Cisco AAA/Identity/Nac :: ACS 5.3 Doesn't Purge User Sessions When VPNs Terminate
Feb 2, 2012
we use an asa5520 like vpn termination point, asa uses acs5.3 for authentication purpose, and all seems to work properly,but acs5.3 doesn't purge user sessions when vpns terminate; I can see many user "logged-in" into menu System Administration --> Users --> Purge User Sessions; this is a problem, because we have configured max session per user how can avoid this problem? is there any new configuration to implement into asa?
we need to configure max session per user, but there is only a global option applyed to all users.how can we configure user accounting? we need to know how long a user is connected via vpn session.
We are using ACS 5.1 in our network. We have created users and grouped them as per the requirements. We want to restrict the user sessions in the network. A user should authenticate and able to access a network resource. But when he is active with that session, we need to block him from another successful authentication. We want to avoid multiple users using same user credentials for logging into the devices. whether this can be achieved by making configuration changes in ACS.
I have recently installed four Cisco RV042 v3 VPN routers for a customer of ours to replace existing Nortel Contivity 1010 devices which were providing VPN tunnels from the customer's 3 branches to their headoffice. The original Nortel devices were working perfectly but the customer wanted some firewall rule changes and the Nortels were proving to be somewhat inflexible and incomprehensible in their configuration hence why they were replaced.
When installing the Cisco routers I configured the VPN settings to match the Nortel device settings so that I could swap out a branch at a time without taking the whole setup down for a day.The customer has a Unix based dumb-terminal application running on a server at headoffice that they access from their branches using terminal emulators on Windows PCs and thin client hardware devices that support vt100 terminal emulation.
Prior to installing the Cisco RV042's everything was working fine. Now they are using the RV042's they keep getting the sessions from their branches dropped. Both PC users and thin client users are losing sessions and it happens with active and idle sessions. I have checked the logs on the routers when users are disconnected and there is nothing logged at that time (other than my login)... I had thought maybe it was to do with tunnel renegotioations so I have set to phase 1 / phase 2 SA timeouts to 86400 & 28800 seconds respectively but this has had no effect. I had also seen somebody advised disabling 'SPI' in the firewall... I have tried this and it makes no difference.
the customer has a problem with LMS 3.2. This software doesn't terminate ssh sessions created by LMS on ACE. All ssh sessions still exist on ACE, so no new ssh session can be created until the administrator manually clear these session on ACE.
I am setting up a simple remote IPsec VPN with a ASA 8.4. All I want to do is the remote user can VPN into the ASA, from there, he can browse the outside Web pages in the internet. and we'd like not to use split-tunneling. The outside infterface is 192.168.1.155/24, which is inside our network and this subnet works fine to outside. The pool for vpn is 192.168.0.0./24 (please pay attention to the 3r octet)
I configured and the remote user can vpn in and get an IP from the pool. but it seems that he cannot do anything. he cannot ping anything.I suspected the NATTing that i use. What is configured wrong? What traffic need to be natted and what need not.
======:ASA Version 8.4(2) ! !interface GigabitEthernet0description VPN interfacenameif outsidesecurity-level 0ip address 192.168.1.156 255.255.255.0 !interface GigabitEthernet1description VPN interfacenameif insidesecurity-level 100ip address 192.168.0.1 255.255.255.0 !ftp mode passiveobject network obj-192.168.0.0subnet 192.168.0.0 255.255.255.0object network obj-192.168.1.155host 192.168.1.155access-list EXTERNAL extended permit ip any any access-list EXTERNAL extended permit icmp any any access-list vpn extended permit ip 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0 pager lines 24mtu outside 1500mtu inside 1500ip local pool testpool 192.168.0.10-192.168.0.15ip verify reverse-path interface outsideicmp unreachable rate-limit 1 burst-size 1icmp permit any outsideicmp permit any insideno asdm history enablearp timeout
I've looked at the forum posts and the document post, and I understand the explanations. My question is, under system administration>max user session global settings, would setting a timeout (say 1 hour) purge these sessions?
Under access policies, I am not enforcing max concurrent sessions per user, due to some of our devices using a generic log in. But if I understand the explanation, and my understanding might be wrong, then setting an expiry timeout should purge the accounting sessions, right?
We are using ACS 5.1 and from time to time we are getting a warning saying that the active sessions are over the limit (250000). It is just a warning, so my assumption is that its not a big deal, but how do we keep from getting the event, or prevent the event?
I have recently enabled the SMTP alert function in ACS 5.3. It seems to work well for most of the alerts. One thing though, the active sessions are over limit warning that comes up every so often. I know it is not impacting operations and it is ACS's way of clearing out sessions that had no accounting stop, but how do I disable this alert from being sent by e-mail from ACS 5.3?
We are running ACS 5.2 patch 6 and want to restrict access for users to be able to add devices to the system.For example, admin person in site A can only add devices into the site A group and cannot see/access other sites groups.
i'am using csm 4.1 and i have configured the keep audit log for 30 days and the entries becomes older than the number of days specified in the keep audit log without deleting, i don't understand why this happend and how can i make shur that the purge is done. if the purge is automaticaly or i have to delete the oldest entries by my self.
i'am using csm 4.1 and i have configured the keep audit log for 30 days and the entries becomes older than the number of days specified in the keep audit log without deleting, i don't understand why this happend and how can i make shur that the purge is done.
if the purge is automaticaly or i have to delete the oldest entries by my self.
Save and reset button is not working on Sys log Purge Settings page (Admin > Network > Purge Settings > Sys log Purge Settings) when Email: field is not empty. An Reset button is not working at all.This is the Cisco Prime LMS 4.2.1.
Is it only my LMS server or you all have this bug?
I can not setup a new user, or access wireless networks that show on my laptop had a virus and the shop said they removed it but the network has not worked since it a dell inspiron 1525
Have WBR-2310 D-Link router. Internet modem and wireless router were working. While trying to connect new wireless printer, lost internet connect. Had to re-enter internet provider user id and password. Was told I needed to make sure that information was in my D-link router, so I typed 192.168.0.1 as internet address. I don't get a webpage to enter the userid and password.
Have been using the Router for four years, recently its started to lose "memory" re. my user name and password. Switching off overnight, I'm not able to connect to the internet until I login and fill in the two boxes for my ID & PW.
Just set-up a new X2000, loaded latest firmware 2.0.01, configured it via the web UI ('Browser based utility' as per the manual). Connected OK to my ADSL broadband by O2. Configured wireless, everything OK. Funny it doesn't need a user name, only a password, my prevoius WAG160N could be configured for both.Now I want to configure the Parental Controls, BUT apart from my computer name and an Android phone name, all I see in the Target Device ADD button pop-up are a list of repeated 'Network Device'. There seems no way to be able to distinguish which is which device (mix of XP & Win 7 PC's and HP Printer through a separate switch), as it does not show IP address or MAC.
I thought I may have better luck with the Cisco Connect software (which I didn't use to set-up the router). I downloaded the latest version 1.4.11194.0, and ran this on another computer with wireless. Apart from reconfiguring my static IP address to DHCP, and then connecting through DHCP, the software said it could not configure my router. So it never gets to a point where it installs any program on the computer so that I can configure Parental Controls. How do I get the router to show ALL the computer names in the list rather than 'Network Device' or is there a way to distinguish which 'Network Device' is which computer?
We are running two ACS appliances but we cannot figure out how we can add a user into 2 differents groups.Here's the context :We have a company A which is having devices, this company uses Group A.then we have a company B which is having devices, this company uses Group B.But the admin has to manage the devices for both companies A & B.We don't want to mix devices from company A with company B.Is there a way to add the user into both groups A & B.
I have ACS 5.1.I have created the Identity Group 'Admin' and added 2 users in that, say User1 and User2.How do I permit only User1 to get authenticated when he logins in to the device?There is option to select 'UserName' while creating Service Access Policy , but I have observed that though I have mentioned only User1 in the rule, User2 is also getting permitted
On the ACS ver5, there is a "User Change Password" feature. When i click the UCP WSDL, it gives me a page with WSDL language. how is it supposed to be installed? does it copy or install to any web server
My company's security group uses Tripwire to monitor for changes in start-config and running-config on network devices in PCI scope. We are migrating from ACS v4.2 to v5.2. I need to create the account for Tripwire on the ACS Appliance but did not want to assign the admin role which would give access to configure terminal. The user role does not have privileges for show start-config or show running-config. Am I missing something or are these the only 2 roles available at the CLI? Can another rolle be added?
I want to have a local user in ACS that is permitted to login to routers. I have TACACS with AD already working but cannot get a local user to work. I used to do this in ACS 4.x.I created a user in the internal identity store.I tried configuring a policy to allow this users TACACS authentication multiple ways to no avail. I cannot find a config example doc and cannot figure it out from the user guide as the documention is sorely lacking.
So we have this problem that just started, I can replicate the issue as well, if a user makes a mistake on typing there password after 1 attempt ACS sends 3 to AD locking out the user.
In a putty or secureCRT session after 1 password failed attempt, I am unable to retry with that same session.
The issue seems to be that after 1 bad password attempt, from the client side I am unable to get another try.
We are using ACS 4.2.1.15 with patch 8 on ACS 1113 SE box.
Our requirement is to assign ACS loal group to user on basis of windows Nt group. Which means I dont wants to create individual users in ACS rather when user will login, the auth request will be forwarded to AD(remote database). Depeneding on the remote database group the user should be mapped to local database.
For this I have configured "database group mapping" according to following cisco guide. [URL]
However when ever my AD users are authenticating they are getting the membership of default group as configured in "Default" profile. I am using TACACS+ protocol in my routers and switches for authentication.
whether "Group mapping by External user database" works with TACACS+ or only with RADIUS protocol. If it works with TACACS+ what else configuration need to be done so that my ACS can map users to proper groups instead of default group.
I am trying to setup up a rule to allow wireless access only to users in my AD when they use computers from my AD.I have Machine authentication working on it's own (computer boots up and connects to wireless - confrimed by ACS logs) I have User authentication working But when I try to creat the floowing rule:it does not work.
I use ACS appliance 1120 for cisco devices administration. The identity store is external. I use Active directory. Actually, Authentication, authorization and accounting work well but users can not change theirs Active directory password when they have expired. Do you now how to configure ACS to permit password changing?
we have created some administration accounts which should only have the possibility to work on the user database. the useradmin role is to limited to create a user and set a fixed password only, but not able to enable the users authentication against a predefined external identity store. Other roles which makes this possible are far to powerful for a second level adminstrator.The adminstrator should have the possibility the create an user and set the password check against an external database. This is not possible with the predefine role "UserAdmin". Other roles do have to many rights for these users.
Migrating from 4.2 to 5.2 acs and have noticed there is no expiration date per internal user added. We expire users at different times due to their time on site. Is there something that has to be added to get back this basic feature we had before?
