Cisco AAA/Identity/Nac :: ACS 5.3 Time And Telnet Device Name?
Sep 12, 2012
This is the great place for ACS discussions , i need two more inputs from experts
acsserver
Thu Sep 13 14:35:28 UTC 2012
pughaz
15
[ CmdAV=ip tacacs source-interface FastEthernet 0/1 ]
Device Type:All Device Types:ROUTERS, Location:All Locations:NON DC DEVICES
On the above message
1. Need to chang time from UTC to IST
2. The Device column is not showing the exact device name ; i telnet and config changed , it is showing the device group name only , how to get the exact device name i telnet on this message
View 1 Replies
ADVERTISEMENT
Mar 14, 2013
1) KA-AGR-DEP-C1941#telnet 74.125.236.133 /source-interface gigabitEthernet 0/1
% telnet connections not permitted from this terminal
How can we enable telnet for the above for testing
2) KA-AGR-DEP-C1941#sh caller
Active Idle
Line User Service Time Time
vty 132 agri VTY 00:02:24 00:00:00
Here we are getting the time of our vty login and not the serial link uptime. How can we enable to check the serial link uptime.
3) CGHSULSOR#traceroute google.com
Translating "google.com"...domain server (164.100.3.1) [OK]
Type escape sequence to abort.
Tracing the route to google.com (74.125.236.129)
1 10.161.20.69 4 msec 4 msec 4 msec
2 10.255.232.38 4 msec 4 msec 4 msec
3 10.255.238.237 40 msec 40 msec 40 msec
4 10.255.221.225 40 msec 40 msec 40 msec
5 * *
CGHSULSOR#telnet 74.125.236.129 80
Trying 74.125.236.129, 80 ...
% Connection refused by remote host
In the above case it's showing refused by remote host. If the port 80 is opened in firewall also if we get this error what will be the issue. As i understood when firewall port is opened we wil get as OPEN
View 4 Replies
View Related
Jul 12, 2011
On an ASA5520 v7.2 I can only seem to authenticate to the console when using telnet and not ssh. I can connect using both methods, but just have trouble authenticating with ssh. Here are relevent lines related to the issue:
username user1 password ***** encrypted privilege 15username user2 password ***** encrypted privilege 15
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
telnet <my subnet> 255.255.255.0 Inside
ssh <my subnet> 255.255.255.0 Inside
View 2 Replies
View Related
Aug 12, 2010
How do we disable the telnet to ACS appliance 4.2 1113 SE
View 4 Replies
View Related
Apr 14, 2011
I have ACS 5.2 running as a VM. I'm AD, then local authentication successfully for device access, but I want to define ACS user groups to restrict login. I don;t see any way to do this. If I use AD groups, they don;t show up as selection options on the policy screens, just the ACS locallyy defined groups.
View 1 Replies
View Related
Nov 29, 2012
I ve recognized some strange issue with LMS 4.2 , when the router becomes down or unreachable , the LMS doesn't send any event as Faultview,also when the router comes back online the LMS takes 1 hour to show its state as reachable.
View 3 Replies
View Related
May 18, 2012
My environment have two device ,a cisco css11501 and a cisco 2960 ,when I reboot CSS11501 then 2960 shutdown fa0/41
I command "sh logging | in 0/41" just up down two time,not five times in 10 seconds
.May 17 11:13:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/41, changed state to down
.May 17 11:13:19: %LINK-3-UPDOWN: Interface FastEthernet0/41, changed state to down
.May 17 11:14:53: %PM-4-ERR_DISABLE: link-flap error detected on Fa0/41, putting Fa0/41 in err-disable state
.May 17 13:44:35: %LINK-3-UPDOWN: Interface FastEthernet0/41, changed state to up
.May 17 13:44:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/41, changed state to up
View 4 Replies
View Related
Aug 29, 2011
On the CLI, we have ACS showing:
clock timezone Etc/GMT-6
!
ntp server 10.10.10.1
A show clock shows the correct local time. When in the GUI of ACS the clock reads
Tue Aug 30, 2011 21:13:58 GMT+06:00
View 1 Replies
View Related
Feb 6, 2011
I have the new E4200 with an attached 750GB hard disk.All works well, however the media server becomes unavailable most of the time and renders the device useless.
I can connect to the Media Server from my xbox and laptop for an hour or so, and then all of a sudden it is gone. The only option I have is to reboot the router to bring it back online however not all of the music and videos are shown on the media server (yet).I uploaded quite a bit of music and video to the hard disk, I can initiate a scan but after a while the media server becomes unavailable / cannot connect to it.
View 9 Replies
View Related
Jun 20, 2012
I have an ACS Server 5.1 which is used to authenticate my cisco and non-cisco devices. however when I take report on my authentications, the time shown in the report is wrong. However, when I take my mouse pointer to the report , the correct time is highlighted.
View 4 Replies
View Related
Dec 12, 2011
I am sending TACACS administration logging to a syslog server. When the messages show up on the syslog server, they are 5 hours ahead of the actual time. Time on the ACS is correct - local logging shows the correct time. Time on the syslog server is correct...all other devices/systems sending syslog messages to it are coming through with the correct time. why the ACS syslog messages would be 5 hours ahead?
View 3 Replies
View Related
Oct 8, 2012
We have dialup users that are connecting to our portal for uploading/downloading credit information. We are currently using ACS 3.3. There is a requirement that, initially we provide clients with their username/password, but we want to enforce the policy that when the user logs in first time, he should be prompted (forcefully) to change his password.
1) Can this be done in ACS 3.3
2) What solution shall be used in this case ? can it be done in ACS 5.3 ?
View 5 Replies
View Related
Mar 13, 2013
In our scenario, easy vpn users are being authenticated by acs 5.3 successfully. We have created seperate user group for these users. The issue is, these users are also able to access our routers using their username/password. I want to restrict this particular group so that its not able to access any device.
View 1 Replies
View Related
Sep 30, 2010
We are using ACS ver 4.2 and trying to setup users with limited access to our switchs and routers. Here is what we did:
1) Created a user in ACS
2) Create Shell command Autorization Set - ReadOnly
Unmatched Commands - Deny
Commands Added
show
exit
* this should limit the user to the show and exit command only (correct)?
3) Created a group - HelpDesk with the following TACACS+ Settings
Shell (exec) is checked
Priviledge level is check with 15 as the assigned level
Assign a Shell Command Authorization Set for any network device - selected
ReadOnly - shell command autorization set seleted
When the user logs on to the router/switch it appears that he has full access. He can enter the enable command, config terminal command, etc. All we want him to be able to do is to issue the show command.
View 13 Replies
View Related
Oct 15, 2012
I have a question reguarding the Cisco Secure ACS 5.2 and network access vs device admin access. We have our switches,routers,and firewall configured to use TACACS+. We also have configured our Wireless LAN Controller to use RADIUS for allowing for 802.1X authentication to the wireless network. We are using Active Directory for the backend user database and have assigned the users to different groups in AD. We have a Network Admins group to access the network devices and a Wireless Users to access the WLAN. The problem that we have is that everyone in the Wireless Users group can access the devices and run full commands on them. We want to limit the Wireless Users group from being able to do this. Is there a policy or config change that we will need to make for this?
View 3 Replies
View Related
Mar 15, 2012
I have 2 types of network, DC & Office. I have 3 types of users NOC, Office & DC. Office network devices are in Office NDG, DC network devices are in DC NDG. Becasue of such config, Office network users can only access Office devices & DC network users can only access DC network devices....Now i have NOC users, who wants access to both Office & DC network devices. How can i achieve this?
View 6 Replies
View Related
Sep 18, 2012
I have a ACS version 5.2 (TACACS) where I require equipment integrated with Sandvine, I currently looking information and very little to manage the integration of ACS with these teams Sandvine.
I have an information on the provider Sandvine with a guide to the case where only states:
TACACS + server
On a TACACS + server, each user entry must allow the service "Sandvine". Within this
service, the attribute-value pairs Following can exist:
• An attribute named "Sandvine-Group" of type string.
[Code]......
View 4 Replies
View Related
Dec 1, 2011
my admin user is still being assigned privilege level 1, as shown in AAA Protocol > TACACS+ Authentication Details report.The report seems to show that the user is getting the right shell profile (Selected Shell Profile: Net-Admin -- is the one I setup for this user's group with both Default Privilege and Maximum Privilege set to Static 15). But still not the right privilege (Privilege Level: 1).Also, I found this document via Google: [URL] The router configuration examples all show this "aaa authorization exec tacacs+|radius local" command, which my device does not have.So I am wondering if I am not reading the ACS report right, or the device actually was assigned the correct privilge but that does not work without the "aaa authorization exec" command in the configuration?
View 1 Replies
View Related
Apr 19, 2011
I am trying to integrate Cisco ACS 5.2 in a network to do device authentication of switches for administrators.
I am not sure if Cisco ACS 5.2 support RADIUS protocol to do device authentication. In the configuration of the Cisco ACS 5.2 I can only see TACACS authentication for device authentication and I have configured it and it works. If CISCO ACS 5.2 supports RADIUS auth for device authentication?
