failed the WebVPN login

Hello world!

I'm setting up a asa 5520 (software Version 8.2 (5)) connection without customer serveral profiles and ACS 5.3 as server authentication, this works well AD users or local can connect vpn without problem, but now I need to show only one (common to all) profile on the portal of the ASA and behind the stage allocated to the connection profile right according to the profile of the user authorization I followed the following document

'Lock group VPN using ACS 5.x.pdf', but it does not work as expected, it continues to show "cannot connect".

So I took a glance at the ACS on radius authentication and the user is authenticated, I did a debug aaa 255 common, debug all the RADIUS

everything seems to be ok, but when I use debug webvpn 255

It gives me the following message

ASA # webvpn_allocate_auth_struct: net_handle = D0200040

webvpn_portal.c:ewaFormSubmit_webvpn_login [3203]

webvpn_portal.c:webvpn_login_validate_net_handle [2234]

webvpn_portal.c:webvpn_login_allocate_auth_struct [2254]

webvpn_portal.c:webvpn_login_assign_app_next [2272]

webvpn_portal.c:webvpn_login_cookie_check [2289]

webvpn_portal.c:webvpn_login_set_tg_buffer_from_form [2325]

webvpn_portal.c:webvpn_login_transcend_cert_auth_cookie [2359]

webvpn_login_transcend_cert_auth_cookie: tg_cookie = NULL, tg_name = SSLClientProfile

webvpn_portal.c:webvpn_login_set_tg_cookie_form [2421]

webvpn_portal.c:webvpn_login_set_tg_cookie_querry_string [2473]

webvpn_portal.c:webvpn_login_resolve_tunnel_group [2546]

webvpn_login_resolve_tunnel_group: tgCookie = NULL

webvpn_login_resolve_tunnel_group: name of the tunnel from the list of groups

webvpn_login_resolve_tunnel_group: TG_BUFFER = SSLClientProfile

webvpn_portal.c:webvpn_login_negotiate_client_cert [2636]

webvpn_portal.c:webvpn_login_check_cert_status [2733]

webvpn_portal.c:webvpn_login_cert_only [2774]

webvpn_portal.c:webvpn_login_primary_username [2796]

webvpn_portal.c:webvpn_login_primary_password [2878]

webvpn_portal.c:webvpn_login_secondary_username [2910]

webvpn_portal.c:webvpn_login_secondary_password [2988]

webvpn_portal.c:webvpn_login_extra_password [3021]

webvpn_portal.c:webvpn_login_set_cookie_flag [3040]

webvpn_portal.c:webvpn_login_set_auth_group_type [3063]

webvpn_login_set_auth_group_type: WEBVPN_AUTH_GROUP_TYPE = 1

webvpn_portal.c:webvpn_login_aaa_not_resuming [3137]

webvpn_portal.c:http_webvpn_kill_cookie [790]

webvpn_auth.c:http_webvpn_pre_authentication [2447]

WebVPN: call to AAA with ewsContext (-780823792) and nh (-803209152)!

webvpn_add_auth_handle: auth_handle = 529

WebVPN: started authentication of users...

webvpn_auth.c:webvpn_aaa_callback [5320]

WebVPN: Status = (ACCEPT) AAA

webvpn_portal.c:ewaFormSubmit_webvpn_login [3203]

webvpn_portal.c:webvpn_login_validate_net_handle [2234]

webvpn_portal.c:webvpn_login_allocate_auth_struct [2254]

webvpn_portal.c:webvpn_login_assign_app_next [2272]

webvpn_portal.c:webvpn_login_cookie_check [2289]

webvpn_portal.c:webvpn_login_set_tg_buffer_from_form [2325]

webvpn_portal.c:webvpn_login_transcend_cert_auth_cookie [2359]

webvpn_login_transcend_cert_auth_cookie: tg_cookie = NULL, tg_name = SSLClientProfile

webvpn_portal.c:webvpn_login_set_tg_cookie_form [2421]

webvpn_portal.c:webvpn_login_set_tg_cookie_querry_string [2473]

webvpn_portal.c:webvpn_login_resolve_tunnel_group [2546]

webvpn_portal.c:webvpn_login_negotiate_client_cert [2636]

webvpn_portal.c:webvpn_login_check_cert_status [2733]

webvpn_portal.c:webvpn_login_cert_only [2774]

webvpn_portal.c:webvpn_login_primary_username [2796]

webvpn_portal.c:webvpn_login_primary_password [2878]

webvpn_portal.c:webvpn_login_secondary_username [2910]

webvpn_portal.c:webvpn_login_secondary_password [2988]

webvpn_portal.c:webvpn_login_extra_password [3021]

webvpn_portal.c:webvpn_login_set_cookie_flag [3040]

webvpn_portal.c:webvpn_login_set_auth_group_type [3063]

webvpn_login_set_auth_group_type: WEBVPN_AUTH_GROUP_TYPE = 1

webvpn_portal.c:webvpn_login_aaa_resuming [3093]

webvpn_auth.c:http_webvpn_post_authentication [1611]

