Cisco AAA/Identity/Nac :: ACS-1120 Large Deployment License?

Mar 26, 2011

i  have 4 X ACS-1120. Each 2 are operating as an Primary and backup. I  want to add a license in order for the ACS to support more than 500  networks which includes in the base license.As I understand this is the license required : L-CSACS-5-LRG-LIC=
 ·        
Is this license applicable to ACS-1120 appliance with ver 5.2 ? – I understand that it is. for my scenario, do I need to purchase total of 2 X L-CSACS-5-LRG-LIC=  (one for each environment, one license will serve 2 X ACS in Primary  and Backup) or I need to purchase 4 licenses each for each ACS ? – I  understand that one license will serve deployment of two ACS in primary  and active scenario. 

View 1 Replies


ADVERTISEMENT

Cisco AAA/Identity/Nac :: ACS 5.x Large Deployment Add-on License / When Should Be Loaded

Mar 24, 2012

I already have large deployment add-on license. I also have 3 ACS Servers. Now, my primary ACS server is now up and my two secondary ACS server will be put up soon.
 
Just want to ask, when should be the large deployment add-on license be loaded? Can I load it to my primary ACS server eventhough my secondary servers are still not up? Or should I load it to my primary ACS server when my two secondary servers are already up?

View 3 Replies View Related

AAA/Identity/Nac :: CSACS-1120 - How To Export License From ACS

Jul 22, 2012

I have an ACS applicance that had a version 5.1 and i did an upgrade to 5.3 with latest patch.For some reason, the runtime process got stuck in (reinitializing and restarting) state.i did the recommended action to perform ACS stop and ACS start and even hard reset of the appliance, but it did not cut itThis process turned out to be a bug and it should have been fixed in version 5.3, but it has not i guess
 
i know that acs reset-config will solve the issue, but i have a problem here , the license file will be deleted as well with the config and i cannot find a way to export the license and then import it into the reseted config ACS hardware. Unfortunately, the license file is not saved anywhere in the company and i cannot affort to lose it.how to export the license from the applicance (CSACS-1120)?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 License - Redundancy Deployment

Feb 9, 2012

I have a question about my ACS redundancy deployment. I bought three ACS all of them came with base license. but i bought large deployment license my question is necesary to buy the large deployment license to add two seconday ACS to my Primary ACS ? now if I install the large deployment in my primary ACS it replique to other ACS or I have to install first the large deployment one by one (secondary ACS) before to join to the Primary ACS.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1120 - How Many Devices (MAB) Can Be Authenticated

Jan 23, 2012

I´m currently looking for a document that specify how many MAC addresses can be stored and authenticated via an ACS (1120)? I prefer to use the internal identity store over AD or LDAP for MAB authentication for 802.1X project. I would like to know what is the impact on the ACS? CPU/MEM? What is the impact on the user authentication? delay, timeout, etc.

View 7 Replies View Related

Cisco AAA/Identity/Nac :: Enabling ICMP On ACS 1120?

Feb 28, 2011

We have downgraded cisco acs appliance 1120 from ACS 5.0 to ACS 4.2.1.15 , when we perform ICMP ping request to acs appliance its not responding , But i can do ping test from acs appliance on console mode not  from GUI mode .
 
Is there any option to enable ICMP Ping response on cisco acs 1120 . else any patch to be upgraded to perform this action , my requirement is enable ICMP ping on acs appliance for troubleshooting . instead always check with telnet x.x.x.x 2002 for service responding

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1120 And RAID Configuration?

