we are moving network devices (200+) authentication/authorization/accounting to new ACS5.2, is there any easy way to copy/sync all those AAA clients configuration to another ACS5.2 server? I don't need other configuration to be synced/copied to another ACS5.2 server
I have a few sites using the RV042 with wireless access points and some of them have over 50 devices.In reviewing the documentation (specifically,[URL]), I came across this:Enable DHCP server: Check the box to allow the router to dynamically assign IP addresses to up to 50 connected devices. Uncheck the box if you have another DHCP server on the network or you want to configure static IP addresses for your network devices.Is this accurate? Or will the RV042 allow more than 50 devices?
What is the maximum allowed number of wired clients behind a workgroup bridge? In other words, is there a limit on MAC addresses?I assume 1262 AP in WGB mode is connecting to a lighweight AP (1262 or 3502), latest IOS and WLC software. I wasn't able to find the answer from Cisco documentation.
is there a way to have multiple instances of user custom attributes and insert those as multiple instances of the A/V Pair in the authorisation profile in ACS 5.2/5.3 ?Background: We have to migrate a ACS 4.2 to 5.3. In ACS 4.2 our client used the multiline attribute
Number #Name #Description #Type of Value #Inbound/Outbound
to specify multiple routes to various networks in the RADIUS reply spcific for every single PPP username of routers dialing in.Using the internal user database, extended by a string attribute and using that attribute as source of a dynamic value in the access-policy works basically. But as I have only ONE single line instance of the attribute for every user, I can only return ONE framed-route.We have lots of cases where multiple routes have to be assigned to one router.I 'd like to avoid defining a seperate access profile for every remote RAS router for external PPP Dial-In...[URL]
When attempting to register an ACS instance to a primary (via System Administration -> Operations -> Local Operations -> Deployment Operations), I receive the following error as a popup in my browser:
"This System Failure occurred: /opt/CSCOacs/db/acs.crt (No such file or directory). Your changes have not been saved.Click OK to return to the list page."
I had 2 ACS 1120 appliances clustered, 1 suffered a hardware failure about a year ago so I replaced it with a VM. That one is now the primary. I'm now wanting to replace the secondary instance (the remaining 1120 appliance) with a VM as well. I removed the current appliance from the network, installed the VM using the same IP address, and attempted to register. It failed as per the above error. After trying this a number of times, I then decided to return the 1120 appliance to secondary status and attempted to register it with the same results as above.
I have an ACS 5.3 cluster, that is configured to use AD. There are a few wireless devices, and monitoring tools that do not have AD accounts. I would like to configure ACS to first check AD for the user authentication, and if that fails to roll over to the local (Internal Users) identity source where I can define these user accounts.
It seems that when the authentication hits the initial Identity Policy rule, it never moves onto the next one if the first fails.
Attached are screen shots that show how i'm configured for the test, i have a local user defined and I'm trying to log into the firewalls.
- Identity Definition : Screen shot of the main ACS definition for the rule i'm testing that's not working - Identity Rule 1 : The configuration of rule 1 that if it fails i need it to move onto rule 2. - Log Output : Screen shot for one of the failed attempts from the ACS View Log server.
Reason I need to configure it this way is:
- Wireless users authenticate to wireless using AD user accounts. Some hand held scanners do not support that and will need to authenticate using the MAC address. - Authentication to Network devices for managment uses AD accounts. We have some monitoring tools that do not have AD accounts, and will need to be able to log into Network devices to issue some commands (Examples: Cisco Prime LMS and NCS, Infoblox NetMRI).
I managed to connect acs5.1 to the AD , user's will be able to get authenticated against the AD when the state is shown "CONNECTED'. This will work ok for a day or so and goes into a 'DISCONNECTED' state , users will no more be able to authenticate . Is this a known error , or is this an error from the microsoft ws2k3 server side ?
I tried to add some more MACs to our Controllers through the WCS. I hate mac-filtering. We plan on stopping sometime. Three of the Controllers(4402s) are reporting that we have reached the max which appears to be 506.First, is there anyway to increase this number?Second, if not, any experience with deleting clients? Should I use reporting to find MACs that haven't been used for sometime and delete them? Is there a better way?
I know this sounds a simple and easy question, but I can't find the answer anywhere - so here it is :-I need to know the maximum number of vpn tunnels that a Cisco 881 can handle.(In context, we have a group of users, who work from home and this office, so their laptops have the cisco vpn client, I need to know how many of these vpn connections the 881 can handle at once before it dies a death.)Hote - I have read somewhere a line that state maximum number of users is 20 but think this was in reference to some VOIP service.
When using CSMA/CD what is the maximum number of end-to-end propagation delays that could elapse from the time a sender starts its transmission until:the collision is detected? the frame it is sending has a collision?
I know ACS 5 lacks the IP Pools of earlier ACS versions. I'm looking at a 4 to 5 migration and was thinking of just configuring the IP Pools on the router ("ip pool local" etc) and sending back a RADIUS Cisco Attribute pair with the name of the pool. (Seemed like a neat fix, needs no extra kit, etc.)
I could have sworn that attribute pair existed... but I can't find it in ACS5! What's it's name?! Where is it!? Or have I gone mad!? (And, if I have gone mad, how would you go about fixing it?)
Is there a cisco best practice on the maximum number of NAT statements on a Cisco ASA? We have a 5520 and a coworker is adding static NAT policies so a vendor can monitor around 1,029 nodes. The problem is each node inside is a 10.X.X.X and to keep the IPs from overlapping with other customers the vendor monitors they would like us to NAT to a 172.16.X.X scheme.
We are having random issues of users not being able to connect to our wireless network consistently. The users will have successfully accessed the network previously but then will have difficulty associating to the network. After a period of time, the association appears successful again. My first thoughts were that there was a restriction on the number of clients that could associate to a given AP at any one time.This is the equipment we have:1x Cisco Wireless Control Server (WCS) 6.0.181.04x Cisco 5508 Wireless LAN Controllers 6.0.196.060x Aironet 1142N Lightweight Access Points (LAP) Is there a hard or recommended maximum number of clients per LAP? If so, where is this defined? From what I have read on these forums, Cisco apparently recommends about 25 clients per AP but I can not find any official documentation to support this.When I go to WCS Home > General > Top APs by Client Count, the top AP reports 20 clients. However, if I click on the AP Name and go to the Current Associated Clients tab, it is only listing 8 clients - why is this?
How many routed ethernet ports do they support when using HWIC-1FE and HWIC-2FE modules? On the Cisco site for the two interface modules and in the corrseponding PDF of supported interfaces for 29xx routers a maximum number of 2 2port modules(HWIC-2FE) and 2 1port modules(HWIC-2FE) is written.Does this mean, that I can put in 4 L3 HWIC modules into one Cisco 2921 router by combining these two HWIC modules resulting in a total number of 7 interfaces for this router?
I have a BT Home Hub 3 and quite often get messages "cannot connect to network". I have many (>20) devices connected. Have I reached the limit? With four kids in the house the pressure to connect even more devices is growing.
This is a feature that I have researched for by looking at ISRs G2 data sheets and cisco.com website.The number of users that can be supported or the recommended number of users per router chassis/model is not mentioned anywhere.However this is mentioned in the Cisco 880 ISR data sheet. What are the number of users that can be supported or the recommended number of users on Cisco 1900/2900/3900 ISRs?
I'm trying to dynamically assign IP address for VPN users from AD (without IAS service). I know that there is a restriction that "Dial-in users are not supported by AD in ACS (note in "acsuserguide51") but Im not exacly sure what can and can't do with it. In "Authorization Profiles" in RADIUS Attributes tab I try to mannually add specific Attribute (Framed-IP-Address).
I have no problem (everything works just fine) with static address assignment in a way as below:
AD is already integrated with ACS and I've managed to download Directory attributes especially msRADIUSFramedIPAddress
When I change "Attribute Value" from static to dynamic type I see the option to select AD (but "Select" which should list all available attributes is empty)
I know that I can do it directly (ASA <-> AD attribute mapping) but I want ACS to do it
I am trying to secure changes to switches using ACS 5.3 and allowing our technicians to only change the vlan for user ports on the switches. How can I use regular expressions to filter out the 1/1/# ports so that those ports cannot be accessed in config mode? If I allow the following, it allows access to all interfaces with 'gi' in them.
Is there a maximum number of licenses for connections to a 877?The reason I ask is that our routers are managed by a datacentre and when I asked for the login details I was told that I couldnt have them due to licensing reasons with no other explanation.