Cisco AAA/Identity/Nac :: Ip Address Pool In ACS 5.3?
Sep 30, 2012Is it possible to create an ip address pool for ip address assignment in ACS 5.3, like it used to be possible in 3.x and 4.x?
View 2 Replies
ADVERTISEMENT
Cisco AAA/Identity/Nac :: ACS 4.2 - IP Pool Allocation Based On NAS Port IP Address
Jul 7, 2010using ACS 4.2 and I can't find a way to bind an incoming NAS port to a specifc IP Pool:
When a user connects the request to auth comes from 2 possible NAS ports randomly (this cannot change). Depending on which NAS makes the requests determines the IP range required, so I need 2 IP Pools. There is no way to say 'if request comes from NAS1 give IP from Pool1 and if request comes from NAS2 give IP from Pool2'
I have gone around and around with NAFs and NARs, but cannot do this.I can create 2 ACS groups with the specific NAS and specific IP pool within, but then I cannot have a single username bound to both groups.
I moved the auth to an AD group in the hope that I could bind that single AD group to the 2 ACS groups; and so have a single username, but no joy.
Cisco AAA/Identity/Nac :: VSA 218 - Configure IP Pool Selection By RADIUS On ACS 5-3-0-40-7?
Feb 18, 2013I'm trying to configure IP pool selection by RADIUS on ACS 5-3-0-40-7.So, I went to configuring the cisco-assign-ip-pool (Cisco VSA 218) attribute within some test authorization profile but discovered that cisco-assign-ip-pool is an integer (?!) and (therefore) accepts digits only.
As far as I can remember, we used to put pool *names* within ip:addr-pool
(something along those lines: cisco-avpair = "ip:addr-pool=test-pool-1").
So how should we configure the values for this attribute in ACS 5?
Cisco VPN :: 5510 Remote Vpn Users Having Address From Pool 2
Apr 5, 2011can i have 2 pools each with diifferent subnet [code] i wanna put restricution on remote vpn users having address from pool-2,and just give them access to 172.16.10.0/24,is it possible on the asa 5510?
View 7 Replies View RelatedCisco VPN :: Remote Access Address Pool ASA 5510
Mar 17, 2013Is the following sysntax correct in removing a remote access vpn address pool and inserting a new one on an ASA5510?
(config)# NO ip local pool BWCVPN 192.168.200.1-192.168.200.128
(config)# ip local pool BWCVPN 192.168.300.1-192.168.300.128
(confif)# tunnel-group BWCVPN ciscovpn general-attributes
(config-general)# address-pool BWCVPN
Cisco AAA/Identity/Nac :: Invoke IP POOL Defined On VPN 3000 To ACS5.3?
Aug 27, 2012I configured an ip pool on VPN 3000 concetnrator. i wanted to an attribute to use on the nework access profile on the acs 5.3. i was advised to use pool name. However, we don't have pool name attribute on VPN concentrator. only, IP range and subnet mask. how do i refer an IP pool on VPN concentrator in ACS5.3? is there another attribute I can use on ACS5.3 to invoke a pool on CVPN3000, like ip range...?
View 2 Replies View RelatedCisco Switching/Routing :: 1811W DHCPD There Is No Address Pool
Mar 19, 2013Cisco 1811W router, IOS 15.1(4)M6, DHCP server not working on internal VLAN but configuration looks OK to me. [code]
View 1 Replies View RelatedCisco VPN :: ASA 5505 - IP Address Assigned By Pool Not Reach LAN Network
Nov 13, 2011I've configured vpn ipsec with wizard but my ip address assigned by pool not reach the lan network ,lan network: 192.168.0.0 /24,pool network: 193.168.0.0 /24
View 12 Replies View RelatedCisco Routers :: RV220W Built-in DHCP Server Can't Save Class B IP Address Pool
Mar 28, 2012I was trying to set a DHCP pool with 127.16.0.0/16 with RV220W, however, RV220W UI can't save it. It displays "IP Address Range -"Step to reproduce: (it is 100% reproducible)
1. login into RV220W admin web
2. Create a VLAN, id 201
3. Go to "Multiple VLAN subnets", select the VLAN, click edit
4. Enter following info:
IP Address: 172.16.0.1
Subnet Mask: 255.255.0.0
DHCP Mode: DHCP Server
Domain Name: Cisco
Starting IP Address: 172.16.2.100
Ending IP Address: 172.16.10.254
Primary DNS Server: 172.16.0.1
Leave rest of settings with default value.
DNS proxy is enabled
5. Press Save button. The UI shows text "IP Address Range -".
Expected result: RV220W shall save the setting and make use of 172.16.0.0 subnet in IP pool. By the way, the error message "IP Address Range -" seems incompleteI tried same setting on netgear FVS318N (very similar settings to RV220W), it accepts 172.16.0.0/16 as DHCP IP pool and works.RV220W has great feature set meets my needs. Its UI is slow and sometime dashboard freezes, which I can live with comparing to features. But DHCP server IP pool can't be class B is huge limitation to me.
Cisco Switching/Routing :: Can Layer 2 2950 Switch Be Used As DHCP Server With Its Own Address Pool
Mar 18, 2009Can a layer 2 cisco 2950 switch be used as a dhcp server with it's own address pool.
View 3 Replies View RelatedCisco VPN :: ASA5505 - IP Address Pool In IPSec Client And Site-to-site VPN
Jul 10, 2012We have a scenario where the Cisco ASA 5505 will be one end of a site-to-site VPN. The same ASA 5505 also allows Client VPN connection. The question is around IP pooling. If I assign a pool of IP's (192.168.1.20 - 192.168.1.30) for Client VPN connections - do I need to be sure that those same IP's are not used on the other side of site-to-site VPN ?
There could be PC's/Servers running 192.168.1.0/24 on the other side of site-to-site VPN. Would this cause an address conflict ?
Cisco AAA/Identity/Nac :: Change IP Address Of ACS 5.2 Itself Through The Web?
May 30, 2011How can I change the IP Address of cisco ACS 5.2 itself through the web?
View 3 Replies View RelatedCisco AAA/Identity/Nac :: ACS 4.2 Changing IP Address
Apr 6, 2013I need to change the IP address of existing primary cisco ACS 4.2 (windows based). What is the required procedure to change the IP address?
View 4 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.2 Logs Are Not Showing MAC Address?
May 10, 2012We recently had to rebuild our ACS server. Now when we have an 802.1x authentication failure and look at the RADIUS logs for the specific user, it does not show us the MAC address of the device the user tried to login with. We use this all the time because users have PDAs and other mobile devices that they save their passwords on. Then when they change their domain password on their laptop, they don't change it on their PDA which then tries to authenticate them using the wrong password and eventually locks them out. We need to see the MAC address so we can pinpoint which device is causing the lockout. The report I am generating is when you go to this location: Monitoring & Reports > ... > Reports > Catalog > User > User_Authentication_Summary
View 4 Replies View RelatedCisco AAA/Identity/Nac :: Bulk Upload Mac Address To ACS 4.2
Mar 9, 2011Customer is running acs4.2 and need to upload thousands of mac addresses in ACS database for MAB. how can this be done? does cisco suport csv file import in acs4.2 or any other utility?
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 Authorization Of User Based On MAC Address
Aug 23, 2012A short background. Our corporate SSID is being migrated from using PEAPv0 to EAP-TLS. This restricts access only to company notebooks. Additionally we have barcode scanners which are used to inventory assets. Those devices are not able to use EAP-TLS as they cannot be integrated in the domain and being unable to do certificate based authentication.
As a workaround we planned to use another SSID with access to the same network but using PEAPv0 as authentication method, basically the same SSID but with a different name. As this naturally allows anyone to access the corporate network with a valid username/password I now wanted to add another step into the authentication process - the MAC of the device. I know I can do the filtering at the WLAN controller, but as it has a limited database as well as the fact that it is cumbersome to maintain the MAC list on all the controllers I thought I can do it over our ACS system.
I am now trying to accomplish the following: The user gets authenticated via the internal user store, which is succesful. Now I want to authorize the user via the MAC address, which is stored in the internal host store of the ACS, if access is granted or not.
For this I created the following policy:
Service Selection Policy -- (Rule based result selection)
-- (NDG:Device Type in All Device Types:Wireless And RADIUS-IETF:Called-Station-ID contains <SSID>) | Result: PEAP access
-- Default | Result: DenyAccess
Service PEAP access Identity: Internal Users -- (Single result selection) Authorization -- (Rule based result selection) -- Internal Hosts:HostIdentityGroup in All Groups:Valid_MACs
When I then try to access the wireless network I won't get authenticated. The error I get, when I look into the logs is: 15039 Selected Authorization Profile is DenyAccess
Is it not possible to use one identity store as "attribute database" for the other identity store?
Cisco AAA/Identity/Nac :: Secure ACS 5 For IP Address Assignment Via RADIUS?
Jan 13, 2013I want to use RADIUS (of Secure ACS 5.3) to authenticate users within an ISP environment. Users log connect to a network using a point to point connection (L2) and then they are sending a RADIUS request to get IP adresses. Secure ACS is not quite easy to look through in that case.
View 3 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 Load Balancing - TACACS+ NAS IP Address?
Jun 26, 2012I'm currently evaluating a scenario where AAA request are load balanced across multiple ACS 5.3 instances. The application delivery controller runs in L3 mode, which naturally causes the original packet's source IP address to be replaced by a randomly selected proxy address.As far as RADIUS is concerned, I can perfectly determine the originating NAS by means of a 'Device Filter' condition. Unfortunately, ACS seems to lack the possibility of achieving the same for TACACS+. According to the user manual, only the actual IP address from the received packet is taken into account. I've also come across the 'NAS-Address' attribute in the protocol dictionary, but it can't be used in a custom condition either.how to retrieve the initial device IP address from a TACACS+ request in order to use it for further policing?
View 8 Replies View RelatedCisco AAA/Identity/Nac :: C3750 What Would Cause NAC To Untrusted And Trusted IP Address
Oct 4, 2011We have c3750s running NAC 4.8. Occassionally, a workstation will flap between the untrusted and trusted vlans. We updated the NIC drivers on the workstation, we verified SNMP was functioning correctly on the switch, and we allowed the phones to act as the pass-through between the workstation and the switch. What could cause the workstation IP Address to not redirect to a TRUSTED VLAN from the NAC_UNTRUST VLAN? All updates have been downloaded to the workstation.
View 1 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.3 / TACACS Proxy - No Source NAS IP Address
Aug 1, 2012i would like to use the ACS 5.3 as TACACS Proxy. Basically it works. But when checking the logs on the destination TACACS Server (ACS 4.2) i see that all requests (Source-NAs) came from the IP of the TACACS-Proxy. Not from the original source IP.
This is useless for my scenario, because on the destination TACACS Server the policies are built on the NetworkDevices Groups and AAA Clients = source IPs.
Cisco AAA/Identity/Nac :: 892 - L2TP And Fixed Framed IP Address For VPN User?
Mar 29, 2012I have a running L2TP/IPsec VPN setup with authentification against a radius server (freeradius2 witch mysql). I would like to have some of my VPN users get a fixed IP address instead of the dynamically assigned IP Pool.
The radius server is returning the correct parameters, I think.
It´s a Cisco 892 Integrated Service Router. Code...
Cisco AAA/Identity/Nac :: 3750 AAA Sever Address Is Dropped After Restart Sometimes
Jan 20, 2013We have Cisco 3750G switches and have them setup to use Cisco ACS 5.2.0.26.5. Some switches after they are restarted and we know that the config is saved the server address for the AAA authentication is dropped. We are running IOS c3750-ipbasek9-mz.122-40.SE. I have started to upgrade switches to c3750-ipbasek9-mz.122-50.SE5 to fix an issue with reporting high drops in Solarwinds.
View 6 Replies View RelatedCisco AAA/Identity/Nac :: Assign Fixed IP Address To User In ACS5.2?
Aug 8, 2011My company requires each user dial-in must be a fixed IP; The old acs4 can,but I cannot find the same configration item in the ACS5.2
View 2 Replies View RelatedCisco AAA/Identity/Nac :: ACS 5.1 AD Connection Setup DNS Failing To Resolve Address
May 9, 2010I am trying to configure the ACS with AD in the identity store but am running into the following issue.I enter the AD Domain Name and username and password and hit the 'Test Connection' button and receive a DNS error stating that it 'Cannot resolve network address'.I have logged into the CLI and test to the domain name from there and it works fine.
View 5 Replies View RelatedCisco AAA/Identity/Nac :: ISE 1.1.1.268 - Cannot Create Guest Account From Email Address
Aug 23, 2012I cannot sponsor a guest account using his/her email address. When I try to create a guest account, its show as file attached.
For example,
email.m@email-me.co.xx ->>>>>> cannot create
email.me@email-me.co.xx ->>>>>> can create
ISE version 1.1.1.268
Patch version 1
Cisco AAA/Identity/Nac :: ACS 5.3 Assign Static IP Address Depending On Authenticated User
Feb 12, 2012Actually I have a lab with ACS 5.3 running with 802.1x, but when when the user is successfully authenticated, it's assigned and IP address from the DHCP server, is there a way to assign a static IP address depending of login username??
View 13 Replies View RelatedCisco AAA/Identity/Nac :: Use ACS 5.2 To Create Static IP Address User For Remote Access VPN
Sep 17, 2011At first I use ACS 4.2 to create static ip address user for remote access VPN,It's easy,just configuration it at user set>Client IP Address Assignment>Assign static IP address,but when I use ACS 5.2 I dont't know how to do it.
