Cisco Security :: Can Integrate Acs Version 5.x With Active Directory Microsoft Windows Server 2012
Apr 5, 2013Can we integrate cisco acs verison 5.x with active directory Microsoft windows server 2012 ?
View 1 RepliesCan we integrate cisco acs verison 5.x with active directory Microsoft windows server 2012 ?
View 1 RepliesI have a 2821 ciso router and i want to setup a vpn for my windows domain users , they must to reach the domain from outside. There is posibile to intregrate Active directory auth with pptp running on 2821 router? kind of dialin via radius server(IAS running on windows server 2003).
View 3 Replies View RelatedI have installed 4 unit Cisco Aironet 1250 acting as Autonomous AP each. I want to integrate these AP to Windows Active Directory for authentication level.
When I read configuration guide on Cisco Aironet, they must be authenticated via RADIUS server.
Is it possible that these AP directly authenticated to Active Directory via LDAP protocol?
i need a documentation or a procedure to how make integration LMS 3.2 with microsoft active directory to make usernames of devices appear in end hosts reports.
View 2 Replies View RelatedWe are using ACS 5.2 and we are trying to create a Microsoft Active Directory (AD) Identity Store. We have a user to be used in the Active Directory creation General page and we would like to know how the test communication / ACS to AD communication takes place.
Our user is a predefined user in AD and has admin rights, but the password expires every 60 days. Will this affect the communication between AD and ACS 5.2 at everytime the entered user's password expires?
i need to know if i can integrate Single Sign On to my Cisco VPN Client v.5 with my Active Directory which run on windows 2008
View 2 Replies View RelatedI have 1 server where i enabled dhcp server and active directory on it . I still have to install something like ISA server on it as isa doesnt support 2008 r2. point me out on the networking , like how should i connect the clients to the server. And how the wireless router and switch should be connected to the server?
View 1 Replies View Relatedi've been using a VPN to connect to my home network from elsewhere for a few months. It's set up as follows:
PPTP
Maximum Strength Encryption
EAP-MSCHAP-v2 Authentication
Now I find out that MSCHAPv2 authentication has been broken and is no longer considered secure (even by Microsoft), so I want to change the protocol I'm using to make it secure.
However, I've spent 3 hours now researching this and I cannot for the life of me figure out how to use a better protocol on my Windows Server 2012 home server. I've tried setting up PEAP authentication (still PPTP) a la Microsoft's recommendation document, but it requires a certificate. I've created a self-signed certificate but it seems I can't issue certificates (via this method) without being a member of a domain, so I'm stuck. I can't even get started with L2TP since I can't find the option for it.
My question is this: Is there a way to setup a secure VPN server using Windows Server 2012 without a domain? If so, how do I do this?
We are still running ACS 4.1 on Window 2003 server. We recently upgraded AD to 2008 although the domain and forest functional level are still 2003. After AD upgrade we now unable to authenticate via ACS Windows Database.
View 13 Replies View RelatedWe are planning to upgrade CORP Domain from Windows 2003 Active Directory Schema to Windows 2008 R2 Active Directory Schema.
I wanted to know if the following applications which are installed on windows (domain member servers) are compatible with windows 2008 server R2 schema?
CiscoWorks LAN Management Solution 2.6 Cisco Secure Access Control System 4.2Cisco Fabric Manager 1.5
I will set up a Dhcp server on the inside interface of my pix. I would like to have the DHCP Server authenticate to the Active Directory Server that is located on the DMZ.
Inside --pix--dmz
Inside interface
Win 2008 DHCP
DMZ interface
Active Directory Server
What would be the issues that I could run in to when I try to authenticate this server from the inside interface to the dmz? I see that Dhcprelay option is available on the PIX 6.3 I'm guessing this is the only command that I need to use: dhcprelay enable dmz
i have installed system (Windows Server 2003) and i have configure Active directory for testing and configure one user under it ( TEST01)now on the same machine i have installed Cisco ACS 4.2.i'm trying to Authenticate (TEST01) using ACS but it's not working, i can't even see the logs under EVENTVIWER. simple and easy to configure since both AD and ACS is on the same machine.
View 4 Replies View RelatedI can't seem to figure out which one I should go for. I'm thinking Kaspersky would have greater security but I'm not familiar with AVG's server level security.I don't need all the bells and whistles such as file encryption or password storage. I'm simply after a really strong AV for the server. Another one is VIPRE although I've heard it can take a while to configure it unlike Kaspersky which is pretty straight forward.
View 1 Replies View Related1) I had Windows XP 2012 Security virus that I removed. The antivirus software also removed afs.sys and afs.reg file, that I repalced from backup. I also copied and merged afs.reg Doing this got me an ipaddress for my PC.
2) I can not connect my wired desktop to the Internet. I can ping the ip address of google.com but not the url. I can also not ping ip address of netgear.com. My laptop has no problem connecting to the wireless network.
3) I ran Winsockxpfix and flushed dns and no luck. [code]
I have an unusual issue, for which I can find nothing on the net similar.
Setup:
ASA5505 = > CISCO3524 => Windows 2012 server
ASA is internet edge with ACL / NAT implemented.
We are wanting to implement inbound NATs for this server - 3389. We have many other servers on the internal side of this ASA that we are NATing to. Creating NATs using the same outside IP to another server is fine, no issues. This other test server resides on the same VLAN as the windows 2012 server. All IPv6 is turned off on the W2012 server, and it can web-browse out via the ASA as well. No matter what I do, however I cannot get iinbound NAT, on ANY port to this server working. Internally from another server to this server on any port is fine, i.e. we can RDP to this server without issue, so we know this works - the firewall on this server is turned off too. This is our ONLY w2012 server on the internal side. When we run a wireshark on the server whilst testing the NAT there is no traffic, so its getting blocked somewhere.
The config of the ASA is fairly big to to santize it and remove all customer reference would take a while to make display of this secure difficult.
In my organization we are having 12, LMS 3.2 servers deployed across the globe. As per Audit policy we need to deploy Microsoft win2003 server security patches on all servers using WSUS. Every month our server team sends us query before applying the patches regarding it's compatibility with LMS.
View 4 Replies View RelatedHow to be able to get AP1252AG-E-K9 running against Microsoft Windows Server 2008 R2 IAS.I am getting these errors:
RADIUS/DECODE: convert VSA string; FAIL
RADIUS/DECODE: cisco VSA type 1; FAILRADIUS/DECODE: VSA; FAILRADIUS/DECODE: decoder; FAIL
RADIUS/DECODE: attribute Vendor-Specific; FAIL
RADIUS/DECODE: parse response op decode; FAILRADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL
I have installed ACS 5.2 and configured it to join the Company's Domain as an External database with Active directory 2008. I'm facing a problem that the user once authenticated using it's active directory account it's cached in the ACS and take a while for the ACS to clear this username. For example, if user TEST authenticates and then we removed this user from the AD and then tried again; it authenticates although this users is removed from the AD !!! same thing happens when we change the user group on the AD, it takes a while for the ACS to clear the old user attributes and get the new ones from the AD.
it there an aging time for this caching mechanism, or can i clear the dynamic users manually just like in ACS 4.X ?
Having problems configuring an SR520 to support SSL VPN with Active Directory authentication. I set up the domain and a user in the SR520. and get the login prompt remotely but when attempting to login using the active directory account i get a login error. I can login fine using local authentication.
View 5 Replies View RelatedI am trying to set up a small domain for my business. I just purchased a Windows 2008 server and would like to use it as my domain controller.Also, I just had a new ATT DSL line put in. It came with a 2Wire modem/4-port router/wireless router device, therefore the modem can handle DHCP. The line has a static IP address as well so that I can eventually use my own exchange server and web server.I have tried 2 different configurations and couldn't get either to work) I tried to put the router into Bridged Mode and use DHCP server on my server using a PPPoe connection to connect to the Internet. I was confused as to what my static IP address and default gateway of my server should be.2) Then I tried to turn DHCP server off on the server and routing back on the modem/router. This didn't work either.What method would you recommend and why? Also I have some additional questions on each method.
Method 1)
* What is the static IP address of the server. Is it in the 192.168.1.x address or the static IP assigned to my account?
* Do I need a second Nic Card And Router to connect to the rest of my network or can I use the router provide
* What would the Static IP addresses of the additional PC be. Do I need more than 1 static IP from AT&T Method 2)
* Will this allow me to use all internal IP addresses on my machines and use port forwarding if I want a specific box to be a web server or exchange server.
I know that when you create a user account in active directory, the user's computer is also added to active directory. However, in what circumstance would you add a computer to active directory in which there are no user accounts created, or used ?For instance, my Linksys wrt54g router, on the main configuration tab has a space to name the router, which is appropriate called, "Linksys", and it has space to enter it's domain name, which if I named it, I guess it would be. LinksysRouter.**.local.Why add a router to an active directory domain ?Why add any other computer to an active directory domain with no users associated with it ?
View 11 Replies View RelatedI've got a fully working active directory with mandatory profiles. I'm looking into adding MS Office 2007. I have the disk and everything, but I'm wondering how to go about installing it. Must I go around each workstation installing it?
View 1 Replies View RelatedI've got this problem with our Operations Manager's laptop not letting him log in once he is offsite(at home). We use an Active Directory server here for all out workstations to log on to the domain but once he is offsite he cannot log in because the laptop obviously cannot find the sever to authorize the user. For now I just have him logging in locally to his laptop and not to the domain when he is offsite but this creates a problem; it makes two users/desktops for him, one user.domain and user.local. Is there a way to tell the machine locally that his username is authorized to let him log onto the domain account though it cannot connect to the domain server?
View 3 Replies View RelatedI am not sure why but when I try to connect with my IPSEC VPN client, authentications are failing. The ldap test passes on the ASA but when I try to login, the VPN client gives me authentication failure even though debugs show authentication was successful.User 'test1' should be able to authenticate based on group membership.User 'test2' shouldn't be able to.I already removed the attribute-map to see if that was the problem but I am still failing authentication.
View 9 Replies View RelatedI am receiving a RADIUS authentication failure stating user must change password; however, password has been changed in AD and is not requiring change password any longer on the AD side.
Is there a cache on the ACS that needs to be cleared? AD connection from ACS to domain is fine. All other accounts authenticate.
It appears that if a user lets their account expire is when this happens. Account has been reenabled in AD and password has been changed. Still will not authenticate via ACS.
I'm attempting to integrate an acs 5v into the domain through the gui. The connection will establish, and the status will read 'connected', just as it lists the domain I've submitted. However, I can't seem to find anything listed under the directory groups, and when I run a connection test, I simply get 'Global Catalogue port status error.' Eventually, I'd like to configure this as a radius server.
View 1 Replies View Relatedquestion 1. in the typical active directory environment and doing wireless/wired 802.1x authentication on endpoints, should ACS join as a domain computer?
question 2. for the endpoint (domain computer) join the domain, in this case is the endpoint will trust the ACS ( also domain computer) ?
question 3. what if there's a GPO policy to install the rootCA certificate toward the endpoints. In this case, ACS should issue the CSR and let the domain CA to signed as the identity certificate? Am i correct?
I am working with ACS 5.2 and using Radius authentication for vpn client.
The authentication method used is Active Directory in an Windows enviroment with multiple domains in the same forest.
My problem occurs when i change a user from one group to another in Active Directory. After that i receive the following message when try to connect:
15039 Selected Authorization Profile is DenyAccess
The message is because match the default policy. Another user in the same AD group works fine. All domain in the forest have trust relation each other. I am using universal groups to include users from all domain belongs this forest.
I recently bought a Cisco WLC 2500. I want to configure a WLAN with Active directory authentication.How I can do this?
View 4 Replies View RelatedA customer uses Active Directory where some group names contain special characters (ç ~ '^). The Cisco ACS 5.2 is presenting the warnings: "Not all Active Directory user groups are retrieved successfully. One or more of thegroup's canonical name was not retrieved "(Category CSC Oacs_ Identity_ Stores_Diagnostics; code 24457).
What are the results of these warnings to the customer's network? Slow? Loss of access?
configure the Cisco ACS to authenticate the users from MS Active Directory. Cisco Acs = 4.2.1(15)Currently, i have multiple users configured as local databse. but now i want to authenticate with the domain users.
View 11 Replies View RelatedCurrently We have several Active Directory Domain at several Technical High Schools. These are used by us as a it educational unit(s). The Tech School System's IT Department has a fiber wan between the schools that allows communication between these units. We wanted to interconnect the unit's Active Directory's with Trusts or by combining them into one forest. However I am wondering How much bandwidth that alone would require? There make be some file access between units but not on a daily basis since the units are separate from one another. How much bandwidth do you think this would require?
View 5 Replies View RelatedI am adding a site in another time zone but keeping the same active directory and domain. the time zone issue if there are no servers in the other time zone?
View 1 Replies View Related