cisco ASA 5505 and SBS 2003

[workhardplayharder]

I have two cisco asa firewalls bridging a satelite office to the main facility. This has been up and running for around three years now. Recently the domain controller (SBS2003) went up in smoke, literally. long story short, i have setup a new pc with sbs2003 from scratch. used the old domain controllers name and ip address but changed the domain name. my network bridge is still in tact, however no one can VPN into the system from home or on the road. I'm having some trouble getting the cisco box to play nice with radius or the other way around.

 

used a fake name and this is what showed up in event viewer

 

User monkey was denied access.

Fully-Qualified-User-Name = CATCOMTEC2\monkey

NAS-IP-Address = 192.168.0.5

NAS-Identifier =

Called-Station-Identifier = 206.248.24*.**

Calling-Station-Identifier = 206.248.24*.**

Client-Friendly-Name = asa

Client-IP-Address = 192.168.0.5

NAS-Port-Type = Virtual

NAS-Port = 26

Proxy-Policy-Name = Use Windows authentication for all users

Authentication-Provider = Windows

Authentication-Server =

Policy-Name =

Authentication-Type = PAP

EAP-Type =

Reason-Code = 16

Reason = Authentication was not successful because an unknown user name or incorrect password was used.

 

used a real account below and see the difference

User cworsham was denied access.

Fully-Qualified-User-Name = catcomtec2/Users/Chris

NAS-IP-Address = 192.168.0.5

NAS-Identifier =

Called-Station-Identifier = 206.248.24*.**

Calling-Station-Identifier = 206.248.24*.**

Client-Friendly-Name = asa

Client-IP-Address = 192.168.0.5

NAS-Port-Type = Virtual

NAS-Port = 26

Proxy-Policy-Name = Use Windows authentication for all users

Authentication-Provider = Windows

Authentication-Server =

Policy-Name = cctivpn

Authentication-Type = PAP

EAP-Type =

Reason-Code = 66

Reason = The user attempted to use an authentication method that is not enabled on the matching remote access policy.

 

any insights as to the difference in the Fully qualified user name, the errors thrown. why is my authentication server showing as undetermined? please help, i've got to get this back up quick!

[SYNACK]

If you changed the domain name this could be causing a few of your problems, a fully qualified domain name will include the domain name ie. domain.local\user1 so any old usernames or setups to automaticly append domain names to logons will need to be changed. Were you able to migrate the users to the new domain or are their computers still setup to point to the old domain. You would need to rejoin each workstation to the new domain so that they appear in AD and point to the appropriate domain for authentication.

 

How much of the old system were you able to restore from backups?

[workhardplayharder]

Nothing from the old domain was salvagable. Started from scratch. Moved all in house pcs to new domain. Having issues with vpn in from home or the road.