I try to add IPv4 address attribute to user by read "ACS 5.2 user guide" ,it says this:
Step 1Add a static IP attribute to internal user attribute dictionary:
Step 2Select System Administration > Configuration > Dictionaries > Identity > Internal Users.
Step 3Click Create.
Step 4Add static IP attribute.
Step 5Select Users and Identity Stores > Internal Identity Stores > Users.
Step 6Click Create.
Step 7Edit the static IP attribute of the user.
I just do it,but it's not work.When I use EasyVPN client to connect ASA 5520,user could success to authentication but will not get the static IP address which I configure on Internal Users,so the tunnel set up failed.I try to Configure a IP pool on ASA for ACS users get IP address,and use EasyVPN client to connect ASA , everything is OK,user authenticate successed.but when I kill IP pool coufigurations and use the "add a static IP address to user "configurations,EzVPN are failed. how to use ACS 5.2 to create a static ip address user for remote access VPN?
Cisco Firewall :: ASA 8.4 No Nat Of Vpn Pool
Jul 17, 2012I am using a range of IPs from my inside LAN for my IPSec VPN clients. For example my inside network is 172.16.1.0/24 and I have a pool setup like this: ip local pool vpnpool 172.16.1.200-172.16.1.210 mask 255.255.255.0.
Before the upgrade to 8.4 it was working and now it isn't. Clients can connect and pickup and IP but can't cominuicate with the inside LAN. I think I have to do manual NAT to nonat this range. So I want to try the following:
object network obj-vpnpool range 172.16.1.200 172.16.1.210 nat (inside,outside) 1 source static any any destination static obj-vpnpool obj-vpnpool
However there are two things preventing me from doing this:
1) When I try to create obj-vpnpool I get an error stating that this object overlaps with local pool
2) Even if I create the obj-vpnpool with a non-overlapping range, when in the VPN config I don't have an option for selecting obj-vpnpool.
Cisco :: Possible To Use DHCP Pool To Assign IP
Feb 27, 2013ON ASA, I understand that we can assign a static IP for a specific VPN client, or we can use a DHCP pool to assign IP. Now if I want to create DHCP pools, say pool_A and pool_B, for user A, B and C they use the IP from Pool_A, and user D, E, and F they get the IP from pool_B. Is there a way to do this in ASA?
View 4 Replies View RelatedCisco VPN :: ASA 8.2 - ACS 5.2 With Dynamic VPN IP Pool Assignment?
Aug 7, 2011I have Remote Access VPN users (IPsec) who are terminated on Cisco ASA 5520 (v8.2). For those users, AAA is done on the ACS. Group-policies and tunnel groups are defined on ASA. Initialy I had all VPN users defined on ASA and group policies were associated with each user. Each group policy had it’s own IP pool for users. Now, I moved users to ACS. How can I associate group policy, defined on ASA, with users group defined on ACS? Is it possible that ACS send to ASA information about IP pool for different group policy? Users will use ONE vpn profile BUT based on the Active Directory group they belong to they obtain a different IP address for each group.Can it be done ? ACS version is 5.2.
View 1 Replies View RelatedCisco LAN :: 3560 - Add Second / Sub DHCP Pool?
Jul 25, 2012We have the configuration below set up in a 3560 switch (addresses and names modified for privacy). We are running out of dynamic IP’s in the current pool (6.35.159.0 – 6.35.159.255). We have a new set of IP’s that we can use (6.44.56.0 – 6.44.57.255 – an additional 512 addresses). Although I can figure out the commands to add a new dhcp pool, secondary subnet, etc., I’ve never done this before so I’m not sure of everything I need to do. The end result I need is that the 3560 needs to be able to hand out IP addresses from the current and new pool to anything connecting to vlan 300 – our datanet where computers access the Internet. What I need to do as far as modifying the vlan, adding the secondary subnet, defining helper IP’s, gateways, whatever, so that computers connecting via vlan 300 have Internet access via either of the pools? I have been told that all I need to do is create the pool, but not sure if that is correct...
[code]....
Cisco VPN :: ASA 5505 / VPN IP Local Pool?
Jan 5, 2012We are testing the upgrade from version 8.2 to 8.4 on an ASA 5505 and ran into a problem. For VPN connections we had pools created. A few of the pools were limited to a single IP address. After the upgrade the ASA rejects the pools that only had one IP address instead of a range. In the command line if you enter a question mark after typing in "ip local pool (pool keyword)" in config mode it says "Specify an IP address or a range of IP addresses:start[-end]" with the word "or" it sounds like it should except a single IP address but it doesn't. The error is "Please enter a valid IP address range."
View 5 Replies View RelatedConfiguring Ip Pool In Freeradius?
Nov 27, 2012How do we setup ip pools in freeradius?
View 1 Replies View Related