I just upgraded to the newest version of ASA code in the 9.12 train:
28lbasa01# sh version | in asa
System image file is "disk0:/asa9-12-4-18-smp-k8.bin"
The session id is actually pulled by this attribute:
Radius:Cisco Cisco-AVPair = %{Radius:Cisco:Cisco-AVPair}
When I run a manual CoA you can see the session id as audit-session-id
On the firewall I see these messages:
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Received RAD_DISCONNECT_REQUEST
No audit-session-id
CoA message from 10.10.201.61 is malformed or cannot be validated.
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Received RAD_DISCONNECT_REQUEST
No audit-session-id
CoA message from 10.10.201.61 is malformed or cannot be validated.
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Received RAD_DISCONNECT_REQUEST
No audit-session-id
CoA message from 10.10.201.61 is malformed or cannot be validated.
This is the session ID from the tunnel on the firewall:
28lbasa01# sh vpn-sessiondb anyconnect | in Sess ID
Audt Sess ID : 0a0a010d0000100060676978
------------------------------
abraham
------------------------------
Original Message:
Sent: Apr 02, 2021 01:58 PM
From: Danny Jump
Subject: Radius CoA failing to ASA firewall
So a couple of things....
It looks like from some of the logs your sending a RADIUS DM, not a Dynamic Authorization {aka CoA} when you perform a manual action.
What version of ASA/CPPM are you running?
There should be in your CPPM an ASA Default CoA Template
I also think that you have to send the SessionId to ASA as part of the CoA request in addition to what you've noted above... I need to check into that...
------------------------------
Danny Jump
"Passionate about CPPM"
Original Message:
Sent: Apr 01, 2021 05:19 PM
From: ajamu abraham
Subject: Radius CoA failing to ASA firewall
I am having a hard time getting my Cisco ASA sslvpn working with Clearpass for authorization. The users can connect and authenticate via my radius service and a radius response is received with attribute filtet-id to assign the user to restrictive ACL only allowing access to DNS and clearpass server. They then do a posture assessment via OnGuard. The WEBAUTH policy is successful but the radius response is not reaching the firewall. Here are the attributes I was trying to send via the WEBAUTH service:
Radius:Cisco | Cisco-AVPair | %{Radius:Cisco:Cisco-AVPair}
Radius:IETF | Calling-Station-Id | %{Radius:IETF:Calling-Station-Id}
Radius:IETF | Filter-Id | allowall-ACL
I first I was not seeing any dynamic-authentication messages on the firewall until I change the device type from Cisco top Cisco-ASA. Once this was changed I started seeing this message:
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Received RAD_DISCONNECT_REQUEST
No audit-session-id
CoA message from 10.10.201.61 is malformed or cannot be validated.
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Received RAD_DISCONNECT_REQUEST
No audit-session-id
CoA message from 10.10.201.61 is malformed or cannot be validated.
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
When I look into the access tracker I cannot manual do a CoA:
But for some reason if I look for an older session I can issue a CoA but it does not disconnect successfully:
28lbasa01(config-tunnel-general)# coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Received RAD_DISCONNECT_REQUEST
RADIUS packet decode (Disconnect-Request)
--------------------------------------
Raw packet data (length = 92).....
28 ac 00 5c 9f b6 61 1b 86 74 ad 3d 51 8e 69 1d | (..\..a..t.=Q.i.
7a 4d 21 92 1a 31 00 00 00 09 01 2b 61 75 64 69 | zM!..1.....+audi
74 2d 73 65 73 73 69 6f 6e 2d 69 64 3d 30 61 30 | t-session-id=0a0
61 30 31 30 64 30 30 30 34 34 30 30 30 36 30 36 | a010d00044000606
36 33 35 39 39 06 06 00 00 00 01 1f 11 31 37 34 | 63599........174
2e 31 39 37 2e 31 34 35 2e 32 33 30 | .197.145.230
Parsed packet data.....
Radius: Code = 40 (0x28)
Radius: Identifier = 172 (0xAC)
Radius: Length = 92 (0x005C)
Radius: Vector: 9FB6611B8674AD3D518E691D7A4D2192
Radius: Type = 26 (0x1A) Vendor-Specific
Radius: Length = 49 (0x31)
Radius: Vendor ID = 9 (0x00000009)
Radius: Type = 1 (0x01) Cisco-AV-pair
Radius: Length = 43 (0x2B)
Radius: Value (String) =
61 75 64 69 74 2d 73 65 73 73 69 6f 6e 2d 69 64 | audit-session-id
3d 30 61 30 61 30 31 30 64 30 30 30 34 34 30 30 | =0a0a010d0004400
30 36 30 36 36 33 35 39 39 | 060663599
Radius: Type = 6 (0x06) Service-Type
Radius: Length = 6 (0x06)
Radius: Value (Hex) = 0x1
Radius: Type = 31 (0x1F) Calling-Station-Id
Radius: Length = 17 (0x11)
Radius: Value (String) =
31 37 34 2e 31 39 37 2e 31 34 35 2e 32 33 30 | 174.197.145.230
The source of CoA packet does not match tunnel-group config.
CoA message from 10.10.201.61 for session 0a0a010d0004400060663599 is inconsistent with the application configuration.
Failed to find aaa-server for CoA Request
coa_process_radius_data: vPifnum:0x6, vcid:0, old_vcid:0
Its obvious to me why this does not work because the session Id is not the same but why would I be able to try to Change Status on an older session and not the current session? What does it mean when it says No advertised access control capabilities for this MAC Address? Has anyone been able to get this working successfully?
------------------------------
abraham
------------------------------