Cisco AAA/Identity/Nac :: 11213 NAC Clients Via ISE Authenticating

Apr 17, 2012

So if I do a static ip address it works fine, but if I turn off static, the machine authenticates fine, but is not assigned to the access vlan, and it does not get an ip address.now when I use static I notice in the ISE live authentication logs, 11213 No response received from Network Access Device, for the switch even though its configured correctly.

View 5 Replies


ADVERTISEMENT

Cisco :: 1140 - Win XP Clients Not Authenticating Using PEAP

Apr 2, 2013

A customer has RADIUS running on a Win Server 2008 R2 machine, has Autonomous 1140 APs and a mix of Windows 7 and XP Pro clients.  Using PEAP as the authentication method the Win 7 clients can access the WLAN, but the Win XP clients cannot.  The Win XP clients are at least SP2.  I am doing some research before going to site on Friday and wanted to poll the community.  I found an older post speaking to a MS Hotfix under KB#885453, but it referes to "third-party RADIUS servers," not MS servers URL.

View 14 Replies View Related

Cisco Wireless :: Clients Authenticating To 1231G Not Getting Assigned DHCP Addresses

Jun 24, 2007

Here at HQ we have a 4402 WLC. At our remote sites we have 1231G APs running in autonomous mode. I upgraded one of the APs -- IOS 12.4(3g)JA -- to run LWAPP. Per release notes I've read upgraded 1231's do not support REAP/HREAP mode, consequently, it's running in LOCAL mode.
 
The AP is managed by the WLC. I created a WLAN for the remote site and assigned it to the MGMT interface; the remote site subnet doesn't exist in HQ. The DHCP server for the remote site is presently at that site; AP and DHCP server reside at the same place.
 
Clients authenticate successfully to the remote site AP, however, they are not getting DHCP addresses assigned.  Does the DHCP server for the remote site have to reside in HQ since the AP is running in local mode? If so, where is that specified, on the MGMT interface config?

View 4 Replies View Related

Cisco Wireless :: 1260 Root AP De-authenticating WGB Clients After 6 Minutes Of Inactivity

May 27, 2013

i have 2 1260 Access points one is in root mode , one is wgb mode. Authentication is EAPFAST. There are 5 devices connected via WGB bridge to the rest of the network.

- If clients are sending some data , then WGB AP announces this client mac via IAPP to root AP and rest of the network sees them correctly
- If clients are "passive" , then after WBG AP announces them to root AP , they timeout after 6 minutes on root AP and obviously they are not pingable from the rest of the network. The only way to restore connectivity is to ping that device from WGB AP, then WGB AP announces via IAPP to root AP , then and only then they become visible from the rest of the network.

My question is related to this 6 minute timeout on root AP . Is it normal behaviour ?

View 5 Replies View Related

AAA/Identity/Nac :: ACS 4.2 Authenticating 4710 ACE Appliance Failed

May 5, 2011

I've got a problem with Cisco ACS 4.2 authenticating Cisco 4710 ACE appliance.
 
ACS4.2 has been configured to use both internal and external database. It's been working fine for a couple or years.
 
Recently we bought a Cisco 4710 ACE appliance. When I use ACS4.2 internal username and password to login the Cisco 4710 ACE appliance, I have no problem. I can also see the passed authentication log on ACS4.2. However, if I use AD username and password, I couldn't login in. The message is "Login incorrect". I checked the failed attempts log on the ACS4.2, there was no log regarding the failed attempt. My AD username and password works fine on all other cisco routers and switches.
 
I've posted my AAA configuration of the 4710 ACE below. ACE is running on the latest version A4(1.1).
 
tacacs-server key 7 "xxxxxxxxxxxxx"aaa group server tacacs+ tac_admin  server xx.xx.xx.xx
 
aaa authentication login default group tac_admin local aaa authentication login console group tac_admin local aaa accounting default group tac_admin

View 2 Replies View Related

Cisco AAA/Identity/Nac :: MC75 Motorola Handheld Not Authenticating With ACS

Jun 6, 2011

I have deployed a Cisco wireless environment at one of our sites. The problem is that we are rolling out new motorola handhelds (MC75) are not authenticating with the ACS. I have copied the same config as it was with the exsisting  wireless that was installed. Funny thing is we have another set of motorola handhelds (MC70) all use the same certificates and can authenticate without any issues.When i look at the ACS for logs I get the following error; EAP-TLS or PEAP authentication failed during SSL handshake.

