Yeah we had the same experience when we set things up. After hours of troubleshooting with TAC we finally threw in the towel, allowed all traffic to the DC's, and added ACLs to limit access. We never could figure out why the logons would never complete, never saw any traffic on a sniff that looked like it was being blocked.

Justin Howell
Telecommunications Network Technician
Solano Community College

-----Original Message-----
From: Cisco Clean Access Users and Administrators [mailto:[log in to unmask]] On Behalf Of Jay Patel
Sent: Tuesday, May 20, 2008 9:43 AM
To: [log in to unmask]
Subject: Re: AD SSO - required open ports?

It truly is a beast.  Are you using roaming profiles?

----
-----Original Message-----
From: Cisco Clean Access Users and Administrators [mailto:[log in to unmask]] On Behalf Of Stempien, Dave
Sent: Tuesday, May 20, 2008 12:29 PM
To: [log in to unmask]
Subject: AD SSO - required open ports?

Does anyone have a definitive list of the ports required to be open in the
unauthenticated role for AD SSO to work?  I've opened the following ports to
our DCs per the suggestion of the Cisco documentation:

TCP 88 - Kerberos
TCP 135 - RPC
TCP 389 - LDAP
TCP 1025 - RPC
TCP 1026 - RPC

After doing some sniffing, I discovered that our DCs are also using UDP for
kerberos and LDAP, so I opened the following:

UDP 88 - UDP-Kerberos
UDP 389 - UDP-LDAP

Also, per a previous suggestion by Cisco TAC, I also opened:

TCP 445 - SMB

Finally, ICMP and DNS is also allowed.

Currently, my test machine won't even completely log into the domain let
alone perform SSO.  It's stuck at "Applying computer settings..."  If I
completely disable my unauthenticated policy (except for ICMP and DNS), I
can log into my test machine using cached credentials.

Has anyone else beaten this beast and care to share your experiences?

Thanks!

--
Dave Stempien, Network Security Engineer
University of Rochester Medical Center
Information Systems Division
(585) 784-2427