SRX Admin configures MS Active Directory for Integrated User Firewall Authentication

The Service account used is a Standard Domain User.

User Group info is not fetched and AD returns Error : nca_s_fault_access_denied

User Group information is not fetched and AD returns Error : nca_s_fault_access_denied

Packet Capture:

13 0.005719 xx.xx.xx.71 yy.yy.yy2 DCERPC 222 0 Bind: call_id: 1, Fragment: Single, 1 context items: REMACT V0.0 (32bit NDR), NTLMSSP_NEGOTIATE

15 0.008091 yy.yy.yy.2 10.xx.xx.xx.71 DCERPC 435 0 Bind_ack: call_id: 1, Fragment: Single, max_xmit: 5840 max_recv: 5840, 1 results: Acceptance, NTLMSSP_CHALLENGE

18 0.012693 yy.yy.yy.2 xx.xx.xx.71 DCERPC 108 0 Fault: call_id: 1, Fragment: Single, Ctx: 0, status: nca_s_fault_access_denied

nca_s_fault_access_denied specifically implies that the SRX successfully reached the Domain Controller (DC) over the network, but the Service Account we have used was rejected when it tried to execute a remote command.

The service account needs to have few required user rights for successfully binding with the AD and fetch the User Group, IP mappings.

Check whether the Service Account is missing any required user rights as per the article below:

KB29659 [juniper.net]

Post fixing the Service Account User Permission the Error should subside.

Reach out to JTAC if the issue persists even after fixing the Service Account User Permission.