View 1 Replies
View Related
Aug 21, 2011
I am new to ACS 5.1.I need to configure the ACS to act as the 802.1x authentication Server, as well as, act as the Radius Server for the authentication and authorization process when I access the switch.
I had created Two rules (under the Access policy) to cater for the two scenario, it will always "stuck" at the 1st rule. For e.g. Rule-1 is meant for the 802.1x, Rule 2 is meant for the AAA process. When I tested with 802.1x, it worked perfectly. But when I tested to login to the switch, it always failed. Based on the log, Rule1 is not able to fulfill my requirement (of course it can't). I thought the rules check process will proceed with Rule-2, but apparently it did not.
View 2 Replies
View Related
Jan 14, 2013
I have multiple campuses and a Central Admin...I've created Groups for all, except I need a few devices within Central to be available to the Campus Admins... (ie..a Cisco WCS System) How do I allow a device to be put into multiple NDG groups?
View 1 Replies
View Related
Jan 24, 2013
how the CDP device sensor probe works with ISE ?What I am trying to do, is to identify different Cisco Wireless Access Point models (i.e. LAP 1142) with ISE.Since the APs do speak CDP (I can see the AP devices on the switch), this should be possible with the CDP device sensor on the switch, shouldn't it I have done the following so far: Configured the switch to talk to ISE via radius accounting: [code] Should this config make the switch send CDP information about connected devices to the ISE (via radius accounting) ?How do the device sensors work ?
View 6 Replies
View Related
Sep 21, 2012
I'm running an ISE 1.1.1 and i need to authenticate guest users.The goal is apply different Authorization profile to the same guest user based on the thevice he use to connect to the guest wlan.
I.E.:
if guest user "user1" connect to the guest WLAN using a windows laptop, than apply "Guest" authorization profile
if guest user "user1" connect to the guest WLAN using an Apple iPad, than apply "Mobile" authorization profile
I've tried to deployed the following 2 authorization policy:
1)if "Apple-Device" and "IdentityGroup:Name EQUALS Guest" then "Mobile"
2)if "Guest" then "Guest"
but the first rule never match and even if I use and iPad to access the guest network the "Guest" authorization Profile is matched
I've verified that the iPad is correctly recognized as an Apple-Device changing for test purposes the rule table in
1)if "Apple-Device" then "Mobile"
2)if "Guest" then "Guest"
View 5 Replies
View Related
Jul 20, 2010
I'm trying to configure ACS 5.1 as radius server for a catalyst switch but i can't make it work.I keep on getting the "11033 Selected Service type is not Network Access" error message.
Tacacs works fine but radius does not. Any sample device administration config to use with RADIUS?it seem the service type does not work with radius in this scenario ( radius + device admin).
View 10 Replies
View Related
Jul 19, 2012
We are conduction a Proof Of Concept (PoC) on Secure Bring Your Own Device ( BYOD ) using Cisco ISE and gonna test all the scenarios like Wired, Wireless and VPN user access.
Our Setup has ISE VM acting as Admin, Monitor and Profiling Device, we have NAC 3315 physical Appliance as Inline posture Device, Wireless LAN controller, Access point and the Identity source as Microsof Active Directory.Having Plans to Integrate Mobile Device Management ( MDM ) and Citrix VDI setup also.
As of now we have tested the Wired Scenario Authentication and authorization for guest users and gonna carry out the profiling and posture.
-MDM can be integrated to ISE ?
-How the MDM can be integrated to Cisco ISE configuration or Guide to show the same?
-What is the demarcation between MDM and ISE ( i.e. What is the role of ISE and MDM on Mobile Devices ) ?
-If MDM is available so then when the control of ISE ends, does MDM do management or ISE will do management of the devices ?
-Is MDM will do client provisioning or ISE should do ?
-Is MDM send or update patches of Mobile Devices ?
View 5 Replies
View Related
Jun 13, 2012
I am trying to move a device from the Default location to a sub group and get the following message when I try (either with IE or Firefox)
This System Failure occurred: Index : 0, Size: 0. Your changes have not been saved. Click OK to return to the list page.
it also gives me the same error if I try and change the Device type from default to a sub group. I'm sure I could do this previously. The ACS build is (VMWARE install):
Cisco Application Deployment Engine OS Release: 1.2ADE-OS Build Version: 1.2.0.228ADE-OS System Architecture: i386
Copyright (c) 2005-2009 by Cisco Systems, Inc.All rights reserved.Hostname: ACS1
Version information of installed applications---------------------------------------------
Cisco ACS VERSION INFORMATION-----------------------------Version : 5.3.0.40Internal Build ID : B.839
I'm suspecting it a read/write issue with the database or a database corruption. I have stopped and started the application acs via the console and show application status acs has the following to say about itself.
