VPN Authentication with Kerberos 5 on Windows Server

karel.stadler · ‎03-22-2006

I'm trying to authenticate users (fomr VPN 3005 Concentrator) wire Kerberos (with preauthentication) on a Windows DC Server.

In the network trace is see that the respone from the Windows Server is too bi (error code 52).

Normal behavior should be that the concentrator should use TCP instead of UDP then.

Is it planned to implement that somtime ?

karel.stadler · ‎03-23-2006

Okay, i try to be more specific.

Cisco Concentrator sends a AS_REQ to the Windows DC (KDC).

The User has many attributes which don't fit into one UDP Segment (the AS_REPLY).

Now Cisco Concentrator should switch over to TCP. But this does not happen.

May there is a solution in setting the SEC_WINNT_AUTH_IDENTITY_ONLY falg in the Request.