ACS 4.2 replication issue

We recently upgraded to ACS 4.2. All works perfectly except for replication. I now receive an error
ACS Internal Database Replication Errors
1.To disable receiving of EAP-FAST replication component, "EAP-FAST master server" must be enabled on "Global Authentication Setup" page
We are not using EAP-FAST and it doen't appear to be enabled. EAP-FAST is not checked to replicate.

I looked at that when I first got the issue. It saya that the server is Master. If I tick the box nothing changes and when I go back to that "Global Authentication" page the box is no longer ticked. The issue is the same on both the Primary Server and the Backup Server.

Similar Messages

ACS 4.2 Database replication issue

Hello Experts,
Hope you are all doing well. I need your help in ACS database replication, I want to do replication between ACS servers. The issue i am facing is that there is no error in ACS replication log. It just says outbound replication started. and sits there no other error message is shown. I can successfully telnet secondary server's destination port 2000. But when i hit the replication button from primary server, i do not observe any hit count on my ASA ACL on which i allowed tcp 2000 for destination secondary server.I also checked my syslog server if there is any traffic denied between these 2 ACS servers but found nothing. I also did wireshark captures on the interfaces but no traffic is initiated when i press replicate now button. Initially i thought its a machine issue, but same behavior is shown when i swapped primary----to secondary. There are other applications running on both the servers which requires JAVA. Like Cisco IME etc. Can it be JAVA issue? Please help me out. i am using Release 4.2(0) Build 124 on both servers.Attached below is the Replication LOG snapshot,
Regards,
Rizwan.

https://supportforums.cisco.com/discussion/11382366/problems-witch-acs-42-replication
https://supportforums.cisco.com/discussion/11363046/replication-problem-acs-ver-42

ACS SE Database replication fails

Hello, I recently upgraded our ACS SEs from 4.0 to 4.1. All appeared to go OK but I checked the logs recently and saw the the database replication is failing with the message:
ACS '[hostname]'is running a different version of ACS - aborting.
All ACS SE were upgraded at the same time and display the same versions when examining the Appliance Upgrade page. Does anyone have any ideas what the problem is?
Thanks in advance.

Hi, I am having a related problem but in my case I am using ACS for Windows ver.4.0. I am replicating from one primary ACS to three other ACS using scheduled nightly replication.
The problem is that the data is being updated on all three ACS servers, but in the database replication logs on the primary I get messages stating that "ACS-server-name replication failed possibly due to short time-out or dead". Moreover, not all three servers timeout. Sometimes one server timeout, and other times two servers timeout, etc.
On the replicated servers logs, the only log, in case server times out, shows that "replication cycle starting....". while when replication is successfull, it also shows Replication cycle completed successfully.
I have played around with the timeouts but the result is random. I have also checked if there are any bandwidth issues, but replication is scheduled at night with minimal network traffic and the servers are also not being used for authentications.
Don't understand why I don't see successful messages all the time, specially when the data does get updated on the replica ACS.
Thanks.
MAG

10.9: Server Replication Issue

Hi ther guys,
I have seen several posts about this replication issue since 2012, i have 2 fresh install systems 10.9 Server app 3.0.2 on both boxes DNS shows correctly setup but im totaly lost on where to continue.
Is there anyone out there that already resolved this?
domaintest2:~ admin$ sudo slapconfig -createreplica 192.168.2.17 diradmin
Password:
2014-01-08 01:05:11 +0000 slapconfig -createreplica
diradmin's Password:
2014-01-08 01:05:22 +0000 1 Creating computer record for replica
2014-01-08 01:05:26 +0000 command: /usr/sbin/slapconfig -delkeychain /LDAPv3/127.0.0.1 domaintest2.int$
2014-01-08 01:05:26 +0000 Added computer password to keychain
2014-01-08 01:05:26 +0000 Adding ldap and host service principals
Unable to obtain kerberos princ, using CRAM-MD5: -2
Unable to obtain kerberos princ, using CRAM-MD5: -2
2014-01-08 01:05:26 +0000 2 Creating ldap replicator user
2014-01-08 01:05:26 +0000 _ldap_replicator exists from previous replica - migrating
2014-01-08 01:05:26 +0000 NSString *_getReplicatorPasswordWithNode(ODNode *): no syncrepl attribute found in results
2014-01-08 01:05:26 +0000 Unable to get replicator password, recreating replicator
2014-01-08 01:05:27 +0000 GetLastServerID: Error creating DSLDAPContainer: 77014 Can't contact LDAP server (-1)
2014-01-08 01:05:27 +0000 ServerID for this replica 1
2014-01-08 01:05:27 +0000 SetLastServerID: Unable to create DSLDAPContainer: 77014 Can't contact LDAP server (-1)
2014-01-08 01:05:27 +0000 Error setting last server id
2014-01-08 01:05:28 +0000 command: /usr/bin/sntp -s time.apple.com.
2014-01-08 01:05:29 +0000 3 Updating local replica configuration
2014-01-08 01:05:29 +0000 4 Gathering replication data from the master
2014-01-08 01:05:29 +0000 5 Copying master database to new replica
2014-01-08 01:05:29 +0000 Removed directory at path /var/db/openldap/openldap-data.
2014-01-08 01:05:29 +0000 Starting LDAP server (slapd)
2014-01-08 01:05:30 +0000 slapd started
2014-01-08 01:05:30 +0000 Stopping LDAP server (slapd)
2014-01-08 01:05:31 +0000 command: /usr/sbin/slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
2014-01-08 01:05:31 +0000 command: /usr/sbin/slapadd -c -w -l /var/db/openldap/openldap-data/backup.ldif
2014-01-08 01:05:31 +0000 command: /usr/sbin/slapadd -c -w -b cn=authdata -l /var/db/openldap/authdata/authdata.ldif
2014-01-08 01:05:31 +0000
2014-01-08 01:05:31 +0000 52cca45b slapd is running in import mode - only use if importing large data
52cca45b bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
2014-01-08 01:05:31 +0000 6 Starting new replica
2014-01-08 01:05:31 +0000 Starting LDAP server (slapd)
2014-01-08 01:05:31 +0000 slapd started
2014-01-08 01:05:31 +0000 command: /usr/bin/ldapmodify -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2014-01-08 01:05:31 +0000 command: /usr/bin/ldapsearch -x -LLL -H ldapi://%2Fvar%2Frun%2Fldapi -b cn=config -s base olcServerID
2014-01-08 01:05:31 +0000 command: /usr/bin/ldapmodify -c -x -H ldapi://%2Fvar%2Frun%2Fldapi
2014-01-08 01:05:31 +0000 Starting password server
2014-01-08 01:05:37 +0000 CFStringRef CopyHostGUID(DSLDAPContainerRef, CFStringRef): Could not get query results
2014-01-08 01:05:37 +0000 FATAL : Could not retrieve HOST GUID for parent
2014-01-08 01:05:37 +0000 FATAL : Could not retrieve HOST GUID for parent (error = 78)
2014-01-08 01:05:37 +0000 Deleting Cert Authority related data
2014-01-08 01:05:37 +0000 No intCAIdentity, not removing int CA from keychain
2014-01-08 01:05:37 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.xscertd.plist
2014-01-08 01:05:37 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.xscertd-helper.plist
2014-01-08 01:05:37 +0000 command: /bin/launchctl unload -w /System/Library/LaunchDaemons/com.apple.xscertadmin.plist
2014-01-08 01:05:37 +0000 Updating ldapreplicas on primary master
2014-01-08 01:05:37 +0000 Unable to create ODNode for domaintest1.int: 2100 Connection failed to the directory server.
2014-01-08 01:05:37 +0000 Primary master node is nil!
2014-01-08 01:05:37 +0000 Unable to locate ldapreplicas record: 0 (null)
2014-01-08 01:05:37 +0000 Error setting read ldap replicas array: 0 (null)
2014-01-08 01:05:37 +0000 Error setting write ldap replicas array: 0 (null)
2014-01-08 01:05:37 +0000 ODRecord *_getODRecord(ODNode *, NSString *, NSString *, NSArray *): ODNodeRef parameter error
2014-01-08 01:05:37 +0000 int _removeReplicaFromConfigRecord(ODNode *, NSString *): ODRecord not found
