ACS with Checkpoint

Question

Hi,
We have a Checkpoint Firewall using ACS for authentication with RADIUS protocol.
We have two ACS servers configured as primary and secondary on the Checkpoint. Both the ACS servers are configured to use AD as the external database.
Checkpoint is forwarding the authentication request to the primary ACS server. The primary ACS server receives the request and keeps trying to authenticate with the AD. For some reason, the authentication is failing. Please check the attached failed login attempt log. ACS tries the authentication many times and hence the account of the user is being locked out on the AD.
Meanwhile, Checkpoint does not receive any response from the primary ACS server. So, it goes to the secondary ACS server. Checkpoint is able to authenticate with the Secondary ACS server.
To add more information to the case, the primary ACS server is successfully authenticating requests from wireless Access Points for the same user accounts.
The External Database configuration on both the ACS servers look the same.
Please let me know, what could be the problem and why the Primary ACS server is not authenticating requests from Checkpoint, while it can authenticate requests from Wireless Access Points.
Regards,
Suresh

Answer 1

Hi Suresh,
In the package.cab this is what I find,
5/2/200723:48:13Authen failedjiwilsonGlobal_AdminsExternal DB account locked outjiwilson10.64.45.1
5/2/200723:48:18Authen failedjiwilsonGlobal_AdminsExternal DB account locked outjiwilson10.64.45.1
AUTH 05/02/2007 23:47:14 E 0365 0728 External DB [NTAuthenDLL.dll]: Windows authentication FAILED (error 1326L)
AUTH 05/02/2007 23:47:14 I 0365 0728 External DB [NTAuthenDLL.dll]: Reattempting authentication at domain PLT
AUTH 05/02/2007 23:47:14 I 0365 0728 External DB [NTAuthenDLL.dll]: Attempting Windows authentication for user jiwilson
Windows is returning error code "error 1326L"
1326L ERROR_LOGON_FAILURE : The attempted logon is invalid. This is due to either a bad user name or authentication information.
I would like you to check for permission issue since the same user is able to login from secondary acs.
In the domain controller serving the ACS server:
- Create a user.
- To make it hard to hack, give it a very long complicated password.
- Make the user a member of Domain Admins group.
- Make the user a member of Administrators group.
On the Windows 2000 server running ACS:
- Add new user to proper local group.
-- Open "Administrative Tools" from the control panel.
-- Open "Computer Management."
-- Open "Local Users and Groups" and then "Groups."
-- Double-click the "Administrators" group.
-- Click "Add."
-- Choose the domain from the "Look in" box.
-- Double-click the user created earlier to add it.
-- Click OK.
- Give new user special rights on ACS server.
-- Open "Administrative Tools" from the control panel.
-- Open "Local Security Policy."
-- Open "Local Policies."
-- Open "User Rights Assignment."
-- Double-click on "Act as part of the operating system."
-- Click "Add."
-- Choose the domain from the "Look in" box.
-- Double-click the user created earlier to add it.
-- Click OK.
-- Double-click on "Log on as a service."
-- Click "Add."
-- Choose the domain from the "Look in" box.
-- Double-click the user created earlier to add it.
-- Click OK.
- Set the ACS services to run as the created user.
-- Open "Administrative Tools" from the control panel.
-- Open "Services."
-- Double-click the CSADMIN entry.
-- Click the "Log On" tab.
-- Click "This Account" and then the "Browse" button.
-- Choose the domain, double-click the user created earlier.
-- Click "OK."
-- Repeat for the rest of the CS services.
- Wait for Windows to apply the security policy changes, or reboot the
server.
- If you rebooted the server, skip the rest of these instructions.
- Stop and then start the CSADMIN service.
- Open the ACS GUI.
- Click on System Config.
- Click on Service Control.
- Click "Restart."
Note that if the Domain Security Policy is set to override settings for "Act as part of the operating system" and "Log on as a service" rights,
the user rights changes listed above will also need to be made there.
Regards,
Jagdeep