Cisco AAA/Identity/Nac :: ACS 5.2 Deploying Devices With IOS XR
Sep 27, 2011We are deploying devices with IOS XR and wondered if deploying them with TACACS authenticating to the Cisco ACS 5.x platform.
View 1 Replies
ADVERTISEMENT
Deploying A Web Server
Sep 4, 2012Is it necessary to understand web development to deploy a web server
View 5 Replies View RelatedCisco :: Deploying Config Templates With LMS 4?
Jul 31, 2011I tried to deploy configuration templates with Cisco LMS Template Center, due to the 10 Cool LMS Tricks to better manage your network i am able to do it now.Just i don't know why, after deploying these templates the configuration is not save to the startup-config.another problem i have with the snmp-server location configuration. It seems my template does not support spaces in the textbox. Any way to put spaces in the snmp location?
<parameter name="snmp-location">
<description>SNMP Server Location</description>
Cisco :: Deploying 4400 Controller As An Anchor For 5500 Controllers?
Jun 7, 2011in one of the sites, the client has an exisiting 4402 controller which he moved to the DMZ in order to set it as an anchor & he purchased two new 5508 controllers to control the corporate APs. I configured all the parameters needed for the guest anchoring & then I tested the connection but there was an issue. (all the controllers are running the same firmware version)after testing the setup, the guest users could get an IP from the internal DHCP of the anchor controller (in DMZ), but then they cannot reach the internet or anything outside the anchor controller.Cisco confirmed that the 4400 is fully compatible with the 5500 to work in an anchor-foreign secnario as long as they are running the same firmware version. yet, when I temporarily used one of the 5500 controller in the DMZ as an anchor & I applied the exact same configurations on it as the 4400, it worked perfectly without any issues.
note: on the anchor controller (4400), the management & AP-manager interfaces reside on the same subnet & the wireless guest SSID is also mapped to the management interface. (may be this setup is causing the issue) but on the 5500 it is working just fine?
Cisco Wireless :: 5580 Deploying Router Into A Data Centre
Aug 18, 2012I'm looking at deploying a single WLC 5580 into a data centre and I'm trying to decide if to use flexconnect or to tunnel traffic back to the controller. There will be 2 offices each with 40 access points. The wireless will need to support roaming voice traffic. Will I have any issues with flexconnect and 30 access points? I'm aware that you can only have 25 aps per flexconnect group but I dont know if this has any limitations such as dirty roaming? Also is tunneling traffic back to the WLC ok for voice and video traffic as the traffic will have to travel back from the data centreto the local offices ?
View 5 Replies View RelatedCisco Application Networking :: ACE 4710 - Using Ciscoworks For Deploying New Image Software
Aug 21, 2011Is it possible to upgrade the software images on ACE 20 modules and/or ACE 4710 Appliances?
View 0 Replies View RelatedCisco Switching/Routing :: Deploying A Virtual Wireless LAN Controller (vWLC 7.3)
Mar 13, 2013I am looking at deploying a Cisco Virtual Wireless LAN Controller (vWLC 7.3).
Do I need Prime Infrastructure to manage the environment, or can I manage my AP's (1200 series) using the vWLC alone?
Cisco AAA/Identity/Nac :: Bug In ACS 5.1 When Importing Devices
Sep 20, 2011there seems to be a problem when I try to import a .csv file to ACS 5.1. After following the procedures for file exports and clicking finish I am left with the screenshot of the ImportAction window attached. According to documentation this window should allow you to monitor the progress of the bulk operation,but there is none of it.
View 3 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.2 - Add DACL To 2 Devices?
Dec 15, 2011I have an ASA 5510 on the outside with a Remote Access VPN. The user will need to get from the 5510, then go through an ASA 5540, then out to the subnet where they will be doing their work. I have a Cisco ACS version 5.2 that sits on a separte VLAN off of the 5540. I can authenticate users with Radius on the 5510 VPN and use DACLs from the ACS with no problems. However, the DACL only gets downloaded to the 5510 (as expected) and I need it to also download to the 5540. Is there a way to do this? I understand this could mean multiple authentications needed somehow. Right now when I authenticate, the DACL shows up fine in the 5510, but I get blocked from the devices I need to get to because it of course is not getting added to the 5540 as well.
Here's the basic topology I have:
remote client
|
|
(outside--internet--VPN)
5510
(vlan X)
[code]....
Cisco AAA/Identity/Nac :: ACS 1120 - How Many Devices (MAB) Can Be Authenticated
Jan 23, 2012I´m currently looking for a document that specify how many MAC addresses can be stored and authenticated via an ACS (1120)? I prefer to use the internal identity store over AD or LDAP for MAB authentication for 802.1X project. I would like to know what is the impact on the ACS? CPU/MEM? What is the impact on the user authentication? delay, timeout, etc.
View 7 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.2 Network Devices Export?
May 10, 2011I am trying to export our network devices from ACS and I can't find out where it is exporting it. Under ACS 5.2 "Network ResourcesNetwork Devices and AAA Clients" you get the list of your network devices and at the bottom of the page there is an export button. When you click it you are given an option to password protect it which I didn't check the box and I pressed Start Export. The window flickers like it processed the request, but nothing happens. There isn't any pop-up to download the CSV. I have also tried setting up a software repo thinking it might just send it to that, but it didn't work either.
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 - Use RSA Server And AD To Authenticate Network Devices
Nov 10, 2011I am not sure what I am trying to do is possible, so I thought I would pose the question on here. In ACS 5.3, I would like to use an RSA server and AD to authenticate my network devices. So when I log into a router or switch I would enter my AD username, be prompted for my RSA token, then when I enable be prompted for my AD password, or visa versa. how to write an access policy to achive this?
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS 4.2.0 Error In ACS Authentication For Accessing Devices
Jun 11, 2012We are using acs version 4.2.0 build 124 on windows server 2003. Our domain controller has been upgraded from 2003 to windows 2008 R2.Now we are facing following error in ACS authentication for accessing our devices.Error: AUTH 06/09/2012 11:55:40 E 1810 3316 0x8f21 External DB [NTAuthenDLL.dll]: Windows authentication FAILED (error 1326L)if we restarted services of ACS server then users get authentiated fine.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: How To Setup ACS 4.2 As LDAP Server To Authenticate Devices
Sep 1, 2011I have a ACS 4.2 under windows, I setuped it to authenticate routers by RADIUS and TACACS+ protocols. now I have some devices whitch know only LDAP protocol. How can setup ACS as a ldap server to authenticate those devices?>
View 1 Replies View RelatedCisco AAA/Identity/Nac :: How Many Network Devices Can Secure ACSv4.1 Support
Sep 13, 2012How many newtork devices can Cisco Secure ACSv4.1 support is there any limit on the same? How to get the Specs of Cisco Secure ACSv4.1 on the above grounds...
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ISE Profiling For Wireless Devices WLC 5508 Like Laptops
Aug 25, 2012We have integrated WLC 5508 to cisco ise 3315 with ios 1.1.1 and using Guest Sponsor portal for wireless guest users.Where we have created open ssid in wlc and redirect web login portal in wlc for guest users. We have enable all respective node in policy service for profiling and also configure snmp in wlc as well as in ise.
When guest user is connected to open ssid its get redirected to web login page of ise portal and when it gets login we are only able to see the username which guest user login but not the end device in monitoring log.
Wireless End devices are not able to get profiled can any one tell me what configuration I need to do on ise or wlc side to profiled end guest wireless device like android,iphone and laptops
AAA/Identity/Nac :: ACS 5.2 Creation Of Network Admin Policy For Nx-os Devices?
May 28, 2012i have acs 5.2 i need to create a network admin policy to our nx-os devices such as nexus switches, how this will be done on acs 5.2?
View 0 Replies View RelatedCisco AAA/Identity/Nac :: 750-1000 Devices / Maximum Accounting Session ACS 4.2 Can Handle
Aug 7, 2011We have Cisco ACS 4.2 in our network and the accounting is done for 750-1000 devices and only for level priv-15.If i want to enable accounting for all levels from priv-1 to 15. All commands executed in devices are sent to ACS. Does the ACS can that much sessions from those many devices?Am also planning to configure acs remote agent to store all the accounting history.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: 6509 - Detect And Block Unauthorized Devices / Users In Network
Sep 25, 2012we have Cisco 6509 as a access switch in our network. Each user has an IP phone and a computer. we are going to implement 802.1X for end users by next month. I need to check all the users activity in the network like if someone plug an access point to the network or a router.I just checked Cisco NAC and how to detect those activities on the network.
I need to get more details on Cisco NAC or other products for that purpose. also what is the difference between Cisco NAC and application like Microsoft TMG?
is it agent less or I have to install something on computers? is it working as a default router for users computers?
TEGs80G - Swap Unmanaged Devices With More Expensive Cisco Devices?
Jun 1, 2012Currently my home network is being switched via TrendNet TEGs80G unmanaged gig switches. I have been using them for about a year now with no issues. As my home network becomes more advanced, I recently just added a Cisco ASA5505, I am thinking about swapping those unmanaged devices, 4 of them, to managed. I was looking at the Cisco SG300-10 for upstairs, and a 16 port variant for my main core. These devices do not support full Cisco IOS cli, but they are manageable with a rich feature set nonetheless. My question is, should I swap the unmanaged devices with the more expensive Cisco devices, or just keep what works and save the money until I really need to spend it. As previously stated, my home LAN works just fine as it is, however my WiFi, NTV550s, server and workstations are all on the same network. Probably not the most secure but it is what it is without VLAN support.
View 11 Replies View RelatedLinksys Wireless Router :: E4200 Can See None Of Devices Attached To Power-line Devices
Aug 15, 2011I have installed my new E4200 and it works beautifully. I have several wirelss adapters and a few wired connections through powerline adapters. I also have a second VPN router attached to the 4200.I can see the wireless connected devices with the associated IP addresses. If I plug a laptop directly into the Cisco, I can of course see it.However, I can see none of the devices attatched to the powerline devices? I have a securty cam connected via the powerline and want to know the IP address. I checked with cisco technical support via chat and they said it is impossible. I have used 2 previous routers with the same configuration and can see all devices.
View 1 Replies View RelatedWireless Devices Can't Connect To Wired Devices?
Oct 11, 2012All of a sudden my laptop, android phone and blu ray player (all wireless devices) can't communicate with my wired devices (marantz receiver and samsung tv). Everything still connects to the internet independently but i can't for instance play music from my wireless laptop to my wired marantz receiver. I had no trouble with this last week and didn't change anything (that I'm aware of) I did get Verizon to switch out my router but it didn't solve anything. My wife's computer also cannot connect to wired devices. Lastly, if I connect my laptop with via ethernet cable it sees wired devices fine. I tried shutting off windows firewall but didn't work. I have no other firewall/virus software installed. I can ping to all devices (wired and wireless) from my laptop.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: 2960 Unprotected Identity Pattern Not Working As Expected
Oct 28, 2012I'm trying to test such 802.1x wired environment:windows xp sp3 as supplicant windows NPS as radius server 2960 as authenticator latest anyconnect (3.1.01065) + nam and standalone profile editor.I have a question: What is the difference between protected identity pattern and unprotected identity pattern (set in nam profile editor)? As I understand documentation PEAP-MSCHAPv2 is a tunneled method and it uses un- protected identity pattern to protect user's identity during phase 0. But if I use any fake identity here (anonymous, anonymous@[domain], etc) access is rejected (Access-Reject in switch debugs). I have to use exacly the same pattern in unprotected identity pattern as in protected identity pattern ([username] or [username]@[domain]) to gain access, regardless of authenticaton mode (same in machine only, user only authentication).
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.2 Group Mapping With LDAP External Identity Store
May 18, 2011I have a new Cisco Secure ACS 5.2 on a VM. We want to use it to for administrative access to our Cisco equipment with TACACS+. I am trying to map user permissions to different groups of devices based on active directory group membership, however it is not working.
I am using an LDAP (configured for secure authentication) external identity store. On the directory organization tab, I have confirmed the accuracy of the subject and group search base and the test configuration button shows that it's finding > 100 users and >100 groups.
On the directory groups page I have entered the groups according to the required format. cn=groupname1,ou=groups,dc=abc,dc=com
I have a rule based result selection under group mapping. I have two rules in the format below.
Conditon
LDAP:Externalgroups groupname1
Result
Identitygroup1
I have the default group set to a identity group named other. My problem is, no matter what user attempts to authenticate, the Default rule is applied, and the user is put into the other identity group.This occurs when I log on as a groupname1 user, groupname2 user, or as user that is not a member of either of those groups. LDAP authentication works and the user is able to logon to the device.
Cisco AAA/Identity/Nac :: ACS 5.2 - Create Microsoft Active Directory (AD) Identity Store?
Jul 11, 2011We are using ACS 5.2 and we are trying to create a Microsoft Active Directory (AD) Identity Store. We have a user to be used in the Active Directory creation General page and we would like to know how the test communication / ACS to AD communication takes place.
Our user is a predefined user in AD and has admin rights, but the password expires every 60 days. Will this affect the communication between AD and ACS 5.2 at everytime the entered user's password expires?
Cisco AAA/Identity/Nac :: ACS 5.3 Host Internal Identity Store / Per Group Modification
Jan 24, 2012I'm currently looking for a solution in order to restrict the modification of the host internal identity store (add or delete MAC host) per group. The default administrator roles does not include "per group restriction". Under the ACS I defined one group per department? My objective it to allow each department to access their ACS MAC database to add or delete MAC addresses as required.
How to restrict internal identity store per group?Do I need to create new roles? and how?I was not able to get an answer from the ACS ADMIN manual.
Cisco AAA/Identity/Nac :: ASA5550 / ACS 5.3 - 22056 Subject Not Found In Applicable Identity?
Dec 5, 2012I have a new ACS 5.3 configure and a ASA5550 to authenticate VPN users using a remote LDAP server. Once I try to authenticate the users with the ACS it gives me the error message "22056 Subject not found in the applicable identity store(s)."
I checked out the documentation and have already configure the Identity store sequences to redirect everything to the LDAP server, I also did the Bind test and it says that is ok, but I still have the same problem.
I validated the Access Policies Menu, and tried to create a new Service Selection Rules, but whet I get to the option of modifying the Identity option I get the error: "This System Failure occurred: {0}. Your changes have not been saved.Click OK to return to the list page. " and I'm not able to modify the identity, not in this new option I created, nor in the ones already created in the ACS.
Cisco AAA/Identity/Nac :: ACS 5.2 Error - 22056 Subject Not Found In Applicable Identity
Oct 6, 2012I have two ACS v 5.2 (primary and secundary) and some users are in the internal stor and the others are in the AD.The local site topology is like this:
PC - AP - WLC - ACS - AD
Authentication method is PEAP(EAP-MSCHAPv2) and all user have the certificate company installed. The OS in the client users is Windows 7.Users was working fine but some users reports intranet disconnections. I see in the ACS log many "22056 Subject not found in the applicable identity store(s)." and "24415 User authentication against Active Directory failed since user's account is locked out" alarms.I believed it was because user wasn´t in the AD data base, but some times the same user is authenticated successfull and other i see the "22056...." or "24415...." alarms.
I switched the role for ACS primary to works as secundary and we see the same alarms.
Cisco AAA/Identity/Nac :: ACS 5.2 Identity Groups - Restrict Device Access
Apr 14, 2011I have ACS 5.2 running as a VM. I'm AD, then local authentication successfully for device access, but I want to define ACS user groups to restrict login. I don;t see any way to do this. If I use AD groups, they don;t show up as selection options on the policy screens, just the ACS locallyy defined groups.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.x Identity Store Sequence And Token Validation
Dec 3, 2012We have a ACS 4.3.2 installed with users authenticating against an Active Directory database. The AD database not only authenticate the users but also assigns the group that is used to select IP address pool.Now the requirements require to use token authentication with SafeNet. This authentication uses the same username but the password is composed of the original password + OTP.The problem is that the SafeNet server doesn't return the group membership.I've read about the Identity Store Sequence in ACS 5.x and I think I could use it in the following sequence:! configure an Authentication Sequence using the SafeNet token server (this works with ACS 4.x)I configure an Attribute Retrieval Sequence against the AD database. This would use the username only, no password and would retrieve the group membership.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ISE V1.1 ISE Authorization Rules Do Not Use Endpoint Identity Group
Dec 5, 2011I'm looking for Cisco ISE v1.1 to use the following licensing feature. url...Endpoint is dynamically profiled by Cisco ISE and assigned dynamically or statically to an endpoint identity group. Cisco ISE authorization rules do not use this endpoint identity group.
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.1.0.44 External Identity Stores Account To Be Locked Out
May 11, 2012I am currently running cisco ACS 5.1.0.44 and use active directory as the main authentication identity store to allow network administrators to have access to network devices in my organization .As per the established security policies in my organization , the ACS has to disable any account after 3 failed login attempts to any network devices .i have gone through all the settings oN the acs but couldn't find where or how it is done .
View 3 Replies View RelatedCisco AAA/Identity/Nac :: Authenticate VPN Users Via ACS 5.4 And AD Via External Identity Store
Feb 22, 2013I have installed ACS 5.4 and we are looking to authenticate our Anyconnect users with ACS via Active Directory. I think I have the correct commands in our ASA ( we had ACS 4 and authenticated our anyconnect users ).
I also have configured ACS to use Active Directory and installed the server side cert in ACS. I'm just uncertain how to program ACS to use the security group that I have setup in Active Directory.