2014-01-08 01:05:37 +0000 Error synchronizing ldapreplicas: 0 (null)
2014-01-08 01:05:37 +0000 Removing self from the database
2014-01-08 01:05:37 +0000 Warning: An error occurred while re-enabling GSSAPI.
2014-01-08 01:05:38 +0000 Stopping LDAP server (slapd)
2014-01-08 01:05:39 +0000 Stopping password server
2014-01-08 01:05:39 +0000 Removed all service principals from keytab for realm DOMAINTEST1.INT
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/__db.001.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/__db.002.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/__db.003.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/__db.004.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/__db.005.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/__db.006.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/altSecurityIdentities.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/apple-config-realname.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/apple-generateduid.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/apple-group-memberguid.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/apple-group-nestedgroup.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/apple-group-realname.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/cn.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/DB_CONFIG.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/dn2id.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/entryCSN.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/entryUUID.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/gidNumber.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/givenName.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/id2entry.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/ipHostNumber.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/log.0000000001.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/macAddress.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/memberUid.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/objectClass.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/ou.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/sn.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/uid.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/openldap-data/uidNumber.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/__db.001.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/__db.002.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/__db.003.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/__db.004.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/__db.005.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/__db.006.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/alock.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/authdata.ldif.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/authGUID.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/DB_CONFIG.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/dn2id.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/draft-krbPrincipalAliases.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/draft-krbPrincipalName.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/entryCSN.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/entryUUID.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/id2entry.bdb.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/log.0000000001.
2014-01-08 01:05:39 +0000 Removed file at path /var/db/openldap/authdata/objectClass.bdb.
2014-01-08 01:05:39 +0000 Removed directory at path /var/db/openldap/authdata.
2014-01-08 01:05:39 +0000 Removed file at path /etc/openldap/slapd_macosxserver.conf.
2014-01-08 01:05:39 +0000 Removed file at path /etc/openldap/slapd.conf.
2014-01-08 01:05:39 +0000 Removed directory at path /etc/openldap/slapd.d/cn=config.
2014-01-08 01:05:39 +0000 Removed file at path /etc/openldap/slapd.d/cn=config.ldif.
2014-01-08 01:05:39 +0000 Removed directory at path /etc/openldap/slapd.d.
2014-01-08 01:05:39 +0000 Removed directory at path /etc/openldap/slapd.d.backup/cn=config.
2014-01-08 01:05:39 +0000 Removed file at path /etc/openldap/slapd.d.backup/cn=config.ldif.
2014-01-08 01:05:39 +0000 Removed directory at path /etc/openldap/slapd.d.backup.
2014-01-08 01:05:39 +0000 Stopping password server
2014-01-08 01:05:39 +0000 Removed file at path /etc/ntp_opendirectory.conf.
2014-01-08 01:05:39 +0000 Removed file at path /Library/Preferences/com.apple.openldap.plist.

We're having the exact same issue, also between two 10.9 servers - any luck finding a resolution?

Active directory SYSVOL replication issues

Hello.
I have 2 domain controllers, both of them on the same site DC1 & DC2. I have added a new site with a DC3. When I have added DC3 to the domain, I have realized, SYSVOL was not initialized correctly. I went back to DC1 and found out, there's following
error in the event viewer:
Error: 4012 on DC1
The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter
(60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.
Error: 2213 on DC2
The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication
WMI method to resume replication.
This indicates a DFS replication issue between DC1 & DC2 and probably this would be the reason, why the SYSVOL was not properly initialized on DC3.
How can I restore correct DFS replication between DC1 & DC2? I've read
this article, but it's not clear to me, which of the 2 domain controllers has a good version of SYSVOL + I can not find a decent step-by-step article for reconnecting Windows 2012 domain controller.
Any idea, how I can proceed further here?

Here's a complete documentation with resolution of my issue. I have created this documentation for my own purposes in our WIKI, so I will paste it here (I hope, it will help somebody else in the future):
The Problem
We have bought a new server for our domain. This server (NEWDC01) was promoted to be a domain
controller in the DOMAIN. After the promotion, I have added a single computer to the domain. When I have logged on the client to the domain, I realized, this computer is not using the new domain controller (NEWDC01)
for authentication, but DC02 domain controller instead. This is not intended. Local clients should use local domain controllers for authentication (assuming, the Active directory sites & services are configured properly). Further investigation revealed,
there are some replication errors on OLDDC01 & OLDDC02 servers. First I need to solve these replication errors. Then I can
add the NEWDC01 server to domain properly.
Analysis
There are several errors related to DFSR replication on both domain controllers:
Error: 4012 on OLDDC01
The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain.
This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder
until this error is corrected.
Error: 2213 on OLDDC02
The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database
is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
In order to have active directory in a healthy condition, one must ensure, there’s a successful
replication between existing domain controllers up and running. If the replication does not work correctly, you can expect bunch of issues.
group policies and logon scripts are not applied correctly, or as intended
when you want to add a new domain controller to the domain, it will not work as expected (although, you will not see any specific errors after the
server is promoted to be a domain controller)
Active directory backup
I have scheduled an AD backup on OLDDC01 server using the ‘Windows Backup’ solution to make sure,
I can restore the AD / SYSVOL, in case something goes wrong. The backup is scheduled to be executed every day.
Active directory restore
In this particular case, I will talk only about SYSVOL restore. As indicated above, we must get
rid of the DFSR event viewer errors which you can find in event viewer. One of them is indicating, that the JET database was not shut down cleanly and autorecovery was disabled. The other error indicates, the SYSVOL volume is no longer replicated. I am not
sure, what is the reason, why the AD’s in the domain stopped to replicate. Probably it was an unclean server shutdown. The DFSR service stopped to replicate the SYSVOL share and I was not aware about that. When the replication did not run for more than ~99
days, the SYSVOL share was excluded from the DFSR replications.
Find out the most accurate SYSVOL share in the domain
I have compared the content of the SYSVOL directories on both OLDDC01 and OLDDC02 servers: C:\Windows\SYSVOL\domain\Policies.
Both directories have 37 subdirectories. Each subdirectory corresponds to one group policy. This means, that the content is approximately the same, thus I can’t tell, which version is most recent. I do most of the GPO changes on OLDDC01, so I made a conclusion,
that this server contains the most recent version of the SYSVOL share.
There are 2 types of SYSVOL restores, you can do:
Authoritative restore
Non-authoritative restore
Non-authoritative restore
This is a more simple kind of a restore. You can perform this kind of restore, when you are sure,
that one of the domain controllers is authoritative (e.g. you presume, the SYSVOL share is intact and working properly). If you can identify such a working server, you can perform non-authoritative restore of the active directory on a broken domain controller.
Authoritative restore
In this case, you can designate a specific domain controller to be authoritative. You set a special
flag on this server, which will prohibit to overwrite it’s state from another domain controllers, when the replication is enabled on the server again. After you designate one server to be authoritative, you need to update all the another domain controllers
using the non-authoritative procedure.
In this article, you can find, how to perform authoritative vs. non authoritative AD resotre:
http://support.microsoft.com/kb/2218556.
In my case, I was not sure, which of the domain controllers had a more recent copy of AD, so I
have decided to make OLDDC01 authoritative (check the link above). Once this has been done, I have made a non-authoritative update on OLDDC02 server.
Everything was almost ready. The last step, I needed to execute was, I needed to fix the ‘JET’
event viewer error on SRVBK1. In the event log entry on the bottom, you can find following:
Recovery Steps
1. Back up the files in all replicated folders on the volume. Failure to do
so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
2. To resume the replication for this volume, use the WMI method ResumeReplication
of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig
where volumeGuid="D37A9FC3-8B1D-11E2-93E8-806E6F6E6963" call ResumeReplication
For more information, see http://support.microsoft.com/kb/2663685.
Final words
After I have executed this command, the replication was again started between OLDDC01 and OLDDC02
servers. After I have started up the NEWDC01 server, I have realized, it has automatically replicated the contents of the SYSVOL share - almost immediately after the server was started up. I have again tried to login with the local client into DOMAIN domain
and now I see, that local client is using local Domain controller for authentication.
Everything seems to be OK now.

ACS internal database replication

I have setup ACS internal database replication and it works once then the secondary config is overwritten and doesn't contain the AAA server of the primary.
primary - 10.100.253.25
ACS 1113 running 4.2
secondary - 10.100.253.26
ACS 1113 running 4.2
Example of before and after
Before replication
The primary has these AAA servers listed under network components.
self - 127.0.0.1
acs2 - 10.100.253.26
The secondary has these AAA servers listed under network components.
self - 127.0.0.1
acs1 - 10.100.253.25
After replication
The primary has these AAA servers listed under network components.
self - 127.0.0.1
acs2 - 10.100.253.26
The secondary has these AAA servers listed under network components.
self - 127.0.0.1
acs2 - 10.100.253.26
therefore after the first replication subsequent attempts will fail because the secondary won't accept attempts from unknown AAA servers. Is this to be expected or can I mitigate it in someway?

Please try setting the original ip address by using "Set ip" Command from the console connection of the ACS Solution engine. Once you successfully changed the ip address, you can apply the patch 11 or above (latest is patch 16) on the ACS SE (This will fix the problem).
In majority of cases set ip command fails but sometime works too.
In case it doesn't help then we have 2 options:
1.] Open a TAC case, send the database file to delete the entry.
2.] If you are not intrested sending your database then try the below listed steps:
In order to remove the loopback entry from the Database, we need to follow following steps,
Please download ACS 4.2 trial from following link, if you do not have ACS Full version for Windows purchased.
http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-eval- eval-ACS-4.2.0.124-SW.zip
[1] Install eval version on Windows 2000/2003 server. Please also ensure that JAVA is installed on that server.
[2] Take a backup from ACS SE from, System Configuration > ACS Backup >Backup Now.
[3] Restore the database backup on ACS eval.
[4] On eval ACS , go to Network Configuration > find the AAA Server entry with 127.0.0.1 entry. Edit it and give it some other IP for
example, 1.1.1.1. Submit + Apply.
[5] On eval, Restart CSAdmin service.
[6] On eval, go back to Network Configuration and search for the changed IP address and delete that entry, Delete + Apply.
[7] Take a backup from eval ACS, System Configuration > ACS Backup > Backup Now.
[8] Restore the database backup from eval ACS into ACS SE from option, System Configuration > ACS Restore, choose the database backup. Check Check option "User and Group Database" and "CiscoSecure ACS System Configuration", then press Restore Now.
[9] On ACS SE, go to Network Configuration, make sure that 127.0.0.1 entry is not there and for ACS SE's hostname we have the correct IP address. Go to Proxy Distribution Table > (Default). Move the server’s hostname entry that has correct IP for this ACS SE into "Forward To" column, if not already. Then press "Submit + Restart".
Reference defect, CSCso36620 - Toggle nic command changes AAA server ip address to "127.0.0.1" in GUI.
Regards,
Jatin
Do rate helpful posts-

