 Feedback
|
Table Of Contents
Release Notes for the Cisco Active Directory Agent, Release 1.0
Active Directory Agent Requirements
Active Directory Agent License Information
Installing the Active Directory Agent Software Release 1.0.0.32
Resolved Caveats in Cisco Active Directory Agent Release 1.0.0.32.1
Open Caveat in Cisco Active Directory Agent Release 1.0.0.32.1
Open Caveats in Cisco Active Directory Agent Release 1.0.0.32
Release-Specific Documentation
Obtaining Documentation and Submitting a Service Request
Release Notes for the Cisco Active Directory Agent, Release 1.0
Revised: April 13, 2012, OL-25136-01Contents
These release notes describe the role of the Cisco Active Directory Agent in an identity-based solution, its limitations and restrictions (caveats), and related information. These release notes supplement the Cisco Active Directory Agent documentation that is included with the software, and cover the following topics:
•
Active Directory Agent Requirements
•
•
Introduction
The Cisco Active Directory Agent (AD Agent) is a component that runs on a Windows machine; monitors in real time a collection of Active Directory domain controller (DC) machines for authentication-related events that generally indicate user logins; learns, analyzes, and caches mappings of IP addresses and user identities in its database; and makes the latest mappings available to its client devices.
Client devices, such as the Cisco Adaptive Security Appliance (ASA) and the Cisco IronPort Web Security Appliance (WSA), interact with the AD Agent using the RADIUS protocol in order to obtain the latest set of IP-to-user-identity mappings, in any one of the following ways:
•
•
The AD Agent interacts with the following components in a network:
•
•
•
The AD Agent can support up to 100 client devices and 30 domain controller machines, and can internally cache up to 64,000 IP-to-user-identity mappings.
Active Directory Agent Requirements
See the Installation and Setup Guide for the Active Directory Agent, Release 1.0 for information on the Active Directory Agent Requirements.
Active Directory Agent License Information
See the Open Source Used in Cisco Active Directory Agent 1.0 document for the Active Directory Agent licence information,
Important Notes
For the Active Directory Agent to function properly in an identity-based solution, you must ensure that:
•
/ibf10_install.html#wp1059852 for more information.•
/ibf10_install.html#wp1060909 for more information.•
/ibf10_install.html#wp1062461 for more information.•
/ibf/setup_guide/ibf10_install.html#wp1060694 for more information.•
Installing the Active Directory Agent Software Release 1.0.0.32
See the Installation and Setup Guide for the Active Directory Agent, Release 1.0 for information on how to install and configure the Active Directory Agent.
Upgrading the Active Directory Agent Software Release 1.0.0.32 to Active Directory Agent Software Release 1.0.0.32.1
To upgrade the Active Directory Agent Software Release 1.0.0.32 (build 539) to Active Directory Agent Software Release 1.0.0.32.1 (build 598), complete the following steps:
Step 1
Step 2
Note
See the Installation and Setup Guide for the Active Directory Agent, Release 1.0 for information on how to install and configure the Active Directory Agent.
Caveats
This section contains the lists of:
•
•
•
Resolved Caveats in Cisco Active Directory Agent Release 1.0.0.32.1
Table 1 Resolved Caveats in Active Directory Agent Release 1.0.0.32.1
CSCto69094
DC name shown for the adacfg cache list command is not similar to the domain name given for the adacfg dc create command.
CSCtq45780
When installing the AD Agent directly on domain controller, the AD Agent cannot monitor domain controllers in other trusted domains.
Due to the resolution of this bug, the following requirement mentioned in the Active Directory Requirements section of the Installation and Setup Guide for the Active Directory Agent, Release 1.0, is no more valid:
Before you configure even a single domain controller machine using the adacfg dc create command, ensure that the AD Agent machine is first joined to a domain (for example, domain J) that has a trust relationship with each and every domain (for example, domain D[i]) that it will monitor for user authentications (through the domain controller machines that you will be configuring on the AD Agent machine).
CSCtq54889
AD agent crashs with two or more ASAs when requesting multiple requests.
CSCtr77801
Support detection of mappings from DC running French 2008R2-SP1.
Open Caveat in Cisco Active Directory Agent Release 1.0.0.32.1
Open Caveats in Cisco Active Directory Agent Release 1.0.0.32
Table 3 Open Caveats in Active Directory Agent Release 1.0.0.32
CSCti71996
Symptom When a user logs into a machine, it may happen that two events are written to the controller's event log instead of a single event. As a result, two events are forwarded to the AD Agent. On rare occasions, the second event has a later timestamp (one second later) and the AD Agent sends two updates to the registered client devices regarding this login event.
Workaround
CSCto34206
Symptom On Windows 2008 R2 machines, some events are not written in their Security Log and are missing.
Conditions
Workaround
CSCto86228
Symptom The WMI Service on the domain controller machine halts operation, and the AD Agent reports the status of the domain controller machine as "down(no-retry)."
Conditions
Workaround
CSCtq45780
Symptom When installing the AD Agent directly on domain controller, the AD Agent cannot monitor domain controllers in other trusted domains.
Conditions
Workaround
CSCtr90042
Symptom AD Agent does not accept domain names that do not contain the character "." (dot) in them.
Conditions
Error: Parameter '-domain' value 'wga' is not full DNS name of AD domain! For further syntax information use: 'adacfg help dc'Workaround
The following Microsoft links provide further information:
•
http://support.microsoft.com/kb/909264
•
Documentation Updates
Table 4 Updates to Release Notes for the Cisco Active Directory Agent, Release 1.0
4/9/2012
Added the following sections:
•
•
Sep 27, 2011
Resolved CSCtr90042
June 13, 2011
Cisco Active Directory Agent, Release 1.0
Related Documentation
Release-Specific Documentation
Table 5 lists the product documentation available for the AD Agent, Release 1.0.
Table 5 Product Documentation for the Active Directory Agent
Installation and Setup Guide for the Cisco Active Directory Agent, Release 1.0
http://www.cisco.com/en/US/docs/security/ibf/setup_guide/ad_agent_setup_guide.html
Release Notes for the Cisco Active Directory Agent, Release 1.0
http://www.cisco.com/en/US/docs/security/ibf/release_notes/ibf10_rn.html
Open Source Used in Cisco Active Directory Agent 1.0
http://www.cisco.com/en/US/docs/security/ibf/open_source_license_document/ipcentral.pdf
Other Related Documentation
Links to Adaptive Security Appliance (ASA) 5500 Series Release 8.4.2 documentation and Ironport Web Security Appliance (WSA) documentation are available on Cisco.com at the following locations:
•
http://www.cisco.com/en/US/products/ps6120/tsd_products_support_series_home.html
•
http://www.cisco.com/en/US/products/ps10155/tsd_products_support_series_home.html
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2011 Cisco Systems, Inc. All rights reserved.
