Cisco :: Lobby Ambassador Profiles In ACS 5.3

Jul 14, 2012

We've set our WCS up to do AAA through our ACS 5.3 which works great. So in order to log into the WCS for Administration or as a Lobby Ambassador (to create guest users etc) the AAA is all done by the ACS, GREAT!
 
I have assigned a set of users the Lobby Ambassador role as passed that back through TACACS to the WCS, so those users have their role setup as Lobby Ambassador and are limited from doing anything else, as expected.
 
What I want to know is: With normal local AAA on the WCS, when you created a Lobby Ambassador account, you could give the account a set of defaults for any guests accounts created by that Lobby Ambassador account, which was good, so Lobby Ambassadors couldn't set up unlimited time accounts and stuff like that.
 
What I want to know now is that since I'm now doing all the AAA on the ACS, is there an attribute I can pass to the WCS in the Shell Profile, along with the roles etc telling the WCS what the guest user creation defaults for the Lobby Ambassador account is, so that we can continue to limit the defaults of any guest account that the Lobby Ambassador accounts create, as it used to be? We'd really like different lobby ambassadors to be able to do different things as well. i.e., Lobby Ambassador X can only create accounts for one region. Lobby Ambassador Y can create Unlimited time accounts where the others can not. We used to do this by assigning different guest user creation defaults to different lobby ambassador accounts on the WCS.

View 1 Replies


ADVERTISEMENT

Cisco :: ACS 5.2 Can't Do Login Into WCS As Lobby Ambassador

Aug 28, 2012

I'm crazy with this version of ACS, it is totally diferent than ACS 4.2, which is familiar for me and seems to difficult to config for me.Although I have red a lot of post about problems with the integration WCS 7.0 and ACS 5.2 using TACACs+ for admin or lobby access to the web portal I can't do login into WCS as Lobby ambassador using ACS 5.2 because always show me the error "User has no usergroups assigned".Steps I followed:
 
- I create a "shell profile" with the custom attributes of the group "lobby ambassador".

- In default device admin / authorization, I create a rule matching this "shell profile".
 
I see lot os Hit counts and passed in logs, but the message written previously.In ACS 4.2 I had to create the custom attribute "HTTP" and string "Wireless- WCS" to work with, but now I don't know if it is necessary and I don't know how to do it.

View 5 Replies View Related

Cisco Wireless :: 2504 WLC Lobby Ambassador Available?

Jan 16, 2012

I was wondering if the 2504 has the lobby ambassador feature available. Customer requires temp username/passwords for guests managed through web gui. I couldn't find conclusive documentation it was included so I figured I'd check here before calling Cisco.

View 2 Replies View Related

Cisco :: WLC 7.0 - Configure Lobby Admin With ACS 5.1

Jan 23, 2012

How to configure a LobbyAdmin account for WLC 7.0 on a 5.1 ACS?  I'm very new to ACS 5. How to configure it.

I've got the ACS policy working that allows me to login to the WLC using a user account with full rights but the Lobby admin account can login with full rights as well.  I've tried setting the custome attributes in the shell profiles with role0-mandatory-LobbyAmbassador, task0-Mandatory-Configure Guest User and task1-Mandatory-Lobby Ambassador User Preferences but it still doesn't work.

View 18 Replies View Related

Cisco :: 4402 WLC - Restrict Lobby Admin

May 12, 2011

I was wondering if there is a way to limit the ability of the "lobby admin" account to only be able to give out 24 hour wireless access?  The situation is this, we are going to move the roles of guest wireless over to our lobby administrators, but we are afraid they might break policy and give out 30 day wireless access so they dont have to keep renewing guest access each day.  We want to limit access to 24 hour "tokens" for all guest unless its a unique situation.

View 2 Replies View Related

Cisco :: Multiple Lobby Admin Account With ACS 5.3

Jan 25, 2012

Any way to create multiple lobby admin account on ACS and each account will have access to only specific WLANs on the WLC?

View 6 Replies View Related

Cisco :: 5508 NAC Guest Server And WLC Lobby Admin

Apr 15, 2012

Why do need Cisco NAC guest server when we have WLC 5508 already configured. The Guest user access can be given by the WLC itself too. We can create users in WLC also and grant access to the user to access internet for specific time frame. My query is - what is so different in Cisco NGS that it is considered good in terms of Guest users access. What are the advatages of NGS.

View 4 Replies View Related

Cisco Firewall :: Way To Create A Guest Access Lobby On ASA 5525

Sep 23, 2012

Is there a module or way to create a Guest Access Lobby on the ASA 5525? We currenly leverage the WLC to do this for us, but are moving to a routed access enviornment which is causing some issues. We would like to offload the guest access responsibility to the ASA if possible.                   

