How to Create a Certificate Authority with Windows Server 2008 R2 DC

Logon to the DC...

Add New Role -> Next
Select Active Directory Certificate Services -> Next
Select Certificate Authority -> Next
Select Enterprise -> Next

Select Root CA -> Next
Create a new private key -> Next
Left deafults (RSA#Microsoft Software Key Storage Provider, 2048, SHA1) -> Next
Name Common name for the CA can't be the same as the FQDN -> Next
Leave it set to 5 years  -> Next -> Next -> Install
Open a command prompt with Admin Access (Right click "Run As Administrator")
Type MMC, press Enter
File Add/Remove Snap-ins
Select Certificates -> Click Add -> Select Computer Account -> Click Next -> Local Computer -> Finish
Click Ok

Navigate to Console root -> Certificates (Local Computer) -> Personal -> Certificates -> Right Click in right window
Right Click All Tasks -> Request New Certificate
Click Next -> Select Active Directory Enrollment Policy -> Click Next
Check Domain Controller & Domain Controller Authentication -> Click Enroll

Source: Link

To confirm that LDAP over SSL is configured successfully

1. Open the Ldp snap-in. To open Ldp, click Start. In Start Search, type ldp. Right-click the Ldp icon on the Start menu, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.
   
2. Click the Ldp Connection menu, and then click Connect. In Server, type the host name (FQDN) of the server to which you want to connect. Ensure that Port is set to 636, the Connectionless check box is cleared, and the SSL check box is selected, and then click OK. If you receive a message that says “Cannot open connection,” LDAP-over-SSL binding is not configured properly.
   
3. Click the Connection menu, click Bind, and then click OK.
   
4. The command output should display the user name and domain name that you used for binding, if LDAP over SSL is configured properly.
   

Source:  Link

Problems with ASA5505 LDAP authentication. Error: Unable to remove PeerTblEntry, Removing peer from peer table failed, no match!

I ran into some problems when trying to authenticate to my Active Directory Server.  The problem was with the crypto.  I wanted to use AES 256, but I was getting error messages.  ASDM told me "Unable to contact the server or ip address".  The two messages the ASDM log were:

Error: Unable to remove PeerTblEntry
Removing peer from peer table failed, no match!

Here is what was in my show running config.

crypto isakmp policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 10

Everything was configured correctly according to documentation.  But after spending a while searching google a user named zx10guy explained the problem.

I suggest you go through the ASDM VPN wizard. It makes it really easy to set things up. I'm going to assume you're going to use the highest level of encryption possible which would be settings like AES 256, SHA-1, etc. One word of warning. I don't think Cisco has fixed this issue yet. But when you select the Diffie Helmen Group number, you'll have a choice of 1 up to 7. Do not select anything higher than 2. The wizard is going to bark at you about not using a stronger group number. But this is incorrect. The Cisco VPN client only supports DH Group 2 as the highest. If you select anything higher in the wizard, you'll never get the tunnel to come up and the error messages you'll get won't point you to this. I figured it out through lots of pain, trial and error, and cursing.

Other things you'll need to set up are the remote client IP pools and the user accounts for authentication. The IP pools get assigned when the connection is made. The IP pool addresses are what the remote client will be assigned on your local network. I would suggest using a set of privates which are NOT in your current subnet range. This will help in troubleshooting and provides some segregation. You need to make sure either the ASA is your default gateway as it will be the only device which knows how to route traffic back to the remote client or you can set up a static route rule on your current default gateway to point to the ASA to reach the remote clients.

You can set up the ASA to have a list of users which can then be assigned to specific VPN policy groups for authentication. With the number of users you're talking about, I think this is the best way and easiest. For my corporate network, I was able to tie in the PIX 515 to use our Active Directory server for user authentication. Took some doing but I got it to work.

Other than that, you should create a PCF file which is the connection profile file used by the Cisco VPN client. You need to enter the hostname or IP address of the public registered to the ASA or the device which will forward the traffic to it. The group policy name you created in the wizard gets entered here. Also the preshared key you used to set up the group policy for initial Phase 1 negotiation would also be entered here. Once you create the PCF file in the VPN client, you can then copy the PCF file and distribute it to other users. The preshared key is hashed in the file so you won't be able to read in plain text.

I know there are problem some details I've left out, but this should get you started.

Source:  Link

Now what we learned from this was that the IPSec client doesn't like any group numbers higher then 2.  So I changed my configuration to this.

crypto isakmp policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2

Now I am able to contact the server successfully while testing the AAA authentication!

How to configure LDAP access for an ASA 5505

Assumptions:

• ASDM is already installed
• You know the password to the ASA

Launch ASDM and select Configuration from the top bar.  On the left hand bard, select Remote Access VPN.  You then should see a heading that says AAA/Local Users. After clicking the + sign, select AAA Server Groups.  You should now see an add button on the right hand side of the screen.  Click add and make up a name for the server group.  This can be anything.  Also set the settings below.

