NA. Kerberos5: An authentication Handshake failure

Similar Questions

• I reinstalled Firefox and still receive an authentication Gateway failure.

  Had a power outage with U-Verse. When power came back on the received message 'bridge of Authentication Failure. I am able to connect to the internet with Google Chrome or MSN but not Firefox. I have Windows on a PC 8.1

  Hello

  Refresh (called "Reset" in older versions of Firefox) can solve a lot of problems in restaurant Firefox as his default factory while saving your bookmarks, history, passwords, cookies, and other essential information.

  Note: When you use this feature, you will lose all the extensions, toolbar customizations, and certain preferences. See article Firefox Refresh - reset modules and parameters for more information.

  Refresh for Firefox:

  1. Open the troubleshooting information page using one of the following methods:
     • Click the menu button

       

       click Help

       

       and select troubleshooting information. Should open a new tab containing your troubleshooting information.

     • If you are unable to access the Help menu, type Subject: support in your address bar to bring up the troubleshooting information page.
  2. At the top right of the page, you should see a button that says 'Refresh Firefox' ('reset Firefox' in older versions of Firefox). Click on it.
  3. Firefox closes. Once the update process is complete, Firefox will display a window with the imported information.
  4. Click Finish and reopen Firefox.

  This corrects the problem? Please report to us!

  Thank you.

• ACS authentication - confusing failure

  I have some confusion currently looking into devices that fail the authentication through the ACS.  When you look at the tool of reporting for the candidate countries, I see a device (Dell laptop) appear on the same switch port with about 900 authentication attempts failed by day.  I followed that with a control on the table of MAC addresses for the switch.  I see devices connected (via a hub), but not one that is a failure.  On the port, the hub, 2 Dell laptops there (but not the get connected GBA) and a VTC unit.

  To add to the confusion, that the VTC unit has an IP address when the firewall ARP table.  Don't know where to go from here.

  Robert,

  I missed your question first, the answer is Yes when authentication fails the customer is not entered on the mac address table since that will allow traffic to pass. Dot1x (mab) is a framework for authentication of l2, which does not allow the mac address to pull until we see the acceptance of the radius server.

  So if the client authentication is expected to fail then everything is ok in regards to your deployment will and the behavior of the switch.

  Tarik Admani
  * Please note the useful messages *.

• Verification verification of authentic software failure

  I downloaded a trial version of Photoshop CS6 since Download Manager Adobe, and when it tries to install it says that he is not an authentic Adobe software and appears to be counterfeit. Is that what I can do about it?

  Your download is corrupt.  Delete the currently downloaded installation files and repeat the download.  Did you receive an error during the download process?

• Error: SSL handshake failure

  Error: Failed to transfer SSL, what is wrong

  Here is the code:

  const QUrl url ("http://xxxxxx.com");

  QNetworkRequest request (url);

  If (AppSettings::isUsingHttps()) {}
  request.setUrl (QUrl ("https://xxxxxxxx.com"));

  Config QSslConfiguration = request.sslConfiguration ();
  config.setPeerVerifyMode (QSslSocket::VerifyNone);
  config.setProtocol (QSsl::TlsV1);
  request.setSslConfiguration (config);
  }

  Answer QNetworkReply * = m_networkAccessManager-> get (request);
  bool ok = connect (response, SIGNAL (finished (()), this, SLOT (onGetReply ()));
  Q_ASSERT (OK);
  Q_UNUSED (OK);

  Benecore wrote:

  Make it easy

  QNetworkReply *reply = m_networkAccessManager->get(request);
  reply->ignoreSslErrors();
  

  I wouldn't have to follow this 'advice', with code like this, there is no reason to use https at all.

  You can call ignoreSslErrors with a QSslError QList of objects.

  Unfortunately, you cannot use the certificate store of the systems (which is really stupid), so you manage the import of the (String) server certificate yourself.

  If you have the cert that you create the list of the QSslErrors with the certificate, which go to method to ignore it.

• Authentication failure - 5505 8.3 configuration to windows server RAIDUS vpn client

  Hello

  I'm trying to put up a 5505 (8.3 running) so that I can use vpn client through the RADIUS authentication

  I set up a new local RAIDUS windows box and used the ASDM Assistant and a few other installation guides the 5505.

  I get the following error:

  INFO: Attempt to <10.0.0.92>IP address authentication test (timeout: 12 seconds)

  ERROR: Authentication rejected: failure of the AAA

  any help would be greatly appreciated

  Here is my config sanitized:

  lit5505-02 # sh run

  : Saved

  :

  ASA Version 8.3 (1)

  !

  hostname lit5505-02

  no names

  !

  interface Vlan1

  nameif inside

  security-level 100

  10.0.0.100 IP address 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  banner motd ****************************************

  Banner motd No. unauthorized access is allowed

  banner motd ****************************************

  passive FTP mode

  DNS server-group DefaultDNS

  domain name

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  object network lotus_notes

  host 10.0.0.3

  network sonicwall_ssl_2000 object

  Home 10.0.0.12

  network of the NETWORK_OBJ_10.0.0.0_24 object

  10.0.0.0 subnet 255.255.255.0

  network of the ABD_LAN object

  10.7.0.0 subnet 255.255.0.0

  network of the LIT_LAN object

  10.0.0.0 subnet 255.255.0.0

  network of the LIT_LAN_vlan101 object

  subnet 10.0.1.0 255.255.255.0

  network of the LIT_LAN_vlan102 object

  10.0.2.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan103 object

  subnet 10.0.3.0 255.255.255.0

  network of the LIT_LAN_vlan104 object

  10.0.4.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan105 object

  10.0.5.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan106 object

  10.0.6.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan109 object

  10.0.9.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan112 object

  10.0.112.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan114 object

  10.0.114.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan120 object

  10.0.20.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan121 object

  10.0.21.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan100 object

  10.0.0.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan107 object

  10.0.7.0 subnet 255.255.255.0

  network of the LIT_LAN_vlan108 object

  10.0.8.0 subnet 255.255.255.0

  network of the BER_vlan1 object

  subnet 10.8.0.0 255.255.255.0

  the LIT_VLANS object-group network

  network-object, object LIT_LAN_vlan100

  network-object, object LIT_LAN_vlan101

  network-object, object LIT_LAN_vlan102

  network-object, object LIT_LAN_vlan103

  network-object, object LIT_LAN_vlan104

  network-object, object LIT_LAN_vlan105

  network-object, object LIT_LAN_vlan106

  network-object, object LIT_LAN_vlan107

  network-object, object LIT_LAN_vlan108

  network-object, object LIT_LAN_vlan109

  network-object, object LIT_LAN_vlan112

  network-object, object LIT_LAN_vlan114

  network-object, object LIT_LAN_vlan120

  network-object, object LIT_LAN_vlan121

  the BER_VLANS object-group network

  network-object, object BER_vlan1

  access list off - in extended permit icmp any one

  out-in access-list extended permit tcp any object sonicwall_ssl_2000 eq https

  access-list out-in extended permit tcp any eq smtp lotus_notes object

  access list-based ip allowed any one

  outside_1_cryptomap list extended access permitted ip LIT_VLANS object ABD_LAN object-group

  outside_2_cryptomap list extended access permitted ip object-group LIT_VLANS-group of objects BER_VLANS

  pager lines 24

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  NAT static LIT_VLANS LIT_VLANS destination (indoor, outdoor) static source ABD_LAN ABD_LAN

  NAT static LIT_VLANS LIT_VLANS destination (indoor, outdoor) static source BER_VLANS BER_VLANS

  !

  network obj_any object

  NAT dynamic interface (indoor, outdoor)

  object network lotus_notes

  Static NAT (indoor, outdoor)

  network sonicwall_ssl_2000 object

  Static NAT (indoor, outdoor)

  Access-group all-out in the interface inside

  out-in access-group in external interface

  Route outside 0.0.0.0 0.0.0.0

  Route inside 10.0.1.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.2.0 255.255.255.0 10.0.0.254 1

  Route inside between 10.0.3.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.4.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.5.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.6.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.7.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.8.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.9.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.20.0 255.255.255.0 10.0.0.254 1

  Route inside 10.0.21.0 255.255.255.0 10.0.0.254 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  RADIUS protocol AAA-server litvms03

  litvms03 AAA-server (inside) host 10.0.0.92

  key *.

  RADIUS-common-pw *.

  the ssh LOCAL console AAA authentication

  Enable http server

  http 10.0.0.0 255.255.0.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set pfs Group1

  map 1 set outside_map crypto peer

  card crypto outside_map 1 set of transformation-ESP-3DES-SHA

  card crypto outside_map 2 match address outside_2_cryptomap

  card crypto outside_map 2 pfs Group1 set

  card crypto outside_map 2 defined peer

  card crypto outside_map 2 game of transformation-ESP-3DES-SHA

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  No encryption isakmp nat-traversal

  Telnet timeout 5

  SSH 10.0.0.0 255.255.0.0 inside

  SSH 10.7.0.0 255.255.0.0 inside

  SSH timeout 5

  SSH version 2

  Console timeout 0

  management-access inside

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  NTP server 216.14.98.234 prefer external source

  NTP server 204.15.208.61 prefer external source

  WebVPN

  internal jdr_littleport_employee_vpn group policy

  attributes of the strategy of group jdr_littleport_employee_vpn

  banner value

  value of 10.0.0.8 WINS server 10.100.1.141

  value of 10.0.0.8 DNS server 10.100.1.141

  Split-tunnel-policy tunnelall

  jdrcables.com value by default-field

  Split-dns value jdrcables.com

  IPv6 address pools no

  type of tunnel-group ipsec-l2l

  Tunnel ipsec-attributes group

  pre-shared key *.

  type of tunnel-group ipsec-l2l

  Tunnel ipsec-attributes group

  pre-shared key *.

  !

  !

  context of prompt hostname

  Cryptochecksum:6d1868630c83f17fe0c7de41006a1526

  : end

  Rich

  I have checked the road conditions but missed the VIRTUAL LAN address. Sorry about that.

  I'm glad to see that you solved the problem and am not surprised that the question seems to have been some incompatible in the serttings server. I think you should be able to close the thread based on your response. Give it a try.

  HTH

  Rick

• ISE node failure &amp; pre authorization ACL

  Hi all

  I would like to know who, in what should be the best practice for the following configuration.

  (1) access for devices/end users network if both nodes ISE become inaccessible? How we can ensure that full network access should be granted if the two ISE nodes become unavailable.

  (2) what is the best practice for setting up pre authorization ACL if IP phones are also in the network?

  Here is the configuration of the port and the pre authorization ACL which I use in my network,

  Interface Fa0/1

  switchport access vlan 30

  switchport mode access

  switchport voice vlan 40

  IP access-group ISE-ACL-DEFAULT in

  authentication event failure action allow vlan 30

  action of death event authentication server allow vlan 30

  living action of the server reset the authentication event

  multi-domain of host-mode authentication

  open authentication

  authentication order dot1x mab

  authentication priority dot1x mab

  Auto control of the port of authentication

  periodic authentication

  Server to authenticate again authentication timer

  protect the violation of authentication

  MAB

  dot1x EAP authenticator

  dot1x tx-period 5

  *****************************************

  IP access-list extended by DEFAULT ACL - ISE

  Note DHCP

  allow udp any eq bootpc any eq bootps

  Note DNS and domain controllers

  IP enable any host 172.22.35.11

  IP enable any host 172.22.35.12

  Notice Ping

  allow icmp a whole

  Note PXE / TFTP

  allow udp any any eq tftp

  Note all refuse

  deny ip any any newspaper

  Thank you best regards &,.

  Guelma

  Hello

  On question 1, since you use 'authentication mode host multi-domain' then "action dead event server authentication allows vlan X" is the way to go.

  But if you use "authentication host-mode multi-auth" then you should use "action death event authentication server reset vlan X"

  On question 2, it is not mandatory to use pre permission ACL. My current deployment have IP phones, since I use the profiling and CDP RADIUS then ISE can detect and allow the IP phones, even if the switch blocks all packets. "Why I didn't need pre-authorization ACL.

  Please rate if this can help.

• 802. 1 x authentication port does not

  I have trouble to know what is happening here. I'm trying to configure 802. 1 x port authentication based to assign customers to a VLAN. I inherited this mess and his for a long time I used it. I ran a wireshark on the radius of my server and I see no same package from my IP address switch when I plug into a port (I checked communication because pings come in my trace)

  Pass the info:

  SW-ConfB > sho worm

  Cisco IOS software, software of C2960C (C2960c405-UNIVERSALK9-M), Version 12.2 (55) EX3, VERSION of the SOFTWARE (fc2)

  Port config:

  interface FastEthernet0/11

  switchport mode access

  authentication event failure action allow vlan 900

  no response from the authentication event action allow vlan 900

  Auto control of the port of authentication

  dot1x EAP authenticator

  dot1x tx-period 5

  The RADIUS server info:

  key acct-port 1646 1645 auth-RADIUS-server host 10.0.1.52 port 802.1 x!

  A little confused why not package Radius comes even from the switch. Any tips?

  According to debug it, it seems that the supplicant connected on the switch port does not support the dot1x and MAB is not configured on the switchport so no method left to try and you got the vlan COMMENTS.

  3 Mar 04:37:47.963: % AUTHMGR-7-RESULT: authentication result 'no response' of 'dot1x' for the customer (d4be.d907.9637) on the Interface Fa0/11 AuditSessionID 0A000103000000090B4AD0F6
  * 04:37:47.963 3 Mar: % AUTHMGR-7-FAILOVER: failover "dot1x' for the client (d4be.d907.9637) on the Interface Fa0/11 AuditSessionID 0A000103000000090B4AD0F6
  * 04:37:47.963 3 Mar: AUTHMGR-7-NOMOREMETHODS %: exhausted all methods of authentication for the client

  At this point, the RADIUS is not even came into the picture. Please make sure that the end customer is configured correctly for the dot1x parameters.

  Kind regards

  Jatin kone

  * Make the rate of useful messages *.

• 802 switch Cisco 3750. 1 x: how to stop a retry of authentication for clients that are not authorized

  Hi experts,

  I'm trying to stop trying to authenticate for the guests. They will not have the credentials to be authorzied and we'll put in the guest VLAN. However, the switch always seems to default retries the authentication every 15 seconds approximately. It is fine if the guests are rare, but I'm being implemented in a hotel where most of the users are invited (like 1000 of them at the same time...).

  I really need to turn off the coast or at least find a timer to reduce the frequency... It is urgent, because the hotel is about to open... Here is the config I put on an interface:

  switchport access vlan 1055
  switchport mode access
  switchport nonegotiate
  switchport voice vlan 657
  IP access-group ACL_PortIso_IDF21 in
  authentication event failure action allow vlan 1055
  no response from the authentication event action allow vlan 1055
  multi-domain of host-mode authentication
  Auto control of the port of authentication
  protect the violation of authentication
  MAB
  no link-status of snmp trap
  dot1x EAP authenticator
  dot1x quiet-time 300
  dot1x tx-timeout 2
  dot1x timeout supp-timeout 2
  dot1x max-reauth-req 10
  dot1x timeout that outfit-300
  No cdp enable
  spanning tree portfast
  spanning tree enable bpduguard
  no ip igmp snooping tcn flood

  Thank you!

  I guess what is happening.

  dot1x in your configuration falls down after tx-period (max-reauth-req + 1) X that for you 22 seconds.

  AUTH MGR (the software that controls (dot1x / MAB / webauth) is probably set to restart every 60 seconds.)

  You can check this with:

  ' performance show all | b X / Y'-replace x / y with the correct port you are testing with.

  Look for the command 'restart timer authentication 60'.

  Try setting it to 0. If IOS doesn't let you change it, thanks for posting your version of the software.

• vRO6.0 SSL Handshake error

  I am trying to run workflows using Python, but it throws error SSL Handshake. The same code works with vCO5.5, but it fails with vRO6.0

  headers = {'Content-Type': ' application/xml', 'Accept': ' application/xml'}

  url = ' https:// ' + vroServer + ' / vco/api/flow / ' + wfid + ' / executions

  data = open (xmlFile) .read)

  # NOTE: check = False indicates Python to ignore SSL certificate problems

  # Run a workflow using a XML for the body:

  r = requests.post (url, data = data, check = False, auth = vroAuth, headers = headers)

  Error:

  Traceback (most recent call changed):

  File "C:\Python27\AddWebServiceHost.py", line 35, < module >

  r = requests.post (url, data = data, check = False, auth = vroAuth, headers = headers)

  File "C:\Python27\lib\site-packages\requests-2.7.0-py2.7.egg\requests\api.py", line 109, in post

  return request ('post', url, data = data json = json, * kwargs)

  File "C:\Python27\lib\site-packages\requests-2.7.0-py2.7.egg\requests\api.py", line 50, at the request

  response = session.request (method = method, url = url, * kwargs)

  File "C:\Python27\lib\site-packages\requests-2.7.0-py2.7.egg\requests\sessions.py", line 465, at the request

  resp = self.send (preparation, * send_kwargs)

  File "C:\Python27\lib\site-packages\requests-2.7.0-py2.7.egg\requests\sessions.py", line 573, sending

  r = adapter.send (request, * kwargs)

  File "C:\Python27\lib\site-packages\requests-2.7.0-py2.7.egg\requests\adapters.py", line 431, to send

  raise SSLError (e, request = request)

  SSLError: [Errno 1] _ssl.c:499: handshake failure alert routines: SSL23_GET_SERVER_HELLO:sslv3 error: 14077410:SSL

  > > >

  SSLv3 is considered an insecure protocol, and it is disabled by default in vRO 6 or more.

  You need to either modify your code in Python to connect using TLS instead of SSL, or manually re-enable SSL support in /etc/vco/app-server/server.xml

• error in SSL handshake during activation of the changes in the administration console

  An error occurred during activation of the changes, please see the log for more details.
  [Deployer: 149150] IOException occurred during playback of entry. ; nested exception is: javax.net.ssl.SSLKeyException: the chain of certificates [Security: 090477] has received from 10.26.176.83 - 10.26.176.83 wasn't confidence origin SSL handshake failure. ; nested exception is: javax.net.ssl.SSLKeyException: certificate chain [Security: 090477] has received from 10.26.176.83 - 10.26.176.83 wasn't confidence causing failure of SSL handshake.
  [Security: 090477] String certificate received from 10.26.176.83 - 10.26.176.83 wasn't confidence causing failure of SSL handshake.
  
  
  WLS 10.3 on Windows 2008: I've set up one of my servers managed for SSL and I'm able to reach deployments via browser and the chain of keys/certificates file I installed. However, I get the above error in Admin Console in all directions. I'm unable to validate configuration changes without removing the managed server for SSL. The server administrator is always HTTP via 7001. I don't know where to look to fix this problem. Any ideas appreciated.

  It seems that you did not update the your AdminServer trust store. It acts as a client of your managed server ssl and cannot verify the certificate of identity.

• Cisco ACS with external DB - EAP - TLS

  Hi guys,.

  I understand how the EAP - TLS exchange works (I think), but if I have a client (with or without wire) that uses EAP - TLS with a CBS, I confirm the following.

  Let both users and computer certificates are used:

  1. customer and ACS are with each of the other automatic certificates to ensure they are known to each other. The eap - tls Exchange.

  2A. At any given time and I'm assuming until the successful eap - tls message is sent to the client, the ACS to check if the user name or computer name is in the AD database?

  2B. Wot is the parameter that is checked on the AD database?

  I read here that it can be: http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/configuration/guide/peap_tls.html#wp999517

  Client certificates

  The client certificates are used to identify with certainty the user in EAP - TLS. They have no role in the construction of the TLS tunnel and are not used for encryption. A positive identification is made by one of three ways:

  CN (or name) comparison-compare CN in the certificate with the user name in the database. More information on this type of comparison is included in the description of the subject field of the certificate.

  Comparison of SAN-compare the San in the certificate with the user name in the database. It is only supported from the ACS 3.2. More information on this type of comparison is included in the description of the field another name of the subject of the certificate.

  Binary comparison - compare the certificate with a binary copy of the certificate stored in the database (only AD and LDAP for that). If you use the binary comparison of certificate, you must store the user certificate in a binary format. Also, for the generic LDAP and Active Directory, the attribute that stores the certificate must be the standard LDAP attribute named "usercertificate".

  3. with the foregoing, if options 1 or 2 are used (CN or SAN comparison), I guess it's just a check between a value out the CERT of the ACS and checked with AD, is that correct? With option 3, GBA exercise a complete comparison of the certificate between what the client and a "cert stored client" on the AD DB?

  Please can someone help me with these points.

  I'm so lost in this kind of things :)) I think.

  Thx a lot and best regards,

  Ken

  TLS only * handle * is complete/successful, but because the user authentication fails.

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: State = SSLv3 client SSL read Exchange of keys A

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: State = SSLv3 read Certificate SSL check

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: SSL = SSLv3 read state completed A

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: State = SSLv3 write change cipher spec A SSL

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: SSL = SSLv3 write finished State has

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: State = SSLv3 data embedded SSL

  CryptoLib.SSLConnection.pvServerInfoCB - process of TLS data: State SSL = SSL handshake completed successfully

  EAP: EAP - TLS: handshake succeeded

  EAP: EAP - TLS: authenticated handshake

  EAP: EAP - TLS: CN using the certificate as an authentication identity

  EAP: State EAP: action = authenticate, username = 'Jousset', the user identity is "jousset.

  pvAuthenticateUser: authenticate "jousset" against CSDB

  pvCopySession: assignment session group ID 0.

  pvCheckUnknownUserPolicy: Group of session ID is 0, the call pvAuthenticateUser.

  pvAuthenticateUser: authenticate "jousset' against the Windows database

  External DB [NTAuthenDLL.dll]: Cache of Creating Domain

  External DB [NTAuthenDLL.dll]: Domain for loading Cache

  External DB [NTAuthenDLL.dll]: no UPN Suffixes found

  External DB [NTAuthenDLL.dll]: could not get the domain controller for dwacs.com trust, [error = 1355]

  External DB [NTAuthenDLL.dll]: could not get the domain controller for enigma.com trust, [error = 1355]

  External DB [NTAuthenDLL.dll]: could not get the domain controller for acsteam.com trust, [error = 1355]

  External DB [NTAuthenDLL.dll]: could not get the domain controller for vikram.com trust, [error = 1355]

  External DB [NTAuthenDLL.dll]: domain loaded cache

  External DB [NTAuthenDLL.dll]: could not find the user jousset [0 x 00005012]

  External DB [NTAuthenDLL.dll]: user Jousset is not found

  pvCheckUnknownUserPolicy: assignment session group ID 0.

  Unknown user "jousset" was not authenticated

  If EAP-failure (RADIUS Access-Reject (is sent, no EAP-Success(Radius Access-Accept).))

  And no matter how port will not be allowed to pass traffic unless the NAS device gets an EAP-Success(Radius Accept) for the user.

  HTH

  Kind regards

  Prem

• dot1x fail loop

  Ciao,.

  I've isolated a stange case in dot1x Scenario:

  • IP phones are authenticate via MAB several areas (Cisco IP Phone 7962 Version: SCCP42.9 - 0-3)
  • Pass C3560-IPBASEK9-M ios Version 12.2 (55) SE1 and 12.2 (55) SE6
  • Cisco ACS 5.2

  Dot1x are activated on the phone and he try to authenticate using MIC. This OK

  ACS, has no Cisco MIC CA ROOT and then it does not authenticate the phone: OK that

  EAP - TLS failed SSL/TLS handshake because of unknown CA in the client certificate chain

  Now this process loop that I see on AUTHMGR:

  August 10 to 13:44:53: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000ED00367B2C

  PED-SW-TESTNAC-136 #.

  August 10 to 13:44:55: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000EE0036832B

  PED-SW-TESTNAC-136 #.

  August 10 to 13:44:57: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000EF00368B2A

  PED-SW-TESTNAC-136 #.

  August 10 to 13:44:59: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F000369318

  PED-SW-TESTNAC-136 #.

  August 10 13:45:02: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F100369B0E

  PED-SW-TESTNAC-136 #.

  August 10 13:45:04: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F20036A2F4

  PED-SW-TESTNAC-136 #.

  August 10 13:45:06: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F30036AAEA

  PED-SW-TESTNAC-136 #.

  August 10 13:45:08: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F40036B2F2

  PED-SW-TESTNAC-136 #.

  August 10 13:45:10: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F50036BAF9

  PED-SW-TESTNAC-136 #.

  August 10 13:45:12: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F60036C2E7

  PED-SW-TESTNAC-136 #.

  August 10 13:45:14: % AUTHMGR-5-START: start "dot1x' for the client (0817.35d5.94db) on the Interface Fa0/2 AuditSessionID C0A8A888000000F70036CAE6

  No comments or MAB VLAN are deployed... It isn't okay

  Port configuration:

  interface FastEthernet0/2

  HIGH DRY MODE description

  switchport access vlan 117

  switchport mode access

  switchport voice vlan 417

  priority queue

  authentication event failure action allow vlan 195

  action of death event authentication server allow vlan 117

  no response from the authentication event action allow vlan 195

  multi-domain of host-mode authentication

  Auto control of the port of authentication

  restrict the authentication violation

  MAB

  MLS qos trust device cisco-phone

  MLS qos trust dscp

  dot1x EAP authenticator

  dot1x tx-time 10

  spanning tree portfast

  end

  I'm trying to authenticate with MIC. It works

  I modified the Decree mab dot1x authentication that works

  But is there a method to avoid it? Why the phone does not stop after 3 attempts?

  Grazie a tutti,

  Iarno

  Hello

  This may be the show hit you:

  MAB starts immediately after a failure of IEEE 802. 1 X, there are no problems of timing. However, to trigger the MAB, the endpoint must send a packet after the failure of the IEEE 802. 1 X. In other words, begging him to IEEE 802. 1 X on the endpoint should fail open.

  It is at the beginning of the guide that you posted before.

  Sent by Cisco Support technique iPad App

• "The initiallization SSL during connection failed." Error

  Hello:

  We just to install a global certificate in our server VMware View connection and now remote ThinApp VMware clients and web clients do not work.  With ThinApp, successfully view customer, he meets with the connection to the server and authenticates the user, but when he tries to establish a tunnel connection, it fails with the error "authentication failure of the server to connect to the view.  Initialization of SSL when connecting to the server ""https://a.b.c:443' failed. " "

  Is certainly not a problem to solve.  When the name cannot be resolved by the customer, the error message reads "the view connection server authentication failed.  The server name "http://a.b.c:443' could not be resolved..." »

  I also confirmed this with packet sniffing.  The client opens a connection on port 443 on the server view connection and then appears to reject the certificate of the server.  (A TLS notify and close alert is sent by the client.)  When you connect for authentication instead of establishing the tunnel, there is no problem.

  I wonder if the fact that the certificate is a certificate with wildcards may contribute to this question.  For example the portion of tunnel of the customer have been written using another SSL/TLS library as part maybe authentication would result questions.

  The most confusing part of this question, is that ThinApp client is agree with the certificate on the local network (these are different machines).

  Any other advice would be appreciated.

  Thank you!

  Update: in the application logs customer, the tracking error.

  SSL: ClientHandshake: InitializeSecurityContext FAILED, Error 0 x 80090308 (the token supplied to the function is invalid).

  The exact same ThinApped View Client does not generate this message on the machines on the local network.  Unfortunately, I can't try to attach a remote computer to the local network to test because of politics.

  Post edited by: njlaw

  Not sure if this will help or not, but I thought I'd throw it out there.   About two months ago, I was working with a customer who had some strange issues SSL conecting in our view eviroment.   They were running a proxy server, so we focused on it and after a few days, I opened a ticket of VMware.   Very quickly, I received a temporary customer who solved the problem of our customers.  When I asked for more details it gave me the info below.  If you use a proxy, this could be it.  My SR number has been 1524766561 if you need to reference it.

  "The problem occurs when a given frame of"token"or SSL data exceeds the size of a single TCP read, which requires so a second reading to complete the token. What causes the second reading data to replace the first reading, rather than add. When this happens, the Windows Client to view SSL handshake failure reports.

  This problem may also occur if you use your own server certificate SSL has Extended Validation (which makes the bigger than the VMware View supplied self-signed certificate certificate) and go through a proxy server (which may change the TCP characteristics like the size packages). »

  If you have found this device or any other useful post please consider the use of buttons useful/correct to award points

• slow iMac

  at the start of Apple is on the screen but stops wheel spinning - booted in safe mode - audited readers (ok) reinstalled OSX - restored from time machine

  currently in safe mode - still have the same issues.

  EtreCheck version: 2.9.12 (265)
  Report generated 2016-06-18 15:27:47
  Download https://etrecheck.com EtreCheck
  Duration 25: 42
  Performance: poor

  Click the [Support] links to help with non-Apple products.
  Click the [details] links for more information on this line.

  Problem: The computer is too slow

  Hardware information: ⓘ
  iMac (27 inch, mid 2011)
  [Technical details] - [User Guide] - [warranty & Service]
  iMac - model: iMac12, 2
  1 3.1 GHz Intel Core i5 CPU: 4 strands
  4 GB OF RAM
  BANK 0/DIMM0
  OK 2 GB DDR3 1333 MHz
  BANK 1/DIMM0
  OK 2 GB DDR3 1333 MHz
  0/DIMM1 BANK
  Vacuum
  BANK 1/DIMM1
  Vacuum
  Bluetooth: Old - transfer/Airdrop2 not supported
  Wireless: unknown
  Video information: ⓘ
  AMD Radeon HD 6970M - VRAM: 1024 MB
  iMac 2560 x 1440

  System software: ⓘ
  OS X Lion mountain 10.8.5 (12F2560) - since the start time: about 2 hours

  Disk information: ⓘ
  WDC WD1001FALS-403AA0 disk0: (1 TB) (rotation)
  < not mounted > (disk0s1) disk0s1: 210 MB
  Macintosh HD (disk0s2) /: 999,35 go-go (777,09 free)
  Recovery HD (disk0s3) < not mounted > [recovery]: 650 MB

  OPTIARC DVD RW AD - 5690H)

  USB information: ⓘ
  Apple Inc. FaceTime HD camera (built-in)
  PNY Technologies USB 2.0 FD 16.36 GB
  Untitled (disk1s1) < not mounted >: 16.36 GB
  Harman/kardon SoundSticks
  Apple Inc. BRCM2046 hub.
  Apple Inc. Bluetooth USB host controller.
  Apple internal memory card reader
  Computer, Inc. Apple IR receiver.

  Information crush: ⓘ
  Apple Inc. Thunderbolt_bus.

  Goalkeeper: ⓘ
  Mac App Store and identified developers

  Kernel Extensions: ⓘ
  / System/Library/Extensions
  jp.co.Canon.bj.print.BJSBP2DriverKext [no charge] (1.5.0 - 2016-06-18) [Support]

  Launch system officers: ⓘ
  com.apple.AirPlayUIAgent.plist [failure]
  com.Apple.CoreServices.appleid.authentication.plist [failure]
  [loaded] 4 tasks Apple
  [loading] 118 tasks Apple
  [operation] 20 tasks Apple

  Demons of launch system: ⓘ
  com.Apple.findmymac.plist [failure]
  [loaded] 54 tasks Apple
  [loading] 134 tasks Apple
  [operation] 46 tasks Apple

  Launch officers: ⓘ
  [no charge] com.adobe.AAM.Updater - 1.0.plist (2012-03-16) [Support]
  com.Epson.esua.Launcher.plist [no charge] (2016-03-28) [Support]
  com.Google.keystone.agent.plist [no charge] (2016-03-03) [Support]
  [no charge] com.oracle.java.Java - Updater.plist (2013-09-23) [Support]
  com.Trusteer.rapport.rapportd.plist [no charge] (2016-03-19) [Support]

  Launch of the demons: ⓘ
  com.Adobe.fpsaud.plist [no charge] (2016-05-09) [Support]
  com.Google.keystone.daemon.plist [no charge] (2016-03-03) [Support]
  [no charge] com.oracle.java.Helper - Tool.plist (2013-09-23) [Support]
  com.Trusteer.rooks.rooksd.plist [no charge] (2016-03-19) [Support]
  net.sourceforge.MonolingualHelper.plist [no charge] (07 / 07/2014) [Support]

  Launch User Agents: ⓘ
  [no charge] com.adobe.AAM.Updater - 1.0.plist (2012-03-16) [Support]
  com.adobe.ARM [no charge]. [...]. plist (2015-12-08) [Support]
  com.Akamai.single - user - client.plist [no charge] (2015-09-23) [Support]
  com.apple.AddressBook.ScheduledSync.PHXC... plist [no charge]
  [no charge] com.apple.CSConfigDotMacCert-[...] @me.com - SharedServices.Agent.plist

  User login items: ⓘ
  Application of database Microsoft Daemon (/ Applications/Microsoft Office 2008 / Office/Microsoft Database Daemon.app)
  TomTomHOMERunner hidden Application (~/Library/Application Support/TomTom HOME/TomTomHOMERunner.app)
  Dropbox application (/ Applications/Dropbox.app)
  ElementsOrganizerSyncAgent Application (/ Applications/Adobe Photoshop elements 10/Adobe elements 10 Organizer.app/Contents/MacOS/ElementsOrganizerSyncAgent.app)
  EpsonLowInkReminderAgent Application (/ Applications/Software Epson Epson Ink Low Reminder.app/Contents/EpsonLowInkReminderAgent.app)

  Other applications: ⓘ
  [performance]    [0 x 0-0 x 45045].org.mozilla.firefox
  [performance]    [0 x 0-0 x 59059].com.etresoft.EtreCheck
  [loading] 370 tasks Apple
  [operation] 97 tasks Apple

  Internet Plug-ins: ⓘ
  Flip4Mac WMV Plugin: 3.1.0.24 - SDK 10.8 (2013-03-11) [Support]
  FlashPlayer - 10.6: 21.0.0.242 - SDK 10.6 (2016-05-24) [Support]
  EPPEX plugin: 4.1.0.0 (2011-07-26) [Support]
  AdobePDFViewerNPAPI: 11.0.13 - SDK 10.6 (2015-12-08) [Support]
  AdobePDFViewer: version 9.0.0 (2016-01-04) [Support]
  Flash Player: 21.0.0.242 - SDK 10.6 (2016-05-24) obsolete! Update
  JavaAppletPlugin: Java 8 update 91 build 14 version Check (2016-06-09)
  OfficeLiveBrowserPlugin: 12.3.6 (2013-03-25) [Support]
  QuickTime Plugin: 7.7.1 (2016-02-08)
  Silverlight: 4.0.60831.0 (07 / 07/2014) [Support]
  iPhotoPhotocast: 7.0 (2010-04-26)

  3rd party preference panes: ⓘ
  Akamai NetSession preferences (2015-09-23) [Support]
  Flash Player (2016-05-09) [Support]
  Flip4Mac WMV (2013-01-09) [Support]
  Java (2016-04-30) [Support]
  Trusteer Endpoint Protection (2016-04-20) [Support]

  Time Machine: ⓘ
  Skip system files: No.
  Mobile backups: OFF
  Automatic backup: YES
  Volumes to back up:
  Macintosh HD: Disc size: 999,35 GB disc used: 222,25 GB
  Destinations:
  [Network] data
  Total size: 2.00 TB
  Total number of backups: 217
  An older backup: 02/07/12 20:14
  Last backup: 11/06/16 13:50
  Size of backup drive: adequate
  Size of backup 2.00 TB > (disc 222,25 GB X 3)

  Top of page process CPU: ⓘ
  55% ScreenSaverEngine
  8% mdworker
  PS 1%
  1% fontd
  0% WindowServer

  Top of the process of memory: ⓘ
  Firefox 373 MB
  CalendarAgent 147 MB
  ScreenSaverEngine 127 MB
  WindowServer 74 MB
  Finder of 74 MB

  Information about virtual memory: ⓘ
  31 MB of free RAM
  3.97 GB used RAM
  401 MB used Swap

  Diagnostic information: ⓘ
  June 18, 2016, 14:44:35 /Library/Logs/DiagnosticReports/firefox_2016-06-18-144435_[redacted].hang
  /Applications/Firefox.app/Contents/MacOS/Firefox
  June 18, 2016, 14:09:34 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-140934_[redact ed] .crash
  System/Library/CoreServices/Dock.app/Contents/XPCServices/com. Apple.Dock.extra.xpc/Contents/MacOS/com.apple.dock.extra
  June 18, 2016, 13:28:21 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-132821_[redact ed] .crash
  June 18, 2016, 13:19:19 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-131919_[redact ed] .crash
  June 18, 2016, 13:17:10 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-131710_[redact ed] .crash
  June 18, 2016, 13:16:37 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-131637_[redact ed] .crash
  June 18, 2016, 13:16:29 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-131629_[redact ed] .crash
  June 18, 2016, 13:16:27 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-18-131627_[redact ed] .crash
  18 June 2016, 12:39:04 self-test - spent
  June 17, 2016, 23:44:23 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-234423_[redact ed] .crash
  June 17, 2016, 21:14:21 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-211421_[redact ed] .crash
  June 17, 2016, 21:04:46 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-210446_[redact ed] .crash
  June 17, 2016, 20:29:57 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-202957_[redact ed] .crash
  June 17, 2016, 20:19:56 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-201956_[redact ed] .crash
  June 17, 2016, 20:19:23 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-201923_[redact ed] .crash
  June 17, 2016, 20:19:15 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-201915_[redact ed] .crash
  June 17, 2016, 20:19:13 ~/Library/Logs/DiagnosticReports/com.apple.dock.extra_2016-06-17-201913_[redact ed] .crash

  Open the Console in utilities & see if there are clues in these Rerorts diagnosis.

  Especially, one of the Dock.