Jul 4, 2011

I encountered some strange issues with one of our appliances in the field. Reinstalled and encountered the strange issues. No errors.. did some memory test and the seagate harddisk test and encountered SMART errors. The device didn't log those errors anywhere.. First reason to check the second harddisk. The appliance is shipped with two so the first thing I was thinking of was RAID. I saw that raid wasn't configured. Try to boot the second harddisk and saw that nothing was on that disk.. so what is the mean reason you got two of those? Got the new machine and try some options to configure RAID.You got two options.. didn't see this before, most of the time you got only one option. Raid driver on or no RAID configuration at all. First tried the intel storage matrix, configured both of the disks for mirror and install the ACS 5.2. The machine boots after installs and rejects the DVD. Result: The installation doesn't boot! Checked the partition with gparted but the partition is active (or flagged as boot) Second option was LSI, got the raid configured for mirror and the installation was also completed. Result: working installation. Tried to test if the installation is still working after removing one of the disks. Appliance is complaining the the RAID is missing one disk (so this works). After that the machine tries to boot, result: no working ACS.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: 1120 ACS 5 - Remote Log Targets?

Mar 19, 2012

I have configured the appliance everything is working fine.We have a remote syslog server and I have configured the  remote syslog server details in the "Remote Log Targets" and  and Logging Categories.But I cannot see any logs on my syslog server  

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ACS 1120 Running 5.0.0.21 RADIUS Timeout With WLC 7.0?

Aug 29, 2011

i am configuring a Cisco Secure ACS 1120 appliance running ACS 5.0.0.21 to handle RADIUS request from a Cisco WLC 5508 appliance running version 7.0.116.0.these devices have open communication on all ports - no firewalls or ACL'sthey have successful ping communication The following statements illustrate some but not all the debugging I have done to ensure each device functions as it should in isolation.Using a simple windows RADIUS server (radserv2.exe) instead of the Cisco ACS  This works and the WLC gets RADIUS response from my makeshift serverUsing a simple windows EAP client to query the ACS using RADIUS protocol   this works and the ACS processes the RADIUS request and sends a responsePlaced a wireshark client on the network to inspect timeout. Wireshark logs the packet from the WLC to the ACS using port 1812 but doesn't see any packet  responses from the ACS At the moment I have the WLC accepting the association from the wireless client and sending the RADIUS (PEAP, EAP-FAST or EAP-TLS) request to the ACS, the WLC receives no response and generates a timeout message and disassociates from the client. note this is not a reject or similar message, the ACS simple does not even process the packet. i.e. there is absolutely nothing in the ACS logs to suggest it even received a radius packet from the WLC. In summary the WLC and the ACS successfully function independently but they do not communicate via radius.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Error Opening Acs Logs

Mar 6, 2013

I have problem with ACS 5.0 on reporting.  On "Monitoring and Report" page  in  Faverite Reports when i clicking on "Authentications - RADIUS - Today", My browser displays error "Error while reading skin-access.config. Please make sure the file exists and conforms to the schema specified"
 
I must also mention that I never upgraded the version of ACS from 5.0 also from command line all the acs services are running. It is running on CISCO 1120 Secure Access Controll Server apliance.
 
My second question is can I upgrade the version of ACS to 5.4 with Cisco Secure ACS 5 Base License?

View 4 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Registering ACS 5.2 Instance To Primary

May 29, 2013

When attempting to register an ACS instance to a primary (via System Administration -> Operations -> Local Operations -> Deployment Operations), I receive the following error as a popup in my browser:
 
"This System Failure occurred:  /opt/CSCOacs/db/acs.crt (No such file or directory). Your changes have not been saved.Click OK to return to the list page."
 
I had 2 ACS 1120 appliances clustered, 1 suffered a hardware failure about a year ago so I replaced it with a VM. That one is now the primary. I'm now wanting to replace the secondary instance (the remaining 1120 appliance) with a VM as well. I removed the current appliance from the network, installed the VM using the same IP address, and attempted to register. It failed as per the above error. After trying this a number of times, I then decided to return the 1120 appliance to secondary status and attempted to register it with the same results as above.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.0 0n 1120 Appliance Stopped Booting

May 10, 2012

I have an acs 5.0 running on Cisco 1120 appliance. It has worked for 2 years. Suddenly, I discovered that user can no longer login with their credentials. On close examination, when I console, the booting does not complete. Screen shot attached.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: CSACS-1120 To Active Directory Without Success

Apr 18, 2011

I'm trying to join a band new CSACS-1120 to our active directory without success. The process in it self should be pretty straigh forward, but so far no luck.
 
I've configured the relevant info under "Users and Identity Stores > External Identity Stores > Active Directory.
 
Active Directory Domain Name: xxx.com
Username/Password : domain administrator account
 
When I test connection I get a info dialog "This machine is currently connected to domain xxx.com".After which I try to save changes which gives a reply ""This System Failure occurred: {0}. Your changes have not been saved. Click OK to return to the list page."
 
I've noticed that in the system log "show logging system tail" that I get a exception as soon as I enter the AD configuration page and subsequently every time I perform a action on that section.
 
Why the AD join keeps on failing and what the debug exception I'm getting means?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Test EAP TLS Authentication On ACS 4.2.1.15 Running On Appliance 1120

May 2, 2011

i am trying to test EAP_TLS authentication on acs 4.2.1.15 running on Appliance 1120 , I have installed my server certficate along with CA certficate on my appliance box , I have enabled features of  EAP_TLS under golbal authentication setup .
 
I have downloaded client supplicant certficate file for my windows XP machine .When i tried to authenticated i am finding following error message under  failed attempts(EAP-TLS or PEAP authentication failed due to unknown CA certificate during SSL handshake) on my acs appliance box .Under certficate revocation list , I have forced my CA as CRL in use . Attached snap shot of all .

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Required Patch For ACS Appliance 1120 Version 4.2.15.3

May 4, 2011

Need URL for patch 4.2.1.15.3  with comptaible for cisco acs appliance 1120 . Though its for appliance patch should be along with webserver . I have downloaded patch of SE its not comptaible to this hardware .

View 4 Replies View Related

AAA/Identity/Nac :: Upgrade From 5.1 To 5.2 By Having Smarnet On 1120 Secure ACS Appliance?

Mar 13, 2011

Am I entitle to upgrade from 5.1 to 5.2 by having smarnet on my 1120 Secure ACS Appliance?

View 1 Replies View Related

AAA/Identity/Nac :: Windows ACS 4.2.0 Backup Database On 1120 Appliance 4.2.1.15?

Apr 26, 2011

I am running windows based acs 3.3 in my lan environment going to be replaced with acs 1120 appliance running acs 4.2.1.15 , ACS 3.3 database has been built upto  4.2.0.124 ,step by step by upgrade process
 
1) acs 3.3.3.14---> 4.1.1.24
2) acs 4.1.1.24 ----> 4.2.0.124 .
 
now my database is with 4.2.0.124 dmp file , I cannot upgrade my database to 4.2.1.15 because 4.2.1.15 patch is not applicable & executable  on 90 days evalution package of 4.2.0.124 of windows platform .
 
can i import my windows based 4.2.0.124 datbase directly to my acs appliance running 4.2.1.15.3 ??? , else its requires any step to be done to modify the windows based databse matching to appliance windows verison once .
 
I could see on appliance under restore settings the following options (restore from 4.2.0 backup file to acs 4.2.1)

View 8 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Account Disablement On Specific Date Feature On ACS 5.2

Nov 7, 2011

I have ACS 1120 ACS appliance running ACS version 5.2.0.26.5 ,authenticating VPN users connecting from internet using radius protocol , we have requirement that VPN user account should be disabled by a specific date , Means user ID should be revoked when their contract expire connecting to our data center .
 
I know this feature is available on ACS version 4.2.,but i could not this feature set on ACS 5.2.0 when user account is created , whether any new sepicfic patch has this feature enabled after acs version 5.2.0.26.5.
 
With out this feature this set , i cannot ensure ID are revoked automatically ,when specific date come in to end user.

View 1 Replies View Related

AAA/Identity/Nac :: SSL Certificate Installation On Acs Appliance 1120 For PEAP Clients

Apr 18, 2011

I need this SSL certficate installation on my acs appliance 1120 for PEAP clients.I have exported SSL server certficate from my old acs 3.3 server which is under acscertstore folder issued by CA vendor . I need to reuse this same SSL certificate on my acs appliance .ACS appliance certficate setup requires following two certificate to be installed for PEAP clients authentication

1) Server Certificate

2) CA certificate
 
Server Certificate : For server certifcate , I have my old certificate which is exported from my old acs 3.3 server , when i tried to download my server certficate via ftp server on my acs appliance , its looking for private key & private key file .Private key & file is generated intially on CSR request when this server certificate is requested to CA vendor for my old acs 3.3 . I dont know the private key password . If i need private key & file , then i need to generate new CSR from my acs appliance and i need to submit this CSR output to my CA vendor to generate new SSL server certificate .which is something like new server certificate request .CA certficate : For CA certficate , when i open my existing SSL certificate under detials tab in CRL distribution point , i could see below URL . whn i open this URL it giving certificate revocation list . [1]CRL Distribution Point.

View 10 Replies View Related

Cisco AAA/Identity/Nac :: 1240AG / ISE Deployment In Wireless Infra Without WLC

Jul 1, 2012

I am having access point 1240AG and planning to deploy ISE as a exteral radius server. I would like to know how different authorization policy need to configure in AP/ISE. Whether I can use named ACL or VLANs (CoA) as a enforcement types without use of WLC. If yes then how?

View 10 Replies View Related

Cisco AAA/Identity/Nac :: WLC 5500 Deployment Just For Open Access Wi-Fi Network

Jun 6, 2013

I am going to deploy Cisco ISE with WLC 5500. I have two kinds of users one for which I want to deploy just open access Wi-Fi network, without working with Cisco ISE and Second group of Users for which I want to deploy Cisco ISE services like advanced authentication, posture and profiling. For both users I have just one WLC. Is there any problem to just deploy two SSID one for open access (without Cisco ISE) and second Secure with Cisco ISE ?

View 5 Replies View Related

Cisco AAA/Identity/Nac :: 1521 ISE 1.1.1 Firewall Rules Distributed Deployment

Dec 1, 2012

I am struggling in some areas to work out my firewall rules for a distributed deployment. The referenced documentation is not entirely clear in my opinion. In some instances it is easy to work out what ports need to be opened eg Admin node TCP 22,80,443 for management from administrator hosts/ranges. In other instances it difficult to work out eg TCP 1521 Database listener and AQ is this for ISE nodes only or for access devices aswell
 
My question is whether there is a better document that details these requirements. What rules are meant to be ISE node - ISE node communications and which rules are for access device - ISE, or ISE - access device. One of the rules I am pretty confused about is the PSN CoA ports. SHould the rule be WLC - PSN on 1700 and 3799 or is it the otherway round or unidirectional?
 
I am pretty sure that the ports are meant to be ISE-ISE in most instances barring the PSN for Radius and CoA.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Nexus 7K Is Mandatory To Implement SGACLs Within Trust-Sec Infrastructure Deployment

Jan 11, 2012

I am wondering if having a Nexus 7K is mandatory to implement SGACLs within a TrustSec Infrastructure deployment or having a Nexus 5500 could be enough?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 And Large Windows Access Tokens?

Nov 4, 2012

We have some users who use AnyConnect regularly; the tunnel is terminated on a 5520 ASA. The tunnel group is currently set up to send RADIUS aaa requests to the ACS server, which in turn is set up to query Active Directory. This is working perfectly for all AnyConnect users except for one person. authentication worked fine for this person as well before we switched from an old Steel Belted Radius server that used to be doing the same thing basically, it handled the RADIUS requests but did a look up into Active Directory. So that part of it has not changed. So now when this user tries to log in he gets these the Windows event logs.   
 
Date        : 11/02/2012
 Time        : 21:13:39
Type        : Information

[code].....
 
I've looked though the ASA configuration and it is using a valid certificate and everything, signed by GoDaddy etc…. It won’t' let me look at the certificate authority configuration because it says it can't be configured when in a failover pair. I don't really think the problem is at the ASA at this point, because all other users are authenticating correctly. (And so was this user before switching to ACS)Also in the ACS logs it says the user used the wrong password and that is why authentication is failing, but they are using the correct password. So now I am looking into issues with the users account in particular. Something that I think may be worth noting is that this user has a very large access token (one of the largest in the entire organization) belonging to over 98 groups (not including all the sub groups). I'm wondering if having a very large access token could be throwing ACS off for some reason.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 Primary / Secondary Same License?

Jan 22, 2012

I have a question about the number of Cisco licenses needed in two cases for ACS 5.3 Virtual Machine.One primary + One secondary : Just one license for all or one license for the primary + another one for the secondary ?One primary + several secondaries : Just one license for all or one license for the primary + just one license for all the secondaries ? 

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 License File Installation Failed

Sep 19, 2011

have a  ACS 5.2 version installed on Vmware . I  purchased below  liscense
 
Product Name                  : L-CSACS-5-LRG-LIC=
Product Description         : L-CSACS-5-LRG-LIC= : ACS 5 Large Deployment License (Electronic Delivery)
 
When i am trying to upgrade the liscense i am getting an Error " Liscense file installation failed : The liscense file must contain single base liscense "

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Will Shipment Of ISE-3315-K9 Includes 3000 End-points Base License

Oct 11, 2011

We want to buy a ISE-3315-K9 for 500 end-devices.In the price-list I found the ISE-3315-K9 but cannot find the base license: L-ISE-BSE-500=. (I think I need this license)Will the shipment of the ISE-3315-K9 includes a 3000 end-points base license (maximum support of the ISE-3315) or do I need to order the base 500 license seperately?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: 2000 Base Concurrent Users Exceed License Allowable Count

Mar 25, 2013

Getting the following alarm from my ISE:Cause:Base License Enforcement Details: Base concurrent users exceed license allowable count.Currently only using 1656 out of 2000 base licenses so I'm not sure what the issue is. Running 1.1.2.145 patch 3.

View 1 Replies View Related

Cisco Firewall :: Difference Of VPN Plus License And Security Plus License ASA 5520

Oct 16, 2012

What's the difference between VPN Plus license and Security Plus license. I have new 5520 shipped with VPN Plus license.Also does it require a seperate license for Anyconnect for Mobile and AnyConnect Essentials.

View 1 Replies View Related

Cisco :: Installation PI1.2 Basic License With LMS4.0 License For 100 Devices

Apr 3, 2013

I’m stuck in some problem with installation of LMS4.0 in customer site.
 
- we purchase a LMS4.0(CWLMS-4.0-100-K9) but couldn’t install it on Windows server 2008 R2 64bit because those things don’t support each other.
- I need to upgrade the LMS4.0 to LMS4.2 that is supporting Windows server 2008 R2 64bit.
- So, I ordered following items via product update tool (url...) [code]
 
- In this status, how to install LMS4.2 with license for 100 devices? If I install R-PI12-BASE-K9 first, can i enter a licese for 100 devices for CWLMS-4.0-100-K9 into PI1.2?

View 3 Replies View Related

Cisco :: 1120 - Software Upgrade From Version 3.3 To 5.x

Feb 16, 2011

I want to upgrade my Cisco ACS Engine appliance 1120 from software version 3.3 to the latest version (5.x). How do I go about this?

View 2 Replies View Related

Cisco Application :: Disable Telnet For ACS 1120 Appliance Version 5.0

Feb 5, 2012

disable telnet for ACS 1120 Appliance version 5.0.0.21 .is there anway to do it , not able to login via telnet and ssh it says wrong credentials but webgui is working fine with same user and password.

View 1 Replies View Related

Cisco Wireless :: Aironet 1100 / 1120 / 1130 Support For IPv6?

May 27, 2012

I find much document, but not found information about whether those support for IPv6 e.g. dual-stack like newer series.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved