We are having Cisco Secure 2.6 and it is using Windows NT Database, We have Pix firewall 5.1, Cisco Secure is configured for single session in group settings that are mapped to Windows NT Groups, initially it worked fine and denying multi sessions, after one week it is allowing anyone to loggin from mutiple machine,s we want Cisco Secure not to allow multiple sessions, please give us the right direction.
CiscoSecure ACS 2.6 has the ability to log SUCCESSFUL authentications, I would recommend turning this on and looking at the results. This should provide some good insight. Chances are that these users are ending up in the wrong group. Also, keep in mind that if your "unknown user policy" is set to go to Windows NT, if a user first authenticates as "george", and next authenticates as "domain1\george", ACS will see this as two different users, create two different user profiles, and possibly drop them into different groups depending on your mappings.
Well cisco has confirmed it is HTTP behavior, and it is not possible to control http traffic on multisession feature in ACS 2.6, below is the cisco comments.
Unfortunately, because of the way that HTTP works, it is not possible to use the Max sessions feature the way you might expect. In a Telnet or FTP
connection, the PIX sends a 'start' accounting record to the CSNT server, and this tells it that this user has started a session. If the user attempts
another session, then because the CSNT server has not received a 'stop' record for the previous session, it will not allow another session if the
session limit is set to 1.
However, in the case of HTTP, the session is very short-lived (typically 1 second). You can see the short duration of the session in the accounting log
Since the CSNT server receives the 'stop' record almost immediately after the 'Start' record, it now counts this user as not connected (which is technically correct since he no longer has a TCP
session), even though he may still be looking at a web page. So, this may give the impression that the user is being allowed many more session than CSNT is configured to allow, but in reality this is not the case.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...