Cisco AAA/Identity/Nac :: 1121 - Upgraded ACS / Clients Are Unable To Authenticate Older Appliance?

Apr 14, 2013

We have had an active ACS unit for many years now, and we've added a second one, both are 1121 Appliances.  The newer one came with 5.4, so we upgraded the older one to 5.4.
 
We setup replication between the two, with the newer one primary and the older one secondary.  Problem is, windows based clients are unable to authenticate to the older ACS appliance.  The only problem we can see is that it indicates that adclient is not running, under Monitoring & Troubleshooting, ACS Health Instance Summary.
 
So... been trying to figure out how to correct this, yet have been hard pressed to find a knowledgebase article that works.  So far, Cisco hasn't added my smartNet on the new box so I can get some support?

View 6 Replies


ADVERTISEMENT

Cisco AAA/Identity/Nac :: ACS 1121 Appliance Downgrade To 4.2.0.124

May 2, 2011

Newly shipped cisco  ACS appliance 1121 has been shipped with ACS version 5.0 , I need to downgrade to ACS version 4.2,0 , I could not see recovery CD or DVD for acs 4.2 along with shipment , Is ACS 1121 appliance is comptaible to acs 4.2.0 version ? .
 
My ACS BOM details
CSACS-1121-K9
ACS 1121 Appliance With  5.1 SW And Base license

[code]....

View 2 Replies View Related

AAA/Identity/Nac :: SSL Certificate Installation On Acs Appliance 1120 For PEAP Clients

Apr 18, 2011

I need this SSL certficate installation on my acs appliance 1120 for PEAP clients.I have exported SSL server certficate from my old acs 3.3 server which is under acscertstore folder issued by CA vendor . I need to reuse this same SSL certificate on my acs appliance .ACS appliance certficate setup requires following two certificate to be installed for PEAP clients authentication

1) Server Certificate

2) CA certificate
 
Server Certificate : For server certifcate , I have my old certificate which is exported from my old acs 3.3 server , when i tried to download my server certficate via ftp server on my acs appliance , its looking for private key & private key file .Private key & file is generated intially on CSR request when this server certificate is requested to CA vendor for my old acs 3.3 . I dont know the private key password . If i need private key & file , then i need to generate new CSR from my acs appliance and i need to submit this CSR output to my CA vendor to generate new SSL server certificate .which is something like new server certificate request .CA certficate : For CA certficate , when i open my existing SSL certificate under detials tab in CRL distribution point , i could see below URL . whn i open this URL it giving certificate revocation list . [1]CRL Distribution Point.

View 10 Replies View Related

Cisco AAA/Identity/Nac :: Use 802.1x To Authenticate Clients On Network With Dynamic VLAN Assignment From RADIUS?

Apr 11, 2013

I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:Connect the phone and let it boot up(takes a while) and authenticate with MAB.Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan) However, the following scenario doesn't work:The computer is already connected to the phoneThe phone is then connected to the switch What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.why the first scenario works, and not the second?
 
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config: network-policy profile 1voice vlan 90!interface GigabitEthernet0/12switchport mode accessnetwork-policy 1authentication control-direction inauthentication event fail retry 1 action authorize vlan 60authentication event server dead action authorize vlan 60authentication event no-response action authorize vlan 60authentication event server alive action reinitializeauthentication host-mode multi-domainauthentication order mab dot1xauthentication priority mab dot1xauthentication port-control autoauthentication periodicauthentication violation replacemabdot1x pae authenticatordot1x timeout tx-period 5dot1x max-reauth-req 1spanning-tree portfast!Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Unable To SSH To ACS 4.2.0.124 SE Appliance

Feb 20, 2010

I could not SSH to ACS SE appliance? Why I could not, however I can do on another ACS SE.
 
note that I can ping the ACS SE, after disabling the CSA, so netowrk connectivity is ok.
 
Cisco Secure ACS: 4.2.0.124.

View 5 Replies View Related

Cisco Application :: Switch Is Not Able To Authenticate Itself To ACS 1121

Jul 30, 2011

The user "shreedhar" is getting authenticated locally and not through TACACS+ (Cisco ACS 1121 appliance running ACS 5.1).
 
In the switch, after entering credentials, the switch says, "Authentication failed - login using local mode". (Not the exact message but close enough!).
 
In ACS 5.1 -> Monitoring and Reports->Dashboard->My Favorite Reports->Authentications-TACACS+, I am getting the following error, "13011 Invalid TACACS+ request packet - possibly mismatched Shared Secrets".
 
Configuration in switch is as follows:
 
feature tacacs+
username admin password 5 $1$joEvYokP$5wZ1mtpBlxuoKMEWbFzRY1  role network-adminusername shreedhar password 5 $1$x8u5N4IR$NbVcY1u6CuoXYkMgXs60l/  role network-admin
tacacs-server key 7 "Ti!23456"ip tacacs source-interface loopback0acacs-server test username demo password demo123 idle-time 3 tacacs-server timeout 10tacacs-server deadtime 5tacacs-server host 192.168.31.11 key 7

[code]....

Is #the encrypted TACACS+ shared secret key from switch not being decrypted by ACS 5.1 as it requires a clear-text password? Could it be the reason for the above error?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: WLC 4402 Unable To Authenticate Correctly With ACS 5.2

Jun 8, 2011

For unknown reason I cannot get WLC to authenticate correctly with ACS 5.2. it's very strange in the sense that when I checked the log. ACS authenticates and authorized the WLC 4402 but I cannot log to the WLC. login screen appeared, if I typed user name it jumped to Controller> user: password:
 
No matter what I typed (internal or external users) nothing seems to work. This is my frustration, I have no problem authenticating routers and switches except WLC 4402.

View 8 Replies View Related

Cisco Security :: Migrating From ACS 1113 Appliance To ACS 1121

Mar 18, 2013

We are currently running a ACS 1113 with version 4.2 software.  We are going to replace the 1113 ACS with two 1121 ACS. 

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Unable To Upload Patch To ACS 5.2 Appliance?

Jul 21, 2011

I'm trying to upload the 5-2-0-26-4.tar.gpg patch to our ACS and so far have been unsucessfull. I keep getting the "please verify the patch bundle is valid".
 
When I download the 5-2-0-26-4.tar.gpg file, for some reason the download always comes down from Cisco as 5-2-0-26-4.tar.tar. I've renambed the file to 5-2-0-26-4.tar.gpg and verified the MD5.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Unable To Register A Secondary ACS 5.2 Appliance

Dec 6, 2011

I have installed 2 ACS 5.2 appliances, the two appear as Primary. When I try to register one of them with the other one using "System Administrator -> Local Operation -> Deployment Operations" I get the following message:
 
This System Failure occurred:  Unable to authenticate with node.. Your changes have not been saved.Click OK to return to the list page.
 
I have tried with both "ACSAdmin" and "admin" users with their respective passwords.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS5.1 - Unable To Authenticate AD User With Empty Password

May 30, 2011

Our customer has the business needs to authenticate remote users against AD with empty password. I've seen ACS5.1 release note where mentioned about resolved issue: #CSCte72751 #ACS 5.1 drops authentication with empty password.

I tried to authenticate dial-in users through Tacacs and Radius against AD with empty password but without success. ACS points to wrong AD password. Is it possible to authneticate remote users with empty password?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Unable To Access CS ACS 1113 Appliance After Enabling HTTPs

Nov 2, 2011

I've recently installed a certificate on my ACS 1113 appliance and in the Admin setup enabled management access over HTTPS. Since then I've not been able to access the GUI console. I have done some troubleshooting and I'm fairly certain that I have a certificate issue as Firefox gives me the error: Certificate type not approved for application. (Error code: sec_error_inadequate_cert_type)when I try and connect. So I want to either reconfigure the management access to use just HTTP or remove the certificate. I have logged on to the serial console and there are no options her to do this. The RADIUS and TACACS functions are working correctly - I just can't logon via the GUI.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Authenticate VPN Users Via ACS 5.4 And AD Via External Identity Store

Feb 22, 2013

I have installed ACS 5.4 and we are looking to authenticate our Anyconnect users with ACS via Active Directory. I think I have the correct commands in our ASA ( we had ACS 4 and authenticated our anyconnect users ).
 
I also have configured ACS to use Active Directory  and installed the server side cert in ACS. I'm just uncertain how to program ACS to use the security group that I have setup in Active Directory.

View 6 Replies View Related

Cisco AAA/Identity/Nac :: Use Acs 5.2 Recovery DVD To 1121 Acs 5.1?

May 31, 2013

It's impossible to use acs 5.2 recovery DVD to cisco 1121 acs 5.1?

View 7 Replies View Related

AAA/Identity/Nac :: Cisco ACS 1121 Integration With AD?

May 15, 2011

integrated the Cisco ACS 1121 with 5.1 and AD and been able to use multiple policies to permit or deny access to different NDG?  I am able to authenticate agains AD but I am having an issue with getting the policies to use the user memberOf attribute to set access levels. 

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 With V5.0 PAK Lost

Jan 6, 2012

It has been more than a year since a customer bought a Cisco ACS 1121. It was unpacked then and the PAK is lost, no where to be found. Is there any way to retrive the lost PAK ?

View 19 Replies View Related

Cisco AAA/Identity/Nac :: Replacement Of ACS 1121

Jun 7, 2013

I have a clarification related with ACS 1121. Client needs a solution for ACS feature, instead of investing on ISE Base, is there any model exists as ACS appliance only. I believe ACS 1121 is going to be EOS and it says SNS 3415 is the replacement model .
 
What I am confused is , It is an ISE as well as ACS and there is separate licensing for ISE (as base and advanced). What should i do , if i need to select SNS 3415 as ACS appliance ? is it built in or should i need to add anything extra ?       

View 3 Replies View Related

Cisco AAA/Identity/Nac :: How To Configure LAN Teaming In ACS 1121

Mar 27, 2011

how to configure LAN teaming in Cisco ACS 1121. My requirement is to have virtual IP in the server with two physical IPs in the available 2 interface in the server.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 With 5.3 MIB For SNMP Monitoring

Mar 26, 2012

I am trying to add ACS 1121 (ver 5.3) to monitoring and seems that MIB are missing. Need MIB for this device which I can use in monitoring tool.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Monitoring ACS 1121 Via SNMP?

Aug 13, 2012

I have 5 installations of ACS appliances (ACS 1121 running ACS 5.3). Is there a way to monitor them via SNMP? The AD client keeps dying on one of them, and even with the newest patch it's not up. Also, i want to monitor them up/down, CPU, memory... basic network monitoring to make sure my devices are  healthy.
 
Any one know if that can be configured? I figured i'd ask here before opening a TAC.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: CSACS-1121-K9 - Dual NIC

Aug 11, 2011

Is it possible to have Dual NIC on ACS v5.2 such as teaming or any else??
 
I am thinking of connecting the two NIC on the CSACS-1121-K9 appliance to two switches on the same network, but wondering if it will be possible or not.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Applying A Patch To ACS 1121

Jun 3, 2012

I have an issue with applying a patch to an ACS 1121 appliance running version 5.2.0.26. I have 5 units that needed updating and the first one is the unit with the problem. The subsequent ones updated with no issues.
 
When I do a show version the 5.2.0.26.10 does not show. When I try to do a reinstall I get back patch all ready exists. When I try to do an uninstall I get back patch does not exist.

Is there a command can wipe out patch 10, so I can start over? The CLI factory-reset only wipes the web configuration not the running-config or IOS.

View 7 Replies View Related

AAA/Identity/Nac :: 1121 - Add Secondary ACS Server 5.4?

May 29, 2013

My customer has an ACS 1121 version 5.4. Now we want to install a secondary ACS 1121.

View 2 Replies View Related

AAA/Identity/Nac :: ACS 5.2 Could Not Be Upgraded And Gives Error

Jan 12, 2012

I have a brand new ACS version 5.2.  Everything is working fine.  I go to cisco website and download the following packages:5-2-0-26-8.tar.gpg
 From there, I ssh into the ACS and performed the following: acs patch install 5-2-0-26-8.tar.gpg repos acs-52-patch That works without any issues.  My ACS is now upgrade to 5.2.0-26-8 An hour later, when I tried to perform this:  acs patch install ACS_5.3.0.40.tar.gz repository Upgrade_to_5.3.0.  it is not working.  I get this message: Failed to copy file 'ACS_5.3.0.40.tar.gz' from repository Upgrade_to_5.3.0 (Error -306).

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 V 5.3 NTP Offset Increasing With Server In Same LAN

Oct 31, 2012

Im installing & configuring a new ACS 1121. Ive updated to version 5.3 with patch:This temporarily solves my Active Directory problem but i still would like to have the NTP server pointing to the same reference as the Active Directory.

View 1 Replies View Related

AAA/Identity/Nac :: Procedure To Migrate From ACS SE 4.0.1 (1112) To ACS SE 5.2 (1121)

Jan 11, 2012

I have to migrate two appliances ACS SE 1112 under 4.0.1 to new two appliances ACS SE 1121 under 5.2 version.I would like to clarify the procedure to do it by minimizing down time impact.I saw there are Migration Utility and Import Tool but do I need an Intermediate Windows Server to do this migration ?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 Log Report Showing Wrong Time?

Jun 20, 2012

I have an ACS Server 5.1 which is used to authenticate my cisco and non-cisco devices. however when I take report on my authentications, the time shown in the report is wrong. However, when I take my mouse pointer to the report , the correct time is highlighted.

View 4 Replies View Related

Cisco AAA/Identity/Nac :: Upgrade CSACS-1121 From ACS 5.2 To 5.4 - Application Initializing?

May 29, 2013

We upgraded a CSACS-1121 from ACS 5.2 to ACS 5.4 with CLI Application upgrade ACS_5.4.0.46.0a.tar.gz FTP After ACS reboot, services never start... After 15 hours, we always get same message:
 
ACS/admin# show application status acs
Application initializing...
Status is not yet available.
Please check again in a minute.
 
We installed patch 5-4-0-46-2.tar.gpg but we got same issue for 2 hours ...What could I do?

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ACS Memory Utilization Limit With CSACS 1121

Aug 21, 2012

We have 2 CSACS 1121 with Cisco ACS 5.2.0.26.10 The primary server manages 20000+ authentications per day. Its memory utilization increases everyday. It is now at 83% , there a limit?,What will happen when memory utilization reach this limit?,What can we do to purge memory utilization? (reboot, service restart.

View 11 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 Running 5.2 - Edit Hosts File?

Apr 13, 2011

Is it possible to edit the hosts file on an ACS 1121 server running ACS 5.2? Our problem is we have a single domain with multiple domain controllers at different sites. So when the ACS server tries connecting to the domain it randomly picks a domain controller which it can't connect to thus causing it to fail.

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1121 / 5.3 - Remote Database Settings In Monitoring And Reporting

Mar 26, 2012

I am configuring new ACS 1121 appliance with version 5.3 and wanted to know how to configure Remote Database settings in ACS5.3 Is that necessary to configure that option ?
 
Also one more thing I can see that ACS 5.3 generates lots of logs is there any solution to reduce such logs. It seems many unuseful logs which are system related are getting logged into device which might no be good for memory requirements of device.

View 6 Replies View Related

Cisco AAA/Identity/Nac :: Account Lockout For Failed Attempts In ACS 1121 Version 5.1.0.44.6

Jun 4, 2011

I have ACS1121 running version 5.1.0.44.6 on my network environement , I need to enable account lock-out for internal user during failed attempt for more than 8 times , How to achieve this .   I could see account lock-out for administrator user account , not for internal user .

View 2 Replies View Related

Cisco AAA/Identity/Nac :: 1121 - Configuring ACS To Strip Domain From Request And Sending It To AD

Jul 24, 2011

We are currently evaluating a ACS 1121 running 5.2, we are trying to configure this to Authenticate eap-peap requests.

Our users will be using credentials in a username@example.com format, if the server sees a request using username@anotherrealm.com then it would forward the request to a external proxy radius server, if the server saw a request for our domain it would strip off the @example.com part and authenticate against AD.
 
Im finding it hard locating documentation to tell the server if a request comes from a NAS using username@example.com then strip @example.com and authenticate username against AD.

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved