Cannot connect to Active Directory after upgrade

[meh_]

I've upgraded our SA2000 from 6.3R5 to 7.1R3 and now I cannot authenticate against Active Directory as the primary authentication server. The message in the logs is:

Info	AUT23457	2011-07-28 15:52:16 - ive - [101.169.39.78] xxxxxx (SMS Token)[] - Login failed using auth server Test_AD (Samba). Reason: ConnectError
Info	AUT24327	2011-07-28 15:52:16 - ive - [101.169.39.78] xxxx (SMS Token)[] - Primary authentication failed for xxxx/xxxx from xxxxx

_

All was working fine prior to the upgrade. Your urgent assistance would be greatly appreciated.

Thanks

[VVJ_]

A ConnectError normally indicates an issue with the network connectivity. Under the Auth Servers > (Your AD server instance), you have an option to "Test Configuration". Do you see any errors when you click this button?

[meh_]

When I do a Test Connectivity, it just sits there for a couple minutes thinking about it, then nothing happens. No confirmation whether it was successful or not.

I can confirm it's not a connectivity issue, as like I said, it was working perfectly before the upgrade. What would have changed as a result of the upgrade?

[zanyterp_]

The server catalog could have undergone failure/corruption.

If you try to pull up groups on the realm, what happens (doing a new search)?
Does LDAP work (which is just better overall; there are some instances where it is not ideal, but this is rare)?
What does your TCP dump on the internal port show?

[quartino_]

Same error, Any news about this case?

[zanyterp_]

The only items we have seen are when there is somet type of communication error with AD (e.g. security settings do not allow IVE to auth, network interference unexpectedly, latency in communication on the backend).

What IVE OS version are you using?

[meh_]

It can't be latency or a security issue with anything external to the IVE, because it used to work prior to the upgrade.

Any way, I got it work by changing two things:

* I selected all three settings, Kerberos, NTLMv2 and NTLMv1. Previously I just had Kerberos.

* Instead of specifying the kerberos realm, I select the option to seach LDAP for the Kerboros realm.

My test connectivity still fails but everything is working as it should, so I'm happy.

Frustrates the hell out of me everytime Juniper releases an update to the IVE something always breaks.

[zanyterp_]

Thank you for sharing the resolution; I am sorry to hear about the frustration you experience with upgrades and that what we have seen for the ConnectError here is not what you are seeing. You are the first person I have come across who has used the option to specify the Kerberos realm (and successfully); it is possible there is a failure in that section of the configuration.