Cisco AAA/Identity/Nac :: ACS 5.3 - How To Only Allow Specific AD Groups To Login

Nov 4, 2012

I've configured three specific AD groups, Admin, Storage, and HelpDesk, with their own commands sets.
 
This seems to be working fine, but everyone can log into everything, but they can't do anything except exit.
 
My goal is to not allow anyone to login that is not part of the three AD groups I have specified with the respective command sets.
 
All the logins hit the Admin account, even though the id in AD is not in the that AD group.  I have something screwed up.

View 6 Replies


ADVERTISEMENT

Cisco AAA/Identity/Nac :: ACS 5.3 / Authenticating Device Admin Users Against AD Specific Groups

Jan 28, 2013

I am using ACS 5.3 What I am about is setting user authentication against existence of the user in specific AD group, not just being a member in any AD. What is happening now, users get authenticated as long as they exists in the AD, luckily they fail on authorization, as it is bound to specific AD group.
 
how can I bind the authentication aginst specific group in AD, not just using AD1 as the identity source.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Identity Groups - Restrict Device Access

Apr 14, 2011

I have ACS 5.2 running as a VM.  I'm AD, then local authentication successfully for device access, but I want to define ACS user groups to restrict login. I don;t see any way to do this.  If I use AD groups, they don;t show up as selection options on the policy screens, just the ACS locallyy defined groups. 

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Can't Add AD Groups In ACS 5.2

Jul 21, 2011

I've run into an annoying issue with my ACS 5.2 install. I can no longer add directory groups in the AD settings, the ACS comes back with "The item you  are trying to delete is referenced by other items.You must remove all references to this item before it can be deleted." but I am not deleting any group, just adding.
 
Could probably be cleared with removing the AD setup completely, which for obvious reasons is not something I want to do.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Add A User Into Several Groups?

Apr 5, 2011

We are running two ACS appliances but we cannot figure out how we can add a user into 2 differents groups.Here's the context :We have a company A which is having devices, this company uses Group A.then we have a company B which is having devices, this company uses Group B.But the admin has to manage the devices for both companies A & B.We don't want to mix devices from company A with company B.Is there a way to add the user into both groups A & B.

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Will Not Enumerate 2003 AD Groups?

Aug 4, 2011

I have seen similar references to this issue, but no concrete solutions.  My new ACS appears to join my domain with little or no issues, however, when I go to list the groups nothing is ever listed.Running ACS as a vm.I have set the ntp server on the ACS server to match my domain.I can ping all domain controllers/DNS servers.nslookup resolves hostnames of my domain controllers
 
***Update***
 
I verified that a computer account for my ACS is in fact being created, however, I am receiving some Kerberos errors on my DC with the FSMO roles:
 
Event Type:          Error
Event Source:          KDC
Event Category:          None
Event ID:          26
Date:                    8/5/2011
Time:                    3:07:46 PM
User:                    N/A
Computer: <MY DC>

Description:While processing an AS request for target service krbtgt, the account <ACS SERVER> did not  have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes were 17.  The accounts available etypes were 23  -133  -128  3  1.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 Directory Groups 2008 R1

Jun 13, 2011

I have an ACS 5.1 and am trying to integrate with windows 2008 R1. The ACS has a valid AD account and indicates that its connected but when I try to list any directory groups my windows IE browser hangs?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Sync With Windows 2008 AD But Cannot See Groups

Jan 2, 2011

Recently I've been working with the ACS 5.2 (Installed on VMWare). At the beginning I was using a Win Server 2003 Enterprise edition AD, and there was no problem with the AD and the CA Authority. Because some of my customers use Win Server 2008 I change the AD platform to Win Server 2008 Enterprise edition  (x64).I don't really have a great experience with Win Server Platforms and, for what I've seen, the Win Server 2003 Services deployment is easier than the Win Server 2008 is.
 
So, when I used the Win server 2003 I could not only synchronize the ACS with the AD but also use some groups created on the AD to perform the Network Access Authentication. When I try to do the same with the Win Server 2008 AD the ACS and the Server get Synchronized but when I want to add the groups for the Authentication purposes there is no one, absolutely nothing... so I cannot do any test.Also I looked for information about the compatibility between the ACS 5.2 and the Win Server 2008 platforms and at the end the platforms are compatibles.

View 13 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 - Custom Attributes And Wireless Groups?

May 13, 2012

I have been tasked with migrating from ACS 4 to ACS 5.3. I havent had any training and so i am finding it a bit different. Currently i have this issue -
 
I have a group in  the ACS 4 for users accessing via wireless on the ACS - Code...

View 4 Replies View Related

Cisco AAA/Identity/Nac :: New Version Of ACS 5.2 Allow User To Belong To Several Groups Of AD?

Jul 7, 2011

We have ACS Engine 4.1 and want to upgrade it to 5.x.
 
Is the new version of ACS 5.2 allows a user to belong to several groups of AD ?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Setup ACS 5.2 With An ASA V8.3.2 To Lock Users Into VPN Groups?

Jan 18, 2011

I'm trying to setup ACS 5.2 with an ASA v8.3.2 to lock users into VPN groups based on a users AD group.  I've tried various combinations but the group lock isn't working.  I've done steps 1 & 2 ...
 
1) Network Devices and AAA Clients -> Define VPN

2) Users and Identity Stores -> Setup AD and Directory Groups, test connection
  
Policy Elements:
 
Q1) Policy Elements - Do I need an authorization profile for each group:

Q2) What RADIUS attributes should I use to match my ASA tunnel-groups?
 
RADIUS-IETF attribute 25?RADIUS-Cisco VPN 3000/ASA/PIX 7.x 85 (Tunnel-Group-Lock)?Other?
 
Access Policies:
 
Q1) Do I need to enable and use group mapping?

Q2) Do I need a Network Access Authorization Policy for each group?

View 8 Replies View Related

Cisco AAA/Identity/Nac :: Setup RA VPN On ASA 8.4 With 2 Groups - VPNGp1 And VPNGp2?

Aug 21, 2011

I am trying to set up RA VPN on ASA 8.4 with 2 groups - VPNGp1 and  VPNGp2. VPNGp1 users will access 1.2.3.0/24 and VPNGp2 users will access  5.6.7.0/24. User authentication will happen using ACS 5.3 Radius.
 
On ASA, I have configured the IP pools, VPN ACLs, VPN groups, group policies for each group, and tunnel groups.
 
On ACS, I have created vpn-user1 and vpn-user2 for each of 2 groups.
 
I am not sure if some more configuration needs to be done on ASA and  ACS... Do I need to add new users - vpn-user1 and vpn-user2 - on ASA,  under each corresponding group policy, using vpn-group-policy command?  Or I need to do something else on ACS?
 
Lastly, how can I configure authorization and accounting for the VPN users? Do I need to do this on ACS or on ASA?

View 8 Replies View Related

AAA/Identity/Nac :: ACS 5.3 Single Device On Multiple NDG Groups?

Jan 14, 2013

I have multiple campuses and a Central Admin...I've created Groups for all, except I need a few devices within Central to be available to the Campus Admins... (ie..a Cisco WCS System) How do I allow a device to be put into multiple NDG groups?

View 1 Replies View Related

Cisco Wireless :: Does WLC 5508 Has Capability To Create Login Credentials With Specific Time Of Validity

Jul 18, 2011

Does WLC 5508 has capability to create login credentials with specific time of validity? Could it be used in hotel set-up to provide prepaid access account to guest?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Can Latest Version Of ACS 4.0 Support Nested AD Groups

Dec 20, 2012

We are running ACS 4.0 so understandably so we are looking to upgrading to a Cisco supportable version of ACS.  The limitation of our current version of ACS does not support nested AD groups.  The latest version of ACS (I think it is 5.4) will?

View 1 Replies View Related

Cisco :: LMS 4.1 No User Defined Groups Shown In Fault Notification Groups?

Dec 12, 2011

I created some User Defined Groups in LMS 4.1, now I want to apply certain fault notification groups to Event Sets.
   
Unfortunately the Groups I configured are not in the Group Selector of the Fault Notification Group: Admin > Network > Notification and Action Settings > Fault Notification Group

View 3 Replies View Related

Cisco AAA/Identity/Nac :: 1113 - Multiple Network Device Groups Using One Windows Remote Agent?

May 4, 2011

I'm working with a 1113 ACS device running the 4.2.0.124 software.  I'm trying to get multiple network device groups to use an existing Remote Agent set up for authentication against our Windows domain.   For instance, we want our infrastructure switches to authenticate agains the local Active Directory and our WLC to authenticate users agains the same Active Directory.  When I try and set both network device groups to use the same remote agent, it fails and reports either the host name is already in use or the IP address overlaps with an existing remote agent.
 
The question is:
 
Can I have multiple network device groups use the same remote agent?   Or do I have to install the remote agent software on separate Windows servers in order to have different types of devices authenticate against the Windows AD? 

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 - Authenticate Only Specific AD Users

Jul 22, 2012

Is it possible for ACS 5.1 to only allow specific AD users to authenticate the switches and routers? Currently What I have configured is only for all AD users. I can't seem to find a way to be selective.

View 9 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 - Delete Specific Log For User X

Jun 25, 2012

on the acs 5.2 , how to delete specific log for user X, ?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 - Exclude Reporting For Specific Username?

May 16, 2011

I'd like to know if there is a way to exclude passed authentications for a specific username from reporting in the Authentications-TACACS and Authentications-RADIUS reports?
 
We have a few usernames that are used in scheduled jobs.  We only need to know when they fail authentication, so we don't need to fill up the reports with every passed authentication from these accounts.  Can this be done?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 - Specific RADIUS Attributes For IP Phones

Mar 28, 2011

I am doing MAB (MAC authentication bypass) for IP phones and printers.
 
But these devices are authenticated with different identity stores (IP phones with AD, printer local host on ACS)
 
Is there any specific AV Radius attributes that i can use in the compound conditions selections which is specific for the IP Phones?
 
so when doing the Authentication, i could seperate each type (IP phones or Printers) with the appropriate database.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 3.3 / RADIUS Vendor-Specific Attribute?

Feb 21, 2005

I'm using Cisco ACS 3.3 for RADIUS. How to do I make Vendor-Specific attribute available? (Attribute number 26, format: OctetString) The online help makes reference to it, but does not tell you how to make it available.

View 9 Replies View Related

Cisco AAA/Identity/Nac :: SSH RSA Login On 3560th?

Feb 12, 2012

how can I import a public or private key in a router? For example, a Cisco 3560th I have found some conflicting answers @ cisco.com . Background, I would like to login with PUTTY  via ssh on a Cisco Router but without username and password.The login should be made with RSA Keys. For this I need to deposit on the IOS device's the public key and on my Client the private key. For this I've already created with PuTTYGen  the two keys. The private is in the ppk format. I still need to convert this into a different format? Since there are PEM and PKCS. Below you can see what times I have entered. With the error message: "CRYPTO_PKI: Import PKCS12 operation failed, failure status = 0x705" With the following error message I can do anything?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: Can't See Login Secondary ACS 5.2

Apr 24, 2011

I have two ACS 5.2 working in redundancy Primary and Secondary my question in when my primary ACS goes down i can´t see the log in the secondary ACS. I read in the documentación that only one ACS can be configurated for working like logg collector server. Now I configurated my secondary ACS  like logg collector server now when my Primary ACS goes down i can see the logg. Finally when my Secondary ACS goes down i can modified the ACS Primary Configution by show me the logg.. Is possible to do this automaticaly for show  me the event logg ? when the ACS that is configurate like logg collector server goes down pass the event other ACS automatically..

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Login Limit Through ACS 5.0?

Jun 1, 2013

Few days ago in my wireless infrastrucer i deploy Cisco ACS 5.0 with Active directory integration. My wireless users are login through web authentication process. The authentication process is passed by AD & its working fine. But i want to do a work on my ACS 5.0 that a user cannot login simultaneously multiple device at a time.

View 21 Replies View Related

Cisco AAA/Identity/Nac :: Specific Targets Not Receiving Syslog Traffic From ACS 5.3

May 9, 2013

We have a distributed ACS 5.3 set up - a PR and DR replicating successfully.I've set up 4 remote syslog targets. 2 of them are at the same site as the PR ACS and 2 are at the same site as the DR ACS.The logging collector is set on the PR ACS.
 
The problem is that it "appears" that  PR ACS  is only sending PR ACS syslog info to one of the remote syslog targets out of the four.
 
The syslog target which does receive from the PR ACS is at the same site as the PR ACS.
 
"appears" means that some one has looked on the syslog targets to see what's been received / or not received.
 
I've been told that the syslog traffic for  syslog targets is being received from the DR ACS. Which is strange as the PR ACS is the actual log collector (and is not at the same site as the DR ACS).
 
I've also got Alarm Syslog targets set up on the PR ACS , (2 are the same ip addresses used in the 4 remote syslog targets). IP addresses of the remote syslog targets have been double checked and can be pinged from each ACS (PR and DR).

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 Simulate AD Failure - Cannot Login

Feb 2, 2012

We have an ACS 4.2 installation and we have users configured on the user setup, they authenicate using the windows database (AD). We ran failure tests and simulated AD failure but disabling the firewall rule. So the ACS server is up, AD is down. Tested user login to a switch and get the following error. External DB user invalid. It looks like as the ACS does not get a response from AD it rejects the user login.
 
What we want it to do is in the event of AD failure is to be able to login to the switch with the username configured on the switch. (as if ACS server does not respond)
 
Date Time Message-Type User-Name Group-Name Caller-ID Network  Access Profile Name Authen-Failure-Code Author-Failure-Code Author-Data NAS-Port NAS-IP-Address Filter  Information PEAP/EAP-FAST-Clear-Name EAP  Type EAP  Type Name Reason Access  Device Network  Device Group 02/03/201214:09:13Authen failedtest.testNetwork192.168.1.1(Default)External DB user invalid or bad password....tty310.0.0.1..........SWITCH30Office

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 Login Snmp Tracking?

Feb 27, 2012

Is it possible to track failed login attempts to ACS instances  (both on CLI and web GUI) by snmp? unfortunately i haven't found such option in Monitoring and Reports > Alarms > Thresholds >

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 Integration With RSA Allow Only One Login Every Minute?

Nov 1, 2011

I have an ACS 5,2.0.26-8 running on VM intergrated with RSA. Users are able to login using their RSA passcode for network management utilizing TACACS. The problem seam to be related with RSA token caching. Once a user login sucessful on device A using current token he can not login with the same token on another device. User must wait for a new token and then he can login again.  Before moving to ACS 5.2 we were using ACS 4.2 (intergrated with the same RSA) and back then ACS 4.2 cache passcode so user where able to login on devices using the same passcode. When the token change user have to use the new one. providing the same functionality like the "Token Card Settings" Durantion option under group properties, to cache token for a specific period. The global option for caching under RSA definition on 5.2 does not solve the problem.

View 4 Replies View Related

Cisco AAA/Identity/Nac :: 1120 - Account Disablement On Specific Date Feature On ACS 5.2

Nov 7, 2011

I have ACS 1120 ACS appliance running ACS version 5.2.0.26.5 ,authenticating VPN users connecting from internet using radius protocol , we have requirement that VPN user account should be disabled by a specific date , Means user ID should be revoked when their contract expire connecting to our data center .
 
I know this feature is available on ACS version 4.2.,but i could not this feature set on ACS 5.2.0 when user account is created , whether any new sepicfic patch has this feature enabled after acs version 5.2.0.26.5.
 
With out this feature this set , i cannot ensure ID are revoked automatically ,when specific date come in to end user.

View 1 Replies View Related

Cisco AAA / Identity / Nac :: How To See Login History On ASDM Or ASA5510

Apr 22, 2013

How to see the ipsec vpn client users login history, they are authenticating to the local AAA, not to active directory. I am able to see current login session. by going to monitoring vpn statistics sessions this shows me current sessions but I would like to see for example logins for vpn client for the last month.

View 11 Replies View Related

Cisco AAA/Identity/Nac :: To Login 1841 By Using LDAP Account

Jan 14, 2010

I've set up a ACS 5.1 Server an want to use it with our LDAP System. Therefor, I'm trying to login to a Cisco 1841 by using my LDAP Account, but it dosent work. The ACS seems not to know that it should use LDAP, because I get,"22056 Subject not found in applicable identity stores"LDAP is configured as Identitiy Store, the bind test works successfully and I created a sequence, where LDAP is at first position. What goes wron?? (TATACS for loal ACS Users works)

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ASA 5505 Cut Through Proxy And Redirection After Login

Jun 17, 2012

I have successfully set up a 5505 as a cut-through proxy so that wireless users are required to log in when they open a browser to access the Internet.   Is there a way to take them to the original page they requested after the login is complete, rather than having it sit at the screen where it is says they are logged in?                  

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved