nerdexam
Cisco

300-730 · Question #198

A network administrator is setting up a Cisco ASA to authenticate clientless SSLVPN users using an internal Microsoft Active Directory server. When the configuration is complete and the…

The correct answer is D. Correct the login distinguished name or login password under the aaa-server configuration. Cisco ASA LDAP authentication to Active Directory fails when the aaa-server bind credentials (login DN or password) are incorrectly configured.

Troubleshooting VPNs

Question

A network administrator is setting up a Cisco ASA to authenticate clientless SSLVPN users using an internal Microsoft Active Directory server. When the configuration is complete and the administrator attempts to connect to the clientless SSLVPN, authentication fails. Which action resolves the issue?

Options

  • AAdd the user account the administrator is attempting to log in with to the database.
  • BThe administrator must use the correct password for the user account they are attempting to log in with.
  • CConfigure the ASA to connect to the LDAP port being listened to on the Microsoft Active Directory server.
  • DCorrect the login distinguished name or login password under the aaa-server configuration.

How the community answered

(20 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    10% (2)
  • D
    80% (16)

Why each option

Cisco ASA LDAP authentication to Active Directory fails when the aaa-server bind credentials (login DN or password) are incorrectly configured.

AAdd the user account the administrator is attempting to log in with to the database.

Adding a user to the local ASA database only affects local authentication, not LDAP-based Active Directory authentication.

BThe administrator must use the correct password for the user account they are attempting to log in with.

Using the correct end-user password does not resolve a server-side bind failure caused by misconfigured aaa-server credentials.

CConfigure the ASA to connect to the LDAP port being listened to on the Microsoft Active Directory server.

The LDAP port is a connection parameter, not an authentication credential; a port misconfiguration typically produces a connection error, not an authentication failure after configuration is complete.

DCorrect the login distinguished name or login password under the aaa-server configuration.Correct

The ASA uses a login distinguished name (DN) and password to bind to the Active Directory LDAP server before it can validate user credentials. If the login DN or bind password is incorrect, the ASA cannot establish the LDAP bind, causing all authentication attempts to fail regardless of valid user credentials.

Concept tested: Cisco ASA AAA server LDAP bind configuration

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98671-asa-vpn-ldap-config.html

Topics

#clientless SSL VPN#LDAP#Active Directory#aaa-server

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice