FMC Anyconnect with LDAP AD server

[Amills]

I followed the directions in this video and document to get AnyConnect configured on the 2110 with FMC. I can connect and get a username and password prompt to come up when I try to connect remotely but it never accepts my credentials. It just flashes and the password field is blank. 

https://www.youtube.com/watch?v=ZZRVAFcSZCA

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/212424-anyconnect-remote-access-vpn-configurati.html

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/214283-configure-anyconnect-ldap-mapping-on-fir.html

I've tried going through this tutorial, a vanilla setup, basically not doing Flexconfig and I get the same results. Doesn't like my credentials.

https://www.youtube.com/watch?v=ZZRVAFcSZCA

[balaji.bandi]

what is the Logs you see on FMC when you try to connect ?

[Mohammed al Baqari]

Hi,

If its not accepting your creds, then either your account is locked, you
are putting incorrect password, or you need to check the connectivity
between your firepower and identity source.


**** please remember to rate useful posts

[Amills]

@balaji.bandi Where do I get the logs, what commands do I run to get the logs? 

@Mohammed al Baqari 

I am in the office with my laptop and a Verizon hotspot to test connecting with a VPN. I can login on my desktop PC just fine with my Windows login creds, my account is not locked. When I reconnect the laptop to the local network I can login to Windows. Connectivity was checked.  I've tested VPN in from home and I get the same results of it not accepting my credentials.

[Amills]

When I go into System > Integration > Realms > Edit Realm > Realm Configuration and "Test AD Join" it fails. however, the directory test succeeds. When I go into "User Download", with the "Download users and groups" checked, I can see all of our user groups configured in Active Directory. We are using Windows Server 2016.

[Amills]

@balaji.bandi 

I have these 2 debugs on and I see this output when I try to VPN in.

debug ldap 250
debug aaa common 250

firepower# ldap_client_server_add: Add server:0.0.0.0, group=4
ldap_client_server_unlock: Free server:0.0.0.0, group=4
ldap_client_server_add: Add server:0.0.0.0, group=4
ldap_client_server_unlock: Free server:0.0.0.0, group=4

[Amills · Accepted solution]

OK, so doing some digging I figured out it was related to DNS, but now I am having issues with access internal resources. Im sure its related to u-turn nat or ACLs. Again, I followed the tutorials listed above, and assuming they are correct in the tutorial, Im not sure what I have wrong on my end. 

I figured out it was the DNS because of this post:

https://community.cisco.com/t5/vpn/community-ask-me-anything-configuration-troubleshooting-and-best/td-p/4058826

adding in DNS here fixed that issue.

the ANYCONNECT object is the Subnet Anyconnect users are on and SPLIT TUNNEL object has all of our internal subnets in it.

[Amills]

OK, I believe I have it all working now.

When I tried to go into network shared drives I couldn't access them, however, when I RDP by IP address into servers or my desktop PC I was able to do that. I double checked my U-Turn NAT and access Policies and they checked out OK. I figured it had to do with DNS because I couldn't ping by hostnames. 

I went into the Group Policy I use for AnyConnect and added in the VPN subnet under "IP Address Pools" and our internal DNS servers under "DNS/WINS". After adding those in I can access network share drives.