Forum Discussion
Zuke_254875
Altostratus
AltostratusAPM AD Pool member selected
Is there a way to determine in APM logs which AD server was selected during the authentication agent? I'm having users reporting authentication errors on their phones, where their username and password fields are already filled, have between 3-10 attempts before authentication is successful.
- Kevin_Stewart
Employee
The great thing about AD traffic is that it's typically unencrypted. If you fire up a tcpdump capture and look at it in Wireshark, you'll likely see where APM and the AD server are talking, and what's happening in that transaction.
tcpdump -vvv -Xs0 -lnni [AD-side VLAN] -w [file.pcap] 
ZukeCirrostratus
Thanks Kevin.
Kees, I forgot that creating APM pools defaults to priority group activation. Viewing the pool statistics, only one of the servers is receiving traffic which debunks my original theory that one of the two servers is having a problem.
Now that I know only one of the two AD servers is getting traffic, I need to figure out why some users are getting denied multiple times before authenticating.
The APM log says "general GSSAPI error."
- Kevin_Stewart
I'd recommend using TMSH:
modify sys db log.accesscontrol.level value debug Yep, that's the setting. Is your AD pool (attached to your AD AAA agent object) configured with Group Priority activation and what health monitor are you using on that pool?
Cheers,
Kees
- Zuke
Kevin, is this the log setting to which you are referring?
- Kevin_Stewart
Have you set Access to debug logging? You should see the server information and failed AD auth attempts.