WebVPN: user: authenticated (John).

webvpn_auth.c:http_webvpn_auth_accept [3066]

User has entered the group, on what it was not supposed to come!

webvpn_remove_auth_handle: auth_handle = 529

webvpn_free_auth_struct: net_handle = D0200040

Any suggestion would be appreciated

Thank you

Jonathan

Jonathan,

The question is clear, your users do not connect to the right profile.

Please see this:

ASA 8.x: allow users to select a group when connecting WebVPN with Group Alias group-URL method

The idea of having the authorization of GBA is to affect a specific group depending on probably the attribute Radius 25 policy, but if you have it working in conjunction with the 'group-lock' feature, then you must ensure that users connect to the correct connection profile, group policy does not allow the connection.

For example:

test group policy attributes

Group-lock testGroup

!

tunnel-group testGroup General attributes

Group Policy - by default-test

!

testGroup webvpn attributes tunnel-group

Group-url https://1.1.1.1/testGroup enable

So if a user connects to a different profile that is not the testGroup and gets group policy named test, then the connection will be rejected.

HTH.

Portu.

Tags: Cisco Security

Similar Questions

  • Customizoing the Webvpn login page

    Hey ppl!

    On ASA 8.x sslwebvpn running with the Anyconnect client.

    The default login page has a Cisco logo in the left corner. Change the properties of defaultcustomization, I see that the Logo comes from

    Now - where is + CSCOU +? How can I / if possible download a business on this frontpage logo?

    I read the customization on the Anyconnect clint doc - and who does not have the trick to this.

    Any thoughts?

    Kind regards

    Kelvin

    Hi Kelvin,

    6.0 (3) ASDM

    Access configuration

    ---> Remote access VPN

    ---> Access clientless SSL VPN

    ---> Portal

    ---> Webcontents

    ---> Import

  • Default connection on the WEBVPN login page profile

    Hi all

    I hope someone can help me... I have a pair of ASA 5550 s running Anyconnect Essentials, with multiple profiles configured connection. I would like to than the login page to the default portal to our corporate profile main (so users get NAM and all the benefits of the policy), but currently it is failing at the last that I created the profile.  Is it possible to change the default connection profile drop down list always defaults to my favorite profile? It seems that I've seen this in the past.

    Thanks for the help!

    Russell

    Hi Russell,

    It seems that group aliases are listed alphabetically so if your main corporate profile is the first one there, it must be set as the default, when your users launch Anyconnect/open the gate without client.

    Kind regards

    Nicolas

  • Need to implement the alternative login if Kerberos authentication fails.

    Need to implement the alternative login if Kerberos authentication fails.

    In our case, we are sure that Kerberos will fail because we allow agencies 'B' to access this application of reliable source.

    Kerberos fails and the application should display the name of user and password page and then authenticate.

    In the web.xml file changed auth method basic with Kerberos, set up successfully.

    'A' agency users can make successful Kerberos SSO. But when an agency "B" SSO access will fail with 401 and the application appears pop base with the name of user and password fields.

    When the user provides the details and present application returns 401 again. not able to go beyond these steps.

    Please provide your inputs.

    can you please enable security ATN debug and share the newspapers?

    Who will be telll us why the authentication will fail.

    Replace the CLIENT-CERT, BASIC authentication method in the web.xml and try.

    What is the default authenticator control indicator? I think that its just / optional.

    -Faisal

  • Tecra M5 - annoying popup messages when fails the automatic BT connection to headset

    Hello

    I use my Bluetooth from Sony headphones to work with my Tecra M5 laptop lately and there is a boring bunch of message that keeps popping up.

    In the bluetooth settings, I ticked the box "auto login feature will be validated. This causes the headset to connect automatically and it works a treat.

    But, when I bring my laptop home I did more than my helmet with me and about every 5 minutes my laptop keep showing these annoying messages popup at the bottom right of my screen saying the "auto login failed, please ensure that your bluetooth device is turned on etc...". ".

    Sometimes it gives me a prompt in the lower right of the screen asking me if I would like to disable the "automatic login" function for headphones.

    Is it possible to disable these popup messages annoying when my headphones are not detected, without having to turn off the option "auto-connect"? I want to leave the function "automatic login" enabled so when I get back to work and back on my headset again, it will be always connected automatically.

    But when I get home, I wish I could continue to do stuff on my laptop without contstantly being bothered by these electronic popup. If there is some sort of registry setting or something to turn them off, that would be great.

    I downloaded and installed the Blueooth battery & Driver Version 6.40

    See you soon

    Toshiba gave me a beta version of the next Bluetooth stack. There the option you are looking for. Just disable the setting in
    "Bluetooth-> Bluetooth-> Options-> Audio settings-> display a message when the device is connected."
    So just wait until this version is available for download.

  • the WebVPN asa8.0 portal (4): Group-url

    Hi all

    I have a problem when I try to use the group-list control to directly select the group for a ssl vpn without the drop-down list.

    Activate the command group-url https://a.a.a.a:port / test in the Tunnel-group, but even if I put it in my browser I still

    See the drop-down list.

    This happens with an ASA8.0 (4).

    I have an ASA8.2 (1) and I did not have this problem.

    I noticed this difference in the login page url after redirection:

    8.0 (4) https://a.a.a.a:port / + CSCOE + / logon.html? token = 4D6912AB72A1FCFA2643F325

    8.2 (1) https://a.a.a.a:port / + CSCOE + / logon.html? tg = test & token = 4D6912AB72A1FCFA2643F325

    Can we do any auggestion?

    Thank you in advance!

    There are a few bugs related to the group-URL in 8.0.4.  In your test above, what port you set the ASA to listen on the WebVPN connections?  If something other than port 443, you can be executed in bug CSCsu77167.

  • Receive the "403 Forbidden" error code on a Web site, I've been accessing years. It is written "forbidden you don't have permission to access the/_cqr/login on that server." I can access this site (AOL) on other browsers. Help!

    Receive the "403 Forbidden" error code on a Web site, I've been accessing years. It is written "forbidden you don't have permission to access the/_cqr/login on that server." I can access this site (AOL) on other browsers.

    I emptied my cache.  I rebooted Firefox.  This is my email website - never had a problem before.  I am able to access it on Safari.  I even tried the simple address (rather then my bookmarked login address) - still got the same error message!
    

    I have the same problem: it is written ' forbidden you don't have permission to access the/_cqr/login on that server. " I can access this site (AOL) on other browsers. After that I connected to AOL, I get this message. then I go to the address line and delete everything after than the aol.com and her and then press ENTER. then, I'm registered and can read my emails. How can we solve this problem?

  • Satellite M40: Modem fails the diagnostic test on WinXp Pro

    Satellite M40 comes with Windows XP Home Edition pre installed and when I ran the diagnostic tools to test the modem the modem passes the test. But when I installed Windows XP Professional SP2 media center, the modem fails the diagnostic test.

    What surprises me is that I have not received any error during installation and all devices, including the installed modem OK with no problems.

    Another observation when I tried to connect to the Internet using our dial back of company during installation of Windows XP Edition family's volition I remembered and the modem responds very well. But with Windows XP Professional SP2 media center installed the modem call how ever in "waiting for call-back ', when the server of our company try to call me, the modem does not respond and waits until I get the message Time out

    Please if anyone has an explanation for this decision No. let me know because it is driving my nuts.

    Thank you
    Oumy

    Hello

    Have you tried to install the latest driver of modem? Please check if you have the right driver for Win Xp. You can find the drivers on the Toshiba site.

    http://EU.computers.Toshiba-Europe.com

    They are a lot of drivers for countries individually.

    In addition, Windows XP SP2 includes the new Windows Firewall. It is possible that the firewall is preventing the modem connection. You can try to disable the Windows Firewall.

    Good bye

  • Fingerprint reader not working not not upon awakening from sleep for the windows login

    Hello
    I have a new T540P with a validity fingerprint reader.

    About 80% of the time, the fingerprint reader does not meet the windows login screen after the wake up the computer from sleep mode. It works 100% of the time when starting from a stop position, however. Once connected, it also works 100% of the time. The question arises when you log in to windows.

    I tried many things

    -uninstallation/installation of the device in the Device Manager and finger print manager pro software

    -prints of setting through two fingerprint Manager software pro (lenovo) OR through the windows built in options of the control panel of the fingerprints

    -disabling "allow windows to turn off this device to save power" in Device Manager.

    Thus, I must say that I have an another T540P I ordered as a replacement. Both models encounter the same problem.

    Is it a matter of broad platform affecting all models of T540P? It's frusterating.


  • How to turn off the windows login?

    There is only one user on this computer and it's a nuisance to have to use the windows login.

    Hello

    You can do 1 of the following:

    1. go in Control Panel > user accounts and remove the password.
    2 configure the computer to automatically connect to your user account:

    a. press the Windows key + R .
    b. type control userpasswords2 in the Open:box and press Enter.
    c. Uncheck users must enter a user name and password to use this computer .
    d. click on apply.
    Enter your user name and password.
    f. click OK twice

    Concerning

    Source: http://answers.microsoft.com/en-us/windows/forum/windows_7-desktop/bypass-windows-login-screen/6b9478b3-b845-4796-8979-cfe7963a5cb3

  • Windows has failed the windows genuine validation

    I wanted to open a file to windows 2007. Guest computer to download the compatible pack before you download. I did, but he says that windows failed the windows genuine validation. So I followed the instructions. My screensaver is also gone and there is no icon on the lower right side of the computer that says you may be a victim of software counterfeiting. How can I go further?

    Quote your full version of Windows (for example, WinXP SP3;) Windows XP 64 - bit SP2; Vista SP1; Vista 64 - bit SP2; Win7; Win7 64 bit) when you post in a forum or a newsgroup. Please do it in your next reply.

    Assuming that "a windows 2007 file" means a file Office 2007, also specify your version of Office installed (for example, Office 2002 SP3).

    The foregoing despite...

    Please visit http://www.microsoft.com/genuine/ and click on the button to validate Windows or validate Office, and then restart your computer.

    If you were not able to validate, follow these steps:

    1. Download this diagnostic tool, save it to your desktop: http://go.microsoft.com/fwlink/?linkid=56062

    -Online Windows XP: double-click the executable file to run the tool.

    -Online Vista & Win7: right-click on the executable and select run as administrator to run the tool.

    2. after running the tool, click on the Windows or Office as appropriate and then click copy (to the Clipboard).

    NB: You can open a new file in Notepad, paste the contents of the Clipboard in it & keep for future reference.

    3 start a new thread in the appropriate forum of Microsoft Genuine Advantage and paste the results of the WGA or OGA data diagnostic in a detailed post tool: http://social.microsoft.com/Forums/en-US/category/genuine

    4 Troubleshooting specialist will analyze the data and recommend an appropriate solution.

    ~ Robear Dyer (PA Bear) ~ MS MVP (that is to say, mail, security, Windows & Update Services) since 2002 ~ WARNING: MS MVPs represent or work for Microsoft

  • updates that have failed the day 1, won't they update automatically the next day? and persevering until they are right? or what I need to do it manually? Dang! Tell me that it is not so...

    OK, so I'm at a dead end and had to buy a computer laptop refurb when my hard drive died while he's on leave.  Bought Monday, they had XP on it, but I checked the updates and it had 74 must be installed.

    I don't have access at home so I tried to install everything that was needed every day of the library since I bought this laptop on Monday.  On day 1, he said 74 needed to install updates, then I guess that the automatic far did a little more every day.  Finally the Service Pk 3 failed to install for the last 2 days.

    Now today I try again, but I'm looking back and see that some other updates in recent days have also failed.

    I don't want to go back and install each separately out of 110 undates installed.

    My question is: If one day some updates failed, the next day, wouldn't it automatically DL updates that failed the day before, get current?  If I were a computer, I would not keep DL and install new updates until the 'old' have been installed correctly.  So I just reasoning flawed or computers work this way?  Please tell me that I can't go back and redo all of those failed?

    Thanks a lot for your help in this matter!

    U

    .. .Meanwhile service pk 3 tells me he has finished loading and is ready to install, restart, etc... and I just canceled the installation because it seems that to me... If these other failures are not fixed first there will be the svc pk 3 effect, as well.  Of course they wish that no cat could have answered my question instantly... but no, he referred me to a technical person...

    Well, perfectionism causes procrastination... and sometimes it's just maddening... Please help me?

  • Windows update fails - the file specifies some updates not installed - 9 updates failed, code 80073712 and code 78(f).

    Windows update fails - the file specifies some updates not installed - 9 updates failed, code 80073712 and code 78(f).
    The update runs, and then told me that updates failed to install update automatik research, I had more failed updates that havew installed correctly.

    Hi Ben Dean,

    Use the (SFC.exe) System File Checker tool to determine which file is causing the problem and then replace the file.

    To run the System File Checker, follow these steps:

    1. Click Start and type cmd in the box start the search.

    2. in the area of results, right-click cmd.exe, and then click Run as administrator. You will be asked to type the password for an administrator account. If you are the administrator or type the administrator password, click on continue. Then click on continue.

    3. at the command prompt, type Sfc/scannow, and then press ENTER.

    For more information, see the following Microsoft article:

    This article describes how to use the tool (SFC.exe) System File Checker to fix the system files missing or corrupted on Windows Vista or Windows 7.

    How to use the System File Checker tool to fix the system files missing or corrupted on Windows Vista or Windows 7
    http://support.Microsoft.com/kb/929833

    I hope this helps!

    Thank you, and in what concerns:
    Shalini Surana - Microsoft technical support.
    Visit our Microsoft answers feedback Forumand let us know what you think.

  • "Windows failed the genuine validation...". Go online and set now and get genuine Windows. »

    I get a message "Windows failed the genuine validation...". Go online and set now and get genuine Windows. "I have a copy of Windows XP that I bought in the store.  My computer came with Vista; When the hard drive crashed, I had the store install the copy of XP that I had bought earlier, instead of reinstalling Vista.  Why I shouldn't "genuine Windows" already?

    You have an installation made from a set of recovery discs Dell on a Hewlett-Packard machine.

    This facility has NOT been made using appropriate media and it is likely that this is what is causing your problems.

    Next time, the system displays as non-authentique try to use Update tool product key to make the real system-

    Use the product key update tool - http://windows.microsoft.com/en-GB/windows/help/genuine/product-key to change the key for that which concerns your COA sticker, and then to restart and to publish a new report MGADiag we can confirm everything went well

  • I get the windows login screen and I do not know the password for administrators

    I accidentally deleted my account and when the computer starts and I get the windows login screen and I do not know the administrators password. Also how can I reinstall windows when I got a disc when I brought my laptop. Thank you, Lorraine

    Thanks for getting back to me. I sold my old laptop to my son-in-law, and he asked me to remove my name from the computer off so that my name wasn't on the screen all the time. so I deleted the profile of cook of lorraine and made one for him, but I didn't give it a password. then I realized what I had to do (I got Lorraine where time is on the bottom of the screen), but was unable to highlight to remove it without a mouse. so I plugged a mouse, but the computer does not read, then I restarted the computer. When I restarted, all I could get was the windows login screen.

    then I typed in the name son-nlaws and they said that he was kidnapped, tyoed in mine and got the same and then typed in Administrator, but did not know the password. I have since reinstalled windows. XP Professional would not install saying a file was missing, so I installed xp family and is working again. He just has to click on what edition it wants to run. Professional XP of course happen just with the display of connection... but it can use again.
    Thank you once again, Lorraine

Maybe you are looking for

  • HP 700-414: what case fan coolers and CPU would fit into a 700 HP - 414

    I installed a GTX 950 in my HP 700-414 played overwatch for maybe 3 or 4 hours max and my time cpu has reached 85 - 87 c and my gpu is between 80-85 C. So I was wondering if you guys know how I could find the size of the case fan and how many mounts

  • Import: "the selected folder is not writable.

    MacPro non-retine mid-2012 last El Capitan / iOS iPhone 5 9.2.1 Tried with iPhone connected by USB import Photo 80 photos and 2 videos but get "the selected folder is not writable" - see attached screenshot. Just reinstalled OS X. PhotoLibrary is loc

  • EA3500 unable to connect USB printer

    I'm unable to connect to a printer using the USB port on my new Linksys EA3500 router. I followed the instructions here: Support Page , but my version of Cisco Connect not not the option "connect a USB printer» I'm on a macbook pro OSX 10.7.4 and my

  • Slow network discovery

    When I click on the network icon, the discovery process is very slow - 10 times slower than XP - why? Win7 x 64 ultimate

  • HP 15-r029wm: is my HP 15-r029wm missed one fan?

    I was upgrading my RAM today and noticed that my laptop doesn't have an installed cooling fan? Is this good?  I got at Wally World, and I know that it's cheaper than the dollar menu at McDonald's - but not fan?  I'm cooling otherwise?  More important