<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>This is a good example of why you should lab test the AD upgrade prior to production.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>ACS 5.1 can’t talk to 2008 Domain controller in 2003 functional level. ACS runs Centrify and ACS 5.2 fixed it. I think ACS 4.2.1 has similar issue but not positive.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>From TAC case after upgrade, “I believe you are running into a problem when a 2008 DC is running at 2003 functional level. Basically we send a ticket request to the KDC and it responds with the encryption versions it supports including AES. Since AES is the strongest encryption we choose that and send an ticket request using AES to the KDC. The KDC then responds saying it does not support AES since 2003 does not support AES encryption.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>If this is the case then raising the domain functional level to 2008 native should resolve the issue assuming that this will not break anything else in your environment. “<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/da205761-4eb3-4896-a71f-7cc8512d5420<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>http://www.windowsitpro.com/article/kerberos/Q-Can-the-default-encryption-types-the-Kerberos-authentication-protocol-uses-in-Windows-7-and-Windows-Server-2008-R2-cause-compatibility-problems-Is-there-a-workaround-.aspx<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Yes customer was warned in advance that 2008R2 isn’t supported until ACS 5.2 was released, for whatever reason they upgraded regardless breaking VPN authentications.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Bill Riley [mailto:bill@hitechconnection.net] <br><b>Sent:</b> Tuesday, February 08, 2011 9:31 AM<br><b>To:</b> Jason Aarons (US); cisco-voip@puck.nether.net<br><b>Subject:</b> ACS 2008 R2<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>From the original thread “support for MS AD 2008R2 and "mixed" 2003 R2 / 2008 R2”<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>You said that the 2008 R2 DC caused problems with ACS. What issues did you have? I am surprised there is that much dependencies between ACS and the active directory authentication. <o:p></o:p></p></div></body></html>
<HTML><BODY><P><hr size=1></P>
<a href="http://dimensiondata.stream57.com/04141pm/"><span style='color:blue;text-decoration:none'><img border=0 src="http://image.exct.net/lib/feed16797d620d/i/2/8c665b10-9.gif" alt=DDIPT></span></a>
<P><STRONG>
Disclaimer:
This e-mail communication and any attachments may contain confidential and privileged information and is for use by the designated addressee(s) named above only. If you are not the intended addressee, you are hereby notified that you have received this communication in error and that any use or reproduction of this email or its contents is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer. Thank you.
</STRONG></P></BODY></HTML>