ACS 5.0 having issues with different subnet AAA Clients

Dear All,
I am getting weird issue. My ACS 5.0 is in subnet 10.1.1.0/24. All the AAA clients which are in the same subnet can communicate with the ACS but different subnet cannot.
I have checked the firewall between them, Its allow any any with all services.
One more thing I have faced today is that now from only one switch (10.1.2.10) can access ACS but switches in the same subnet (10.1.2.0/24) cant access ACS as same previous issue.
Following are the logs of one switch(10.1.2.10) in different subnet can access ACS :
Working Switch with Same configuration:
SW-A#test aaa group tacacs+ test cisco legacy
Attempting authentication test to server-group tacacs+ using tacacs+
User was successfully authenticated.
SW-A#
*Nov 17 00:05:52.041: AAA: parse name=<no string> idb type=-1 tty=-1
*Nov 17 00:05:52.041: AAA/MEMORY: create_user (0x1B1FD04) user='test' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
*Nov 17 00:05:52.041: TAC+: send AUTHEN/START packet ver=192 id=3237327729
*Nov 17 00:05:52.041: TAC+: Using default tacacs server-group "tacacs+" list.
*Nov 17 00:05:52.041: TAC+: Opening TCP/IP to 10.1.1.2/49 timeout=5
*Nov 17 00:05:52.041: TAC+: Opened TCP/IP handle 0x1B44D48 to 10.1.1.2/49
*Nov 17 00:05:52.041: TAC+: 10.1.1.2 (3237327729) AUTHEN/START/LOGIN/ASCII queued
SW-A#
*Nov 17 00:05:52.243: TAC+: (3237327729) AUTHEN/START/LOGIN/ASCII processed
*Nov 17 00:05:52.243: TAC+: ver=192 id=3237327729 received AUTHEN status = GETPASS
*Nov 17 00:05:52.243: TAC+: send AUTHEN/CONT packet id=3237327729
*Nov 17 00:05:52.243: TAC+: 10.1.1.2 (3237327729) AUTHEN/CONT queued
*Nov 17 00:05:52.444: TAC+: (3237327729) AUTHEN/CONT processed
*Nov 17 00:05:52.444: TAC+: ver=192 id=3237327729 received AUTHEN status = PASS
*Nov 17 00:05:52.444: AAA/MEMORY: free_user (0x1B1FD04) user='test' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 vrf= (id=0)
Logs from the same subnet switch (10.1.2.20) which cannot access ACS:
SW-B#test aaa group tacacs+ test cisco legacy
Attempting authentication test to server-group tacacs+ using tacacs+
No authoritative response from any server.
SW-B#
*Oct 20 00:54:12.834: AAA: parse name=<no string> idb type=-1 tty=-1
*Oct 20 00:54:12.842: AAA/MEMORY: create_user (0x1A6F3F0) user='test' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
*Oct 20 00:54:12.842: TAC+: send AUTHEN/START packet ver=192 id=3281146755
*Oct 20 00:54:12.842: TAC+: Using default tacacs server-group "tacacs+" list.
*Oct 20 00:54:12.842: TAC+: Opening TCP/IP to 10.1.1.2/49 timeout=5
*Oct 20 00:54:12.842: TAC+: Opened TCP/IP handle 0x1B1E888 to 10.1.1.2/49
*Oct 20 00:54:12.842: TAC+: 10.1.1.2 (3281146755) AUTHEN/START/LOGIN/ASCII queued
SW-B#
*Oct 20 00:54:12.943: TAC+: (3281146755) AUTHEN/START/LOGIN/ASCII processed
*Oct 20 00:54:12.943: TAC+: received bad AUTHEN packet: type = 0, expected 1
*Oct 20 00:54:12.943: TAC+: Invalid AUTHEN/START/LOGIN/ASCII packet (check keys).
*Oct 20 00:54:12.943: TAC+: Closing TCP/IP 0x1B1E888 connection to 10.1.1.2/49
*Oct 20 00:54:12.943: TAC+: Using default tacacs server-group "tacacs+" list.
*Oct 20 00:54:12.943: AAA/MEMORY: free_user (0x1A6F3F0) user='test' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 vrf= (id=0)
Waiting for your responses.
Regards,
Anser

Ok, cool,
So this usually means that the switch is sourcing the requests from a difernet interface that is configured on the ACS.
I would guess that the ACS is reporting unknown NAS...
Can you please use the "ip tacacs source-interface" command to make sure the switch will source the Tacacs+ packets from the interface with the IP address for which you have the ACS configured to?
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

AD replication issue. had 1722 error after running repadmin

Hi,
I got 1722 error ( The RPC server is unavailable) when I run repadmin /replsummary. The result points that one source DSA is having 1722 error and the problem DC is the DC I run repadmin command from.
Do it make sense. Why DC itself cannot rpc to itself?
Thanks
Qing

I would start with what is mentioned in this Wiki article: http://social.technet.microsoft.com/wiki/contents/articles/18513.active-directory-replication-issues-basic-troubleshooting-steps-single-ad-domain-in-a-single-ad-forest.aspx
That should be a good start for troubleshooting.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Replication issue between lync 2010 FE and lync 2013 FE