View 1 Replies View Related

Cisco :: 4400 WLC / WCS - Monitoring Lobby Admin User Activity

Jan 26, 2011

We currently have about 8 WLC 4400 series controllers deployed around the company, one of these controllers is acting as an Achor controller for GUEST wifi access for visitors to the company, as a result of this we have many users with "LobbyAdmin" access to setup users.
 
We have recently introduced a Cisco WCS to manage these devices but its not fully implemented/active to see all WLC's.I need to be able to report on the LobbyAdmin users to see who is setting up accounts and for who etc. Currently access to the WLC/WCS is done via Local admin accounts. All accounts for the LobbyAdmin people are setup on our anchor controller.
 
I have added the anchor controller for this to the WCS system but when looking in Administration/AAA/Groups the LobbyAdmin groups shows No Members.Is there a way that i can import the Lobby Admin names from the anchor WLC to the WCS so i can do reports/audit checks on these users?

View 2 Replies View Related

Cisco Wireless :: 5508 WLC / Lobby Admin Guest Account With Two Controllers?

Feb 14, 2013

I have two 5508 WLCs.  Both have APs attached to them.  If I create a guest account with the lobby administrator on one, will that user account be able to log in to the network if the client is attached to the ohter WLC?  So far, I have found that I need to create the same user on both WLC's, in order to have the user login.

View 2 Replies View Related

Cisco :: Number Of RF Profiles On 5508?

Feb 17, 2013

I've searched the release notes for 7.2+, but I haven't found a documented number of how many active RF Profiles a 5508 can support. Any limitation of how many RF Profiles they can have?

View 3 Replies View Related

Cisco VPN :: Disable VPN Profiles In ASA 5550

Feb 11, 2010

I need to disable approxematly 40 different VPN profiles in our ASA5550`s without deleting them (need the ability to quickly activate them again if needed). I thought maybe i could disable IPSec for those profiles, but since the IPSec is an attribute for Group Policy, i cant do it - as many other profiles are sharing the same policy.

View 2 Replies View Related

Cisco VPN :: ASA And ACS 5.3 Multiple VPN Profiles For One User

May 21, 2012

I have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:ACS 5.3 group hierarchy:VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles),VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A),VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)

View 3 Replies View Related

Cisco VPN :: One User Associated With Two VPN Profiles ASA 5510

Apr 3, 2011

Is there a way that i can associate one user with two VPN profiles. Now here is the scenario.Our company has bought a win 7 64 bit pc for some of the employees , so i had to create anyconnect. But the same users are also connecting via normal cisco vpn client. they will give away these old pc but for the time being my need is that both users shall connect to anyconnect profile and ipsec profile.

I tried ti to assign same profile with both ipsec and svc so that they could use single profile but anyconnect didn't work. I am having cisco ASA 5510 as VPN gateway.And How many licenses does cisco asa have by default for anyconnect users. Here is the configuration for anyconnect
 
group-policy Broad_Anyconnet internalgroup-policy Broad_Anyconnet attributes dns-server value 4.2.2.2 vpn-tunnel-protocol svc webvpn split-tunnel-policy tunnelspecified split-tunnel-network-list value Nit_Broadcast_Network_Tunn_ACL address-pools value Broadcast_AnyPool webvpn  svc ask none default svc
 [Code]...

View 5 Replies View Related

Cisco :: 3500 - WLC QoS Profiles Not Applying Egress

Sep 8, 2011

In regards to QoS profiles on the WLC. I have applied a profile to a newly created WLAN and set the Per User Bandwidth to 512k and it seems to be kicking in on the ingress only, this is supposed to work ingress AND egress or is it just designed to work one way?  I have a 4402-25 with Cisco 3500 AP's and am running the 7.0.98 code. If it is designed to work one way only is there a different way to apply it ingress and egress simultaneously off the WLC?

View 3 Replies View Related

Cisco Wireless :: WLC 2504 / Group APs To Get Different Profiles?

Aug 21, 2012

Is there way to group APs to get different profiles. I need to have some that have the 2.4GHz turned down and some wiht the 2.4 and 5.0 GHz on.

View 7 Replies View Related

Cisco VPN :: Adding User Profiles In AnyConnect VPN 2.5

Feb 15, 2012

I recently upgraded to Windows 7 in my company and the OS came bundled with Anyconnect VPN client version 2.5.
 
In the earlier version I used to add user profile using a .pcf file by importing it into the client to access customer LAN.
 
But in the Anyconnect VPN client I dint find any option to import the file. The IT support has told to edit the xml file to add it. The problem is I even after i edit the anyconnect-cert.xml with changes in host name and host address tags  I am not able to start a connection. I dont knw know exactly what address must be given in Host address tag. I copied the host address from .pcf file which i used earlier.
 
Whether I will be able to add a user profile in this way or any correction is to be done in the whole process of adding the user profile,

View 1 Replies View Related

Cisco :: WLC 4402 / Can Use ISE Server And Make Profiles

Jun 13, 2012

Customer has a WLC 4402 and 21 AP's LAP1131AG, there is a PDA wlan created to give PDA's and wireless Phones access to the webmail. This is done by access lists and firewalls. Now the customer wants more access to the internet in this PDA wlan, maybe in a later phase to the other vlans, can we use an ISE server and make profiles, is this the only additional server that we need or is an upgrade of the WLC and ÄP's also needed.

View 1 Replies View Related

D-Link DCS-942L :: How To Switch Profiles

Dec 18, 2012

I just bought new 942L (HW Rev3, 1.12 FW) and the only profile which is used to stream to iPhone or Web browser in mydlink is profile 3 which is limited to JPEG. Is there some way how to change the profile to be used for streams or is there a way how to make to profile 3 something else then JPEG?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Network Access / Authorization Profiles ACS 5.4

Apr 17, 2013

For ACS 5.4: In Network Access -> Authorization Profiles there is a Permit Access profile. If you try to edit it a message pop's up that says: "The profile you have selected is reserved and cannot be deleted or modified". What this profile contains in its rule base? If I wanted to create a similar profile what Common Tasks, or Radius Attributes would I need to use? The same would go for a Deny Access profile. I have looked at the Common Tasks and Radius Attributes for a new profile and it doesn't seem very intuitive.

View 2 Replies View Related

Cisco VPN :: ASA 5510 - AnyConnect VPN Multiple Connection Profiles?

Nov 9, 2011

I use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else.
 
I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group.
 
My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile?

View 1 Replies View Related

AAA/Identity/Nac :: ACS 5.41 Same Username With Two Different Group / Shell Profiles

Mar 23, 2013

In my ACS 5.4 I want to have same useranme to use two shell profiles. Here is the requirement.One shell profile with privelege 15 for IOS device admin and other one with different privelege for WCS admin.As there can't have two shell profiles on the same authroization profile, I created two different profiles, and match with the ACS local group name. However whenever user tries to access it always hits the 1st profiles.

View 3 Replies View Related

Cisco :: WLC 4402 / Order Of WLAN Profiles In AP Group From MIB Files

May 19, 2009

WLC Model
---------
WLC 4402
 Software Version
----------------
5.2.178 
Problem Statement
-----------------

Do we have any Cisco WLC MIB to get WLAN profile (Order in which WLAN profiles are added inside an AP Group) information present in an AP group?

View 3 Replies View Related

Cisco VPN :: 5510 - Separate RADIUS Profiles For SSLVPN Group

Sep 11, 2012

We are starting to deploy SSL VPN in our company and we recently purchased two ASA 5510 firewalls. I have already completed the initial configuration but I do have some inquiry on how to have it configured properly.
 
1. Employees and clients will access the URL
2. They will select the appropriate group on where they should login.
3. Enter credentials, etc.
4. Username/Password authentication is via RADIUS. The usernames were all created in Cisco ACS 5.3.
 
My challenge is, we have several clients and all their usernames were created in ACS5.3. Meaning if the configuration is just being differentiated by group settings, clientA can select the profile of clientB and still get authenticated. If that happens, they will be able to access the resources of each other. Also in the future, we will be deploying 2-Factor authentication for some of our clients.

View 4 Replies View Related

Cisco VPN :: ASA 8.2.x / Assigning AnyConnect Client Profiles Based On The Machine?

Mar 3, 2010

I have an ASA running 8.2.x code with AnyConnect 2.4.x.I have both Radius and LDAP (AD) AAA available.If a user connects from a company owned laptop, I want to push down AnyConnect client ProfileA (with scripts to map drives etc...) and network ACL's set A.
 
If a user connects from any other computer, I want to push down AnyConnect client ProfileB (no scripts etc...) and network ACL's set B.
 
What I would like to do is CSD to do a machine certificate check (for presence of a cert from my private CA) and to assign a EndPoint Policy attribute (Managed on successful check or Unmanaged on failure). I can then use DAP to tailor the ACL's that get set.
 
It seems like the only way to handle AnyConnect client profiles is with Group-Policy. Using LDAP I can assign a user to a Group-Policy, but I have no way of determining is they are coming in from a company laptop or not when assigning the Group-Policy. DAP can not assign an AnyConnect client profile.
 
If at all possible, I do not users to have to pick a conenction profile or use different URL's.

View 1 Replies View Related

Pending - Windows 7 And XP Profiles On Server 2003 Environment?

May 16, 2011

i have recently added to a domain. The initial setup is a server running windows 2003 and several xp machines which logon to the domain using mandatory profiles. However, after adding windows 7 machines and logging them on to the system it doesnt load the profiles. (which is fine as I understand you cannot use the same profiles with windows 7+xp)The problem is it automatically creates a roaming profile when logging off and saves it back to the same path as the other profiles under user.V2 which is growing considerably and causing huge logoff and logon times.How can I get the windows 7 machines to not attempt roaming profiles back to the server and instead to just save the profiles locally when logging off.

View 14 Replies View Related

Cisco Firewall :: 5510 - AnyConnect Client Profiles Not Replicating To Standby ASA

Jan 18, 2012

We have 2 ASA 5510's running in a Active/Standby configuration.  It appears that most of the changes we make on the active unit are replicated to the standby unit.  However, there are 3 AnyConnect Client Profiles on the active unit and none of them show up on the standby, the standby has no AnyConnect Profiles.  We also have 1 OnConnect script on the active unit and it does not appear on the standby unit either.
 
I was under the assumption that all config items on the active unit would replicate to the standby.  Is this not correct?  Do I need to do something extra to get everything replicated?  Are there other items that do not replicate? 

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Acs 5.2 Unable To Launch Common Task On Authorization Profiles?

Feb 15, 2013

I have recently installed acs5.2 evaluation on a vmware and i can't launch common task on authorization profiles when i click on it i have the bellow message javascript:cuesToggleTab('NetworkAccess',1,false,false

View 4 Replies View Related

Cisco Switching/Routing :: Different Netflow Export Profiles On Cat 6513 With Sup720

Aug 28, 2012

Is it possible to have one netflow export profile (may not be the right word...) to send all the flow information to one collector and another profile to only send traffic to and from centain IP addresses to another collector? If it is possible on the hardware and software, any quick sample config?
 
#sh ver
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXH4,
 
#sho module 7
Mod Ports Card Type                              Model              Serial No.
--- ----- -------------------------------------- ------------------ -----------
  7    2  Supervisor Engine 720 (Active)         WS-SUP720-3B       SAL1115LJBR
 
Mod MAC addresses                       Hw    Fw           Sw           Status
--- ---------------------------------- ------ ------------ ------------ -------
  7  0017.9444.9814 to 0017.9444.9817   5.3   8.4(2)       12.2(33)SXH4 Ok
 
Mod  Sub-Module                  Model              Serial       Hw     Status
---- --------------------------- ------------------ ----------- ------- -------
  7  Policy Feature Card 3       WS-F6K-PFC3B       SAL1115L2NH  2.3    Ok
7  MSFC3 Daughterboard         WS-SUP720          SAL1115LH7W  2.6    Ok

Mod  Online Diag Status
---- -------------------
  7  Pass

View 2 Replies View Related

Cisco :: Test Fast Roaming Using A Cisco 2100 Series Controller And 2 1140 APs?

Jul 20, 2011

I'm trying to test fast roaming using a Cisco 2100 Series controller and 2 1140 APs. The initial authentication succeeds fine and the wireless connection works ok using WPA2+CCKM and LEAP with a Cisco ACS radius server.The problem is that the client does not attempt to preauthenticate with the other AP because the RSN Capabilities IE in the AP beacons and probe responses do not set the RSN Preauthentication capable bit. I can't figure out what it takes to get the APs to indicate to clients that it can do preauthentication. I'm been crawling through all the documentation I can find, to no avail.

View 1 Replies View Related

Cisco WAN :: Does Cisco Catalyst 2960-8TC Support Bandwidth Limit Control

Aug 22, 2011

We are about to share a 10 MBit ISP connection with 2 others companies, and they are going to split the bill up into 3,3 and 4 Mbit, so we where thinking that we could setup a switch before their and ours router and provide them with a static IP from our ISP. But is it possible to set a bandwidth limit on the ports of a Cisco Catalyst 2960-8TC, so that we can set a limit of 3,3 and 4 on 3 ports.

View 1 Replies View Related

Cisco Wireless :: WLAN Cisco / AP 3502e - How To Get PAT (Product Acceptance Test)

Dec 3, 2011

I want to PAT my project of WLAN and i attached the document, how I create the Testing Criteria of the said scenarios, PAT document includes WCS 7.0, WLC 5508, MSE 3310, Cisco AP 3502e and ACS 4.2.

View 0 Replies View Related

Cisco Firewall :: Cisco ASA5510 Unable To Block Unwanted URLs

Jul 12, 2012

I have  cisco ASA5510 firewall  using in my network but  unable to bolck Url's  unwanted. can i block the [URL] on the asa by using regular exp.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved