Forum Discussion

kiml01_143042's avatar
kiml01_143042
Icon for Nimbostratus rankNimbostratus
Jun 03, 2014

Allow agent: Logon denied due to validation error, Error Code: 3003 (No Network Access resource assigned)

We have one F5 SSL VPN user who is having his second round of trouble getting logged in.

 

We use LDAP to query AD for group membership, and allow access based on that.

 

the most relevant error I see in the Access Policy report is this: Allow agent: Logon denied due to validation error, Error Code: 3003 (No Network Access resource assigned)

 

The first time this happed to the user, we tried a number of different things. Working off a theory that the user's Active Directory account was somehow implicated, I copied his AD account and tried to log in with that. That failed, so simply copying the account didn't fix the issue. Next, I tried creating a completely new AD account with the right permissions and group memberships. When I tested that, it was able to successfully connect via the SSL VPN. The user who's having the problem tried the new account and was able to get in as well.

 

Now after about 4 weeks, he's reporting the same issue with the new account, and when I look, the line I pasted appears in each session report.

 

I've searched for info on this in askF5, but my searches aren't returning helpful hits.

 

I'd appreciate it if anyone solved similar situations can share the knowledge.

 

Of course, there's always the old standby, Open a case with F5....

 

APM
security

3 Replies

Sort By
  • David_Stout's avatar
    David_Stout
    Icon for Nimbostratus rankNimbostratus
    Jun 04, 2014

    Couple of things to check along the lines of issues I've had to resolve in the past. Not sure if these are relevant but they may help get you started.

     

    1. Password didn't expire or is set to be changed on next log in.
    2. The sAMAccountName is only returning LDAP attributes for a single domain account not multiple domain accounts
    3. Nested groups are not used
    4. Testing against LDAP using the LDP tool returns the correct result from AD

    You can use the inbuilt LDAPSEARCH tool as well as LDP to query AD for groupmembership. This is the syntax i use

     

    ldapsearch -xLLL -H 'ldap://X.X.X.X:3268' -b "dc=XXXXXX,dc=com" -s sub -D "" -w "(sAMAccountName=xxxxxxx)"

     

    Hope that helps you get to the bottom of it.

     

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Jun 04, 2014

    Is the AD auth failing? You can do a cmdline testing using adtest to verify the said account.

     

  • kiml01_143042's avatar
    kiml01_143042
    Icon for Nimbostratus rankNimbostratus
    Jun 04, 2014

    Hi, David

     

    I discovered that the account in question had been removed from the AD group that would allow access, which explains why the second account I had created stopped working. As soon as we found the missing group membership and added it back, the account could log in successfully.

     

    Thanks for the suggestions! I was running down your list when we found the issue above.

     

    Kim