ACS connecting to AD

[darrenshaw]

I have had this problem quite a few weeks. Basically my ACS will not authenticate unknown user to AD.

I have gone through the following.

Ensure the ACS services start with Domain Admins account....

log on as service......

and act as part of the operating system.

All users are added to the pre-windows 2000 compatible access group.

I have done a packet capture and the ACS does talk to the Domain controller but will not authenticate, i get the following error in the authentication log on the ACS

EXTERNAL DB ACCOUNT RESTRICTION.

If i set up a user in the ACS this works fine no problems. ACS VER is 3.2, running on W2K SP3.

I will be setting a test bed up to test this against another AD machine.

Any Ideas...anyone?

[sbilgi]

If you have access to the Cisco Bugtoolkit, you can check there to find if there are any known issues in this.

[dominic.caron]

I had a similar problem at first.

I found that some ACL blocked ICMP between ACS and DCs. Windows Domain Controler need ICMP(it's send a ping to the ACS server before sending policys) to send security credential to the windows part of ACS.