Cisco AAA/Identity/Nac :: Assign Fixed IP Address To User In ACS5.2?
Aug 8, 2011My company requires each user dial-in must be a fixed IP; The old acs4 can,but I cannot find the same configration item in the ACS5.2
View 2 Replies
ADVERTISEMENT
Cisco AAA/Identity/Nac :: 892 - L2TP And Fixed Framed IP Address For VPN User?
Mar 29, 2012I have a running L2TP/IPsec VPN setup with authentification against a radius server (freeradius2 witch mysql). I would like to have some of my VPN users get a fixed IP address instead of the dynamically assigned IP Pool.
The radius server is returning the correct parameters, I think.
It´s a Cisco 892 Integrated Service Router. Code...
Cisco AAA/Identity/Nac :: ACS 5.3 Assign Static IP Address Depending On Authenticated User
Feb 12, 2012Actually I have a lab with ACS 5.3 running with 802.1x, but when when the user is successfully authenticated, it's assigned and IP address from the DHCP server, is there a way to assign a static IP address depending of login username??
View 13 Replies View RelatedCisco AAA/Identity/Nac :: How Does Acs Export User Records Via ACS5.3
Nov 29, 2011I want to export the ACS local user's records.Then import to other ACS5.3 server.But the export file not the user's password record.I cannot import it well....
View 1 Replies View RelatedAAA/Identity/Nac :: ACS5 Try To Authenticate User In External Database
Jan 16, 2012Is it possible to create on ACS5 rule which will:
1. Try to authenticate user in external database1 (radius)
2. When external database1 returns FAIL (because of bad password) ACS5 should try to authenticate user in another external database2 (radius)
Cisco AAA/Identity/Nac :: ACS5.1 - Unable To Authenticate AD User With Empty Password
May 30, 2011Our customer has the business needs to authenticate remote users against AD with empty password. I've seen ACS5.1 release note where mentioned about resolved issue: #CSCte72751 #ACS 5.1 drops authentication with empty password.
I tried to authenticate dial-in users through Tacacs and Radius against AD with empty password but without success. ACS points to wrong AD password. Is it possible to authneticate remote users with empty password?
Cisco AAA/Identity/Nac :: ACS5.2 - Establish Independent User Group / Only VPN Username And Password
Mar 28, 2012My question is on ASA and ACS5.2 users.Have my ASA SSL VPN and IPSEC VPN, the my ACS5.2 many users, for example, wireless user.I would now like to establish an independent user group, only the VPN user name and password, while both the ASA VPN can only allow users in this independent group of ACS5.2 VPN login, how to configure?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS5 / One User / Two Credentials (external Token Versus Cert)
Nov 30, 2011I have ACS4 and i am planning to upgrade to ACS5.I would like to have such a rules:I have user1, one ASA device which is VPN concentrator for remote users.ASA have two different tunnel-groups: one which allow for logging via certificate (with mandatory pki authorization thru ACS) with disabled Xauth,and second tunnel-group with allow login thru typical Xauth with authorization thru ACS which users external database (RSA Tokens).So i have one user1 which can login thru VPN using RSA tokencode or certificate.For example: on phone user1 uses certificate, and on PC station the same user1 uses token password.For tunnel-group with pki authorization ASA checks username in ACS and in typical scenario login="CN from certificate" and password="CN from certificate". So we would need "two credentials" for the user - one for pki authorization, and second one external database (RSA token).Is such scenatio possible under ACS 5 ? where one user uses different credentials based on tunnel-group usage ?
View 2 Replies View RelatedCisco AAA/Identity/Nac :: Assign Personal Access List To User In ACS 5.1
Apr 4, 2010Is there any way (in ACS 5.1) to assign personal access list to each user instead of assigning it to Authorization profile and Authorization profile to user?
View 5 Replies View RelatedBelkin Routers :: N600 How To Pre-assign IP Addresses To Fixed Devices
May 10, 2013I have a Belkin Play N600 HD router. Does it have the capability to let me assign fixed IP addresses to devices like printers, NAS drives, and cameras so I know where they are?
