ProxySG & Advanced Secure Gateway

Hi Team,

We couldnt connect to primay authenticaito server.

We are getting below logs in the eventlogs.

2018-04-15 18:27:26+01:00BST  "Could not send request to agent for realm DBSGB_Realm, result=0x2501C1 error=22"  0 420001:1   txworker.cpp:24
2018-04-15 18:27:26+01:00BST  "The connection was closed to alternate authentication agent for realm DBSGB_Realm at 10.197.228.154:16101:002501C1"  6F 420001:96   admin.cpp:455
2018-04-15 18:27:26+01:00BST  "Could not send request data to agent for realm DBSGB_Realm, result=0x2501C1 error=22"  0 420001:1   txworker.cpp:24
2018-04-15 18:27:26+01:00BST  "Could not send request to agent for realm DBSGB_Realm, result=0x2501C1 error=22"  0 420001:1   txworker.cpp:24
2018-04-15 18:27:26+01:00BST  "The connection was closed to alternate authentication agent for realm DBSGB_Realm at 10.197.228.154:16101:002501C1"  6F 420001:96   admin.cpp:455
2018-04-15 18:27:27+01:00BST  "Unable to connect to primary authentication agent for realm DBSGB_Realm at 10.196.228.76:16101: connect failed"  6F 420001:1   admin.cpp:442
2018-04-15 18:27:27+01:00BST  "Unable to connect to alternate authentication agent for realm DBSGB_Realm at 10.197.228.154:16101: connect failed"  6F 420001:1   admin.cpp:442
2018-04-15 18:27:27+01:00BST  "Could not send request data to agent for realm DBSGB_Realm, result=0x2501C1 error=22"  0 420001:1   txworker.cpp:24
2018-04-15 18:27:27+01:00BST  "Could not send request to agent for realm DBSGB_Realm, result=0x2501C1 error=22"  0 420001:1   txworker.cpp:24
2018-04-15 18:27:27+01:00BST  "The connection was closed to alternate authentication agent for realm DBSGB_Realm at 10.197.228.154:16101:002501C1"  6F 420001:96   admin.cpp:455
2018-04-15 18:27:27+01:00BST  "Could not send request data to agent for realm DBSGB_Realm, result=0x2501C1 error=22"  0 420001:1   txworker.cpp:24

Proxy Version: 6.5.10.1

Thanks,

Ram.

Hi Ram,

                  Can you share BCAAA version too ? There was a known bug with BCAAA where lot of processes will be created and broken due to network data corruption. This was fixed in version "6.1.5.212879". You may want to plan for an upgrade if that helps

Hi Aravind,

Could you please provide some information regaring BCAAA 6.1.5.212879? Or some information regarding this bug which causes these issues?

Thanks in advance!

Hi Niels,

                Information I found from the BCAAA release notes Fixed an issue where BCAAA stopped authenticating requests and became unresponsive when a high number of BCAAA realm processes were created after a network device corrupted the initial data from the proxy to BCAAA. (B#254189)

Hi Aravind,

Customer is running the BCAAA version 6.1.3.XX. 

We need to upgrade BCAAA 6.1.5.212879 in order to fix this issue?

Thanks,

Ram.

Hi Ram,

               Yes, an upgrade will be required for BCAAA.

Hi Aravind,

We have observed the below logs in the BCAAA installed server which is related to BCAAA serices.

The description for Event ID 1310 from source BCAAA cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

[14376:6532] Failed NTLM Authentication for user: 'REG1\eloisacruz'; status=1909:0x775:The referenced account is currently locked out and may not be logged on to. 

We have found below information on the event code 1310(BCAAA event)

This records the failure of NTLM authentication or group authorization

Is this kind of issue resolved after installing the new BCAAA version?

Be Well,

Ram.

Hi Ram,

                  The above event entry is not due to BCAAA. As the message says, the account seems to be locked out. The upgrade will be dealing with the error mentioned in the first post of yours.

Hi Aravind,

Thank you for the update.

The earlier once showed as the information in the event logs.

Please find the below logs which shows as error in the BCAAA server.

The description for Event ID 1221 from source BCAAA cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

Thanks,

Ram.

Hi Ram,

                This eventlog is explained in article https://support.symantec.com/en_US/article.TECH240882.html . Possibly some orphaned Group reference in proxy policy. Also keep the master reference article https://support.symantec.com/en_US/article.TECH240886.html

Hi Aravind,

Thank you for the update.

Could you please share the BCAAA 6.1.5.212879 release notes.

Customer requested us to know the known Bugs/Limitations with 6.1.5.212879.

Thanks,

Ram.

Hi Ram,

                BCAAA don't have extensive relase notes like we have for Proxy. I am attaching the latest on the BCAAA where this bug information is mentioned under 6.1.5.x.

Attachment(s)

BCAAA 6.1 Service Requirements.pdf   208 KB 1 version