Hello
I face any issue in my lync server's .
I was in the last steps in the migration process from lync 2010 to 2013 enterprise edition .
where CMS was moved already to 2013 , and later on many time I checked the replication and it was fine , then I deleted the CMS DB FROM 2010 FE and I checked the replication and it was fine .
later on I proceed to delete the archiving server and monitoring server and it was fine .
later on I proceed to
Reset call admission control
Prevent sessions for services
Stop Lync Server 2010 services
Remove a Front End Server from a pool
I just I face this replication issue after I start the process to delete the lync 2010 pool which im stuck on it now .
one more thing while I was trying to delete the 2010 front end pool , I got the error .
Error: An error occurred: "System.InvalidOperationException" "Cannot publish topology changes. Conference directories still exist on a pool that would be deleted. Remove the conference directories before continuing."
so I moved the conference directories from 2010 pool to the 2013 pool successfully.
but later on when I check the replication I notice the replication issue ?
Get-CsManagementStoreReplicationStatus
UpToDate           : False         """""""""""""""""""it is already shutdown
ReplicaFqdn        : HQ-EDGE01.mydom
LastStatusReport   :
LastUpdateCreation : 3/23/2015 11:22:17 AM
ProductVersion     :
UpToDate           : True
ReplicaFqdn        : HQ-LYNC2013-FE.mydom
LastStatusReport   : 3/19/2015 5:21:27 PM
LastUpdateCreation : 3/19/2015 5:21:25 PM
ProductVersion     : 5.0.8308.556
UpToDate           : False
ReplicaFqdn        : HQ-LYNC-FE-01.mydom
LastStatusReport   : 3/19/2015 11:38:25 AM
LastUpdateCreation : 3/23/2015 11:52:17 AM
ProductVersion     : 4.0.7577.0
then I run the
I run Invoke-CsManagementStoreReplication
Get-CsManagementStoreReplicationStatus
UpToDate           : False     """""""""""""""""""it is already shutdown """"""""""""""""""
ReplicaFqdn        : HQ-EDGE01.mydomain
LastStatusReport   :
LastUpdateCreation : 3/23/2015 10:18:22 PM
ProductVersion     :
UpToDate           : True
ReplicaFqdn        : HQ-LYNC2013-FE.mydomain
LastStatusReport   : 3/23/2015 10:18:26 PM
LastUpdateCreation : 3/23/2015 10:18:22 PM
ProductVersion     : 5.0.8308.556
UpToDate           : False
ReplicaFqdn        : HQ-LYNC-FE-01.mydomain
LastStatusReport   : 3/19/2015 11:38:25 AM
LastUpdateCreation : 3/23/2015 10:18:22 PM
ProductVersion     : 4.0.7577.0
====================
Get-CsManagementStoreReplicationStatus
UpToDate           : False """"""""""""""" it is already down """""""""""""""""""""
ReplicaFqdn        : HQ-EDGE01.mydomain
LastStatusReport   :
LastUpdateCreation : 3/23/2015 10:53:23 PM
ProductVersion     :
UpToDate           : True
ReplicaFqdn        : HQ-LYNC2013-FE.mydomain
LastStatusReport   : 3/23/2015 10:18:26 PM
LastUpdateCreation : 3/23/2015 10:18:22 PM
ProductVersion     : 5.0.8308.556
UpToDate           : False
ReplicaFqdn        : HQ-LYNC-FE-01.mydomain
LastStatusReport   : 3/19/2015 11:38:25 AM
LastUpdateCreation : 3/23/2015 10:53:23 PM
ProductVersion     : 4.0.7577.0
why LastUpdateCreation : 3/23/2015 10:53:23 PM from the lync 2010 pool ????
I'm not doing any change on 2010 pool now (I just try to delete it ) , all the change it is on 2013 pool .
for edge server 2013 I shut down the server since there is another configuration issue there (so replication to edge server not the issue now since it is down).
my question is this will affect my lync 2013 since it is the production now ? is this un completed steps for removing the 2010 pool affect my production.
is the replication issue affects my 2013 pool ?
Kind Regards
MK

Hi,
From your description above, did you mean before deleting the Lync Server 2010 Pool from topology, you found the replication of Lync 2010 FE Server not update to date?
If it is the case, based on my knowledge, there is no affect for Lync Server 2013 Pool. Please double check if Lync Server 2013 Pool work normally, and Lync users in Lync 2013 Pool can use all Lync function without issues. Then you can delete Lync 2010 Pool
from Topology and publish it. After finish it, please re-run step 2 on Lync Server 2013 FE Servers.
Best Regards,
Eason Huang
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Eason Huang
TechNet Community Support

ACS 4.1 replication error

Hi netPro,
when i start the replication that's an error ,
ACS Internal Database Replication Errors
Number Error
1 'User and Group Database' and 'Group Database' cannot be replicated together
what does it means ?
thanks.
regards,
Jack

Hi Jack,
Under database replication components, either select "user and group database" or "group database only"..You can't have both selected, as first option include the other..
regards
Hamid

DC Replication issue

Hello Team,
We have built a new Domain Controller in our environment with OS 2003 Server.
While checking for replication from an existing server (using the command repadmin /replsummary) I get and an as below:
1753 - NLHAAAHDC002
(NLHAAAHDC002 is the DC name that is built new)
Also if I run the same command on the new server (NLHAAAHDC002) I get the error that as below:
"'repadmin' is not recognized as an internal or external command,
operable program or batch file".
An urgent response is appreciated.
Regards,
Suman Rout

Hi Suman,
Please refer the below link on Microsoft KB article for Troubleshooting steps - DC Replication issue,
http://support.microsoft.com/kb/2089874/en-us
Regards,
Gopi
JiJi
Technologies

ACS replication issue on VMware ESX 3.5

I have just installed ACS 4.2 on two VMware hosts. I've configured database replication but it won't work. The error message is "shared secret mismatch". This error message occurs if a NAT device is in the path (which it isn't in this case) or if the tcp header is otherwise changed during transmission. I'm wondering if VMware is adding something to the TCP header. Has anyone come across this problem before or has anyone successfully implemented ACS replication when both hosts are on VMware?
Thanks.

Hi,
I see that you are getting "shared secret mismatch error" under database replication logs. Just wanted to inform you that this is not because of nat'ed device. This happens when we have different keys for AAA servers on primary and secondary ACS.
The primary server must be configured as an AAA server and must have a key.
The secondary server must have the primary server configured as an AAA
server and its key for the primary server must match the primary servers own
key. The shared secret key should be same on the both the ACS's.
I am sending you one link for Setting Up Replication for Cisco Secure ACS, I
am sure this example with screen shots gives you better understanding.
Please visit the below suggested ULR:
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration
_example09186a00800e518a.shtml
If that doesn't resolve the issue, please let me know if you see any server with this ip address 127.0.0.1.
HTH
JK
-Plz rate helpful posts-

ACS Replication Issue

Yesterday we had two ACS 4.0 servers installed on Windows 2000 Domain Controllers that were working great. ACS1 was the primary server and replication was configured to send to ACS2. ACS2 replication was configured to receive from ACS1.
We lost ACS2 yesterday so I installed ACS 4 on a 2003 Domain Controller (ACS3). I installed ACS3, went into network configuration and added ACS1 as an AAA server.
I then logged onto ACS1 and added ACS3 as an AAA server and configured ACS3 as a replication partner.
It is not replicating - if I look at the log I get
ERROR, ACS 'ACS3' has denied replication request
I do not have the primary as a replication on the secondary.
I have some screen shots of the configuration from ACS2 and I've duplicated everything I've could (except for name and IP).
Any ideas on what I can try next?

I had what seems to be the same issue.
In my case I have two ACS SE 1113 appliances, but the issue could still be the same with your Windows servers.
The appliance has two NIC's - I had both of the NIC's connected. Although the appliance only allows you to use the Primary NIC (the bottom one) ACS still detected the Secondary NIC and creates an additional "AAA Server" entry under the "Network Configuration" tab called "self". You should only have one "self" entry in your AAA Server list, not two.
Unfortunately I couldn't find a way to undo this. So I disconnected the Secondary NIC (the top one) and used the recovery CD to reload both of my ACS devices. Now everything works just fine.
- Nate

Replication issues with ACS for Windows 3.3.3 build 11

I have built two ACS for Windows servers on Windows 2003 SP1. The AD environment is Windows 2003 SP1 as well. I have configured the two ACS servers on each box. However, when I go to replicate from box A to box B, the following error appears:
Inbound database replication from ACS 'acsradius.asu.edu' denied - shared secret mismatch
I have double checked the shared secret keys on both servers in the Network Configuration AAA servers section. Any idea what the issue is?
Thanks.

Do not run replication to a server installed on Windows 2003. Due to changes in the way Win2003 handles registry changes, each change can take up to 100 times longer and replication can fail and the server hang.

Problems witch acs 4.2 replication

i installed the primary and secondary server.
i see only one problem in the logs.
when i try to replicate
i get this :
cisco acs 01/04/2012 23:50:58 NTVMEM73 INFO Outbound replication cycle starting...01/04/2012 23:40:25 NTVMEM73 INFO Outbound replication cycle starting...01/04/2012 23:29:51 NTVMEM73 INFO Outbound replication cycle starting...01/04/2012 23:19:16 NTVMEM73 INFO
further no issue
can someone helps me

Hello,
There are still important files missing. Are both ACS servers configured for Full Detail of logging?
Also, are you selecting the following when collect the package?
There are still missing files on the package.cab file that I need. Please try again with the above settings.
Regards

ACS 4.2 replication issue

Similar Messages

Maybe you are looking for