Issues with Cisco ASA 5500 Series and NAP
using vpn nap enforcement in test lab step step guide, trying setup , test vpn solution having problems getting nap authentication work. not sure if there issue asa, nap server or client.
information below how have configured.
cisco asa 5500 series configured internet facing device
server 2008 configured radius server , nap authentication server
windows xp sp3 machines clients, these machines running cisco vpn client version 5.0.x
appears soh not being passed or received client/nap server. whenever enable nap policies, following error in event logs:
network policy server denied access user.
contact network policy server administrator more information.
user:
security id: domain\username
account name: username
account domain: domain
qualified account name: domain\username
client machine:
security id: null sid
account name: -
qualified account name: -
os-version: -
called station identifier: -
calling station identifier: -
nas:
nas ipv4 address: 172.16.102.3
nas ipv6 address: -
nas identifier: -
nas port-type: virtual
nas port: 87
radius client:
client friendly name: evg asa
client ip address: 172.16.102.3
authentication details:
proxy policy name: nap vpn 2
network policy name: nap vpn 2 non nap-capable
authentication provider: windows
authentication server: msmmv102.domain.com
authentication type: pap
eap type: -
account session identifier: -
reason code: 65
reason: connection attempt failed because network access permission user account denied. allow network access, enable network access permission user account, or, if user account specifies access controlled through matching network policy, enable network access permission network policy.
information below how have configured.
cisco asa 5500 series configured internet facing device
server 2008 configured radius server , nap authentication server
windows xp sp3 machines clients, these machines running cisco vpn client version 5.0.x
appears soh not being passed or received client/nap server. whenever enable nap policies, following error in event logs:
network policy server denied access user.
contact network policy server administrator more information.
user:
security id: domain\username
account name: username
account domain: domain
qualified account name: domain\username
client machine:
security id: null sid
account name: -
qualified account name: -
os-version: -
called station identifier: -
calling station identifier: -
nas:
nas ipv4 address: 172.16.102.3
nas ipv6 address: -
nas identifier: -
nas port-type: virtual
nas port: 87
radius client:
client friendly name: evg asa
client ip address: 172.16.102.3
authentication details:
proxy policy name: nap vpn 2
network policy name: nap vpn 2 non nap-capable
authentication provider: windows
authentication server: msmmv102.domain.com
authentication type: pap
eap type: -
account session identifier: -
reason code: 65
reason: connection attempt failed because network access permission user account denied. allow network access, enable network access permission user account, or, if user account specifies access controlled through matching network policy, enable network access permission network policy.
- how 1 troubleshoot pc side of things. other netsh there logs anywhere detail soh being passed nap server.
- no matter network policies use, client-machines being seen non nap-capable.
- it appears able pass pap , not eap/peap. there way configure either radius/nap server or asa allow eap , nap go through when using cisco vpn client.
hi,
you can't use vpn enforcment method without microsoft vpn server. if @ step step guide setting vpn nap, there procedure not valid non-microsoft vpn server - see below:
when tell nps radius client nap-capable, expect soh. if skip step on microsoft vpn server, clients appear non nap-capable. since cisco vpn server doesn't recognize soh, discards data , marking nap-capable doesn't help.
to use nap non-microsoft vpn server, need deploy ipsec enforcement method.
-greg
you can't use vpn enforcment method without microsoft vpn server. if @ step step guide setting vpn nap, there procedure not valid non-microsoft vpn server - see below:
configure vpn1 nap-capable radius client
because vpn1 nap enforcement server running windows server 2008, must marked nap-capable radius client.
when tell nps radius client nap-capable, expect soh. if skip step on microsoft vpn server, clients appear non nap-capable. since cisco vpn server doesn't recognize soh, discards data , marking nap-capable doesn't help.
to use nap non-microsoft vpn server, need deploy ipsec enforcement method.
-greg
Windows Server > Network Access Protection
Comments
Post a Comment