I want to limit a local user's access to some specific groups of devices. In Role Management Setup I can define which service they can access, but I want to restrict it to a specific device as well.
View 3 RepliesI have a 3845 router (12.4(13r)T10) with ZBF. On my LAN there is a user who need to access a remote IPSEC VPN server. He is able to get the tunnel but afterwards he cannot connect to any service in the remote LAN. As I'm using zbf I think that I should inspect traffic from my LAN zone to EXT zone, There is a document that describe a solution to this? What IP adressess should I use?
View 2 Replies View RelatedI have a 3845 router (12.4(13r)T10) with ZBF. On my LAN there is a user who need to access a remote IPSEC VPN server. He is able to get the tunnel but afterwards he cannot connect to any service in the remote LAN. As I'm using zbf I think that I should inspect traffic from my LAN zone to EXT zone
View 3 Replies View RelatedI would like to create a additional user vpn on a 55010 where the user authenticates with the firewall and not the radius server.This user should NOT be able to log on to the firewall, but only be able to authenticates with the vpn client.I'm correct that the command "username abc123 password abc234 privilege 0" ?Also for this remote vpn how to I make sure the user only authencates with this password?
View 3 Replies View RelatedI want to create a local user in my Cisco ASA 5520 to allow the user to use the ASDM in Read-Only mode. I want the user to view the Dashboard only.
View 1 Replies View RelatedHow can I limit the speed of the wireless user.(I am using lan connection).
View 8 Replies View RelatedIs there anyway to limit a user's traffic volume on ASA8.4? if there is, how?
View 3 Replies View RelatedThe rest of us use wifi for our internet services but this isn't good enough for are newest member so they have now connected a cable directly into the modem, so now whenever he is online ALL wifi suffers dramatically! What can i do to limit his bandwidth and allow the wifi to gain more access is there a way to limit via his MAC address or IP address?
View 3 Replies View Relatedhow many remote user connect using Cisco VPN client on Cisco Firewall ASA5520-BUN-K9? Already i read VPN Client FAQ But their have no information about user limitation.
View 1 Replies View Relatedconfiguring a switch or a router to limit the bandwidth for a specific user/IP when need it. Most of my remote offices are configured like this:
Users ------ 3560 switch ------- 2801 router -------- T1 to NOC -------- 7204 router with channelized DS3
I use Netflow Analyzer for high bandwidth usage alerts and can see the user's IP right away when someone is clogging our T1s. My goal is to be able to temporarily limit the bandwidth of the user taking over the T1. Whatever is best switch config or on the router.
We have been deploying 3502 APs remotely to locations with full T1s that backhaul to where I sit at HQ. Both the foreign and anchor controller are here at my location.
I am seeking to rate limit per user the bandwidth each client will get on the guest internet ssid. As you know this traffic is encapsulated in capwap between the AP and the controller so I cant use a standard ACL on the switch or router.
We are trying to keep the guest internet access usage in check on the T1 at any given site so the other ssid's & local lan traffic is not overly competing for the bandwidth.
I found the place to edit the default profiles in the controller but the documentation really isnt clear on best practices.
So I put it to you my fellow wireless engineers to suggest how you are implementing bandwidth management on your wireless guest internet.
Oh and here is my hardware & software levels.
5508wlc - forgeign
4402wlc - anchor
Software Version7.0.230.0
I want to have a local user in ACS that is permitted to login to routers. I have TACACS with AD already working but cannot get a local user to work. I used to do this in ACS 4.x.I created a user in the internal identity store.I tried configuring a policy to allow this users TACACS authentication multiple ways to no avail. I cannot find a config example doc and cannot figure it out from the user guide as the documention is sorely lacking.
View 5 Replies View RelatedWe are running ACS 5.2 patch 6 and want to restrict access for users to be able to add devices to the system.For example, admin person in site A can only add devices into the site A group and cannot see/access other sites groups.
View 1 Replies View RelatedA quick query regarding setting up a local user on a Cisco 2811. I have setup a few users as they need to have remote VPN access into our edge router, this works fine and I'm happy with it. The only thing is that when they come into the office they now have logins to get onto the router, they do not have the enable secret so they can't exactly do a lot (plus I've created them with privilege 0 which cuts a few extra CLI options) but I'd rather not allow them access at all if possible.If they weren't on DHCP then I could setup an access-list but this isn't really an option, I could also set me up statically and deny everyone else, but yet again I'd rather not.Is there anyway to restrict telnet/ssh access based on user alone? So when they put in their login it just boots them out. I could setup something like RADIUS (and therefore remove the local users completely) but I think it will be a bit over kill for the sake of a couple of users.
View 1 Replies View Relatedhow I can assign a static IP to a user in ACS 5.2. I am able to do it in ACS 4.2, but I don't see the same options under 5.2. General idea is that users authenticate from our VPN appliance via RADIUS, and upon authentication, their static IP is passed back to the VPN device. I can attach an arbitrary field to my local users by going to System Administration -> Configuration -> Dictionaries -> Identity -> Internal Users, but how do I get that IP address passed back when the user is authenticated via Radius?
View 1 Replies View RelatedWe are wanting to use local database users to authenticate our SSH connections to our 6500 cores.
We have added the usernames and password into the 6500 using
username anameduser password astrongpassword or username anameduser secret astrongpassword
We where expecting the commands to be the same as other iOS devices example C3750 we would add.
Line vty 0 4 login local
And this would allow us to use the local user database to authenticate our ssh sessions.
The login local commands are not availbe on the 6500s and we have not found any documentation on how to impliment a local database for this purpose except in a CatOS 6500.
I know the way to configure the ASA to fallback to LOCAL authentication, if the Radius server is not available.
Now we would like to authenticate the local users, if the user is not found in the AD. Is this possible and how can I configure this with the new policies? I tested it with "dropping" when the user is not found in the AD, but then the Radius server will be marked as "dead" and the other AD users can't login for a given period. Maybe we can configure the dead time to 0, but this is not as nice it could be.
How i can use both LDAP Authentication and local user database to authenticate the remote vpn clinet in asa 5505?
when i try to do the things either only one method is working both are not working at a time.
I have FWSM's in Cat 6513's. I have a need to be able to session from the switch to the FWSM by using default account (not local user), at privilege level 15 I further have a need to allow a user read only access by ssh'n into the FWSM...
I believe I need to setup a local user, at, say privilege level 5, assign the show command only to privilege level 5, then set the authorization command for that user. So, i think my command sets are as follows to accomplish this:
username <username> password <pw> priv 5
priv command level 5 mode exec command show
aaa auth ssh console LOCAL
aaa auth enable console LOCAL
aaa authorization command LOCAL
I think, that this will allow the user at privilege 5 to run only the show command and only by SSH to the FWSM while allow the priv 15 level default login to continue to function properly.
I have a console access to a Cisco 4500 series router over Cisco access server, which has following "line con 0" configuration:
View 8 Replies View Relatedi am running NX-OS image n5000-uk9.5.1.3.N1.1.bin on the nexus 5020 platform.i have configured authorization with tacacs+ on ACS server version 5.2 with fall back to switch local database.a user test with priv 15 is craeted on ACS server, password test2 everything works fine, until i create the same username on the local database with privilege 0. ( it doesnt matter if the user in local database was created before user in ACS or after ) e.g.: username test password test1 role priv-0 (note passwords are different for users in both databases)
after i create the same user in local database with privilege 0,if i try to connect to the switch with this username test and password defined on ACS, i get only privilege 0 authorization, regardless, that ACS server is up and it should be primary way to authenticate and authorizate the user.
I am trying to configure an ASA 5505 running 8.3 to allow a priv 15 local user to be able to ssh into the device and be placed into priv 15 mode without having to execute the enable command and type the enable password.Right now when you log in as a priv 15 user you still have to execute the enable command and type the enable password to get to priv 15.
View 3 Replies View RelatedI'm a bit new to Cisco and i find this AAA a bit confusing..I've turend on AAA by:aaa new-model
Can I use this "default" list for WebVPN ? And what would be a different if i create new "sslvpn" list..Also when I'll be creating user for VPN remote access.. that user will also exist in local database and have access to router via SSH?Because the research I've done it doesn't seem you can group users in different "aaa groups" e.g. user admin belongs under "admin" aaa group which can do ssh to router, users for VPN can only do remote VPN access and not SSH and login into router.i saw ASA has some attribute for users called remote-user
•admin, in which users are allowed access to the configuration mode. This option also allows a user to connect via remote access.
•nas-prompt, in which users are allowed access to the EXEC mode.
•remote-access, in which users are allowed access to the network.
But i can't find this option in IOS on my 1900 Series ISR router.
I have a Cisco ASA 5505 that I've setup with an SSL VPN. This is for personal use, and I therefore don't have need for anything more than local authentication. [code]
I'd like to have one profile/policy where I only encrypt data going to my split-tunnel ACL, and I'd like to have one profile/policy where I encrypt all traffic.
The issue ive been fighting is - it doesn't seem like its possible to associate more than one group policy per user. If it IS possible - can you tell me how I associate both groups to my local account?
One of our customer , where there 2 6509 switch , one is Core_sw1 and other is Core_sw2 , catering about 32 Vlan , and HSRP in running for all Vlans , till here no problem , now there internet Router which having one Internet link , which connected and configured on Core_sw1 in a way that one interface of Core_sw1 is given Public IP and there is vlan 85 which internet vlan and vlan 85 ip are natted with that public IP with one simple static route given toward internet router , this is how internet is working ok.
Now i have configured vlan 85 in hsrp as all other are , how can give redundancy to vlan 85 user , that if Core_sw1 get down , internet traffic can get out through Core_sw2.using same internet router with single internet link .i am not talking of ISP redundancy , but Vlan 85 in Core_sw1 goes down , other Core_sw2 will server internet.
My home LAN supports 3 Chinese students who spend many hours each day watching movies through either Baidu or QQ. Both these operations seem offer streaming video but in a P-2-P mode. As a result typical daily uploads are running at greater than 6GB. My ISP daily upload limit is 1750 MB; after that I am throttled to 25% of the service I am paying for.I have tried and failed to explain to the students the impact this is having on me. I would like therefore to be able to prevent P2P uploads by suitable settings on my router. Is this possible?
View 9 Replies View RelatedSo i have a bit of an odd question and i think i already know the answer but i want to be sure. I would like to set up RDP for 3 desktops at my house to be accessed over a vpn when not home. Currently i am running a VPN on a linksys WRT54g router with dd-wrt. I would like to know what all needs to be done to limit the RDP connections to my lan and VPN connection only? IE I would like to block RDP access over the normal wan connection completely.
View 3 Replies View RelatedMy children are enrolled in an online school. Is there a way to restrict access to allow access to the school site only with the option to toggle this on and off?
View 2 Replies View RelatedWe are expanding our wireless infrastructure by adding further access points AIR-AP1242AG-E-K9.We use four WLC 4402 running version 6.0.188.0 as a fail over pair.What is the maximum limit the WLC can handle ?What is the recommended limit one WLC can handle ?We can divide the load on the controllers but in case of a failover one WLC will manage all access points.
View 4 Replies View RelatedI need to limit access to two ip address via acl but when i add them to the list i lose access to internet.
View 1 Replies View RelatedWe have a small office and already have a firewall in place that uses content filtering. I am looking for a low cost wireless access point that I can place behind my firewall that will allow me to control access by a username and password list, not just the passkey.
Does this exist without having to go to an Aruba or Ruckus type enterprise WIFI product?
I have a Verison Mifi hot spot it runs two computers, I would like to know if there is some way that I can limit what is coming in on the hot spot
View 1 Replies View RelatedLimit his bandwidth. but he will only be staying till the end of summer. The new roomie then might be a torrent monkey.Completely shield my other computers from his sight, so to speak. Like I said he's not a hacker but the new roomie might be.
I'd like the router (linksys WRT54G v3 runner latest linksys fw) and the rest of my network (main PC and media server) to be resistant to at least a script kiddie, and hopefully against a intermediate hacker.I'm currently using wifi with WAP2 personal as the router security.