Cisco VPN :: 1921 / IOS Maximum Group Profile Attributes?

Feb 17, 2012

I'm looking into starting a file sharing server (think this is what its called) which will allow people to login into one of my PC's over the internet and download my files. My goal is to allow family members and friends to access my files and only specific files on this PC. The files could be family videos as well as pictures. Some video files will be in excess of 10gb along with typical jpegs and what not. I'll probably be running windows server 2008 on it. I'm also considering allowing people on some other forums that I'm a member on (cars, hobbies, ect) and allowing people to host vids on my server. My current IP provider is Comcast and I'm on a Dynamic IP so wondering how easy this is or if its recommended I get a static IP.

I' am looking for some articles that you'd recommend on this. I'd also like to have password protection / or login criteria so car members aren't able to view all my family videos, but can only log into some folder labeled (cars) and not my folder labeled family. Or another option would be that people have to login before they are able to even see what folders are accessible.For instance car members could only see car folders Family members could see anything stored on the PC?

View 6 Replies


Cisco VPN :: 1921 - IOS Maximum Group Profile Attributes?

May 24, 2012

I'm in router setting in 1921, I have 40 remote VPN group profile attributes, but I can only connect simultaneously at 30, I wonder if there is a maximum limit of groups configured on a router 1900 IOS

View 0 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 Authorization Profile / RADIUS Attributes

Jun 1, 2011

I am setting up Radius AAA for cat6K switch.For authentication its work and user can login to switch. But for the privilege level assignment, it does not work. After loging in, I always get privilege 1. I need your guide on how to configure on ACS 5.1,  RADIUS Attribute.I follow the document to configure the cisco-av-pair for assign Privilege 15 and Privilege 5 , but it does not work.This attribute format was shown in document is to set Privilege 15, "shell:privlvl=15" it is correct way of configure it on ACS 5.1

View 5 Replies View Related

Cisco AAA/Identity/Nac :: Add RADIUS Attributes Under Group Setup In ACS 4.2

Jul 5, 2012

I need to add RADIUS attributes for a custom vendor under "Group Setup" page in ACS 4.2. As of now, I see Cisco Aironet RADIUS Attributes, IETF RADIUS Attributes etc in "Group Setup" page. How can I make sure that the RADIUS attributes for a vendor also appear on that page?

View 2 Replies View Related

Cisco AAA/Identity/Nac :: 3395 - ISE Not Identifying AD Group Attributes When Using Multiple ISE

Oct 2, 2012

So we have multiple ISE Servers with differing personals. I was having an issue with our new ISE setup not identifying AD Group Attributes when using them in Authorization rules. We have 2- 3395 appliances running Admin and Monitoring/Troubleshooting Personas and 2- 3395 appliances running as Policy server personas. We are running  v1.1.1.268 with the latest two patches. I was unable to pull Active Directory Group Attributes in any of my Authorization rules. After Resyncing all the boxes with the Primary Administration box I was able to do this. There is no bug listings for this occurrence nor do we have Smartnet to call support for other reasons.

View 3 Replies View Related

Cisco VPN :: ACS 5.X - How To Assign Connection Profile Without Using Group Drop-down List

Mar 8, 2013

i've configured 4 connection profiles (IT,HR,Admon,VIP) on the asa everything works well, but our boss wants to know if it's possible to assign the right connection profile without using group drop-down list, what he wants is to use a unique connection profile (non-default) and via radius attributes using ACS 5.X  to assing the right profile.

View 6 Replies View Related

Cisco Firewall :: ASA 5520 CSC Module Per Subnet / IP Group Inspection Profile

Sep 7, 2011

verify if the ASA 5520 CSC module way of applying security policy (http, smtp, pop3, etc.) is per network/subnet or group of users? Based on my understanding through reading, web and email protection profile/config is global. It will be the same to every network user that is redirected via service-policy config on the ASA.
Scenario: I have two VLAN, guest and employee. Of course guest and employee have different web filter profile. Can i configure it such that guest web-filter profile is not just strict while employee's access is limited only to productive internet sites.

View 5 Replies View Related

Cisco VPN :: ASA5510 - AnyConnect Client Profile / Group-URL In Server-List With OGS?

Dec 2, 2012

Cisco Adaptive Security Appliance Software Version 8.4(4)1
Device Manager Version 7.0(2)
Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
#show webvpn anyconnect
1.disk0:/anyconnect-win-3.1.00495-k9.pkg 1 dyn-regex=/Windows NT/
CISCO STC win2k+
Hostscan Version 3.1.00495
Profile in atthach-file. After this profile is uploaded to client Optimal Gateway Selection doesn't work propertly: When '' (it best TTL server) is unreachable, then OGS try to be connected to other servers, but without group-url, for example '' (instead of '')

View 2 Replies View Related

Cisco WAN :: Maximum ARP Cache Entries For ISRg2 1921 And 887VA Devices

Feb 23, 2011

We are looking to find the number of maximum ARP Cache Entries for 1921 and 887VA series Routers. Do they go upto a limit that memory allows, or is there a maksimum arp cache entry limit for both of the router types?

