Cisco AAA/Identity/Nac :: ACS 5.3 For A Second Server To Resiliency
Apr 21, 2013I am looking for any PDF, recomendation, link for best approach for secondary ACS as resiliency.
View 4 Replies
ADVERTISEMENT
Cisco WAN :: 1841 PPP Multilink Bonding 2x DSL But No Resiliency
Mar 7, 2012I have a Cisco 1841,c1841-ipbase-mz.124-20.T4.bin, with 2x HWIC-1ADSL-M.I have managed to bond 2x DSL with PPP multlink with the config below and traffic is being sent equally across both DSL circuits. However if i disconnect either of the DSL cables connectivity fails. I was expecting connectivity to continue to work just over the one circuit. [code]
View 1 Replies View RelatedFrame Relay Hub And Spoke Resiliency?
Apr 7, 2011I am having real problems trying to build resiliency into a hub and spoke frame relay scenario. I know the hub is a single point of failure. Is there any way to put some resilience into the network? There is 4 attached branch offices.
View 8 Replies View RelatedCisco Switching/Routing :: 3560 / 2851 - Build LAN Resiliency With Spanning Tree And Bridge Groups?
Oct 26, 2012I have a site that is very dense, but not high throughput. I have 4x48 port switches all 3560 and 1 2851 router. The switches are pretty much full to the brim but the site is never completly lit, they just like to move around a lot. However i wanted to provide this site with as much redundnace as possible. So my first thought was to build redundant pathing with the switches so that they could loose a switch and not have a single point of failure. So therefore I built a ring. SW1 to SW2, SW2 to SW3, SW3 to SW4, SW4 to SW1. To make this even more redundant against port hardware failure, i used two uplinks for each and built an etherchannel. is it good practice to use Etherchannel and Spanning Tree together?So i now have a good redundant LAN switching topology. I have multiple VLANs at the site so I am using Rapid-PVST. I did not set priorities on the switches as I don't think that is really truly necessary, but correct me if I am wrong!Ok so next step is to make sure that my WAN connection for all of these switches is redundant. I have a 2851 router, with 1 of the built in interfaces dedicated to our ethernet hand-off WAN connection (MPLS in this case using BGP routing). The other would be used as an uplink. I also got an additional card for the Router so that i can have redudant local LAN connections. I then built up some IRB bridges so that I could uplink the Router to SW1 and SW3. Is it good practice to use IRB Bridging on a Router to provide redundancy?So at this site i have the first part running, and it works pretty well but I have had 1 strage issue, which has to do with after a failure and re-convergence of spanning-tree, it seems that DHCP starts failing to work. I actually had to go into each of my switches make a dummy VLAN interface and put on helper-addresses to get them to work. They are not L3 switches (programatically speaking) so they should just forward the broadcast packet onto the router, which DOES have the helper-addresses programmed,Also at another site I have the bridge router setup configured, just without so many switches, and no etherchannel between the switches. This seems to work flawlessly, but the site is very small so performance issues would be difficult to spot since they are just thin-clients coming back to a Citrix server over a single T1.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 4.1 In New MCS Server?
Mar 21, 2011we Bough new mcs server in order to install ACS 4.1,now acs is running on normal PC and its fully configured , so now i want to back up the acs database and the configuration file in order to install it in the new server so how to do that
View 4 Replies View RelatedCisco AAA/Identity/Nac :: Patch ACS Server To 4.2.0.124.17 From 4.2.0.124.6?
May 9, 2011I need to patch our ACS server to 4.2.0.124.17 from 4.2.0.124.6. My question is, do I need to apply the same patch to our remote agents? Cisco's documentation only states that both the ACS and the Remote Agents need to be 4.2.0.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: Server Certification From MS CA For ACS 5.3
May 23, 2013I am wanting to generate a signing request for an ACS 5.3 box to send to a Microsoft CA. Is there anyone out there using a MS CA for eap-tls?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: Upgrade An ACS Server From 5.0 To 5.1?
Dec 7, 2009I'wont to upgade my ACS server 5.0.0.21 to 5.1 . I wont to use Active Directory . it's seem that in my curent version AD is not supported !
View 12 Replies View RelatedCisco AAA/Identity/Nac :: ACS Server Certificate From 3.3 To 4.2?
Mar 2, 2011We have enabled EAP-TLS authentication for our wireless LAN end user in our network setup , And we have defined certificate on our old acs server 3.3 from a third party CA . I want to use the same certifcate which is being used in 3.3 ,how i can copy that certficate from 3.3 and get it installed on new acs 4.2 .
View 7 Replies View RelatedCisco AAA/Identity/Nac :: 5.2 - Add Second ACS Server To Existing 4.2?
May 13, 2012Question on this, is 5.2 backwards compatible with 4.2 appliance? If not, what is needed to bring the 4.2 appliance up to 5.2 and will the VMWare version work for the second system with the appliance as primary? Years ago I had 2 of them and replication worked flawlessly, but we had to take the one unit offline for another project and have never replaced it.
View 3 Replies View RelatedAAA/Identity/Nac :: Cisco 881w - Way To Get AAA Configuration Through Server
Jun 3, 2011configure AAA (Radius server, access list) There are two devices An access point and cisco 881w. It is necessary to set up authentication through a radius server. You can configure detailed how to do this?
View 3 Replies View RelatedCisco AAA/Identity/Nac :: Guest NAC Server AAA Administration With ACS 5.3
Nov 30, 2011I'm having problems settting up a Guest NAC server to authenticate administrative users against a ACS 5.x server. In the ACS RADIUS Authentication log, I can see the user authentication is successful.In the AAA Diagnostics log, I can see the following warning:An Access-Request MUST contain either a NAS-IP-Address or a NAS-Identifier or both; Continue processing.
View 2 Replies View RelatedCisco AAA/Identity/Nac :: Converting 3140 CAM To CAS Server
Feb 7, 2011How to convert a 3140 CAM to a CAS ? if so what software / licensing would be required and is there a documented process
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 How To Enable Log On Secondary Server
Feb 28, 2013We are using ACS 5.3 with two servers in a distributed solution.All logs are collected on primary server so when this server fails all logs are lost.How can I enable log on secondary server also?
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS 4.0 Not Getting Authenticated With 2008 AD Server
Nov 8, 2011I have a cisco ACS 4.0 build 27 on windows 2003 server . My site was working fine when i was having a AD on 2003 server . Recently i have migrated my AD servers is 2008 .
After the migration the ACS is not authenticating the users . Now i have made a server with 2003 and made the site working . I need a solution to make it work using 2008 server is there any compatiblity issue between ACS 4.0 and 2008 server .
Cisco AAA/Identity/Nac :: How To Setup Sync Between Two New ACS Server V5.3
Dec 4, 2011I setup one acs v5.3 in one server in NYC and another acs v5.3 in SJC.I want to make the acs.nyc as primary and acs.sjc as the secondary, how do i setup it up?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.1 Integration With NGenius Server
Mar 8, 2011I'm currently working on ACS 5.1 to use it as AAA server for Netscout NGenius.I followed a guide for ACS 4.2 and tried to replicate the configuration settings in ACS 5.1.
- created a host profile on network devices and AAA clients having the same shared key with NGenius
- added three (3) NGenius required attributes in system administration > configuration > identity > internal users
- added attribute values to Internal User database
- created an access policy:
* identity pointing to Internal Users
- edit serverprivate.properties in NGenius server to match the requirements
I would like to have NGenius authenticate via ACS 5.1, but as of the moment there is an error message that I receive:
Unicentified error, Code=16510, Details: AV pairs do not match NGenius format ::<insert tacacs username here>, Severity 1, Code: 16510.
Cisco AAA/Identity/Nac :: Import Server Certificates On ACS 5.2
Jan 10, 2012When I tried to import the file, there are two lines there, One is Certificate file, the other is for "Private Key File".
My question for you is, is this the private key of CA? My understanding has always been that the private key stays in CA only, not going to any other devices.
Cisco AAA/Identity/Nac :: Errors In ACS View Server In ACS 5.2?
May 30, 2011I have deployed 7 appliances 5.2.0.26.4 CSACS-1121-K9 whose 6 are performing AAA authentications while the last one is is the primary and is the master for configuration and log collector.
Since this morning, I cannot access anymore the view where I can see all Radius authentication for today. I obtain the following message:The server workspace storage for on demand transient reports is full, please try again later or contact administrator to increase on demand transient report storage capacity?
Moreover, if I generate other report, I have the message:18002: iPortal generate report failed.I could find some information which makes references to a Cisco bug CSCtb98071, as below:
Launching a shared report in the ACS 5.1 Monitoring and Report Viewer displays an iportal error for a particular scenario.
#Symptom: You will see the following iportal error message when you launch a shared report:
#iPortal generate report failed.
#
#Conditions: This error occurs when you add a report to a group in the interactive viewer and save it as a shared report.
#Workaround: Avoid using the option Add Group from the interactive viewer for hyperlinked column entries when you save the report as shared
However, I am not adding any report to any group, so I don't understand why this error appears and how to solve it.
Cisco AAA/Identity/Nac :: ISE 1.1.0.665 Application Server Is Still Initializing
Sep 25, 2012I had a working server running ISE version 1.1.0.665 but someone in the build room decided to pull the power out of the server rather than shutting it down correctly. I have booted the server back up however the web management page was not accessable. I have checked the server status and the end result is the Application Server in the "still initializing" stage. I have left the server for several hours and the status has not changed.
I know people have previously run into this issue but no one has posted any resolution or confirmed that a rebuild is the only solution. I have tried to create an on-demand backup but it seems to fail when attempting to provide the credentials (which are correct) for the FTP server.
Cisco AAA/Identity/Nac :: 5508-WLC Using MS NPS As RADIUS Server For EAP-TLS
May 18, 2011getting a Cisco WLC to work with MS NPS server? We've done it before albeit with differnt code versions.
I have a Cisco 5508 WLC running 7.0.116.0 code hosting a WLAN configured for WPA2 with 802.1x for authentication. I have two Windows NPS servers configured as the RADIUS servers for EAP-TLS authentication. Via debug info on the WLC I can see the 802.1x handshake take place with the wireless client and the WLC as well as a successful transmission of an Authentication Packet from the WLC to one of the RADIUS servers. However on the WLC I see repeated RADIUS server x.x.x.x:1812 deactivated in global list and on the NPS server I'm seeing event log errors indicating "The Network Policy Server discarded the request for a user" along with the pertinent auth request info that I would expect the NPS server to receive from the WLC. Based on the WLC debug info I'm never actually getting to the EAP-TLS certificate authentication part. It seems the NPS servers don't like the format of the initial RADIUS authentication request coming from the WLC and so don't respond whcih in turn casues to WLC to switch to the other NPS server which produces the same issue.
Cisco AAA/Identity/Nac :: ACS 4.2 No Authoritative Response From Any Server
Nov 1, 2010I'm having issue with tacacs server(ACS 4.2), did the following test from the router:
Router1#test aaa group tacacs+ cisco cisco legacyAttempting authentication test to server-group tacacs+ using tacacs+No authoritative response from any server.I can ping the ACS server from this router though.
Cisco AAA/Identity/Nac :: Authentication With One ACS 4.2 Server While Authorization With Another
Apr 5, 20111 ) : Is it possible to do authentication with one ACS server while authorization with another ACS? Use case is if the user authenticated to one ACS server and then switch loses the connectivity to this ACS. Now command authorization requests will go to another ACS server since switch is not able to communicate to the 1st ACS.
2): How can the local database sync be acheived in distributed ACS deployments?
3): Are the accounting records are sync between different ACS? In other words can accounting be centeralised with ACS4.2
Cisco AAA/Identity/Nac :: ACS 5.3 Secondary Server Connection With RSA AM 6.1?
Oct 23, 2012We have 4 ACS 5.3 Servers connected as Primary and Secondary Servers.We use a "RSA SecurID Token Servers" External userdatabase for authentications and are able to sucessfully authenticate (vpn-)users when the requests are send from the primary ACS Server.As soon as a secondary ACS server sends the request to the RSA server the request fails. "Node verification failes"
On the RSA Authentication Manager 6.1 Server, we have created a Agent-host wich contains the 3 secondary nodes (FQDN and IP's). The "sdconf.rec" file has been installed on theprimary ACS Server and are automatically (so it looks like) replicated to all ACS Servers.Still none of the secondary server are able to authenticate the users agains the RSA server.
Cisco AAA/Identity/Nac :: ACS 4.2 / ISE As Standalone RADIUS Server
Apr 7, 2013Is there any way to set up our ISE to provide Radius instead of acting as Radius Proxy? In our Company we use ACS 4.2 to provide AAA via Tacacs+ and this works proper with all our Cisco-Switches. Now we are testing the ISE 1.1.1 as NAC-Solution.
I know how to set up the ISE as 'Radius Proxy', configuring the Sequences and Policies, but till now we are using only Tacacs+ for AAA. The current version of ISE does not support Tacacs+ and I don't want to set up a Radius-enviroment in ACS if not necessary. Somewhere ( I think the specs) I read, the ISE is a merge of ACS and NAC. So in my Opinion there should be a way to provide AAA via Radius on the ISE without ACS and without 'Radius Proxy'.
Cisco AAA/Identity/Nac :: How To Install ACS 4.2 On Server 2003
Oct 17, 2011I'm curently studying for my CCNP Switch certfification, and I'm learning about RADIUS and AAA. I need to practice this topics, but unfortunately I can't find any way to do it. I have cisco ACS 4.2 but I'm unable to install it on my Server 2003 (it says mmc.exe needs to be closed, tried some things but no luck...). I'm unaware of any simulator for RADIUS or anything similar.
how to install ACS 4.2 on Server 2003 (how to solve the error I'm recieving), or point me towards some other product to practise RADIUS and AAA authentication
Cisco AAA/Identity/Nac :: 4.8.2 / Adding NAC Server To Manager?
Jul 6, 2011I have a pair of managers in HA mode and a pair of servers in HA mode. The solution is working in OOB Virtual Gateway. When i add the server in the manager, which IP address must i use, the service IP address or the physical Ip address.I'm running 4.8.2
View 2 Replies View RelatedCisco AAA/Identity/Nac :: 6500 - Synchronize ACS 5.2-0-26-4 With NTP Server
Sep 14, 2011Today I have configured my ACS 5.2-0.26.4 to synchronize with NTP server which is implemented in Cisco 6500, but it don´t become to work. The switch Core is configuared in HSRP, for that reason in the ACS server I defined the IP virtual of the Core like ntp server, maybe the ACS don´t work with IP virtual of the switch Core. Finally I wanto to kown if is posible to synchronize this versión of the ACS withc cisco 6500. I had integrated this ACS versión with cisco 2800.. maybe the ACS could integrate with same special models.
View 3 Replies View RelatedAAA/Identity/Nac :: 1121 - Add Secondary ACS Server 5.4?
May 29, 2013My customer has an ACS 1121 version 5.4. Now we want to install a secondary ACS 1121.
View 2 Replies View RelatedAAA/Identity/Nac :: Status-Server Request And ACS SE 4.2?
Mar 31, 2013According to traces collected in mt ACS SE 4.2, it would seem that the underlying software does not support the RADIUS Status-Server request. Is this request type is supported in version 5.*?
View 2 Replies View RelatedCisco AAA/Identity/Nac :: Upgrade To ACS 5.4 - Authentication Server And Log Collector
Jan 28, 2013We got 2 Cisco ACS 5.2.0.26.10.Primary server as authentication server and log collector.Secondary server as authentication server. Replication is configured. url..."There are some exceptions to this usual setup, which you can handle as described below: If the ACS 5.3 primary server also functions as a log collector in your 5.3 deployment, you should promote any one of the secondary servers as primary server in the deployment. See Promoting a Secondary Server to Primary "
This exception matches with my case. I have to promote my secondary server as primary.I would have :Secondary server as authentication server and log collector.Primary server as authentication server. I think I have to deregister secondary from primary server..According to the guide, I have to upgrade the log collector server. "Step 1: Choose any secondary server to become a log collector:" I dont have another secondary server..
Cisco AAA/Identity/Nac :: ACS 4.2 Can't Install On Windows Server 2003 R2
Nov 29, 2011I have a problem when I try to install ACS 4.2 on Server 2003 R2. When I start the ACS setup, i recive an error message saying:
View 6 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 - Use RSA Server And AD To Authenticate Network Devices
Nov 10, 2011I am not sure what I am trying to do is possible, so I thought I would pose the question on here. In ACS 5.3, I would like to use an RSA server and AD to authenticate my network devices. So when I log into a router or switch I would enter my AD username, be prompted for my RSA token, then when I enable be prompted for my AD password, or visa versa. how to write an access policy to achive this?
View 2 Replies View Related