View 2 Replies View RelatedCisco :: 1921 - DHCP Configuration / Assign Fixed IP To One Device While Assigning Others?
Jun 19, 2012This is IOS 15.1(4)M3 on a 1921 router. The LAN is 192.168.42.1/24. (DHCP config is further down.) We have a small range that we want to assign via DHCP to devices; .200 through .220 . At the same time, we have a handful of Macintosh systems to which we want to assign a specific address that is not in that 200-220 range. I don't want to configure the assignment based on the Ethernet MAC addresses because these systems might connect via UTP or wireless; that is to say, they have more than one MAC address. They only ever connect using one interface/MAC address at a time, but it's their choice; in some areas wi-fi is available, and in some areas they have to cable-up.
The Mac OSX network settings has a field for "DHCP Client ID". It would be much easier to tell the users of these systems to put their Mac's name in the Client ID field for both their wired and wireless DHCP configs. (As opposed to having them all lookup, and then give me their Ethernet MAC addresses for both of their interfaces.) I tried this with my Mac's (named "shrike") wi-fi interface, but I don't get the 192.168.42.14 address that I expected. I get an address from the .200 to .220 range.
Here's the DHCP-related config from the router:
router#sh run | s dhcp
ip dhcp excluded-address 192.168.42.1 192.168.42.199
ip dhcp excluded-address 192.168.42.221 192.168.42.254
ip dhcp pool OurOffice
network 192.168.42.0 255.255.255.0
[code]....
Is "client-name" the wrong place to configure the DHCP Client ID?
Cisco AAA/Identity/Nac :: ACS5.3 - Configuring Multiple Identity Sources
Aug 28, 2012I have an ACS 5.3 cluster, that is configured to use AD. There are a few wireless devices, and monitoring tools that do not have AD accounts. I would like to configure ACS to first check AD for the user authentication, and if that fails to roll over to the local (Internal Users) identity source where I can define these user accounts.
It seems that when the authentication hits the initial Identity Policy rule, it never moves onto the next one if the first fails.
Attached are screen shots that show how i'm configured for the test, i have a local user defined and I'm trying to log into the firewalls.
- Identity Definition : Screen shot of the main ACS definition for the rule i'm testing that's not working
- Identity Rule 1 : The configuration of rule 1 that if it fails i need it to move onto rule 2.
- Log Output : Screen shot for one of the failed attempts from the ACS View Log server.
Reason I need to configure it this way is:
- Wireless users authenticate to wireless using AD user accounts. Some hand held scanners do not support that and will need to authenticate using the MAC address.
- Authentication to Network devices for managment uses AD accounts. We have some monitoring tools that do not have AD accounts, and will need to be able to log into Network devices to issue some commands (Examples: Cisco Prime LMS and NCS, Infoblox NetMRI).
Cisco AAA/Identity/Nac :: ACS 5.3 Authorization Of User Based On MAC Address
Aug 23, 2012A short background. Our corporate SSID is being migrated from using PEAPv0 to EAP-TLS. This restricts access only to company notebooks. Additionally we have barcode scanners which are used to inventory assets. Those devices are not able to use EAP-TLS as they cannot be integrated in the domain and being unable to do certificate based authentication.
As a workaround we planned to use another SSID with access to the same network but using PEAPv0 as authentication method, basically the same SSID but with a different name. As this naturally allows anyone to access the corporate network with a valid username/password I now wanted to add another step into the authentication process - the MAC of the device. I know I can do the filtering at the WLAN controller, but as it has a limited database as well as the fact that it is cumbersome to maintain the MAC list on all the controllers I thought I can do it over our ACS system.
I am now trying to accomplish the following: The user gets authenticated via the internal user store, which is succesful. Now I want to authorize the user via the MAC address, which is stored in the internal host store of the ACS, if access is granted or not.
For this I created the following policy:
Service Selection Policy -- (Rule based result selection)
-- (NDG:Device Type in All Device Types:Wireless And RADIUS-IETF:Called-Station-ID contains <SSID>) | Result: PEAP access
-- Default | Result: DenyAccess
Service PEAP access Identity: Internal Users -- (Single result selection) Authorization -- (Rule based result selection) -- Internal Hosts:HostIdentityGroup in All Groups:Valid_MACs
When I then try to access the wireless network I won't get authenticated. The error I get, when I look into the logs is: 15039 Selected Authorization Profile is DenyAccess
Is it not possible to use one identity store as "attribute database" for the other identity store?
Cisco AAA/Identity/Nac :: Use ACS 5.2 To Create Static IP Address User For Remote Access VPN
Sep 17, 2011At first I use ACS 4.2 to create static ip address user for remote access VPN,It's easy,just configuration it at user set>Client IP Address Assignment>Assign static IP address,but when I use ACS 5.2 I dont't know how to do it.
I try to add IPv4 address attribute to user by read "ACS 5.2 user guide" ,it says this:
Step 1Add a static IP attribute to internal user attribute dictionary:
Step 2Select System Administration > Configuration > Dictionaries > Identity > Internal Users.
Step 3Click Create.
Step 4Add static IP attribute.
Step 5Select Users and Identity Stores > Internal Identity Stores > Users.
Step 6Click Create.
Step 7Edit the static IP attribute of the user.
I just do it,but it's not work.When I use EasyVPN client to connect ASA 5520,user could success to authentication but will not get the static IP address which I configure on Internal Users,so the tunnel set up failed.I try to Configure a IP pool on ASA for ACS users get IP address,and use EasyVPN client to connect ASA , everything is OK,user authenticate successed.but when I kill IP pool coufigurations and use the "add a static IP address to user "configurations,EzVPN are failed. how to use ACS 5.2 to create a static ip address user for remote access VPN?
D-Link DIR-655 :: Doesn't Resolve Own Fixed IP Address
Aug 13, 2012I have a fixed external ip address.I have port forwarding setup for accessing a NAS inside my LAN, lets say port 12345.Now when I use my laptop outside my own LAN, e.g. 99.99.99.99:12345 resolves nicely to my NAS. But when I use the same 99.99.99.99:12345 inside my LAN, it does not resolve. Instead, it gives me a 'server takes too long to answer' error
I have also setup a virtual host to an ip cam inside my network. That one resolves just fine. I tried enabling remote management on the DIR-655 and also that works fine using 99.99.99.99:8888.When I replace the external ip address with the internal ip address of my NAS, thus bypassing port forwarding, it obviously also works ok.
Why the forwarded ports are not accessible when I use my own external fixed IP address? Does the DIR-655 treat it different than other external IP addresses?
Cisco AAA/Identity/Nac :: ACS5.1 Getting Disconnected From AD?
Jul 30, 2010I managed to connect acs5.1 to the AD , user's will be able to get authenticated against the AD when the state is shown "CONNECTED'. This will work ok for a day or so and goes into a 'DISCONNECTED' state , users will no more be able to authenticate . Is this a known error , or is this an error from the microsoft ws2k3 server side ?
View 3 Replies View RelatedCisco Switching/Routing :: Setting Fixed Ip Address On Vlan?
Jan 25, 2012I need to create several VLans on my switch.After reading the admin guide pdf, i still don't understand how to create any simple VLan.some tutorial or steps (with IE or Mozilla browser) how to create and use VLan, and to connect one VLan to another.For example,i need to create 3 VLans.
First Vlan consist of 5 ports (Vlan Name = Red)
Second Vlan consist of 15 ports (Vlan Name = Green)
Last Vlan consist of the rest of the ports (VLan Name = White)
Cisco AAA/Identity/Nac :: ACS5 - Replacement For IP Pools
Jan 26, 2013I know ACS 5 lacks the IP Pools of earlier ACS versions. I'm looking at a 4 to 5 migration and was thinking of just configuring the IP Pools on the router ("ip pool local" etc) and sending back a RADIUS Cisco Attribute pair with the name of the pool. (Seemed like a neat fix, needs no extra kit, etc.)
I could have sworn that attribute pair existed... but I can't find it in ACS5! What's it's name?! Where is it!? Or have I gone mad!? (And, if I have gone mad, how would you go about fixing it?)
Cisco AAA/Identity/Nac :: ACS5.2 Authentication With Fortigate Firewall
Jun 10, 2013I am trying to configure Fortigate firewall for device authentication through TACACS+ using Cisco ACS 5.2.
I was wondering if any one had an experience to worked on this scenario. I am looking for authorization command attibute to grant admin access.
Cisco AAA/Identity/Nac :: Sync / Copy AAA Clients Between Two ACS5.2
May 17, 2011we are moving network devices (200+) authentication/authorization/accounting to new ACS5.2, is there any easy way to copy/sync all those AAA clients configuration to another ACS5.2 server? I don't need other configuration to be synced/copied to another ACS5.2 server
View 8 Replies View RelatedCisco AAA/Identity/Nac :: ACS5.1 - AD And RADIUS Attributes Mapping
Aug 18, 2010I'm trying to dynamically assign IP address for VPN users from AD (without IAS service). I know that there is a restriction that "Dial-in users are not supported by AD in ACS (note in "acsuserguide51") but Im not exacly sure what can and can't do with it. In "Authorization Profiles" in RADIUS Attributes tab I try to mannually add specific Attribute (Framed-IP-Address).
I have no problem (everything works just fine) with static address assignment in a way as below:
AD is already integrated with ACS and I've managed to download Directory attributes especially msRADIUSFramedIPAddress
When I change "Attribute Value" from static to dynamic type I see the option to select AD (but "Select" which should list all available attributes is empty)
I know that I can do it directly (ASA <-> AD attribute mapping) but I want ACS to do it
AAA/Identity/Nac :: ACS5.2 - Implementing IP Phones In Network?
Oct 13, 2011We have customer with implementation ACS5.2 in Windows environment. Now they want to implement IP phones in the network.
View 0 Replies View RelatedAAA/Identity/Nac :: ACS5.3 Command Set Regular Expressions
Jul 9, 2012I am trying to secure changes to switches using ACS 5.3 and allowing our technicians to only change the vlan for user ports on the switches. How can I use regular expressions to filter out the 1/1/# ports so that those ports cannot be accessed in config mode? If I allow the following, it allows access to all interfaces with 'gi' in them.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS5.2 Command Sets Permit All Commands
Mar 3, 2011I have everything working on a new 5.2 ACS but:I can only make a command set that permits things and denies all.I thought with the check box. Permit any command that is not in the table below" one could allow all and specifically deny commands.and that would allow the user to do all commands except for conf and set. But it doesn't seem to adminstratively block it, it allows them to still "conf" for instance.
Then it works as expected, it allows the commands that are permitted and denying all unspecified commands.I know I am in the right command set because the changes I make are reflected immediately.Can someone test the "Permit any command that is not in the table below' and tell me if it works? I can make it work with the unchecked box, sure, but it would be nice to get it to work.
Cisco AAA/Identity/Nac :: Command Auth Failure On ASA5510 Using ACS5.1
Jun 11, 2012I'm having trouble getting things working on a pair of ASA5510's using Cisco Secure ACS v5.1. We were previously using a much older version of ACS to these (and a lot of other) devices which worked OK for remote access for read/write use. Am in the process of migrating to the new ACS software and have got it working OK to everything (many Cisco switches and other IOS devices) except these ASA5510s.
I can get TACACS authenticating fine and am able to log on and go into enable mode. Any subsequent commands are then met with 'command authorization failure', including 'show run', 'conf t' and even 'exit'!
My ASA5510 config has not changed, other than to define the new AAA server, which leads me to think its something to do with how I have the ACS user profile set up. I have configured the ACS5.1 device administration Shell Profile to have the maximum privilege level (15) and the command set I'm using has the box checked 'permit any command that is not in the table below'.
Cisco AAA/Identity/Nac :: ACS5.2 Backup And Restore On A Different Software Version?
Oct 3, 2011We are trying to make a restore from the backup done on ACS version 5.1 to a new appliance running ACS5.2 Before doing it I found this note in Cisco ACS user guide:
Note: You cannot back up data from an earlier version of ACS and restore it to a later version. Backup and restore must be performed on the same version of ACS. If you need the data on a different version of the ACS, you can perform an upgrade after you restore the data. Refer to the Installation and Setup Guide for Cisco Secure Access Control System 5.1 for more information on upgrading ACS to later versions.
How should I understand it? This note has conflicting statements. We can't restore to a later version but if you need data on a different version of ACS you can perform an upgrade AFTER YOU RESTORE the data. Doesn't it mean that the restore will still work? How would I do the upgrade to version 5.2 or even version 5.3 that was announced to be released very soon? I didn't find anything on the software upgrade in ACS5.1 guide.
Cisco AAA/Identity/Nac :: ACS5.2 - Allow Show Running Configuration Without Enable
May 24, 2012I am using ACS5.2 I want user to access the device with all necessary command like show run/ver/int/log… I try to set user privilege using Shell from 1 to 10 but show run doesn't work.
View 15 Replies View RelatedCisco AAA/Identity/Nac :: Invoke IP POOL Defined On VPN 3000 To ACS5.3?
Aug 27, 2012I configured an ip pool on VPN 3000 concetnrator. i wanted to an attribute to use on the nework access profile on the acs 5.3. i was advised to use pool name. However, we don't have pool name attribute on VPN concentrator. only, IP range and subnet mask. how do i refer an IP pool on VPN concentrator in ACS5.3? is there another attribute I can use on ACS5.3 to invoke a pool on CVPN3000, like ip range...?
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS5.1.0.44 Authentication Base AD Group Member
Nov 25, 2012I had a problem about authentication use AD group member. Below webiside is the way I config on ACS.
[URL]
I'm using ACS 5.1.0.44 and this version has a bug , ACS cannot read AD group. I have to add it manually . After I change the access policy from Internal user to AD1. I can use anyone AD ID to pass authenticaiton. I finished all config from the website had same result.
I checked the access polices -- default device admin -- authorization , the new rules I created had no hit count. How can I make sure that I make a right config ?
Cisco AAA/Identity/Nac :: ACS5.1 - Machine Certificate And AD-Account-Verification
Aug 2, 2011We plan to use machine certificates on our notebooks with Windows Vista. Our authenticating server is Cisco ACS 5.1. To access the wireless network we want to use the machine certificate of the notebook and a verification of the corresponding computer account in the Active Directory. What authentication method is the best to check the machine certificate and if in the Active Directory exist the enabled corresponding computer account ? How to configure the ACS and the notebook to use it like described ?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS5.3 - Difference Between WebVPN And IPSEC Radius
Aug 14, 2012I am using Cisco ACS5.3 to authenticate users (using radius) for a cisco ASA firewall for both WebVPN and IPSEC client connections. I have been able to do this successfully. However I need to be able to deply Cisco vendor specific attributes (VSA) for both IPSEC and WebVPN sessions using authorisation profiles. Ideally I don't want to have to combine the attributes required for both services in the same authorisation profile, as I will have to produce alot of different profiles for the different combinations.
The only way I can see that you could possibilly do this is by having service selection rules that can differentiate between WebVPN and IPSEC Radius authentication requests. I have experimented inbound VSA's without success. Is this possible?
Cisco :: Assign Static IP To IPSec VPN User In ASA 8.2?
Nov 29, 2011I want to assign static IPs to users that login to IPSec VPN using Group Authentication in ASA 8.2. The authentication through a Windows RADIUS server. Right now, they are connecting just fine and pulling an IP from the pool I have configured in the IPSec policy.
What would the best way to assign static IPs through VPN?
Cisco AAA/Identity/Nac :: 500GB Datastore Requirement To Install ACS5.3 On ESX5.0?
Jul 11, 2012Why ACS5.3 requires 500GB datastore? what for? do we still need this when we use external database? am in the process of migrating from ACS4.2 to 5.3.
View 49 Replies View Related