IC with AD

[angel.hernandez_]

Hi everyone,

I'm trying to add an AD authentication server in a IC6500 4.1R6

I'm getting:

Error while joining domain CNBYV. Possible causes:
- The specified administrator credentials do not properly authenticate.
- The specified domain or domain controller may not be valid.
Also, the device's clock must be in sync with the Active Directory server.

and I now my AD account works because I just added a PC to the domain...

Any ideas?

Thanks

[Raveen_]

Hi,

What is the server OS that you are using as DC?

Could you check the following?

1. The specified administrator credentialshave sufficient previlleges.

2. Ensure that you have added NETBIOS name of the DC

3. IC and DC are in time synch

If all the above are correct, please do the following,

1. Check if IC-name is present under Computer object of DC.

2. Verify if group Catalog is working fine for you

- Navigate to User realm

- Try adding Role mapping based on group membership

- Search if you can see all the AD groups.

If group mapping and user authentication works, you may ignore the error message.

Regards,

Raveen

Note: You could mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!!

[Raveen_]

Hi,

If the server that you are using is 2008, you need to configure GPO to allow NT4 crypto and also allow NTLM responses.

Reference: KB16216, KB16105

Regards,

Raveen

Note: You could mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!!

[Winston_]

If you tried all the above steps and still it is not working; Just try sync the time again and restart the IC-6500. It has worked for me most of the time.

regards

Winston

[angel.hernandez_]

Thanks for your replies !!! I'll try your recommendations this afternoon and get back to you. Thanks again

[angel.hernandez_]

Sorry about the delay in this update...

Turns out I was trying to add an AD 2008 R2 as an authentication server, several things I've learned since then... one of them is you can't do that... at least not without the new IC realese (coming soon) scheduled for end of March 2012.

I finally add the underlying LDAP server as an authentication server, I still have all the benefits including the role mapping rules.

Noticed that I have to follow your recommendetions (time synch, admin account) even for the LDAP.

Tricky part was to set the right filters and DN strings.

Regards and thanks for your help.

[Fahad_khan_]

Hi angel,

Did you finally able to integrate the IC with 2008R2 ? can you please let me know the steps in detail??

Thanks in advance

regards,

[Raveen_]

Full fledged support of windows 2008R2 is available from IC 4.2 which is likely to be avialable in couple of weeks.

Regards,

Raveen

[Raveen_]

IC version 4.2R1 is officially available for download at Juiper support page.

http://www.juniper.net/support/products/uac/4.2/#sw

Regards,

Raveen