ACS1/admin# show application status acs
ACS role: PRIMARY
Process 'database' runningProcess 'management' runningProcess 'runtime' runningProcess 'view-database' runningProcess 'view-jobmanager' runningProcess 'view-alertmanager' runningProcess 'view-collector' runningProcess 'view-logprocessor' running
View 3 Replies
View Related
Jul 6, 2010
I've just installed ACS 5.1 and noticed that it seems to count managed devices differently than previous versions.
I have a 500 count license which should be fine as I have about 100 devices which will use ACS for TACACS. On ACS 3.x and 4.x, I would set up AAA clients by using a wild card for the subnets that host our routers/switches, say 192.168.1.0/24, 172.16.1.0/24 and 10.1.1.0/24. when I do this with ACS 5, I get a Managed Device Count Exceeded error messasge becasue of the potential of more than 500 AAA clients. It seems to be counting every IP address in the subnet as a managed device, even if there are only a handful actually in use. Is there a way around this short of having to manually enter (and maintain) the exact IP Address of every managed switch and rotuer which will use the ACS server for TACACS?
View 10 Replies
View Related
Sep 18, 2012
Under 'Policy Elements/Authorization and Permissions/Network Access/Authorization profiles' I have defined a profile and the following Attribute:Attribute = F5-LTM-User-RoleType = Unsigned Integer 32Value = 300.
My question is:How can I define the same as above using 'Device Administration/Shell Profiles' ?
There is a Custom Attributes tab but I cannot figure out how to specify the 'Type' field. (Under Custom Attributes tab there is only space for 2 fields and not 3 fields).
View 3 Replies
View Related
Jun 14, 2012
we've configured an ACS 5.1 and integrated it with active directory Win2K3, we created two groups in the AD for managing network devices one for Administrators and the other for operators (read-only), so we configured a device admin policy and both groups work fine, but now we are facing a little problem any user who exists in the AD can login (user exec mode) in the network devices and we want to restric the login with the policy, but we just don't know how. Is there a way to get a user be authenticated against external group or internal acs but at user level, just like you can do it in the ACS 4.X?
View 8 Replies
View Related
May 30, 2013
I am using ISE 1.1.1.268 and WLC 7.2.111.3 and NAC agent version 4.9.1.6 on Windows 7 Client machines.
About once a day i get the error "ISE Alarm (WARNING): Dynamic Authorization Failed for Device".
The device it is referring to is my NAD, a WLC 5508 running 7.2.111.3
I have looked at the logs and I cannot see anything in the logs which corresponds to this message so that I can troubleshoot further. Maybe I can if I am enabling the correct logging level on the correct ISE component.
What are the components and the logging level that I should set to get some more detail about this error?
At the moment, I have only set debug logging on Active Directory. I have TRACE logging set on Posture, Run time AAA & prrt-JNI.
I do not want to enable too much debug logs, so what is the specific element that I should be debugging.
I thought debugging the posture element would be enough but when I look at the logs there is nothing there that relates to this message.
View 3 Replies
View Related
Jan 28, 2013
I am using ACS 5.3 What I am about is setting user authentication against existence of the user in specific AD group, not just being a member in any AD. What is happening now, users get authenticated as long as they exists in the AD, luckily they fail on authorization, as it is bound to specific AD group.
how can I bind the authentication aginst specific group in AD, not just using AD1 as the identity source.
View 1 Replies
View Related
May 22, 2012
we managed to integrate our newly setup ACS 5.2 to our regional domain. now im creating a Device Admin access Policy for Regional Network Admin group and Regional Network Operators group. each having full and read access respectively.
i already have the default identity policy and authorization policy with with command sets fullaccess and showonly for each group, now i dont know how can i match the AD group regionaladm and regionalops so that each user falls under one of these groups will have a correct read/write access.
View 4 Replies
View Related
May 4, 2011
I'm working with a 1113 ACS device running the 4.2.0.124 software. I'm trying to get multiple network device groups to use an existing Remote Agent set up for authentication against our Windows domain. For instance, we want our infrastructure switches to authenticate agains the local Active Directory and our WLC to authenticate users agains the same Active Directory. When I try and set both network device groups to use the same remote agent, it fails and reports either the host name is already in use or the IP address overlaps with an existing remote agent.
The question is:
Can I have multiple network device groups use the same remote agent? Or do I have to install the remote agent software on separate Windows servers in order to have different types of devices authenticate against the Windows AD?
View 1 Replies
View Related