Reactivation Mode: Depletion
Dead Time: 10 Minutes (this was the default setting)
Max Failed Attempts: 3 (this was the default setting)

Click Ok.  You should now see that in the AAA Server Group box at the top of the page.   Highlight the newly created group and click add button beside the servers in the selected group box.  This is what it should be set to:


Interface Name: Inside
Servername or IP Address: Your active directory server IP
Timeout: 10 seconds
Enable LDAP over SSL: Unchecked (this is up to your current setup)
Server Port: 389
Server Type: Microsoft
Base DN: dc=example,dc=com (see note below on how to find this and your user name)
Naming Attribute(s): sAMAccountName
Login DN: CN=John Doe,OU=Custom Users,DC=example,dc=com
Login Password:  Type the password to the user
LDAP Attribute Map: None

Everything else was just left as default.  Click ok, then click apply.  Highlight the server IP in the box and click the test button.  You will see a box pop up.  You will want to choose the Authentication button and type your active directory username and password.  If everything is configured correctly, you should get a message saying "Authentication test to host ip is successful."

***Note:*** Now I had some problems when configuring this.  The first problem I felt deserved its own post.  It's here.

The second problem was getting the right syntax for the LDAP part of it.  You can refer to my post that talks about dsquery more in depth.  It could help you.  It is here.  The two commands that will help you the most are:

dsquery user (This lists every single user.  I only have maybe 20 users so if you have alot more then this, you can use some more specific switches to narrow it down).

dsquery computer (This will show you all the computers.  Same possible problem with dsquery user.  The big thing here is all you need is the dc part of the results).

Finding your base DN in Active Directory

I was trying to do an LDAP query against Active Directory and I was unable to get the query to work.  A good tool to use to troubleshoot this is ldp.exe.  It is installed by default on Windows Server 2008, but I believe its on the Windows Server 2003 disc, just not installed by default.  A typical base DN is DC=microsoft, DC=com.  I was using exactly the same logic and it still wasn't working.  I then found a tool called dsquery.

I was able to use dsquery on my 2008 server.  I haven't had a chance to see if runs on Server 2003.  This is how it can be used to help you.

Open a command prompt (Start->Run->cmd).


If you type "dsquery" (Link) you will get what is below: (I modified it a little bit and added Links)

Description: This tool's commands suite allow you to query the directory
according to specified criteria. Each of the following dsquery commands finds
objects of a specific object type, with the exception of dsquery *, which can
query for any type of object:

• Type "dsquery computer" - 
• finds computers in the directory.
• More Info: Link
• Type "dsquery contact" - 
• finds contacts in the directory.
• More Info: Link
• Type "dsquery subnet" - 
• finds subnets in the directory.
• More Info: Link
• Type "dsquery group" - 
• finds groups in the directory.
• More Info: Link
• Type "dsquery ou" - 
• finds organizational units in the directory.
• More Info: Link
• Type "dsquery site" - 
• finds sites in the directory.
• More Info: Link
• Type "dsquery server" - 
• finds AD DCs/LDS instances in the directory.
• More Info: Link
• Type "dsquery user" - 
• finds users in the directory.
• More Info: Link
• Type "dsquery quota" - 
• finds quota specifications in the directory.
• More Info: Link
• Type "dsquery partition" - 
• finds partitions in the directory.
• More Info: Link
• Type "dsquery *" - 
• finds any object in the directory by using a generic LDAP query.
• More Info: Link

For help on a specific command, type "dsquery <ObjectType> /?" where
<ObjectType> is one of the supported object types shown above.
For example, dsquery ou /?.

Remarks:
The dsquery commands help you find objects in the directory that match
a specified search criterion: the input to dsquery is a search criterion
and the output is a list of objects matching the search. To get the
properties of a specific object, use the dsget commands (dsget /?).

The results from a dsquery command can be piped as input to one of the other
directory service command-line tools, such as dsmod, dsget, dsrm or dsmove.

Commas that are not used as separators in distinguished names must be
escaped with the backslash ("\") character
(for example, "CN=Company\, Inc.,CN=Users,DC=microsoft,DC=com").

Backslashes used in distinguished names must be escaped with a backslash
(for example,
"CN=Sales\\ Latin America,OU=Distribution Lists,DC=microsoft,DC=com").

Examples:
To find all computers that have been inactive for the last four weeks and
remove them from the directory:

    dsquery computer -inactive 4 | dsrm

To find all users in the organizational unit
"ou=Marketing,dc=microsoft,dc=com" and add them to the Marketing Staff group:

    dsquery user ou=Marketing,dc=microsoft,dc=com |    dsmod group
        "cn=Marketing Staff,ou=Marketing,dc=microsoft,dc=com" -addmbr

To find all users with names starting with "John" and display his office
number:

    dsquery user -name John* | dsget user -office

To display an arbitrary set of attributes of any given object in the
directory use the dsquery * command. For example, to display the
sAMAccountName, userPrincipalName and department attributes of the object
whose DN is ou=Test,dc=microsoft,dc=com:

    dsquery * ou=Test,dc=microsoft,dc=com -scope base
    -attr sAMAccountName userPrincipalName department

To read all attributes of the object whose DN is ou=Test,dc=microsoft,dc=com:

    dsquery * ou=Test,dc=microsoft,dc=com -scope base -attr *

Directory Service command-line tools help:
dsadd /? - help for adding objects.
dsget /? - help for displaying objects.
dsmod /? - help for modifying objects.
dsmove /? - help for moving objects.
dsquery /? - help for finding objects matching search criteria.
dsrm /? - help for deleting objects.

------

Hopefully this helped you like it helped me!

UPDATED:  Need to add the full config because we missed 2 things, but here is a page I wanted to link to because it talks about how to deny users by using LDAP.

Link