View 3 Replies View Related

Cisco WAN :: How Maximum Channel-group Supported By VWIC2 1MFT G.703

Jun 14, 2012

How  maximum channel-group supported by VWIC2 1MFT G.703? And the CISCO1941/K9 ?

View 0 Replies View Related

Cisco VPN :: How To Limit Maximum SSL VPN Sessions Per Group-policy On ASA5510

Nov 25, 2012

How to limit maximum SSL VPN sessions per group-policy on ASA5510?
There are 2 group-policy: in one maximum of 10 connections, in the second - 15 (In total licenses for SSL VPN 25 connections).

View 5 Replies View Related

Cisco Switching/Routing :: Maximum Group Of HSRP That Supports WS-C3750G-24T-S

May 4, 2011

What is the maximum group of HSRP Group that supports the WS-C3750G-24T-S running the IOS  c3750-advipservicesk9-mz.122-44.SE2.bin?I have this message:Mensaje ERROR: %Platform already has maximum FHRP groups configured

View 6 Replies View Related

Cisco Wireless :: 1262 Maximum Number Of Clients In Work Group Bridge Mode

Dec 6, 2011

What is the maximum allowed number of wired clients behind a workgroup bridge? In other words, is there a limit on MAC addresses?I assume 1262 AP in WGB mode is connecting to a lighweight AP (1262 or 3502), latest IOS and WLC software. I wasn't able to find the answer from Cisco documentation.

View 2 Replies View Related

Cisco VPN :: ASA 5520 / Error / Split Tunnel Attributes(51) Greater Than Max Allowed Split Attributes(50)

Jul 21, 2012

We have ASA 5520 acting as the VPN Server and Cisco 1941 router as EZVPN client. Since last few days client is not able to establish vpn connection. 1941 router is continuously generating the below log messages
001569: Jul 22 12:19:05.883 ABC: %CRYPTO-4-EZVPN_SA_LIMIT: EZVPN(VPNGROUP) Split tunnel attributes(51) greater than max allowed split attributes(50)
 001574: Jul 22 12:19:07.835 ABC: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client)  User=vpn_user  Group=VPNGROUP Client_public_addr=<client public ip>  Server_public_addr=<server public ip>
 004943: Jul 22 11:32:42.247 ABC: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer1: the fragment table has reached its maximum threshold 16

View 3 Replies View Related

Cisco Switching/Routing :: IP SLA Support On 1921/K9 Or 1921-SEC/K9?

Oct 5, 2012

We want to puchase new Cisco ISR 1921/K9 .   i want to know does it support the following sample IP-SLA commands
ip sla 2icmp-echo 500frequency 1ip sla schedule 2 life forever start-time now
track 10 rtr 1 reachability
delay down 1 up 1
track 20 rtr 2 reachability
delay down 1 up 1 
ip route track 10ip route track 20
Im asking above question because we will need to enable ip-sla  on  the mentioned router.   as i read on the cisco webside, it says Cisco-ISR-1921/K9-IP Base  support only  IP-SLA RESPONDER  feature nothing else. If  Cisco-921/K9  does not support the above commands , should i go for ordering Cisco-1921-SEC/K9 ? 

View 4 Replies View Related

Cisco VPN :: ASA 8.4 LDAP Group To ASA Group Policy Mapping?

Jul 31, 2012

I try to map LDAP Group to ASA Group policy following documentation:
This is a config for ASA 8.0. I would have expected it to work on 8.4 as well but I do run into problems. The mapping as shown in LDAP Debug and ASA Log will actually happen but it is overwritten by the "GPnoAccess" Group Policy configured locally in the Tunnel Group. From earlier works with RADIUS I would have expected the user specific Attribute to be "stronger"?
ASA Log:
AAA retrieved user specific group policy (correct Policy) for user = XXX
AAA retrieved default group policy (GPnoAccess) for user = XXX

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 - Add RADIUS Attributes

Mar 17, 2012

I want to add Radius attribute to Rad ware devices , so I will have the option to grant "read only" permission to users. as I understand I need to add VSA for the "read only" permission, or configure specific "Service-Type value 255"
in the following picture you can see the required information from Rad ware:

View 1 Replies View Related

Cisco AAA/Identity/Nac :: Add OPNET Radius Attributes In ACS 4.2

May 16, 2012

I need to add OPNET Radius attributes in ACS 4.2. How should I add a new VSA in ACS?  The google search is pointing me to CSUtil.exe, and I cannot find this utility in the ACS install files.  These are the values that I need added for OPNET. When configuring the RADIUS server to support the ACE Live Appliance, use the following Vendor Code and Vendor Specific Attribute (VSA): Vendor Code: 7119 VSA: 33.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 / 5.3 Configuring Packeteer Attributes

Oct 9, 2012

We have found the following  issue configuring radius attributes for network access with packeteer appliances.with PAcketeer-AVPair  attribute , value --> access=touch Login fails and we see this
PacketShaper# radius login user password
"user" RADIUS Authentication Fail
Vendor-Specific: ccess=touch  <--- value is bad
PAcketeer is not receiving  vendor-specific value correctly, As workaround , we put other character  before value --    xacces=touch
PacketShaper# radius login user password
"user" RADIUS Authentication OK
Vendor-Specific: access=touch

View 5 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 - Custom Attributes And Wireless Groups?

May 13, 2012

I have been tasked with migrating from ACS 4 to ACS 5.3. I havent had any training and so i am finding it a bit different. Currently i have this issue -
I have a group in  the ACS 4 for users accessing via wireless on the ACS - Code...

View 4 Replies View Related

Cisco AAA/Identity/Nac :: Multiple Instance Of Custom Attributes ACS 5.x?

Nov 27, 2011

is there a way to have multiple instances of user custom attributes and insert those as multiple instances of the A/V Pair in the authorisation profile in ACS 5.2/5.3 ?Background: We have to migrate a ACS 4.2 to 5.3. In ACS 4.2 our client used the multiline attribute
#Type of Value


to specify multiple routes to various networks in the RADIUS reply spcific for every single PPP username of routers dialing in.Using the internal user database, extended by a string attribute and using that attribute as source of a dynamic value in the access-policy works basically. But as I have only ONE single line instance of the attribute for every user, I can only return ONE framed-route.We have lots of cases where multiple routes have to be assigned to one router.I 'd like to avoid defining a seperate access profile for every remote RAS router for external PPP Dial-In...[URL]

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.1 - Specific RADIUS Attributes For IP Phones

Mar 28, 2011

I am doing MAB (MAC authentication bypass) for IP phones and printers.
But these devices are authenticated with different identity stores (IP phones with AD, printer local host on ACS)
Is there any specific AV Radius attributes that i can use in the compound conditions selections which is specific for the IP Phones?
so when doing the Authentication, i could seperate each type (IP phones or Printers) with the appropriate database.

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS5.1 - AD And RADIUS Attributes Mapping

Aug 18, 2010

I'm trying to dynamically assign  IP address for VPN users from AD (without IAS service). I know that there is a restriction that "Dial-in users are not supported by AD in ACS (note in "acsuserguide51") but Im not exacly sure what can and can't do with it. In "Authorization Profiles" in RADIUS Attributes tab I try to mannually add specific Attribute (Framed-IP-Address).
I have no problem (everything works just fine) with static address assignment in a way as below:

AD is already integrated with ACS and I've managed to download Directory attributes especially msRADIUSFramedIPAddress
When I change "Attribute Value" from static to dynamic type I see  the option to select AD (but "Select" which should list all available attributes is empty)
I know that I can do it directly (ASA <-> AD attribute mapping) but I want ACS to do it

View 5 Replies View Related

Cisco :: 1231 / External RADIUS Attributes For MAC Authentication

Jun 21, 2006

We have a 1231 AP and a Freeradius Server.Now we are using MAc authentication.The thing is that the AP sends two parameters to the RADIUS:
User-Name = "000ff855df2e"
User-Password  =  "000ff855df2e"
both are the MAC of the wireless client.I want that the AP send:
User-Name = "00-0f-f8-55-df-2e"
User-Password  =  "mykey"
Note that the MAC is dash separated and the password is forced to the key that I want.

View 2 Replies View Related

Cisco VPN :: LDAP Operational Attributes Match In ASA 5510 During Authorization

Jan 13, 2013

we're using openldap for authorising our user to connect to the webvpn via our ASA.We'd like to rely on operational attributes to do some DAP matching. This is an example of how a user record looks in our LDAP tree:
# extended LDIF
# LDAPv3

Are LDAP operational attributes supported at all by the Cisco ASA?

View 2 Replies View Related

Cisco VPN :: ASA 5520 - AnyConnect Check Endpoint Attributes Not Working

Mar 12, 2013

While user's connecting through AnyConnect, AnyConnect doesn`t check endpoint attributes. I've configured checking process  of "notepad.exe", but it doesn`t work. There is no checking process of  "notepad.exe" in output debug dab trace (see attach).

