Cisco AAA/Identity/Nac :: 1120 ACS 5 - Remote Log Targets?

Mar 19, 2012

I have configured the appliance everything is working fine.We have a remote syslog server and I have configured the  remote syslog server details in the "Remote Log Targets" and  and Logging Categories.But I cannot see any logs on my syslog server  

View 4 Replies


Cisco AAA/Identity/Nac :: Specific Targets Not Receiving Syslog Traffic From ACS 5.3

May 9, 2013

We have a distributed ACS 5.3 set up - a PR and DR replicating successfully.I've set up 4 remote syslog targets. 2 of them are at the same site as the PR ACS and 2 are at the same site as the DR ACS.The logging collector is set on the PR ACS.
The problem is that it "appears" that  PR ACS  is only sending PR ACS syslog info to one of the remote syslog targets out of the four.
The syslog target which does receive from the PR ACS is at the same site as the PR ACS.
"appears" means that some one has looked on the syslog targets to see what's been received / or not received.
I've been told that the syslog traffic for  syslog targets is being received from the DR ACS. Which is strange as the PR ACS is the actual log collector (and is not at the same site as the DR ACS).
I've also got Alarm Syslog targets set up on the PR ACS , (2 are the same ip addresses used in the 4 remote syslog targets). IP addresses of the remote syslog targets have been double checked and can be pinged from each ACS (PR and DR).

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1120 - How Many Devices (MAB) Can Be Authenticated

Jan 23, 2012

I´m currently looking for a document that specify how many MAC addresses can be stored and authenticated via an ACS (1120)? I prefer to use the internal identity store over AD or LDAP for MAB authentication for 802.1X project. I would like to know what is the impact on the ACS? CPU/MEM? What is the impact on the user authentication? delay, timeout, etc.

View 7 Replies View Related

Cisco AAA/Identity/Nac :: Enabling ICMP On ACS 1120?

Feb 28, 2011

We have downgraded cisco acs appliance 1120 from ACS 5.0 to ACS , when we perform ICMP ping request to acs appliance its not responding , But i can do ping test from acs appliance on console mode not  from GUI mode .
Is there any option to enable ICMP Ping response on cisco acs 1120 . else any patch to be upgraded to perform this action , my requirement is enable ICMP ping on acs appliance for troubleshooting . instead always check with telnet x.x.x.x 2002 for service responding

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1120 And RAID Configuration?

Jul 4, 2011

I encountered some strange issues with one of our appliances in the field. Reinstalled and encountered the strange issues. No errors.. did some memory test and the seagate harddisk test and encountered SMART errors. The device didn't log those errors anywhere.. First reason to check the second harddisk. The appliance is shipped with two so the first thing I was thinking of was RAID. I saw that raid wasn't configured. Try to boot the second harddisk and saw that nothing was on that disk.. so what is the mean reason you got two of those? Got the new machine and try some options to configure RAID.You got two options.. didn't see this before, most of the time you got only one option. Raid driver on or no RAID configuration at all. First tried the intel storage matrix, configured both of the disks for mirror and install the ACS 5.2. The machine boots after installs and rejects the DVD. Result: The installation doesn't boot! Checked the partition with gparted but the partition is active (or flagged as boot) Second option was LSI, got the raid configured for mirror and the installation was also completed. Result: working installation. Tried to test if the installation is still working after removing one of the disks. Appliance is complaining the the RAID is missing one disk (so this works). After that the machine tries to boot, result: no working ACS.

View 1 Replies View Related

AAA/Identity/Nac :: CSACS-1120 - How To Export License From ACS

Jul 22, 2012

I have an ACS applicance that had a version 5.1 and i did an upgrade to 5.3 with latest patch.For some reason, the runtime process got stuck in (reinitializing and restarting) state.i did the recommended action to perform ACS stop and ACS start and even hard reset of the appliance, but it did not cut itThis process turned out to be a bug and it should have been fixed in version 5.3, but it has not i guess
i know that acs reset-config will solve the issue, but i have a problem here , the license file will be deleted as well with the config and i cannot find a way to export the license and then import it into the reseted config ACS hardware. Unfortunately, the license file is not saved anywhere in the company and i cannot affort to lose to export the license from the applicance (CSACS-1120)?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1120 Running RADIUS Timeout With WLC 7.0?

Aug 29, 2011

i am configuring a Cisco Secure ACS 1120 appliance running ACS to handle RADIUS request from a Cisco WLC 5508 appliance running version devices have open communication on all ports - no firewalls or ACL'sthey have successful ping communication The following statements illustrate some but not all the debugging I have done to ensure each device functions as it should in isolation.Using a simple windows RADIUS server (radserv2.exe) instead of the Cisco ACS  This works and the WLC gets RADIUS response from my makeshift serverUsing a simple windows EAP client to query the ACS using RADIUS protocol   this works and the ACS processes the RADIUS request and sends a responsePlaced a wireshark client on the network to inspect timeout. Wireshark logs the packet from the WLC to the ACS using port 1812 but doesn't see any packet  responses from the ACS At the moment I have the WLC accepting the association from the wireless client and sending the RADIUS (PEAP, EAP-FAST or EAP-TLS) request to the ACS, the WLC receives no response and generates a timeout message and disassociates from the client. note this is not a reject or similar message, the ACS simple does not even process the packet. i.e. there is absolutely nothing in the ACS logs to suggest it even received a radius packet from the WLC. In summary the WLC and the ACS successfully function independently but they do not communicate via radius.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Error Opening Acs Logs

Mar 6, 2013

I have problem with ACS 5.0 on reporting.  On "Monitoring and Report" page  in  Faverite Reports when i clicking on "Authentications - RADIUS - Today", My browser displays error "Error while reading skin-access.config. Please make sure the file exists and conforms to the schema specified"
I must also mention that I never upgraded the version of ACS from 5.0 also from command line all the acs services are running. It is running on CISCO 1120 Secure Access Controll Server apliance.
My second question is can I upgrade the version of ACS to 5.4 with Cisco Secure ACS 5 Base License?

View 4 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Registering ACS 5.2 Instance To Primary

May 29, 2013

When attempting to register an ACS instance to a primary (via System Administration -> Operations -> Local Operations -> Deployment Operations), I receive the following error as a popup in my browser:
"This System Failure occurred:  /opt/CSCOacs/db/acs.crt (No such file or directory). Your changes have not been saved.Click OK to return to the list page."
I had 2 ACS 1120 appliances clustered, 1 suffered a hardware failure about a year ago so I replaced it with a VM. That one is now the primary. I'm now wanting to replace the secondary instance (the remaining 1120 appliance) with a VM as well. I removed the current appliance from the network, installed the VM using the same IP address, and attempted to register. It failed as per the above error. After trying this a number of times, I then decided to return the 1120 appliance to secondary status and attempted to register it with the same results as above.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.0 0n 1120 Appliance Stopped Booting

May 10, 2012

I have an acs 5.0 running on Cisco 1120 appliance. It has worked for 2 years. Suddenly, I discovered that user can no longer login with their credentials. On close examination, when I console, the booting does not complete. Screen shot attached.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS-1120 Large Deployment License?

Mar 26, 2011

i  have 4 X ACS-1120. Each 2 are operating as an Primary and backup. I  want to add a license in order for the ACS to support more than 500  networks which includes in the base license.As I understand this is the license required : L-CSACS-5-LRG-LIC=
Is this license applicable to ACS-1120 appliance with ver 5.2 ? – I understand that it is. for my scenario, do I need to purchase total of 2 X L-CSACS-5-LRG-LIC=  (one for each environment, one license will serve 2 X ACS in Primary  and Backup) or I need to purchase 4 licenses each for each ACS ? – I  understand that one license will serve deployment of two ACS in primary  and active scenario. 

View 1 Replies View Related

Cisco AAA/Identity/Nac :: CSACS-1120 To Active Directory Without Success

Apr 18, 2011

I'm trying to join a band new CSACS-1120 to our active directory without success. The process in it self should be pretty straigh forward, but so far no luck.
I've configured the relevant info under "Users and Identity Stores > External Identity Stores > Active Directory.
Active Directory Domain Name:
Username/Password : domain administrator account
When I test connection I get a info dialog "This machine is currently connected to domain".After which I try to save changes which gives a reply ""This System Failure occurred: {0}. Your changes have not been saved. Click OK to return to the list page."
I've noticed that in the system log "show logging system tail" that I get a exception as soon as I enter the AD configuration page and subsequently every time I perform a action on that section.
Why the AD join keeps on failing and what the debug exception I'm getting means?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Test EAP TLS Authentication On ACS Running On Appliance 1120

May 2, 2011

i am trying to test EAP_TLS authentication on acs running on Appliance 1120 , I have installed my server certficate along with CA certficate on my appliance box , I have enabled features of  EAP_TLS under golbal authentication setup .
I have downloaded client supplicant certficate file for my windows XP machine .When i tried to authenticated i am finding following error message under  failed attempts(EAP-TLS or PEAP authentication failed due to unknown CA certificate during SSL handshake) on my acs appliance box .Under certficate revocation list , I have forced my CA as CRL in use . Attached snap shot of all .

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Required Patch For ACS Appliance 1120 Version

May 4, 2011

Need URL for patch  with comptaible for cisco acs appliance 1120 . Though its for appliance patch should be along with webserver . I have downloaded patch of SE its not comptaible to this hardware .

View 4 Replies View Related

AAA/Identity/Nac :: Upgrade From 5.1 To 5.2 By Having Smarnet On 1120 Secure ACS Appliance?

Mar 13, 2011

Am I entitle to upgrade from 5.1 to 5.2 by having smarnet on my 1120 Secure ACS Appliance?

View 1 Replies View Related

AAA/Identity/Nac :: Windows ACS 4.2.0 Backup Database On 1120 Appliance

Apr 26, 2011

I am running windows based acs 3.3 in my lan environment going to be replaced with acs 1120 appliance running acs , ACS 3.3 database has been built upto ,step by step by upgrade process
1) acs>
2) acs ----> .
now my database is with dmp file , I cannot upgrade my database to because patch is not applicable & executable  on 90 days evalution package of of windows platform .
can i import my windows based datbase directly to my acs appliance running ??? , else its requires any step to be done to modify the windows based databse matching to appliance windows verison once .
I could see on appliance under restore settings the following options (restore from 4.2.0 backup file to acs 4.2.1)

View 8 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Account Disablement On Specific Date Feature On ACS 5.2

Nov 7, 2011

I have ACS 1120 ACS appliance running ACS version ,authenticating VPN users connecting from internet using radius protocol , we have requirement that VPN user account should be disabled by a specific date , Means user ID should be revoked when their contract expire connecting to our data center .
I know this feature is available on ACS version 4.2.,but i could not this feature set on ACS 5.2.0 when user account is created , whether any new sepicfic patch has this feature enabled after acs version
With out this feature this set , i cannot ensure ID are revoked automatically ,when specific date come in to end user.

View 1 Replies View Related

AAA/Identity/Nac :: SSL Certificate Installation On Acs Appliance 1120 For PEAP Clients

Apr 18, 2011

I need this SSL certficate installation on my acs appliance 1120 for PEAP clients.I have exported SSL server certficate from my old acs 3.3 server which is under acscertstore folder issued by CA vendor . I need to reuse this same SSL certificate on my acs appliance .ACS appliance certficate setup requires following two certificate to be installed for PEAP clients authentication

1) Server Certificate

2) CA certificate
Server Certificate : For server certifcate , I have my old certificate which is exported from my old acs 3.3 server , when i tried to download my server certficate via ftp server on my acs appliance , its looking for private key & private key file .Private key & file is generated intially on CSR request when this server certificate is requested to CA vendor for my old acs 3.3 . I dont know the private key password . If i need private key & file , then i need to generate new CSR from my acs appliance and i need to submit this CSR output to my CA vendor to generate new SSL server certificate .which is something like new server certificate request .CA certficate : For CA certficate , when i open my existing SSL certificate under detials tab in CRL distribution point , i could see below URL . whn i open this URL it giving certificate revocation list . [1]CRL Distribution Point.

View 10 Replies View Related

Cisco AAA/Identity/Nac :: Remote Agent With ACS 4.2

Mar 18, 2013

We have ACS runnning with remote agent installed on win 2003/32 bit ent server. Now we are facing issue like logs (daily backup) from ACS to the Remote Agent is not happening properly. We usually get logs around 1 MB everyday in remote agent but sometimes we are getting 1 KB continuosly untill the services to be restarted in ACS manually.

View 9 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 And 8.2 Remote Access VPN Configuration

Feb 11, 2012

ACS 5.2 , and I can't find document about how to configure remote access vpn authentication in ACS 5.2.

View 6 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 Remote Database Compatibility?

May 26, 2013

Would like to check up either Microsoft SQL Express 2012 is able work with ACS 5.3 remote database?

View 5 Replies View Related

Cisco AAA/Identity/Nac :: Upgrading ACS 4.1 SE And Remote Agent

Mar 20, 2012

Presently we are upgrading the existing domain controller to Windows Server 2008, R2 Standard Edition.
I'm bit confound with the information available for the upgrade scenarios. Listed out the present working versions.
Cisco ACS SE - Release 4.1(1) Build 23 Patch 5
Cisco ACS Remote Agent version 4.2(0.124)
As the new operating system is going to work on 64 Bits, I think the existing ACE SE and remote agent may/should be upgraded.
Based on my existing versions, provide the possible upgrade scenarios available for me.After upgrading SE and Remote Agent should be working for 64 bit OS.

View 6 Replies View Related

AAA/Identity/Nac :: ASA5510 With 2 Remote Access VPN And 2 MS IAS

Jun 17, 2011

We have a Cisco 5510 with 2 IPSec Connection Profiles each using a different IAS for authentication.If we add another VPN profile we need another IAS.With Cisco ACS can it be configured for different VPN profiles from the same ASA 5510?

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 Remote Agent Compatibility (2008 R2 DC)?

May 7, 2012

I have been doing a bit of reading on the ACS 4.2 remote agent compatibility with Windows 2008 R2, and it seems like the only way out is to upgrade the ACS to 5.2. We have Cisco ACS 4.2 SE and if I install the Remote agent on a Windows 2003 member server instead of the 2008 R2 DC.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Remote Agent For ACS For Windows 2008 R2 64-bit?

Jul 17, 2012

We having difficulties with installing remote agent on windows 2008 R2 64-bit server and got the attached error.
Our ACS is and remote agents we tried are and

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Windows Remote Agent For ACS 4.2 Appliance?

Jun 7, 2011

The problem is that i had configured the ACS appliance with a remote agent to Integrate with Microsoft active directory and I installed that agent on one of our domain controls and it is working fine.
When I installed another agent on anther domain control and add it to the ACS server it appear that the remote authentication service is working on it but when try to make the new agent the primary and the old one the secondary from External database configuration all the domain users authenticated but only to one group which configured in Unknown User Policy.It appeared like it can't read any more groups from active directory.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS Remote Agent 4.2.1 On VMWare Server?

Jul 17, 2011

it's possible to install ACS Remote Agent 4.2.1 on VMWare server. Is it supported by Cisco?Do you have any experience with running the remote agent on VMWare servers?

View 2 Replies View Related

AAA/Identity/Nac :: ACS 5.2 - Unable To Delete Remote Log Target?

Oct 12, 2011

I have two ACS 5.2 running as primary and secondary instances respectively.  When I try to delete a remote log target under System Administration > ... > Configuration > Log Configuration > Remote Log Targets I get the following error message...."The item you trying to delete is referenced by other items. You must remove all references to this item before it can be deleted".
I have searched the configuration within the web gui and was unable to find anything that reference the object that I'm trying to delete. 

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ASA 5510 - Remote Access To Network When Server Is Down

Jan 2, 2013

I have a Cisco ASA 5510. I have configured Cisco Anyconnect to authenticate via Windows IAS. We had an outage of that server recently and I tried to remote in via anyconnect and could not. Once the IAS server came up I could get back into the network.
Is there a command that I'm missing that will let me use Anyconnect to connect into the network even if my AAA server is down?

View 2 Replies View Related

Cisco :: 1120 - Software Upgrade From Version 3.3 To 5.x

Feb 16, 2011

I want to upgrade my Cisco ACS Engine appliance 1120 from software version 3.3 to the latest version (5.x). How do I go about this?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 / 5.3 - Remote Database Settings In Monitoring And Reporting

Mar 26, 2012

I am configuring new ACS 1121 appliance with version 5.3 and wanted to know how to configure Remote Database settings in ACS5.3 Is that necessary to configure that option ?
Also one more thing I can see that ACS 5.3 generates lots of logs is there any solution to reduce such logs. It seems many unuseful logs which are system related are getting logged into device which might no be good for memory requirements of device.

View 6 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 / Logs Are Lost Frequently In Remote Agent Server

May 2, 2013

ACS 4.2 and remote agent was working properly two months before. But in past two months we are facing weird issue in RA server.For Somedays we are missing logs from both ACS and RA server. Once we notice this we use to restart the services in ACS to give workaround. But due to this we loose our daily logs intermittently and facing risk in without having logs.This is not like communication between ACS and RA is not at all happening. It happens properly for a week or month, but again it is going bad without any config change. CSAgent.ini file is properly configured.Full version is and patch is 10 in acs and ra.ACS and Remote Agent Major and Patch version are same.

View 5 Replies View Related

Cisco AAA/Identity/Nac :: Use ACS 5.2 To Create Static IP Address User For Remote Access VPN

Sep 17, 2011

At first I use ACS 4.2 to create static ip address user for remote access VPN,It's easy,just configuration it at user set>Client IP Address Assignment>Assign static IP address,but when I use ACS 5.2 I dont't know how to do it.
I try to add IPv4 address attribute to user by read "ACS 5.2 user guide" ,it says this:
     Step 1Add a static IP attribute to internal user attribute dictionary:
     Step 2Select System Administration > Configuration > Dictionaries > Identity > Internal Users.
     Step 3Click Create.
     Step 4Add static IP attribute.
     Step 5Select Users and Identity Stores > Internal Identity Stores > Users.
     Step 6Click Create.
     Step 7Edit the static IP attribute of the user.
     I just do it,but it's not work.When I use EasyVPN client to connect ASA 5520,user could success to authentication but will not get the static IP address which I configure on Internal Users,so the tunnel set up failed.I try to Configure a IP pool on ASA for ACS users get IP address,and use EasyVPN client to connect ASA , everything is OK,user authenticate successed.but when I kill IP pool coufigurations and use the  "add a static IP address to user "configurations,EzVPN are failed. how to use ACS 5.2 to create a static ip address user for remote access VPN?

View 7 Replies View Related

Copyrights 2005-15, All rights reserved