Cisco AAA/Identity/Nac :: Use Two Servers ACS 5.2 In (primary And Secondary) Active?
Jun 16, 2011it is possible de use two servers ACS 5.2 (primary and secondary) in active/ active? or just in active/ passive?
View 3 Replies
ADVERTISEMENT
Cisco Firewall :: 5505s - Secondary ASA Active And Primary Is On Standby
Dec 5, 2011We have 2 ASA 5505s in a data center at a remote site.
Whilst troubleshooting another issue I noticed the below. I don't know much about fail over but this would suggest that the secondary ASA is active and the primary ASA is on standby.
if the primary is "active" then how come the secondary is the active ASA? I would have thought that once the primary ASA became active this would assume the "main" role".
[Code] .....
Cisco VPN :: 888 Configure VRF With COOP Having Primary And Secondary Key Servers
Jun 19, 2012We are trying to configure vrf aware GET VPN with COOP having primary and secondary key servers and also 3 GM routers. All GM routers we use are Cisco 888 and Key servers we use cisco 2911 routers. All GMs crypto maps have been applied into Vlan interface as there's no L3 interface on 888 routers.
Always members can form a tunnel with primary KS, we have configured redundancy with secondary key server and listed on each GM primary and secondary KS on GDOI group.
The issue we facing is that whenever we shutdown the primary or secondary servers the tunnel is not forming with available KS unless otherwise we mannually clear the crypto session. In another way when primary KS down it doest not fall back to secondary KS and no GM get registered. We have already played with all the timers such as DPD, SA lifetimes, GDOI rekey lifetime etc and also exchanging the keys (import/export) with KS and COOPs but there's no luck. We could see the following message was seen on both KS.
[code] 192.168.1.3 is the primary KS and 192.168.1.6 is the secondary KS.I captured attached debug output from 1 GM and secondary KS while I shutdonw the primary KS and also attached is our senario we were trying get work.
Also attached is the show output from both KSs when it form a tunnel with GM.
Cisco AAA/Identity/Nac :: ACS 5.3 Primary / Secondary Same License?
Jan 22, 2012I have a question about the number of Cisco licenses needed in two cases for ACS 5.3 Virtual Machine.One primary + One secondary : Just one license for all or one license for the primary + another one for the secondary ?One primary + several secondaries : Just one license for all or one license for the primary + just one license for all the secondaries ?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 - Unable To Re-register Secondary To Primary?
Jun 11, 2012Today I ran a failover test between our primary and secondary ACS systems (ran 'acs stop' on the primary) and in the process decided to promote the secondary while I had the primary down. All was fine until I brought the primary back up and tried to re-register the secondary to it. I get the following error message: I went into System Administration >Operations >Distributed System Management on each and it showed the other device as deregestered, tried to promote from there but it failed too, so I deleted them and tried to register the secondary again. After that didn't work I tried rebooting both but that didn't work either. I know the user/pass I'm using is good and I've tried using both the IP address and the hostname.
ACS/admin# sh app version acs
Cisco ACS VERSION INFORMATION-----------------------------Version : 5.3.0.40.5Internal Build ID : B.839Patches :5-3-0-40-5
Cisco AAA/Identity/Nac :: ACS 5.2 - Primary-secondary Radius Server Configuration
Apr 21, 2013I have a couple of ACS 5.2 configured as active and backup and I am doing dot 1x authentication using these servers . I have configured the switch with the bellow configuration.
radius-server host 10.0.10.15 auth-port 1645 acct-port 1646
radius-server host 10.0.10.16 auth-port 1645 acct-port 1646
radius-server key 7 aaaaaaaaaaaaaa
please help to understand what will happen in switch
1) in case of primary failure
2)in case if primary returns alive .
Cisco AAA/Identity/Nac :: Secondary ACS 5.1 Fails To Deregister After IP Change On Primary
Aug 9, 2011IP address of Primary had to be changed, to respond to a hardware failure of TACACS server with IP in many device configs.
Now the Secondary fails to respond to repeated "Deregister from Primary" requests, even after reload - apparently because it cannot reach the Primary at its old IP address.
