual user-to-IP mapping table update is performed. (My problem) Conclusion:              Based on our observations, deploying identity firewall requires careful design of ACL and extensive testing to make sure an AD agent outage will not neither cause user traffic to be blocked nor accidently allow an unauthorized access. Idle timer may also need to be adjusted to prevent deny-access due to users prematurely becoming inactive while they are still logged in to the domain. (How can i adjust this if my company is 24x7?, disable this function? What could happen?) In addition, there is a chance that the ASA user-to-IP mapping table becomes out-of-sync from the AD agent. Although we can manually force update, this certainly is not practical. Maybe with this problems, is not a good idea deploy identity firewall... ... View more