Cisco AAA/Identity/Nac :: 3650 - 802.1x Multidomain Not Working
Sep 16, 2010
I configured multidomain on a Cisco 3650 port (12.2(53)SE1), and connected a 7941 Phone and laptop behind it. The phone gets successfully authenticated but the PC does not get fully connected. The PC adapter´s icon shows a "authentication error" message. The same PC, connected to another port (same commands except "authentication host-mode multi-domain") works perfect, including new VLAN and ACL assigned from ACS.
This is the configuration on the switch port where the PC chained to the phone fails:
interface FastEthernet0/6 switchport access vlan 701 switchport mode access switchport voice vlan 123 authentication event fail action next-method authentication event server dead action authorize vlan 704 authentication event no-response action authorize vlan 701 authentication host-mode multi-domain authentication open authentication port-control auto authentication periodic dot1x pae authenticator dot1x timeout tx-period 60 spanning-tree portfast
This is the configuration on the switch port where the PC without a phone works OK (exactly the same config, except for multidomain):
interface FastEthernet0/7 switchport access vlan 701 switchport mode access switchport voice vlan 123 authentication event fail action next-method authentication event server dead action authorize vlan 704 authentication event no-response action authorize vlan 701 authentication open authentication port-control auto authentication periodic dot1x pae authenticator dot1x timeout tx-period 60 spanning-tree portfast When the PC fails to get connected, I see the following messages on the switch:
Sep 17 18:36:18: %DOT1X-5-SUCCESS: Authentication successful for client (0023.aeb8.ce44) on Interface Fa0/6 AuditSessionID 0A01460A000000310080FDFCSep 17 18:36:18: %AUTHMGR-7-RESULT: Authentication
[Code].....
View 9 Replies
ADVERTISEMENT
Mar 14, 2013
I have created a PBR in 3650 switch to route traffic from a specific IP address to a specific next hop or IP address(Router)
ROM: Bootstrap program is C3560 boot loader
BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(44)SE5, RELEASE SOFTWARE (fc1)
SW1 uptime is 6 weeks, 2 days, 16 minutes
System returned to ROM by power-on
[Code]....
View 6 Replies
View Related
Feb 28, 2012
I am doing 802.1X for a user on Cisco 3650 and wanted the Radius Server to return an attribute to set the Duplex setting of the port. with the correct Radius Return Attribute.
View 4 Replies
View Related
Oct 28, 2012
I'm trying to test such 802.1x wired environment:windows xp sp3 as supplicant windows NPS as radius server 2960 as authenticator latest anyconnect (3.1.01065) + nam and standalone profile editor.I have a question: What is the difference between protected identity pattern and unprotected identity pattern (set in nam profile editor)? As I understand documentation PEAP-MSCHAPv2 is a tunneled method and it uses un- protected identity pattern to protect user's identity during phase 0. But if I use any fake identity here (anonymous, anonymous@[domain], etc) access is rejected (Access-Reject in switch debugs). I have to use exacly the same pattern in unprotected identity pattern as in protected identity pattern ([username] or [username]@[domain]) to gain access, regardless of authenticaton mode (same in machine only, user only authentication).
View 1 Replies
View Related
Apr 15, 2012
We are about to move our IT rack to a data centre and will be adding a new Layer 3 (Catalyst 3560) switch beyond our ASA 5510 which will be providing our existing WAN plus another SVI which will be carrying our HSRP range.
I have never configured a switch to use two SVI's before and can't seem to find the relevant docs online.
View 2 Replies
View Related
Mar 11, 2012
We have a 3750 and a 3560 defined as a layer 2 switches. One gig port on each switch is trunked to layer 3 switches, which containall the VLAN definitions etc. The other gig port on the 3650 and 3750 switches are trunked together to provide an alternative path in the event of a failure.
We have added a new device to the 3750 and given it a VLAN 9, and the VLAN added to allowable VLANS on both trunk ports between the layer 3 and layer 2 devices ie:
switch port trunk allowed vlan 9,10,20,30,40,50,60,90,200,202,206,211,212,700.
From either of the 3750 or the 3560 we can ping any device on any VLAN on any switch in this group with exception ofVLAN 9. We can however ping the ip address of VLAN 9 on the layer three switches.
View 2 Replies
View Related
Jul 9, 2012
Seeing very strange behaviour my 2811 Router is sitting behind 3650 switch, when the link between switch and router is trunk the router start rebooting itself, to test i changed to access mode then I can see ip address of router on cdp neig de or else not seeing ip address of router.
View 3 Replies
View Related
Sep 16, 2012
I have a small network using a 24 port 3750 switch. I need to add five computers in another room and only have one Cat 6 cable running there and no room left on the 3750. I got a 3650 to put in the new room with the new computers. The problem is, whenever I plug the new switch into the 3750, it shuts down the port and gives me an err-disable. I can do a shut/no shut and re-enable the port. I searched the web and read about trunking and clusters. I'm not sure which, if either, is appropriate. I see various documentation that shows you can put one switch behind the other. But nothing tells me the configuration which will allow it.
View 9 Replies
View Related
Aug 3, 2011
Configuring a network with Rapid Spanning Tree Protocol. There's a combination of Cisco 3650s, 2950 and 2960 switches. It is a flat Layer 2 network with a single VLAN. CLI configuration?
View 3 Replies
View Related
Nov 22, 2011
Does 3650-X IP Base support Static Load Balancing or i should upgrade to ip service SW ?
View 4 Replies
View Related
Dec 22, 2012
I have set up a scenario for a small business and have some questions about how to manage the access between the VLANs. Is there is a better / another way to do it. See the attached picture for the topology / info.
My question is:
My switches is set up with x numbers of VLANs and a routed port (no switch port) to the ASA for internet connectivity. How is the best (or only??) way to manage the access between the VLANs? Is it ACL's on the switch?
And by "managing access" I mean VLAN 50 (public WiFi) only have access to the internet, only management servers have access to management VLAN, Client VLAN only have RDP access to server VLAN and so on. Is there any way to do this in the ASA (or add another (gigabit) router to the topology)) or it the only way to have lots of ACL's on the switch itself? I have thought about "router on a stick", but then I imagine there will be a bottleneck between the switch and the ASA?
(Equipment is 2 x 3650G, ASA5505, AP1252 - see attached file).
View 3 Replies
View Related
May 18, 2013
I have a question about speed negotiation process between interfaces. I have 3650X Sw and 2960S-48port. All ports of two are GigabitEthernet, however the link between them is only 100Mb/s, Full duplex. I try to set the speed 1000 Mb/s manually in the interface then the interface never up. Its status is down/down. I must set back to speed auto. I show interface Gigabit0/24 in Sw 3650-X and figure out that there are many output drop (over 600000). I clear counter then after two days the output drop is over 70000. This link is trunk link between two switches, all ports of access SW are Gigabit and connect to PC. First, I thinks the 3650X is throttled somewhere in output direction of trunk link. But there is another trunk link (Gi0/23) to another 2960S-48port and no output drop number in this interface. This Giga 0/23 speed is 1000 Mb/s (auto speed, auto duplex)
Does any outside things impact the speed negotiation process between 2 interfaces? And output drop number may caused by abnormal speed between two Gigabit interface?
View 1 Replies
View Related
May 22, 2013
|_voip PBX___|-----|__3650___|------fiber-------------|__3650_____|------|_voipphone__| I have a case where voipphone is registered on the voippbx but peaple on both end can't hear each other . No ACL on both 3650 , no firewalls between them , distance is about 2 miles . I tried to make telnet x.x.x.x 1720 or 1719 or 1721 (h323 ports) to opposite switch -connection refused . How can test if ports are open on the 3650 ? Is it coorect If I create allowing acl and apply it on both 3650 on the interfaces connected one switch to voippbx "IN" , second switch on the interf connected to voipphone "IN" ?
View 3 Replies
View Related
Apr 9, 2006
How does the 3550 with enhanced image compare to the 3650 with enhanced image in terms of routing functionality?
View 5 Replies
View Related
Sep 20, 2012
I have a question regarding fabric storage and cisco catalyst switch 3650.My plan is connecta a esxi server to a nexus switch and then to a san storage. I want add a new switch to have a redundant link between esxi and the storage.Can I use a cisco catalyst 3650 with a fiber conecction to connect the HBA esxi server card to 3650 sw and the SAN storage to the 3650 sw ?
View 2 Replies
View Related
Sep 27, 2012
I got a question about ACS 5.3 and WLC We have now the ACS 5.3 running for MAB (good working) and TACAS for device AAA.But now our WLC’s will not work.I have created already a special “custom attribute” => role1 / mandatory / ALL Already changed to the combinations Role1=ALL / Role1=All / Role1=all / role1=ALL / role1=All / role1=all But still not working. I get a wrong response.
I followed the guideline in attach, PDF file.
Debug dump from WLC
ACS 5.2 / ACS 5.3
-------------------
*tplusTransportThread: Sep 28 15:07:59.222: auth_cont get_pass reply: pkt_length=24
*tplusTransportThread: Sep 28 15:07:59.222: processTplusAuthResponse: Continue auth transaction
*tplusTransportThread: Sep 28 15:07:59.388: tplus response: type=1 seq_no=4 session_id=b1fddbfc length=6 encrypted=0
[code]....
View 3 Replies
View Related
Apr 20, 2011
I have Cisco ACS 4.2 since few days users can not change their password, what could be the issue? Even after resetting the password I got error.
View 3 Replies
View Related
Aug 17, 2011
I have a dot1x client with client certificate working well with my ACS 5.2 and EAP-TLS. Now I would like to configure the Re-Auth periode on the ACS 5.2, I did the following:
1. Configure a Access Profile with Reauthentication Timer = static and 30 seconds (see attachment ACS1.png and ACS2.png)
2. Enabled authentication periodic and authentication timer reauthenticate server on switchport
interface GigabitEthernet1/0/x
description to dot1x clients
switchport access vlan 5
switchport mode access
authentication event fail action authorize vlan 998
[code]....
View 2 Replies
View Related
Sep 12, 2012
I've got an issue with my ACS 5.1 implementation not updating any of the RADIUS or TACACS authz, authc, or acct records. Nothing is showing up, even though i've logged in via TACACS to several devices, and there are numerous wireless devices authenticated and online via RADIUS right now.
View 3 Replies
View Related
Mar 4, 2013
I have to created command set under "Policy Elements>Authorization and Permissions>Device Administration" for limited access user in ACS 5.3. Like i triyed to give them permission to only few show commands. I have set user priviledge 1, 7, 10 however either of the priviledge level user was able to run those commands. I works like the shell priviledge level.
View 1 Replies
View Related
Mar 31, 2011
We have a Cisco Access Control Server (TACACS+ version 5.1) with an additional 2 port NIC card. This produces 4 ports on the ACS server(G0 through G3).After initial setup of the ACS server with an IP address on G0, I connected a Windows 7server with IE8 to G0. The ACS web interface appears (after accepting certificate) and Ientered some user accounts and NDGs.I then connected the ACS server to a configured port with port-security on our 6500switch. The port becomes err-disabled since the MAC address does not match up. It appearsthat the onboard NIC on the ACS server is bonded thus producing the MAC address issue.To fix this connection issue, on the ACS server, I cleared out G0 and setup G2 (additiional NIC card) with the IP address. After connecting to the 6500 switch, the ACS server port works fine. I removed the connection to the 6500 and connected the Windows server to the ACS.I can ping the ACS server but the web interface is now unavailable unlike before. I do not get a certificate warning on IE, it just states that internet not available. On ACS, the 'show' status of acs shows all the processes are running and initialized. It has got me stumped as all I did was change NIC configurationon the ACS server.
View 8 Replies
View Related
Oct 9, 2011
we updated our NAC appliances from 4.8.1 to 4.9 and have noticed that web authentication is no longer woking on Apple IOS devices. We had setup a user page for the MAC_ALL OS and iphones etc. were able to authenticate using thier browser ok. Now (after the upgrade) after they authenticate they receive the below warning.
There doens't seem to be any other config changes we can make for the IOS device.
View 2 Replies
View Related
Jan 31, 2011
I have not managed to get the Monitoring to work on the ACS 5.1. This is an eval version. Advanced monitoring and reporting is installed on the ACS. This is my configuration on the Cisco Router
aaa accounting exec default start-stop group tacacs+aaa accounting commands 0 default start-stop group tacacs+aaa accounting commands 1 default start-stop group tacacs+aaa accounting commands 15 default start-stop group tacacs+aaa accounting connection default start-stop group tacacs+
logging origin-id iplogging facility sysloglogging source-interface GigabitEthernet1/1logging host 1.1.1.1 transport udp port 20514
logging monitor informational
epm logging
On the ACS, when I open the dashboard --> ACS health -> I get Status not available.Global Instance under Logging Categories been configured for local logging?
View 4 Replies
View Related
Oct 19, 2011
we are facing a strange problem with a Cisco Small Business SG 200-08 Switch (firmware release 1.0.1.0). When configuring the switch to act as a RADIUS Client with 802.1x port security enabled, it sends the “Account Name” attribute to the radius server with max. 32 characters. The string comes in this format: host/dns Host Name and will be cut after 32 characters which will cause the NPS to say: “The specified domain does not exist.” and NPS is right. When I reduce the hostname so that host/dnsHostName <= 32 characters, authentication is working fine. And by the way, we also have a SG 200-26 in production and it can handle more than 32 characters which lead me to think of a bug in the firmware of the SG 200-08.
View 1 Replies
View Related
Feb 14, 2012
I'm trying to configure a timeout for network connection, but when it suppose to disconnect client, it's not working. Is it possible to do this??
Only works when the client is connecting and is denied if the time is not valid. But how could I do this if the client is already connected, enable re-authentication?
View 2 Replies
View Related
Nov 27, 2012
I configure my Cisco ACS5.2 using Command set policy and providing Shell access 15.I allow user only “show * ” command.It works fine with Telnet. User Group cannot execute any command apart from “Show * ”But when I connect the device using Console user group has full permission on the devices.I believe Command set policy is not working on Console. Is it normal behavior or do I need to update some changes in ACS or Network devices ?
My network device configuration is as below :
tacacs-server host 10.x.x.x key test123
tacacs-server host 10.y.y.y key test123
tacacs-server timeout 1
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
[code].....
View 1 Replies
View Related
Aug 25, 2011
I have configured under Administration password policies about password lenght, items to be putted as number, letters and so on.on the second tab is the password expire for users and I configured to expire after 90 days.
I even tried creating a new user and changing a password from an existing user using Apache TOMCAT WAR,I have checked CLOCK of ACS appliance and setted up NTP on our internal NTP servers
even I create a new user or I change the password via Admin GUI or I change the user password via Apache TOMCAT WAR, I have the user being disabled in a few of minutes, half an hour.,As last, with CISCO AnyConnect is possible to warn the user about the password being expireing and if so, the change could be driven via AnyConnect or is absolutely needed a User Hand Task on the Apache TOMCAT portal I setted up with the ACS WAR application?
View 6 Replies
View Related
Sep 13, 2012
I have a cisco 3845 running 12.4(15)T10.
I can send a POD and disconnect my session. But when I try to send a COA, I always get back the same error. Here is the debug log:
*Sep 14 17:25:16.017: COA: 172.16.XX.XX request queued
*Sep 14 17:25:16.017: ++++++ CoA Attribute List ++++++
*Sep 14 17:25:16.017: 66F2DBEC 0 00000009 string-session-id(337) 8 0000007F
*Sep 14 17:25:16.017: 670B3394 0 00000009 sub-qos-policy-out(346) 11 POLICE-TEST
[code]....
View 10 Replies
View Related
Feb 3, 2013
C4948-10G switch running IOS 15.0(2)SG ?ACS 4.2 cannot authenticate on the vrf interface. The issue on vrf aaa authentication.
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication login no_tacacs local
aaa authentication enable default group tacacs+ enable
[code]....
View 13 Replies
View Related
Mar 3, 2013
We have a configuration that work fine but one of the combinations it don´t work. When we connect a guest laptop, the first time work fine. The configuration is when the laptop don´t authenticates with radius, the dhcp server assigned vlan guest and ip guest. The first time was ok. After, We connect a laptop with users authenticates work ok, the radius asigned vlan of users and dhcp server assigned ip users. The problem was when we connect for two time a guest laptop, radius didn´t validate and laptop didn´t negociate ip with dhcp server. In this time, the administrator of dhcp server, tell us that they didn´t see nothing traffic of my mac. and anymore run fine. If Whe change the port of switch , the laptup start working again.
Radius=NPS
Server dhcp: is typical.
Our scenario is with a ip cisco phone. the ip phone don´t have the authentication. The administrator of radius tell us that the configuratation is fine and the configuration of dhcp is fine. When we connect only laptop, everything run ok.
Configuration Port.
interface GigabitEthernet1/0/3
switchport access vlan 202
switchport mode access
[Code]...
View 4 Replies
View Related
Mar 20, 2013
I am trying to get AAA Authentication working on a Cisco 2960-24pc-l running 12.2(55)SE5 IOS and cannot get it to work. I have it currently working on a Cisco 3750-24te-m running 12.2(55)SE IOS. Here is my config: [code]
When I login to the 3750, AAA is used. When I login to the 2960, the local username is used. Any thoughs here as to why it works on the 3850 and not the 2960?
View 2 Replies
View Related
Feb 25, 2013
For some reason i can't get access anymore to the web interface of our ACS 5.3 appliance.Where i used to get a certificate warning first, and after that the ACS5 login screen, i now get totally no response anymore in my IE browser.
I can telnet to port 443 of the unit however. And i (fortunately) still have ssh access to the unit. So i did a reload (microsoft habits) but that did'nt solve anything.https access to other systems from the same browser is functioning fine
=================================
admin# sh ver
Cisco Application Deployment Engine OS Release: 1.2ADE-OS Build Version: 1.2.0.228ADE-OS System Architecture: i386
Copyright (c) 2005-2009 by Cisco Systems, Inc.All rights reserved.Hostname: <deleted>
Version information of installed applications---------------------------------------------
Cisco ACS VERSION INFORMATION-----------------------------Version : 5.3.0.40.8Internal Build ID : B.839Patches :5-3-0-40-55-3-0-40-8
=================================
View 4 Replies
View Related
Feb 28, 2013
I've configure Ldap authentication on ASA 5545 to allow only a certain user group. I mapped the the memberOf group but this seems not to be working as it allows all AD users. [code]
View 1 Replies
View Related