Requesting Deregister in GUI generates pop-up that says, "This operation will deregister this ACS Instance from the Primary Instance. Management applications on this ACS instance will be restarted and you will be required to login again. After performing this operation
[code]....
Cisco AAA/Identity/Nac :: ACS 5. 2 Secondary Server Is Not Collecting Logs From Primary
Nov 2, 2011Cisco ACS 5.2 secondary server is configured as a log collector for both primary and secondary server .Now i am facing problem in log collection from primary server .ACS secondary server is not collecting any logs from primary .
View 2 Replies View RelatedFigure Out Primary And Secondary DNS?
Jun 22, 2011How can you figure out your primary and secondary DNS? I have a linksys router, and i'm trying to figure out what my primary and secondary DNS are so i can hook up my PS3 online.
View 1 Replies View RelatedMake Secondary Router As Primary?
Apr 25, 2011I have been having problems when trying to host servers on games, etc.I have 2 routers. A modem router, which is a Thomson router. That is the main one. It has a wire connecting from it, to a D-Link router that is near my Computer, and my brother's one. Then that D-Link router has 2 wires from each port, to mine, and my brother's computer.So, I am trying to host games.I didn't connect to the Thomson one, which is also wireless. I am connected to the wired one (D-Link). When I try to host while connected to it, my brother, and other people can't find the server. My brother and me can find it on LAN, but not Internet.But when I disconnect from the Wired, and connect to the Thomson wireless one, and then when I host, I can find it on INTERNET. Even my brother can. He can connect to it perfectly.
I do not want to connect to the wireless, because then it will cause lag spikes every 5 minutes.So, when I disconnect from the wireless, and connect to the wire, I went into the CMD, and typed in ipconfig. I found out that the Default Gteway is the D-Link IP.When I connect to the wireless, and disconnect the wired, I went into CMD, and then the Default Gateway is the Thomson one, which is the main router.So what I want to do, is use the D-Link router, and that router will have the same IP as my thomson one, so that I can host perfectly with no lag spikes, and using a wired connection.
Single SSID For Primary And Secondary DD-WRT Wireless Router
Feb 22, 2013I have more than 5000 sq. ft home and have some dead places other end of the house. Now I am looking for Range Extender/Repeater to boost signal. My primary wireless router is Motorola Surfboard SBG6580 and Secondary Linksys E3000 (planning to update firmware to DD-WRT). So I wanted something such that I can roam between the two routers without switching SSID (use single SSID name for primary and secondary DD-WRT routers) and connect automatically to whichever the best signal (or) strength router. In work place we have same thing like that single wireless SSID name which automatically connect wireless SSID from one end to another end of the building.
View 1 Replies View RelatedCisco :: Setting Up Primary And Secondary 5508 Using Redundancy Port
May 15, 2013Management purchased a HA package from Cisco consisting of 2 5508's with pre installed 500 users license on the Primary WLC and none on the secondary WLC. We have 5508's already so I am familiar with setting them up and so forth. What I am not familiar with is setting them up using HA for failover and license sharing. I've looked and looked and can't find documentation online showing how to set this up. I have found some but nothing that is complete. I have spent 2 days spinning my wheels.
View 2 Replies View RelatedCisco VPN :: 5520 - Primary And Secondary ASAs / L2L Tunnels Not Responding?
Apr 12, 2011I have a pair of ASA5520s in active/active failover - this works fine. Both primary and secondary ASAs are running 8.2(2) code.I have a 30-day temp 50 seat SSL license that I applied to the primary. I then started having problems with L2L tunnels.
I noted that if the 'show crypto isakmp sa' state for an L2L was MM_STANDBY, then the remote protected net could not reach my side. However, I could ping across to the other side at which time the state changed to MM_ACTIVE as I would expect and the remote could then reach my side.
I believe this results from the differences between the two licenses. When I applied the 50 seat SSL lic. it disabled failover, but I was willing to risk that for a few days to do show my customer the benifits of SSL connectivity. Note license differences. Is this causing the MM_STANDBY IKE issue and if so can I overcome it and use the 50 SSL VPN Peers lic.
[code]...
Cisco Switching/Routing :: C6509 - Broadcast Not Working Between Primary And Secondary IP Address
May 11, 2012I have recently configured secondary ip address on LAN Interface of Cisco C6509.. We have some application which needs to use broadcast traffic communication to communicate with client... Broadcast is working within subnet & also working from broadcast server to primary subnet. But not working from secondary subnet.. I have checked broadcast within secondary IP range & it's working fine... Secondary not working broadcast with primary and also with broadcast server... broadcast address is different for these subnet but both should be communicate since configured on same interface... When I went through Cisco website found that command "ip directed broadcast" which will pass broadcast to different subnet... But I'm not sure whether any other impact if I enable that command on particular Ethernet interface...
View 6 Replies View RelatedCisco Firewall :: ASA 5505 - Dual ISP SLA Track With Primary PPOE Secondary DHCP
Aug 25, 2011Cisco ASA 5505 Security Plus 1 link with PPOE dialup for internet access
desirable situation: Primary link with a PPOE dialup Secondary Link with DHCP address Asignment
Problem: i want to configure Dual ISP Failover modus, but the problem exist when i configure the ip sla syntax it looks good in the running config. but after a reload the secondary line becomes primary
It looks like the ppoe client authentication is busy when the ip sla tracking mechanism becomes active. can i tweak the settings that the ip sla tracking mechanism starts later?
What i the correct config for Dual ISP setup with primary PPOE and secondary DHCP
Cisco Switching/Routing :: 887m - Unable To Route Data Between Primary And Secondary IP Networks
Jan 7, 2013We an 887m router in our office with an unmanaged switch. We have two networks, 192.168.0.x and 192.168.11.x connected to router on the same interface (192.168.11.253 is a secondary ip) but I can seem to be able to route packets from one network to the other. Internet traffic is fine from both networks. I can't see what I'm doing wrong here. I can ping the 192.168.11.253 (router) from the 192.168.0 network but nothing beyond that.
I tried this at home with no other config and its the same. Is this by design?
Cannot Connect To Primary DNS Servers
Feb 5, 2011my partner cannot connect to the internet on her computer. I have tried disabling the ipv6, typing in oranges dns server in the ipv4,and attempted to find the dns automatically. I tried running the ipconfig, but it flashes up for a second then goes off before I can look at it. As mentioned I am with Orange, I contacted them and they wanted to run the computer through an ethernet cable and reset everything which I think is a pain in the backside and I know it should be a bit simpler than that.
View 14 Replies View RelatedCisco :: Failover Configuration - Allow Primary Link To Fail And Secondary Link To Automatically Pick Up Traffic?
Dec 27, 2012We have a customer who has a network consisting of two ISPs, one as a primary and the other as a backup. We are trying to create a configuration that would allow the primary link to fail and the secondary link to automatically pick up traffic and begin routing .how to set something like this up. Both routers are non Cisco routers and there for HSRP is out.
View 14 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.2 - Create Microsoft Active Directory (AD) Identity Store?
Jul 11, 2011We are using ACS 5.2 and we are trying to create a Microsoft Active Directory (AD) Identity Store. We have a user to be used in the Active Directory creation General page and we would like to know how the test communication / ACS to AD communication takes place.
Our user is a predefined user in AD and has admin rights, but the password expires every 60 days. Will this affect the communication between AD and ACS 5.2 at everytime the entered user's password expires?
Cisco AAA/Identity/Nac :: ACS V.5 Cannot Be Added As Secondary Via WAN
Aug 26, 2012i have planned a deployment with one acs in Europe working as primary, one acs in europe as secondary and one acs in USA as secondary also.
I can add one acs in europe to the deployment as secondary. When I try to add the acs in USA to the deployment - Nothing really works.
The status shown in the primary is offline (red) and status pending. It stays like this for hours. When I log in to the gui directly on the acs in USA, it still has status primary.
The two acs are transparently connected. There is WAN optimization (cisco waas) in between the two datacentres..
Cisco AAA/Identity/Nac :: Can't See Login Secondary ACS 5.2
Apr 24, 2011I have two ACS 5.2 working in redundancy Primary and Secondary my question in when my primary ACS goes down i can´t see the log in the secondary ACS. I read in the documentación that only one ACS can be configurated for working like logg collector server. Now I configurated my secondary ACS like logg collector server now when my Primary ACS goes down i can see the logg. Finally when my Secondary ACS goes down i can modified the ACS Primary Configution by show me the logg.. Is possible to do this automaticaly for show me the event logg ? when the ACS that is configurate like logg collector server goes down pass the event other ACS automatically..
View 3 Replies View RelatedServers :: Set Up Active Directory Without DHCP
Mar 23, 2011I am trying to set up a small domain for my business. I just purchased a Windows 2008 server and would like to use it as my domain controller.Also, I just had a new ATT DSL line put in. It came with a 2Wire modem/4-port router/wireless router device, therefore the modem can handle DHCP. The line has a static IP address as well so that I can eventually use my own exchange server and web server.I have tried 2 different configurations and couldn't get either to work) I tried to put the router into Bridged Mode and use DHCP server on my server using a PPPoe connection to connect to the Internet. I was confused as to what my static IP address and default gateway of my server should be.2) Then I tried to turn DHCP server off on the server and routing back on the modem/router. This didn't work either.What method would you recommend and why? Also I have some additional questions on each method.
Method 1)
* What is the static IP address of the server. Is it in the 192.168.1.x address or the static IP assigned to my account?
* Do I need a second Nic Card And Router to connect to the rest of my network or can I use the router provide
* What would the Static IP addresses of the additional PC be. Do I need more than 1 static IP from AT&T Method 2)
* Will this allow me to use all internal IP addresses on my machines and use port forwarding if I want a specific box to be a web server or exchange server.
Cisco AAA/Identity/Nac :: ACS 5.3 How To Enable Log On Secondary Server
Feb 28, 2013We are using ACS 5.3 with two servers in a distributed solution.All logs are collected on primary server so when this server fails all logs are lost.How can I enable log on secondary server also?
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 Secondary Registration Failed
Jun 5, 2013I've just had to rebuild my ACS appliance with new hardrives but I am unable to register the devices to each I get a system error. I thought it may have had something to do with the rebuilt device not being joined tothe domain but it has now been joined albeit using a different ad account, but still cannot register to primary.
View 11 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 Secondary Server Connection With RSA AM 6.1?
Oct 23, 2012We have 4 ACS 5.3 Servers connected as Primary and Secondary Servers.We use a "RSA SecurID Token Servers" External userdatabase for authentications and are able to sucessfully authenticate (vpn-)users when the requests are send from the primary ACS Server.As soon as a secondary ACS server sends the request to the RSA server the request fails. "Node verification failes"
On the RSA Authentication Manager 6.1 Server, we have created a Agent-host wich contains the 3 secondary nodes (FQDN and IP's). The "sdconf.rec" file has been installed on theprimary ACS Server and are automatically (so it looks like) replicated to all ACS Servers.Still none of the secondary server are able to authenticate the users agains the RSA server.
Cisco AAA/Identity/Nac :: ACS 5.3 - Error Generating CSR On Secondary
Nov 16, 2012I am attemtping to install new ssl certs on our 5.3 cluster. I was able to generate the CSR on the Primary host. When I attempt to generate the csr on the secondary host, I receive the following error:
This System Failure occurred: Error while remotely calling Primary to create: com.cisco.nm.acs.im.certificate.CertificateRequest Object{ request=[B@144cead, privateKey=null, encryptedPrivateKeyPassword=[B@5ce155, certificateSubject=CN=xxxx.xxxxxx.net, keyLength=2048, digest=SHA1, timeStamp=null, friendlyName=null, guid=[B@1cd99ca, description=null, name=xxxx.xxxx.net, version=0, id=0}. Your changes have not been saved.Click OK to return to the list page.
Both hosts are running identical versions:
Cisco ACS VERSION INFORMATION
-----------------------------
Version : 5.3.0.40
Internal Build ID : B.839
AAA/Identity/Nac :: 1121 - Add Secondary ACS Server 5.4?
May 29, 2013My customer has an ACS 1121 version 5.4. Now we want to install a secondary ACS 1121.
View 2 Replies View RelatedCisco AAA/Identity/Nac :: Unable To Register A Secondary ACS 5.2 Appliance
Dec 6, 2011 I have installed 2 ACS 5.2 appliances, the two appear as Primary. When I try to register one of them with the other one using "System Administrator -> Local Operation -> Deployment Operations" I get the following message:
This System Failure occurred: Unable to authenticate with node.. Your changes have not been saved.Click OK to return to the list page.
I have tried with both "ACSAdmin" and "admin" users with their respective passwords.
Cisco AAA/Identity/Nac :: ISE 1.1.3.124 Secondary Node Not Reachable After Registration
Jun 1, 2013I'm constantly seeing that the sync and replication status for my secondary admin/monitor node in the primary node as node not reachable. The secondary still thinks it is in standalone mode. When I run the ISE diag tool connectivity tests I am able successfully ping the devices from each other using both hostname and ip and the nslookup also works fine between both nodes. Ping and nslookups also work from different networks within the environment. The two nodes are in the same vlan on a 6500 vss pair but on different switches of the pair.
View 6 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.1 - How To Generate Certificate Signing Request On Secondary
Oct 3, 2012I have a pair of ACS appliances running 5.1 code. The appliances are set up as a replicated pair. I have valid local and trusted certificate authority certificates on the primary.
The trusted certificate authority certificate gets replicated to the secondary. Obviously the local certificate doesn't get replicated. I need to generate a certificate signing request on the secondary but it doesn't seem to allow you to do it.
Cisco AAA/Identity/Nac :: ACS 5.4 - Audit Logs Operated By Secondary Instance?
Mar 28, 2013I'm using ACS 5.4p2 within distributed systems: one primary and one secondary instance.For now, primary instance is acting as Log Collector server and I can see any AAA audit logs.
When the primary instance fails I can authenticate successfully using the secondary instance.However, when primary instance comes back, I'm not able to see any audit logs operated by secondary.
Cisco AAA/Identity/Nac :: Database Is Not Lost On Primary ACS 5.1
Apr 23, 2013We have recently upgraded acs 5.1 to 5.3 ( normal upgrade process), all secondary (ACS-B) was deregistered from primary (ACS-A , used as configuration server and log collector) and updated successfully. But while upgrading primary acs server was rebooted manually. But later primary server was re upgraded successfully to 5.3.
Just to ensure database is not lost on primary acs (ACS-A) , primary acs was registered to one of the secondary acs (ACS-B). Initially ACS-A registered with ACS-B, both ACS was showing proper role now. ACS-A ( secondary ) and ACS-B (primary). But on New primary ACS (ACS-B) is showing new secondary (ACS-A) offline and replication pending. Whereas on Secondary ACS-B its shows primary ACS-A online and updated. But ACS replication id is gradually incrementing. ACS system is in this system for last 2 day, But not sure if there is real replication happening at backend? How long it take place to replicate completely? and how to check / verify status of upgrade?
AAA/Identity/Nac :: Primary ACS 5.2 Lost Connection?
Apr 9, 2012I have a 802.1x solution with two redundant ACS 5.2. Network A configuration use like Primary ACS-SJM and ACS-GLX like a secondary for network B configuration use like Primary ACS-GLX and ACS-SJM like a secondary. My solution was working fine about one year ago. but one week ago isn´t working fine. The problem my ACS-SJM lost connectión and user can´t authenticated when the user trye to connect to ACS-GLX either can´t connect. I have to shutdown the ACS-SJM that way can authenticate to the ACS-GLX. I check the log and I didn´t find anything I check the switch.. too where the ACS is connected. but didn´t find anything too.
both ACS have the following IOS version:
ACS 5.2.0.26.4