Identity Based Firewall doesn't work using Citrix Published Desktop environment

Question

Hi!
We are using the newest release of AD Agent (1.0.0.32.1, built 598). The ASA Firewalls 5520 are having the software release 8.4(3)8 installed.
The problem:
When somebody tries to connect thru the Identity based firewalls from a citrix published desktop environment (PDI) the connection is not possible. Checking the ip-of-user mapping on the firewalls (show user-identity ip-of-user USERNAME) mostly doesn't show the mapping of the USERNAME and the PDI the user is logged in. The user-of-ip mapping of the PDIs IP-address shows mostly other users, which then are used to authenticate the acces thru the firewalls.
What is interesting, that on the AD Agent using "adacfg.exe cache list | find /i "USERNAME"" i can't see the PDIs IP-address neither because it is mapped to another user.
Questions:
Is Citrix Published Desktop environment supported to connect thru Identity based Firewalls?
Anybody knows how AD Agent, Domain Controllers and Firewalls are working together?
On the firewalls with "show user-identity ad-agent we see, the following:
Authentication Port: udp/1645
Accounting Port: udp/1646
ASA Listening Port: udp/3799
Why Cisco does use 1645 and 1646 and not 1812 and 1813?
The Listening Port is used for what purpose?
Remark: we tried the AD Agent modes full- download and on-demand with the same effect.
Thanks for your replies
Walter
Sent from Cisco Technical Support iPad App

Answer 1

There are no Firewalls between the AD-Agent and the DCs. We checked the names using nslookup. Everything ok. I asked our AD responsibles to doublecheck the firewall settings and the logs on the DCs and on the AD Agent. As soon i get an answer I will let you know.
What I saw on the firewalls is, that just one (the first) DC is communicating with the firewalls. Is this normal?
fw-1# show aaa-server protocol ldap
Server Group: AD-ALL
Server Protocol: ldap
Server Address: 192.168.229.30
Server port: 0
Server status: ACTIVE, Last transaction at unknown
Number of pending requests 0
Average round trip time 0ms
Number of authentication requests 114
Number of authorization requests 0
Number of accounting requests 0
Number of retransmissions 0
Number of accepts 114
Number of rejects 0
Number of challenges 0
Number of malformed responses 0
Number of bad authenticators 0
Number of timeouts 0
Number of unrecognized responses 0
Server Group: AD-ALL
Server Protocol: ldap
Server Address: 192.168.229.31
Server port: 0
Server status: ACTIVE, Last transaction at unknown
Number of pending requests 0
Average round trip time 0ms
Number of authentication requests 0
Number of authorization requests 0
Number of accounting requests 0
Number of retransmissions 0
Number of accepts 0
Number of rejects 0
Number of challenges 0
Number of malformed responses 0
Number of bad authenticators 0
Number of timeouts 0
Number of unrecognized responses 0
Server Group: AD-ALL
Server Protocol: ldap
Server Address: 192.168.229.39
Server port: 0
Server status: ACTIVE, Last transaction at unknown
Number of pending requests 0
Average round trip time 0ms
Number of authentication requests 0
Number of authorization requests 0
Number of accounting requests 0
Number of retransmissions 0
Number of accepts 0
Number of rejects 0
Number of challenges 0
Number of malformed responses 0
Number of bad authenticators 0
Number of timeouts 0
Number of unrecognized responses 0
Server Group: AD-ALL
Server Protocol: ldap
Server Address: 192.168.229.40
Server port: 0
Server status: ACTIVE, Last transaction at unknown
Number of pending requests 0
Average round trip time 0ms
Number of authentication requests 0
Number of authorization requests 0
Number of accounting requests 0
Number of retransmissions 0
Number of accepts 0
Number of rejects 0
Number of challenges 0
Number of malformed responses 0
Number of bad authenticators 0
Number of timeouts 0
Number of unrecognized responses 0
Server Group: AD-ALL
Server Protocol: ldap
Server Address: 192.168.229.41
Server port: 0
Server status: ACTIVE, Last transaction at unknown
Number of pending requests 0
Average round trip time 0ms
Number of authentication requests 0
Number of authorization requests 0
Number of accounting requests 0
Number of retransmissions 0
Number of accepts 0
Number of rejects 0
Number of challenges 0
Number of malformed responses 0
Number of bad authenticators 0
Number of timeouts 0
Number of unrecognized responses 0
Server Group: AD-ALL
Server Protocol: ldap
Server Address: 192.168.229.42
Server port: 0
Server status: ACTIVE, Last transaction at unknown
Number of pending requests 0
Average round trip time 0ms
Number of authentication requests 0
Number of authorization requests 0
Number of accounting requests 0
Number of retransmissions 0
Number of accepts 0
Number of rejects 0
Number of challenges 0
Number of malformed responses 0
Number of bad authenticators 0
Number of timeouts 0
Number of unrecognized responses 0
fw-1# sho user-identity ad-agent
Primary AD Agent:
Status up
Mode: on-demand
IP address: 192.168.11.8
Authentication port: udp/1645
Accounting port: udp/1646
ASA listening port: udp/3799
Interface: Intranet
Up time: 1 day 0 hours
Average RTT: 0 msec
AD Domain Status:
Domain DOMAIN: up
fw-1#
Sent from Cisco Technical Support iPad App