ASA 5520 ver 8.4(1)
AnyConnect 3.1.02040
HostScan     3.1.02043
CSD            3.6.6234

View 16 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.3 - Radius Attributes And Device Administration / Shell

Sep 18, 2012

Under 'Policy Elements/Authorization and Permissions/Network Access/Authorization profiles' I have defined a profile and the following Attribute:Attribute = F5-LTM-User-RoleType = Unsigned Integer 32Value = 300.
My question is:How can I define the same as above using 'Device Administration/Shell Profiles' ?

There is a Custom Attributes tab but I cannot figure out how to specify the 'Type' field. (Under Custom Attributes tab there is only space for 2 fields and not 3 fields).

View 3 Replies View Related

Cisco Wireless :: ASR1006 L4 Redirect CaptivePortal-DHCP Radius Attributes

Dec 3, 2012

There is an ASR1006 Router in the network that serves as an Intelligent Service Gateway (ISG). Subscribers are layer 2 connected and subscriber sessions are initiated on a DHCP request. ISG is configured as a DHCP relay agent. Wi-Fi clients connect to the WLAN using Open SSID and are being redirected to a Web Portal where they enter their login info. This info is sent to RADIUS server which checks if the user is allowed to use Internet service. All the APs are connected o WLC using CAPWAP. The question is the following: there is a requirement to track from which AP a particular Wi-Fi clients is connected. In this case ISG needs somehow to obtain AP’s mac address and send it to the Radius server (probably using attribute 30 – Called-station-id). One possible way for ISG to obtain AP’s  mac is via WLC. But the thing is that when WLC is configured as DHCP proxy and Option 82 is set, a wireless client does not obtain IP address via DHCP. In this particular case there two DHCP relay/proxy in the network path between client and DHCP server. Is there any other away for ISG to obtain AP’s mac address?

View 8 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 - Adding Custom Attributes For Juniper Netscreen TACACS+?

Aug 9, 2011

I am trying add custom attributes for Juniper Netscreen TACACS+ authentication to a v5.2 ACS. The advice is to add it to the group as follows:
ervice = netscreen {
vsys = root
privilege = read-write
} I know how to add this to a version v4.x ACS

However, I do not know how to apply this to the custom attribiutes to a v5.x ACS?do I add the vsys and privilege attribute seperately or together? What should be the attribute name? netscreen? Should it be mandatory?

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 RADIUS Authentication Based On IMEI And MSISDN Attributes

Apr 19, 2011

I've been working on trying to get RADUIS authentication working for devices connecting to our corporate mobile APN.  Out APN provider sends us Username & Password attributes which I can authenticate fine using ACS 5.2 but I'm having a problem using other attributes sent in the Access-Request.  We have mobile SIM cards with an MSISDN value match with a physical device with an IMEI value.  The SIM cards cannot be used in other devices, only their matched device.  The provider passes us the MSISDN attribute under RADIUS-IETF 31 and the IMEI under a VSA of 3GPP-IMEI
What is the best way of being able to authenticate a user and match the MSISDN and IMEI associated to that user?

View 1 Replies View Related

AAA/Identity/Nac :: ACS 5.3 RADIUS Authentication Based On IMESI & MSISDN Attributes

Jan 9, 2012

I'm trying to find out the options for authenticating remote users via IMEI and MISDN values via ACS 5.3/I'm unfamiliar with the Radius attribute options here and what kind of request/response we can utilise.  Also previously I could define IP pools on ACS 4 but can't seem to do that now.  Is there a way have ACS 5.3 to provide a DHCP server address for the connection ?

View 6 Replies View Related

Cisco VPN :: ASA5520 Any Way To Set Up Profile To Check PC

Mar 5, 2013

I have a Cisco ASA5520 that we are going to use to allow users to connect to our network via the Anyconnect client, I have authentication set up to validate against AD via LDAP, but was wondering if there were any way to set up the profile to check the PC before they log in....we do not want users using their home PCs to attach to our corporate network, only PCs that were issued to them by the company. Nothing is jumping out at me in the config, we are running some fairly old sofware on the boxes (ASA - v8.2(2), Anyconnect - v2.5.3046) I plan on upgrading the Anyconnect to v3.1 but will probably need to keep running the 8.2(2) version on the ASA due to support issues.

View 2 Replies View Related

Cisco VPN :: AnyConnect 2.5 Profile Editor

Apr 17, 2011

I have enabled the following attribute...Show Pre-connect Message—Displays a message to the user before the user makes the first connection attempt.Where do you actually enter the text for the message?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved