Enforce AnyConnect client to do machine authentication when user is logged on

Hi All,
I want to use AnyConnect as a supplicant to our corporate WLAN and also use Machine Authentication feature on ACS 5.3.
Is there a way how to enforce AnyConnect client to do machine authentication when user is logged on? Sometimes can happen, when user just hybernate the computer and do not log off and log on. If they don't do this in some period, then they are not allowed to use WLAN.
Thanks for your help.
Regards
Karel

The problem appears to be if a user hibernate or ACS is reloaded and machine authentication timer expired and user need to logout and wait or reboot the machine. After that it authenticates and then user can login again. Anyconnect 3.1 will allow eap chainging and should be able to address that problem.

Similar Messages

Machine Authentication and User Authentication with ACS v5.1... how?

Hi!
I'm having trouble setting up Machine Authentication and User Authentication on ACS v5.1 using WinXP SP3 (or SP2) as supplicant.
This is the goal:
On wireless (preferably on wired too) networks, get the WinXP to machine authenticate against AD using certificates so the machine is possible to reach via for example ping, and it can also get GPO Updates.
Then, when the user actually logs in, I need User Authentication, so we can run startup scripts, map the Home Directory and so on.
I have set up a Windows Sertificate server, and the client (WinXP) are recieving both machine and user certificates just fine.
I have also managed to set up so Machine Authenticaton works, by setting up a policy rule that checks on certificate only:
"Certificate Dictionary:Common Name contains .admin.testdomain.lan"
But to achieve that, I had to set EAP Type in WinXP to Smart Card or other Certificate, and then no PEAP authentication occurs, which I assume I need for User Authentication? Or is that possible by using Certificates too?
I just don't know how to do this, so is there a detailed guide out there for this? I would assume that this is something that all administrators using wireless and WinXP would like to achieve.
Thank you.

Hello again.
I found out how to do this now..
What I needed to do was to add a new Certificate Authentication Profile that checks against Subject Alternative Name, because that was the only thing I could find that was the same in both user certificate and machine certificate.
After adding that profile to the Identity Store Sequences, and making tthe appropriate rule in the policy, it works.
You must also remember to change the AuthMode option in Windows XP Registry to "1".
What I really wanted to do was to use the "Was Machine Authenticated" condition in the policies, but I have never gotten that conditon to work, unfortunately.
That would have plugged a few security holes for me.

Windows network shares disappearing when users are logged on to Mac

We are having some problems with windows network shares disappearing when users are logged on to Mac computers.
We have a number of Mac labs that users can logon to using their AD login credentials. Their network shares are saved on a windows file server. The ad plug has been configured on each client Mac as has the LDAP plug-in. It is configured to connect to the Xserve which is running as an OD master. The system preferences for the client Macs are being managed from the Xserve.
The problem for the users is that they can log into the Mac no problem and they can see their network share appearing on the desktop and in the dock, but for some reason on random Macs and with random users the network share disappears. If they log off and log back in again the network share is still missing. As it happens randomly I can not put my finger on what the problem is.
Most labs either have Intel iMacs running 10.4.11 or Intel iMacs running 10.5.5
Any help will be appreciated
Noel Patterson
Southern Regional College
Northern Ireland

Mike,
We need to know some basic scoping information to provide any further input.
1)
Is the user prompted that the server will be shutting down?
2)
Does Task Scheduler show that the task ran at the scheduled time?
3)
Are there any errors in %windir%\tasks\schedlgu.txt?
4)
Does the problem still occur if the machine is in its own OU with blocked inheritance?
Does the problem still occur in a clean boot configuration with MSConfig
Steps to clean boot machine:
================
Start > Run > Msconfig > Select Services > click "check box", "Hide all microsoft services" > Disable all
Start > Run > Msconfig > Select startup> Disable all
Reboot
Thanks,
ankit

Find out from the machine name, what user is logged in

thank you. Is there a way to find out from the machine name, what user is logged in or who the machine belongs to?
I can actually find out from the username what machine they have because there is a field called the wWWHomePage that gets populated with the computer name
how do I do that?
Also I have a list of email addresses. How do I find the username from the list of email addresses ?
thanks

I have no good way to test this, so you'll probably have to adjust this on your end:
Get-Content .\users.txt | ForEach {
$emailAddr = $_
$props = @{
EmailAddress = $emailAddr
Username = ''
ComputerName = ''
ComputerPath = ''
try {
$userDetails = Get-ADUser -Filter "EmailAddress -eq '$emailAddr'" -Properties wWWHomePage -ErrorAction Stop
$pcDetails = Get-ADComputer -Identity $userDetails.wWWHomePage -Properties CanonicalName -ErrorAction Stop
$props.Username = $userDetails.SamAccountName
$props.ComputerName = $userDetails.wWWHomePage
$props.ComputerPath = $pcDetails.CanonicalName
} catch {
$props.Username = 'ERROR'
$props.ComputerName = 'ERROR'
$props.ComputerPath = 'ERROR'
New-Object PsObject -Property $props
} | Select EmailAddress,Username,ComputerName,ComputerPath
Don't retire TechNet! -
(Don't give up yet - 12,950+ strong and growing)

Payroll locks when user is logged into the portal

When users are logged into the portal, and HCM runs payroll
they call and ask the user to log out, because payroll can't run and gets hung-up.
Seems very odd, anyone else hear of this?
Thanks
Edited by: Gareth Nicholas on Jul 17, 2008 10:20 PM

hi
strange behaviour
did u open oss note to sap ?
dont forget to revert back here with the solution
regards,
vijay.

HTML Client - can I use authentication when debugging locally inside Visual Studio

This should be so simple, but I cannot find it, is it possible to enable authentication when debugging an HTML client locally inside VS so that the Login page is shown and you have to log in when you run the app?
We are adding additional code into the Login page and need to debug this... at the moment the only way we can find to do this is to actually deploy the app.
There must be a way?
Regards, Xander. My Blog

In this post Security with HTML Client Huy said the following:
"Unfortunately at debug time the runtime will always use a Test Account with Administrator permission and there's no good way to change this behavior."
So there is no "good" (i.e. easy) way to do this, but perhaps there is a work around?
Regards, Xander. My Blog

CryptAcquireContext failing with ERROR_FILE_NOT_FOUND (2L) when user not logged on Windows 8.1

I am having a hard time migrating a C++ CryptoAPI-based application that currently runs on Windows Server 2008 to Windows 8.1. The scenario is:
This application is eventually triggered by WatchDog.exe, which in its turn is triggered when the computer is started by Windows' Task Scheduler.
Task Scheduler uses the following rules to start the WatchDog.exe:
A Administrator User Account;
Run Whether user is logged on or not;
UNCHECKED: Do not store password. The task will only have access to local resources;
Run with Highest Privileges;
Configure for Win 8.1;
Triggered at system startup.
The server sits there, nobody logged, until in a given scenario WatchDog.exe starts the application. Application log confirms that the owner of the process (GetUserName)
is the very same user Task Scheduler used to trigger WatchDog.exe.
It turns out that this application works fine in Windows Server 2008, but in windows 8.1 a call to CryptAcquireContext fails
with return code ERROR_FILE_NOT_FOUND (2L). The odd thing is that the application will NOT fail if, when started, the user is physically logged
on the machine, although it was not the user who started the application manually.
I took a look at the documentation and
found:
"The profile of the user is not loaded and cannot be found. This happens when the application impersonates a user, for example, the IUSR_ComputerName account."
I had never heard of impersonification, so I made a research and found the APIs LogonUser,ImpersonateLoggedOnUser and RevertToSelf.
I then updated the application in this way:
HANDLE hToken;
if (! LogonUser(L"admin", L".", L"XXXXXXXX", LOGON32_LOGON_BATCH, LOGON32_PROVIDER_DEFAULT, &hToken))
logger->log (_T("Error logging on."));
else
logger->log (PMLOG_LEVEL_TRACE, _T("Logged on."));
if (! ImpersonateLoggedOnUser(hToken))
logger->log (_T("Error impersonating."));
else
logger->log (_T("Impersonated."));
err = XXXXXXXXX(); // calls function which will execute CryptAcquireContext
if (! RevertToSelf())
logger->log (_T("Error reverting."));
else
logger->log (_T("Reverted."));
Excerpt with the call to CryptAcquireContext:
// Get the handle to the default provider.
if(! CryptAcquireContext(&hCryptProv, cryptContainerName, MS_ENHANCED_PROV, PROV_RSA_FULL, 0))
DWORD e = GetLastError();
_stprintf_s (logMsg, 1000, _T("Error %ld acquiring cryptographic provider."), e);
cRSALogger->log (logMsg);
return ERR_CCRYPT_NO_KEY_CONTAINER;
cRSALogger->log (_T("Cryptographic provider acquired."));
As the result, I got the log:
[2015/01/08 20:53:25-TRACE] Logged on.
[2015/01/08 20:53:25-TRACE] Impersonated.
[2015/01/08 20:53:26-ERROR] Error 2 acquiring cryptographic provider.
[2015/01/08 20:53:26-TRACE] Reverted.
That seems to show that impersonation is working properly, but still I get Error 2 (ERROR_FILE_NOT_FOUND) on CryptAcquireContext.
Summary:
On Windows Server 2008, the very same application runs properly even without the calls to LogonUser/Impersonate/Revert.
On Windows 8.1, the application, with or without the calls to LogonUser/Impersonate/Revert, will only work properly if the user is logged on (which
is not acceptable).
Any thoughts where I can run to in order to get this working on windows 8.1?
Thank in advance,
Dan

There are a couple of issues.
Based on the parameters being used in CryptAcquireContext(). A profile needs to be loaded and your app has to be running as the same user who created the keyset. (which is why it works when a user is logged on Windows 8.1) Also, impersonation
does not load your user profile, you need to call LoadUserProfile(). It seems like you should be using a machine keyset for your scenario if you want to do this when nobody is logged on.
Take a look at the following KB article for more information.
https://support.microsoft.com/kb/238187?wa=wsignin1.0
thanks
Frank K [MSFT]

Display text in navigation bar when user is logged in

Hi all,
I'm (still ) on Apex 4.2.6.
Currently, I have in my page templates, the following snippet:
      <div class="logoBar">
          <img src="#IMAGE_PREFIX#themes/theme_125/images/logo_.png" />
          <h1><a href="#HOME_LINK#" id="uLogo">#LOGO#</a></h1>
        <div class="userBlock">
          <span>Username: &APP_USER.</span>
          #NAVIGATION_BAR#
        </div>
      </div>
I have the requirement to display both the username (APP_USER) and the company the user works for (Application item AI_COMPANY), only when the user is logged in. When the user isn't logged in; instead of those items, I have to show a login link. Well, I know how to only show a link to the login page, when the user isn't authenticated, using the navigation bar. Currently, when a user isn't authenticated; the page shows: Username: nobody. That's because it is in my page template. How can I only show the username when the user is logged in? And show the company name only then?
My first thought was to add an item in the navigation bar. But those items shows up as links. Is there a way to add a navigation bar item, and let it display as text? Sure, I could write a dynamic action on page 0 to remove the link, but I'm searching for a nicer/better sollution.
I apreciate your help!

Hi tomvdduin,
you can show company name which is already in your Application item(AI_COMPANY) by modifying the page template mentioned above.
<div class="logoBar">
<img src="#IMAGE_PREFIX#themes/theme_125/images/logo_.png" />
    <h1><a href="#HOME_LINK#" id="uLogo">#LOGO#</a></h1>
<div class="userBlock">
    <span>Username: &APP_USER.(&AI_COMPANY.)</span>
    #NAVIGATION_BAR#
</div>
</div>
I have included company inside ( ), you can change how you want to show.
for example
<span>Username: &APP_USER.</span><span>Company: &APP_COMPANY.</span>
Hope this helps you,
Regards,
Jitendra

On which machine an AD user is logged?

So I have single forest, single domain infrastructure. 8 DCs if it would help. I need to find out on which machine(joined in the domain) given AD user is logged. For example user tt4567 is logged on ws32t45. All DCs are running on Win 2012 R2. I'm wondering
if there is a way to do it with AD or some other MS tools and which ones they would be?

Hi,
But because client logon your site DC process may failure (the network delay), so the client may logon any of your forest DC, You can use the following two options
for the user logon event auditing, then create the script filter the user logon information.
Option 1:
1. Enable Auditing on the domain level by using Group Policy:
Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policy
There are two types of auditing that address logging on, they are Audit Logon Events and Audit Account Logon Events.
Audit "logon events" records logons on the PC(s) targeted by the policy and the results appear in the Security Log on that PC(s).
Audit "Account Logon" Events tracks logons to the domain, and the results appear in the Security Log on domain controllers only
2. Create a logon script on the required domain/OU/user account with the following content:
  echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver% >>
\\SERVER\SHARENAME$\LOGON.LOG
3. Create a logoff script on the required domain/OU/user account with the following content:
  echo %date%,%time%,%computername%,%username%,%sessionname%,%logonserver% >>
\\SERVER\SHARENAME$\LOGOFF.LOG
Note: Please be aware that unauthorized users can change this scripts, due the requirement that
  the SHARENAME$ will be writeable by users.
Option 2:
Use WMI/ADSI to query each domain controller for logon/logoff events.
The related KB:
How to track users logon/logoff
http://support.microsoft.com/kb/556015
More information:
Finding a Domain Controller in the Closest Site
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Creating a disclaimer when users / administrator logs onto the PC / servers

Hi there,
I would like my administrators / users to see a security disclaimer banner when they log onto Windows regardless server or PC. All of our servers / PC are joined to a domain so is it possible if I can set the banner on the domain level so that all of the member
servers / PCs will automatically take effect?
The disclaimer banner is something like "The system is for use for authorized users only, anyone using this system without authority is subject to bla bla bla bla".
So each time they log onto their system via their windows domain ID and password, this banner is prompted to them first before they go into their desktop.
My domain controller is on W2K8 and some still on W2K3.

you can configure the interactive logon message through GPO.
check this KB http://support.microsoft.com/kb/310430/en-us

SD card and USB key connection when user is logged off

Yes I have to admit: I am a switcher.
There is a thing I don't understand and I don't know if it is a feature or a bug.
I have implemented the screensaver to ask me the password after some time. So I have noted that when the Mac is in this state, if I connect an SD card or a USB key, these pheriperals are not connected. If instead I logon and I reconnect them they work.
Is it a feature or a bug?
I hope I have explained well the problem

It's a feature. USB drives must be unmounted or ejected before they are disconnected, to prevent volume corruption and data loss. The feature prevents users from getting into the situation where they accidentally plug a drive into the wrong computer, and then can't unlock the screen to safely unmount the drive before disconnecting it.
That's my guess, anyway.

Picture not shown in report when user not logged on.

Scenario (also described in thread: http://technet.oracle.com:89/ubb/Forum81/HTML/000726.html)
I create a table mypics:
title varchar2(100), mypic varchar2(100). I create a Portal form that uses file upload on mypic. The form will put the picture into some table...
I then create a report with the following sql:
select title,
'[IMG SRC="'| | decode(MYPIC, '', PORTAL30.wwctx_api.get_image_path | | 'noimg.jpg',
owa_util.get_cgi_env('DOC_ACCESS_PATH') | | '/' | | MYPIC) | |'"]' MYPIC
from SCOTT.mypics
(replace [] with <>)
The report do not show the picture if the report is added as a component in a content area, and the user is not logged on.
(Workarounds are to use portal pages instead i think).
But still, the problem probably has to do with some granting ?
Terje.
null

Hi,
If this is the case, then first of all you have to make your objects language dependant. Then load the data for English (If you have), German etc with 0LANGU as the key of the object.
Then only you can view the descriptions/names/texts etc. in the various languages.
Hope this helps.
Regards,
Yogesh.

ISE machine authentication - only plug in to the network after booting

Hi experts.
I have recently deployed ISE with machine authentication.
However, when the machine is already plugged in to the switch before booting, the machine does not authenticate automatically. It isn't until I log on, using a local computer account, that 802.1X authentication occurs. Using wireshark, I have verified again that this authentication is MACHINE authentication, not user-authentication.
Is there a way to solve this problem, other than having my users unplug their computer and only plug in to the network after booting?
Eric

Hi Vattulu,
The method of machine access restriction will be used, because there is no a plan to use anyconnect NAM on the client environment, since the prerequisite for EAP-chaining is to use anyconnect.
Regards,
Eric

AnyConnect error " User not authorized for AnyConnect Client access, contact your administrator"

Hi everyone,
it's probably just me but I have tried real hard to get a simple AnyConnect setup working in a lab environment on my ASA 5505 at home, without luck. When I connect with the AnyConnect client I get the error message "User not authorized for AnyConnect Client access, contact your administrator". I have searched for this error and tried some of the few solutions out there, but to no avail. I also updated the ASA from 8.4.4(1) to 9.1(1) and ASDM from 6.4(9) to 7.1(1) but still the same problem. The setup of the ASA is straight forward, directly connected to the Internet with a 10.0.1.0 / 24 subnet on the inside and an address pool of 10.0.2.0 / 24 to assign to the VPN clients. Please note that due to ISP restrictions, I'm using port 44455 instead of 443. I had AnyConnect working with the SSL portal, but IKEv2 IPsec is giving me a headache. I have stripped down certificate authentication which I had running before just to eliminate this as a potential cause of the issue. When running debugging, I do not get any error messages - the handshake completes successfully and the local authentication works fine as well.
Please find the current config and debugging output below. I appreciate any pointers as to what might be wrong here.
: Saved
ASA Version 9.1(1)
hostname ASA
domain-name ingo.local
enable password ... encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ... encrypted
names
name 10.0.1.0 LAN-10-0-1-x
dns-guard
ip local pool VPNPool 10.0.2.1-10.0.2.10 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif Internal
security-level 100
ip address 10.0.1.254 255.255.255.0
interface Vlan2
nameif External
security-level 0
ip address dhcp setroute
regex BlockFacebook "facebook.com"
banner login This is a monitored system. Unauthorized access is prohibited.
boot system disk0:/asa911-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup Internal
dns domain-lookup External
dns server-group DefaultDNS
name-server 10.0.1.11
name-server 75.153.176.1
name-server 75.153.176.9
domain-name ingo.local
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-10-0-1-x
subnet 10.0.1.0 255.255.255.0
object network Company-IP1
host xxx.xxx.xxx.xxx
object network Company-IP2
host xxx.xxx.xxx.xxx
object network HYPER-V-DUAL-IP
range 10.0.1.1 10.0.1.2
object network LAN-10-0-1-X
access-list 100 extended permit tcp any4 object HYPER-V-DUAL-IP eq 3389 inactive
access-list 100 extended permit tcp object Company-IP1 object HYPER-V-DUAL-IP eq 3389
access-list 100 extended permit tcp object Company-IP2 object HYPER-V-DUAL-IP eq 3389
tcp-map Normalizer
check-retransmission
checksum-verification
no pager
logging enable
logging timestamp
logging list Threats message 106023
logging list Threats message 106100
logging list Threats message 106015
logging list Threats message 106021
logging list Threats message 401004
logging buffered errors
logging trap Threats
logging asdm debugging
logging device-id hostname
logging host Internal 10.0.1.11 format emblem
logging ftp-bufferwrap
logging ftp-server 10.0.1.11 / asa *****
logging permit-hostdown
mtu Internal 1500
mtu External 1500
ip verify reverse-path interface Internal
ip verify reverse-path interface External
icmp unreachable rate-limit 1 burst-size 1
icmp deny any echo External
asdm image disk0:/asdm-711.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
object network obj_any
nat (Internal,External) dynamic interface
object network LAN-10-0-1-x
nat (Internal,External) dynamic interface
object network HYPER-V-DUAL-IP
nat (Internal,External) static interface service tcp 3389 3389
access-group 100 in interface External
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server radius protocol radius
aaa-server radius (Internal) host 10.0.1.11
key *****
radius-common-pw *****
user-identity default-domain LOCAL
aaa authentication ssh console radius LOCAL
http server enable
http LAN-10-0-1-x 255.255.255.0 Internal
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map External_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map External_map interface External
crypto ca trustpoint srv01_trustpoint
enrollment terminal
crl configure
crypto ca trustpoint asa_cert_trustpoint
keypair asa_cert_trustpoint
crl configure
crypto ca trustpoint LOCAL-CA-SERVER
keypair LOCAL-CA-SERVER
crl configure
crypto ca trustpool policy
crypto ca server
cdp-url http://.../+CSCOCA+/asa_ca.crl:44435
issuer-name CN=...
database path disk0:/LOCAL_CA_SERVER/
smtp from-address ...
publish-crl External 44436
crypto ca certificate chain srv01_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain asa_cert_trustpoint
certificate <output omitted>
quit
crypto ca certificate chain LOCAL-CA-SERVER
certificate <output omitted>
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable External client-services port 44455
crypto ikev2 remote-access trustpoint asa_cert_trustpoint
telnet timeout 5
ssh LAN-10-0-1-x 255.255.255.0 Internal
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh xxx.xxx.xxx.xxx 255.255.255.255 External
ssh timeout 5
ssh version 2
console timeout 0
no vpn-addr-assign aaa
no ipv6-vpn-addr-assign aaa
no ipv6-vpn-addr-assign local
dhcpd dns 75.153.176.9 75.153.176.1
dhcpd domain ingo.local
dhcpd option 3 ip 10.0.1.254
dhcpd address 10.0.1.50-10.0.1.81 Internal
dhcpd enable Internal
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address LAN-10-0-1-x 255.255.255.0
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter use-database
dynamic-filter enable interface Internal
dynamic-filter enable interface External
dynamic-filter drop blacklist interface Internal
dynamic-filter drop blacklist interface External
ntp server 128.233.3.101 source External
ntp server 128.233.3.100 source External prefer
ntp server 204.152.184.72 source External
ntp server 192.6.38.127 source External
ssl encryption aes256-sha1 aes128-sha1 3des-sha1
ssl trust-point asa_cert_trustpoint External
webvpn
port 44433
enable External
dtls port 44433
anyconnect image disk0:/anyconnect-win-3.1.02026-k9.pkg 1
anyconnect profiles profile1 disk0:/profile1.xml
anyconnect enable
smart-tunnel list SmartTunnelList1 mstsc mstsc.exe platform windows
smart-tunnel list SmartTunnelList1 putty putty.exe platform windows
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
webvpn
anyconnect profiles value profile1 type user
username write.ingo password ... encrypted
username ingo password ... encrypted privilege 15
username tom.tucker password ... encrypted
class-map TCP
match port tcp range 1 65535
class-map type regex match-any BlockFacebook
match regex BlockFacebook
class-map type inspect http match-all BlockDomains
match request header host regex class BlockFacebook
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 1500
id-randomization
policy-map TCP
class TCP
set connection conn-max 1000 embryonic-conn-max 1000 per-client-max 250 per-client-embryonic-max 250
set connection timeout dcd
set connection advanced-options Normalizer
set connection decrement-ttl
policy-map type inspect http HTTP
parameters
protocol-violation action drop-connection log
class BlockDomains
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map dynamic-filter-snoop
inspect http HTTP
service-policy global_policy global
service-policy TCP interface External
smtp-server 199.185.220.249
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:41a021a28f73c647a2f550ba932bed1a
: end
Many thanks,
Ingo

Hi Jose,
here is what I got now:
ASA(config)# sh run | begin tunnel-group
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPNPool
authorization-required
and DAP debugging still the same:
ASA(config)# DAP_TRACE: DAP_open: CDC45080
DAP_TRACE: Username: tom.tucker, aaa.cisco.grouppolicy = DfltGrpPolicy
DAP_TRACE: Username: tom.tucker, aaa.cisco.username = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username1 = tom.tucker
DAP_TRACE: Username: tom.tucker, aaa.cisco.username2 =
DAP_TRACE: Username: tom.tucker, aaa.cisco.tunnelgroup = DefaultWEBVPNGroup
DAP_TRACE: Username: tom.tucker, DAP_add_SCEP: scep required = [FALSE]
DAP_TRACE: Username: tom.tucker, DAP_add_AC:
endpoint.anyconnect.clientversion="3.1.02026";
endpoint.anyconnect.platform="win";
DAP_TRACE: Username: tom.tucker, dap_aggregate_attr: rec_count = 1
DAP_TRACE: Username: tom.tucker, Selected DAPs: DfltAccessPolicy
DAP_TRACE: Username: tom.tucker, DAP_close: CDC45080
Unfortunately, it still doesn't work. Hmmm.. maybe a wipe of the config and starting from scratch can help?
Thanks,
Ingo

Machine Authentication not happening with MAR

ACS(SE)4.2
WLC (4402)5.1.163
AD 2003 Server
Currently we are using ACS to authenticate VPN user for two domain.In the same ACS we want to configure machine authentication + PEAP + Self Signed Certificate.Now clients are authenticated with a valid username and password in any of the domain but machine authentication is not happening.
Our Requirement :we want to acheive machine authentication and user authentication simultaneously. i.e. Computers which are added to particular group with a valid username and password can only access the network.If any one of above requirement is not fulfill then end host cannot access the network.
Can anyone suggest what configuration required to acheive our requirement?
Note: We are using same ACS for VPN authentication.

Currently we are using WindowXP SP3.
Client Configuration:
1. network Authentication: WPA + TKIP
2. EAP type: Protected EAP(PEAP)
3. Authenticate as computer when computer information is available is (checked)
4. Validated server certificate is (unchecked)
5. Authentication Method is: EAP- MSCHAPv2
ACS External Database Configuration:
Tick "Enable PEAP machine authentication".
Tick "Enable Machine Access Restrictions".
Ensure that "Group map for successful user authentication without machine authentication:" is mapped to "No Access".
We are using Windows AD database as external database.
Currently we have created one wireless group in AD which is mapped to a group in ACS and the ACS group is mapped to the SSID in WLC. We are trying to authenticate the computer which are added to the Wireless AD group. But currently all users which are there in the AD are authenticate by their Username/password instead of machine authentication ( computer which are present in the group).
In WLC, client details showing domain\username instead of host/computer name.
Your quick response would be highly appreciated!!!!!!

Enforce AnyConnect client to do machine authentication when user is logged on

Similar Messages

Maybe you are looking for