I have a separate NTP server, synced via GPS.

-----Original Message-----
From: Cisco Clean Access Users and Administrators
[mailto:[log in to unmask]] On Behalf Of Jeremy McGuinn
(jemcguin)
Sent: Tuesday, May 20, 2008 1:16 PM
To: [log in to unmask]
Subject: Re: [CLEANACCESS] AD SSO - required open ports?

Don't forget NTP. If time gets too far off, logins will fail.
The question about roaming profiles is an important one, so is the login
script and all of the resources that it references.
Jeremy

-----Original Message-----
From: Cisco Clean Access Users and Administrators
[mailto:[log in to unmask]] On Behalf Of Stempien, Dave
Sent: Tuesday, May 20, 2008 12:29 PM
To: [log in to unmask]
Subject: AD SSO - required open ports?

Does anyone have a definitive list of the ports required to be open in
the
unauthenticated role for AD SSO to work?  I've opened the following
ports to
our DCs per the suggestion of the Cisco documentation:

TCP 88 - Kerberos
TCP 135 - RPC
TCP 389 - LDAP
TCP 1025 - RPC
TCP 1026 - RPC

After doing some sniffing, I discovered that our DCs are also using UDP
for
kerberos and LDAP, so I opened the following:

UDP 88 - UDP-Kerberos
UDP 389 - UDP-LDAP

Also, per a previous suggestion by Cisco TAC, I also opened:

TCP 445 - SMB

Finally, ICMP and DNS is also allowed.

Currently, my test machine won't even completely log into the domain let
alone perform SSO.  It's stuck at "Applying computer settings..."  If I
completely disable my unauthenticated policy (except for ICMP and DNS),
I
can log into my test machine using cached credentials.

Has anyone else beaten this beast and care to share your experiences?

Thanks!

--
Dave Stempien, Network Security Engineer
University of Rochester Medical Center
Information Systems Division
(585) 784-2427