VPN auth over AD - AD Realm - FDM 7.0.5

[petrsenik]

Hello,

i have Cisco Firepower 1140 and I am trying to setup AD realm for authentication via active directory. I created connector under Objects -> Identity sources -> AD Realm and filled the fields. But when i Test connection i get:

 Realm is available for Identity policies.

 Cannot connect to realm for RA VPN. ERROR: Authentication Server not responding

Do you have any advice where i have to start search the problem?

Thank you.

[Aref Alsouqi]

Can you reach the 192.168.152.128 from the FDM management interface? if not, then please change the interface to the data interface facing the domain controller.

[petrsenik]

Yes, i can ping to 192.168.152.128 from CLI.

[MHM Cisco World]

Directory username' you need to specify admin@domain 

I dont get what you specify here 

[petrsenik]

This was last try what I found in some manual. When i change it to user@domain.local it is the same.

[MHM Cisco World]

user@ domain.local <<- this user is  admin ?
the user must admin in AD and this user only use to contact AD.

[petrsenik]

Yes, its domain admin.

[petrsenik]

There is log from diag-cli:

debug ldap enabled at level 255
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5

[-2147483497] Session Start
[-2147483497] New request Session, context 0x0000153f38410478, reqType = Authentication
[-2147483497] Fiber started
[-2147483497] Creating LDAP context with uri=ldap://192.168.152.128:389
[-2147483497] Connect to LDAP server: ldap://192.168.152.128:389, status = Failed
[-2147483497] Unable to read rootDSE. Can't contact LDAP server.
[-2147483497] Fiber exit Tx=0 bytes Rx=0 bytes, status=-3
[-2147483497] Session End
ldap_client_server_delete: Remove server 192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5

[MHM Cisco World]

https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv32615

First change port to 636'

If you get same rootdse error then check above bug 

[petrsenik]

At web interface i got different error, at cli i got same.

[-2147483478] Session Start
[-2147483478] New request Session, context 0x0000153f38410478, reqType = Authentication
[-2147483478] Fiber started
[-2147483478] Creating LDAP context with uri=ldaps://192.168.152.128:636
[-2147483478] Connect to LDAP server: ldaps://192.168.152.128:636, status = Failed
[-2147483478] Unable to read rootDSE. Can't contact LDAP server.
[-2147483478] Fiber exit Tx=0 bytes Rx=0 bytes, status=-3
[-2147483478] Session End
ldap_client_server_delete: Remove server 192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5

But the workaround is for ASA 9.3.2, I have Firepower 7.0.5-72

[MHM Cisco World]

Unable to read rootDSE. Can't contact LDAP server. <<- same error message 
I dont know friend, open TAC to cisco and attach the bug number I mention before. 
sorry 
good luck 
thanks 

MHM

[Aref Alsouqi]

Before you can switch from LDAP to LDAPS (port 636) the server should be configured with LDAPS services. Could you please try to change the interface from management to the one facing the LDAP server and see if that works?

[petrsenik]

Here is debug log:

debug ldap enabled at level 250
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5
ldap_client_server_add: Add server:192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5

[-2147483492] Session Start
[-2147483492] New request Session, context 0x0000153f38410478, reqType = Authentication
[-2147483492] Fiber started
[-2147483492] Creating LDAP context with uri=ldap://192.168.152.128:389
[-2147483492] Connect to LDAP server: ldap://192.168.152.128:389, status = Failed
[-2147483492] Unable to read rootDSE. Can't contact LDAP server.
[-2147483492] Fiber exit Tx=0 bytes Rx=0 bytes, status=-3
[-2147483492] Session End
ldap_client_server_delete: Remove server 192.168.152.128, group=5
ldap_client_server_unlock: Free server:192.168.152.128, group=5

[Aref Alsouqi]

I do still believe there is some connectivity issues between the firewall management interface and the LDAP server. When you tried to ping the LDAP server from the firewall clish mode, did you add the "system" keyword? if not, the firewall won't be sending the packets from the management interface and it will send them in that case from the data interface that can reach the LDAP server.

[petrsenik]

No I didnt, can you please specify the command? I am not very familiar with this.