Cisco AnyConnect – Allow Domain Password Change via LDAP
KB ID 0001273 Problem If you have remote users who connect via VPN, and a policy that forces them to change their password periodically, this can result in them getting locked out without the ability to change their password (externally). If your Cisco ASA is using LDAP to authenticate your users, then you can use your remote AnyConnect VPN solution to let them reset their passwords remotely. Solution Standard LDAP runs over TCP...
Reset an AD Users Password Expiry Date
KB ID 0001272 Problem I was setting up a Cisco ASA this week and needed to enable the ability for users to reset their domain passwords when they are about to expire. To actually test that, I needed a test user that had their password either about to expire, or actually expired. As I dint want to wait 42 days, or setup a password policy just for one user, I needed to find a ‘quick and dirty’ fix for one user. Solution You...
Cisco – LDAP AAA Error ‘AAA Server has been removed”
KB ID 0001271 Problem Seen while attempting to test AAA authentication via LDAP to a Windows domain Controller. Authentication test to host {IP-Address} failed. Following error occurred – ERROR: Authentication Server not responding: AAA Server has been removed Solution This is a terribly ambiguous error! What it means is that the ASA cannot bind to active directory, either because; The ASA bind account password is wrong. The...
Cisco Licence Differences LAN-Lite / LAN Base / IP Base / IP Services
KB ID 0001270 Problem Actually finding the answer to this question is far more challenging than it needs to be! As usual Cisco can change this on a whim so before you purchase any equipment it’s still a good policy to check on the feature navigator. Solution This is about the best reference I’ve found. Although anyone who can tell me what the correct Layer 2 differences between Enterprise Access and Complete Access are,...
Managing IE Settings via GPO
KB ID 0001269 Problem There used to be a GPO called “Internet Explorer Maintenance” that you could set your Internet Explorer settings, i.e. Proxy server settings, home pages etc. This has now gone, and has been replaced with a group policy preference. Solution From the Group Policy Management Console > Locate the OU containing the USERS you want to link the policy to and create a new policy, then give it a sensible...