View 6 Replies View Related

Cisco AAA/Identity/Nac :: ASA5510 / VPN Client And Clientless Users Not Authenticating With AD?

Oct 16, 2012

Web clients are receiving login failed messages and VPN clients are getting disconnected by host messages. I am able to ping the server from the ASA5510.  Users authenticate in AD.  I am not sure if the problem is on the server or the ASA.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 / Authenticating Device Admin Users Against AD Specific Groups

Jan 28, 2013

I am using ACS 5.3 What I am about is setting user authentication against existence of the user in specific AD group, not just being a member in any AD. What is happening now, users get authenticated as long as they exists in the AD, luckily they fail on authorization, as it is bound to specific AD group.
 
how can I bind the authentication aginst specific group in AD, not just using AD1 as the identity source.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Timed Out For AAA Clients

Aug 16, 2011

I have 2 ACS 5.2 (VMWARE) in my network configured as primary and secondary. When my AAA clients are configured for Primary ACS authentication works fine.But the clients configured with secondary  fails authenticating.My replication status  of the secondary box is showing UPDATED.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 Mac Filtering For WLC Clients?

Jul 30, 2012

Any upto date reference for setting up the ACS v 5.3 for mac filtering via built in radius with wireless lan controllers?
 
all I seem to find is this old document - which uses the user database.
 
the ACS 5.3 has host store, which seems like the logical place to setup mac address information
 
[URL]

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Supports IPv6 Clients?

Jun 28, 2011

We are using the Cisco ACS 5.2 for AAA to manage our network devices.  We plan to migrate all our edge's devices to IPv6 soon.  Can or when the Cisco ACS 5 support IPv6 address?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 - Delete Multiple Clients?

Jun 28, 2011

I've inherited some ACS appliances from another part of my organization.  I need to keep most of the settings but want to remove all the AAA clients; and preferably not one-by-one.  I don't see a way in the documentation and web searches have proven fruitless.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Sync / Copy AAA Clients Between Two ACS5.2

May 17, 2011

we are moving network devices (200+) authentication/authorization/accounting to new ACS5.2, is there any easy way to copy/sync all those AAA clients configuration to another ACS5.2 server? I don't need other configuration to be synced/copied to another ACS5.2 server

View 8 Replies View Related

Cisco AAA/Identity/Nac :: Wireless Clients Fail SSL / TLS Handshake And Reject ACS 5.2

Aug 29, 2011

I have a problem where wireless clients at a remote site cannot successfully authenticate through their WLC to my ACS 5.2 (Linux on VM). I have three sites where this authentication is functioning properly; at my fourth site the wireless clients fail with a PEAP error: "12321 PEAP failed SSL/TLS handshake because the client rejected the ACS local-certificate". My wireless clients are Win7 using WPA2-Enterprise security type with AES encryption. The authentication method is set to Microsoft PEAP (EAP-MSCHAP v2) and the 'Validate server certificate' is not checked. My wireless access rules on ACS 5.2 are working well at three sites. My ACS 5.2 has a self-signed certificate that doesn't expire until August 2012. A laptop that can successfully authenticate at other sites cannot authenticate at the fourth site.
 
Phase one of the PEAP process is where the client authenticates the server certificate and the TLS tunnel is created so that in phase two user authentication credentials are sent through the TLS tunnel using EAP. My clients do not seem to be able to create the TLS tunnel because they reject the ACS local certificate; thus, user credentials are never passed and authentication fails. I have renewed the ACS local certificate and rebooted the ACS server but the problem persists. My WLAN on the WLC has its security policy set to [WPA + WPA2][Auth(802.1X)]. WPA uses TKIP and WPA2 uses AES; Auth Key Mgmt is set to 802.1X. The remote site where authentication fails is a different domain; the other three sites are the same domain.
 
I can see the failed authentication attempts in my ACS "Monitoring and Reports | Reports | Catalog | AAA Protocol | RADIUS Authentication" report. They all fail with the same PEAP error: 12321 PEAP failed SSL/TLS handshake because the client rejected the ACS local-certificate. The ACS local certificate works fine at three sites--just not at the fourth. Is my problem the certificate or is it an 802.1X client problem?

View 4 Replies View Related

AAA/Identity/Nac :: SSL Certificate Installation On Acs Appliance 1120 For PEAP Clients

Apr 18, 2011

I need this SSL certficate installation on my acs appliance 1120 for PEAP clients.I have exported SSL server certficate from my old acs 3.3 server which is under acscertstore folder issued by CA vendor . I need to reuse this same SSL certificate on my acs appliance .ACS appliance certficate setup requires following two certificate to be installed for PEAP clients authentication

1) Server Certificate

2) CA certificate
 
Server Certificate : For server certifcate , I have my old certificate which is exported from my old acs 3.3 server , when i tried to download my server certficate via ftp server on my acs appliance , its looking for private key & private key file .Private key & file is generated intially on CSR request when this server certificate is requested to CA vendor for my old acs 3.3 . I dont know the private key password . If i need private key & file , then i need to generate new CSR from my acs appliance and i need to submit this CSR output to my CA vendor to generate new SSL server certificate .which is something like new server certificate request .CA certficate : For CA certficate , when i open my existing SSL certificate under detials tab in CRL distribution point , i could see below URL . whn i open this URL it giving certificate revocation list . [1]CRL Distribution Point.

View 10 Replies View Related

Cisco AAA/Identity/Nac :: Use 802.1x To Authenticate Clients On Network With Dynamic VLAN Assignment From RADIUS?

Apr 11, 2013

I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:Connect the phone and let it boot up(takes a while) and authenticate with MAB.Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan) However, the following scenario doesn't work:The computer is already connected to the phoneThe phone is then connected to the switch What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.why the first scenario works, and not the second?
 
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config: network-policy profile 1voice vlan 90!interface GigabitEthernet0/12switchport mode accessnetwork-policy 1authentication control-direction inauthentication event fail retry 1 action authorize vlan 60authentication event server dead action authorize vlan 60authentication event no-response action authorize vlan 60authentication event server alive action reinitializeauthentication host-mode multi-domainauthentication order mab dot1xauthentication priority mab dot1xauthentication port-control autoauthentication periodicauthentication violation replacemabdot1x pae authenticatordot1x timeout tx-period 5dot1x max-reauth-req 1spanning-tree portfast!Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Maximum Number Of AAA Clients Supported By Single ACS5.3 Instance

Aug 7, 2012

what is the maximum number of AAA clients supported by a single ACS5.3 instance?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: 5508 / ISE / BYOD / Windows Clients Reject ISE Local-certificate

Mar 26, 2013

We are deploying BYOD with Cisco ISE 1.1.2 and WLC (5508) using 802.1x authentication.Windows clients cannot connect to 802.1x SSID with the following error on ISE:Authentication failed : 12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
 
The client doesn't have preconfigured wifi profile or root certificate installed.The concept of BYOD suppose that you can connect your device without any installed certificates and preconfigured wifi-profiles.
 
The problem is that Windows 7 supplicant does not send TLS alert in pop up window, when connecting to 802.1x SSID.If this alert is seen, than you can accept it and proceed the connection. After that you will be asked to install ROOT-cert, get your own cert and etc.So, the question is: how to make the windows supplicant to show the pop-up window with TLS alert?

p.s. the attached file shows the example of pop up TLS-alert window

View 6 Replies View Related

Cisco AAA/Identity/Nac :: 1121 - Upgraded ACS / Clients Are Unable To Authenticate Older Appliance?

Apr 14, 2013

We have had an active ACS unit for many years now, and we've added a second one, both are 1121 Appliances.  The newer one came with 5.4, so we upgraded the older one to 5.4.
 
We setup replication between the two, with the newer one primary and the older one secondary.  Problem is, windows based clients are unable to authenticate to the older ACS appliance.  The only problem we can see is that it indicates that adclient is not running, under Monitoring & Troubleshooting, ACS Health Instance Summary.
 
So... been trying to figure out how to correct this, yet have been hard pressed to find a knowledgebase article that works.  So far, Cisco hasn't added my smartNet on the new box so I can get some support?

View 6 Replies View Related

Cisco Wireless :: OEAP 600 Not Authenticating

Feb 18, 2013

We have cisco 5508 office extend in dmz running code 7.3.112. 1132 AP seems to register and authenticate fine but OEAP 600 series dont seem to authenticate. they seem to join the controller and download the SSID but just wont authenticate ? not even registering on the AAA server

View 9 Replies View Related

Cisco :: Authenticating LMS 4.x Users Via TACACS+ On ACS 5.3.0

Jul 12, 2012

how to Configure ACS 5.x so LMS 4 users can authenticate via TACACS+?  I have ACS 5.x setup and authenticating to Active Directory.  Have changed the LMS 4.x Authentication Module to TACACS+.  Have gotten past the user / password problem by configuring a local user in LMS 4.x.  Now, am hitting the Default rule in ACS and Shell Profile is deny access.. 

View 1 Replies View Related

Cisco :: Authenticating Windows 7 On AP1231?

Feb 23, 2011

We are starting to roll out a few Win7 devices. Even on our Guest WLAN, they are taking longer to authenticate on the AP1231 than WinXP. The APs are controlled by a WLC, which connects to NAC?

View 3 Replies View Related

Linksys / Cisco Router Stuck In Authenticating?

Feb 3, 2013

Dell inspiron 1525 / Windows XP

Linksys/Cisco Router.

When trying to connect (wireless or wired), I can't get past the authenticating status. Have used this computer with same router for 3 years. If there was ever a problem, I would unplug/replug the router.I am currently connected through my neighbor's unsecured network.

View -1 Replies View Related

Cisco Wireless :: WAP4410n Authenticating To Active Directory?

Aug 22, 2011

I have a WAP4410n which I'd like to authenticate users against our corporate active directory. I would like to know how to achieve this - whether we require a dedicated RADIUS server, whether AD has a RADIUS engine which can be used, etc. Also, what would the pros / cons be of this setup versus using a WPA2 password?

View 2 Replies View Related

Dell :: Inspiron 6000 Non Stop Authenticating

Mar 15, 2012

My computers inability to connect to the internet.  It is a 2006 Dell Inspiron 6000 with a 1370 WLAN  card.  I just moved into a new house and was able to connect to my roommates wireless connection with no problem.  Then a couple weeks ago we both lost our ability to connect.  When we disconnected the router and modum and then reconnected she was able to get on the internet again.  I was unable to.  A computer savvy friend came over and through some finagling was able to get my connection going again. I might try cleaning my computer up and putting stuff onto an external hard drive.  Since then I have tried some different stuff I have seen on the internet, such as ipconfig to no avail, tried repairing the connections doesn't do anything.

View 11 Replies View Related

Cisco :: AP1252 - Authenticating Client Computers Onto Wireless Network?

May 22, 2013

I am having problems authenticating client computers onto the wireless network using a Cisco AP1252 via radius
 
Setup:

I have a Cisco AP1252 wireless Access Point connected to a Cisco ASA5510 on subnet X.X.5.Z    The access point ip address is X.X.5.101

The ASA on another port is also connected to the wired network on a different subnet X.X.0.Z
 
On the wired network are two radius servers - Ubuntus servers running freeradius which are running fine and reliably authenticate wired users for ssh connections to the ASA and importantly to the AP1252 as well (The radius servers ip addresses are X.X.0.191 and X.X.0.192)
 
Problem:

When a wireless user tries to connect to the wireless network via the AP1252 after being disconnected form it for a while (or after waking from a long sleep) they are never authenticated. They just try over and over and never obtain an IP
 
Interestingly in such a case neither Ubuntu server shows any sign of receiving an authentication request from the AP  - Both ubuntu servers are running in debug mode so they show any activity - there is none

Oddly:

If i try to authenticate a user wirelessly to the AP and leave it in the usual state of trying over and over (with no visible activity on the ubuntu servers) BUT then go to a wired machine and attempt to authenticate an ssh connection to the AP1252 using a terminal command     ssh user1@X.X.5.101   THEN as soon as I hit enter on that request (and before I enter a password for the ssh connection) THE WAITING WIRELESS USER IS IMMEDIATELY AUTHENTICATED (and the ubuntu server shows the authentication activity for the wireless user

I really do not understand this and cannot use this method to facilitate wireless user authentication 
 
What might be causing this behavior - it seems like the AP sleeping and the wired ssh request wakes it up so that it sees the pending wireless user waiting and then acts on that completing the wireless user authentication request.

View 11 Replies View Related

Cisco Firewall :: Pix 6.3 DHCP Server - Authenticating To Active Directory On DMZ

Apr 28, 2011

I will set up a Dhcp server on the inside interface of my pix.  I would like to have the DHCP Server authenticate to the Active Directory Server that is located on the DMZ.
 
Inside --pix--dmz 
Inside interface
Win 2008 DHCP 
DMZ interface
Active Directory Server
 
What would be the issues that I could run in to when I try to authenticate this server from the inside interface to the dmz? I see that Dhcprelay option is available on the PIX 6.3 I'm guessing this is the only command that I need to use: dhcprelay enable dmz

View 3 Replies View Related

Linksys Wireless Router :: WRT54GC Ver 2.0 Keeps Authenticating And Never Connects

Feb 18, 2012

I put a password on my WRT54GC ver 2.0. After that i couldn't access internet. It keeps authenticating and never connects.

View 2 Replies View Related

Cisco VPN :: ASA 5505 VPN Clients Can't Ping Router Or Other Clients On Network

Jun 18, 2012

I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
 
Result of the command: "show running-config"
 
: Saved
:
ASA Version 7.2(4)
!
hostname ASA
domain-name default.domain.invalid
 
[code].....

what I need to add to get the vpn client to be able to ping the router and clients?

View 3 Replies View Related

Cisco VPN :: 5520 / 5510 - Can VPN Clients Communicate With Other Dynamic Clients

Nov 5, 2012

We currently have an ASA 5520 communicating with 10 ASA 5510's, all on static outside addresses.  I was asked to add 5 additional 5510's on dynamic address.  All worked well in testing until it was decided that some of the dynamic clients needed to talk to each other.

My testing shows packets just dying in the 5520.

View 1 Replies View Related

Routers / Switches :: Dlink DIR 615 Router - Wireless Clients Can't See Ethernet Clients

Feb 1, 2011

I have 4 desktops cat5 to Dlink DIR 615 router. All work fine. Any wireless clients, laptop or netbooks, see the desktop computers for a while then disconnect somehow. All machines can see the Internet through the router at all times. The desktops disappear from the laptop/netbooks but the wireless machines can be seen from the desktop computers but clicking on them gets 'Access Denied' message after a wait.3 desktops = XP, 1 98SE. All laptop/netbooks = XP

View 2 Replies View Related

Netgear WNDR4500 - Clients Not Showing Up In Clients List

Jul 6, 2012

I have a Netgear WNDR4500 running the stock firmware, acting as a router for my home. I also have 2 routers that are flashed with DD-WRT (Linksys WRT54G and Asus WL-520GU) running as client bridges. The Netgear is 192.168.1.1 and the other 2 client bridges are 192.168.1.2 and 192.168.10.3. The Netgear router is performing DHCP giving addresses from 192.168.10.100 to 192.168.10.254. I have numerous machines connected to the Netgear, wirelessly and wired, and numerous machines wired to each client bridge. All machines have IP addresses that are 192.168.10.100, 192.168.10.101, 192.168.10.102, etc... Everything is working fine, but I have one question: When I access the Netgear router, it shows the client bridges as clients, machines that are wired and wireless to the Netgear router are listed as clients, but the client list does not show any clients that are connected to the client bridges. I assumed that since the router is performing DHCP that all clients would show up.

View 2 Replies View Related

Cisco VPN :: ASA5510 Can't Ping VPN Clients But Clients Can Ping

Feb 29, 2012

I have a strange issue on my ASA 5510 (8.4). I can't ping or connect to the VPN clients but the VPN clients can ping/connect to any inside resources. I have checked all the NAT extemtion entries.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved