we're using openldap for authorising our user to connect to the webvpn via our ASA.We'd like to rely on operational attributes to do some DAP matching. This is an example of how a user record looks in our LDAP tree:
# extended LDIF
#
# LDAPv3
[Code]......
Are LDAP operational attributes supported at all by the Cisco ASA?
I am setting up Radius AAA for cat6K switch.For authentication its work and user can login to switch. But for the privilege level assignment, it does not work. After loging in, I always get privilege 1. I need your guide on how to configure on ACS 5.1, RADIUS Attribute.I follow the document to configure the cisco-av-pair for assign Privilege 15 and Privilege 5 , but it does not work.This attribute format was shown in document is to set Privilege 15, "shell:privlvl=15" it is correct way of configure it on ACS 5.1
View 5 Replies View RelatedI have configured a lab for RA VPNs with a ASA5510 software version 8.2 and VPN Client 5 using digital certificates with Microsoft CA on a Windows 2003 server. I did the configuration based on this document from Cisco website: URL
Now the vpn works just fine, but now I need to configure different tunnel-groups so I can provide different services to different users. The problem I have now is that I don't know how to configure it so the certificate matches the tunnel-group name. If i do a debug crypto isakmp on ASA I get this error messages:
%ASA-7-713906: IP = 165.98.139.12, Trying to find group via OU...%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload: Unknown%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IKE ID...%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload: Unknown%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IP ADDR...%ASA-7-713906: IP = 165.98.139.12, Trying to find group via default group...%ASA-7-713906: IP = 165.98.139.12, Connection landed on tunnel_group DefaultRAGroup
So basically when using certificates I always connect the RA VPN only with the default group DefaultRAGroup. Do I need to use a different web enrollment template for certificate request instead of the user template??? How can I define the OU on the User certificate so it matches the tunnel-group???
I set up LDAP store pointing to a Windows domain and am testing authenticating users via an ASA. In my LDAP config, its set for "Groups Objects refer to subjects" and I selected usernames in the drop down. I also added a a Global Group to the Directory groups tab in the LDAP store that I created.
Under my Access Polices, I created a rule that meets two condititons - coming from the ASA, and then I was able to select the group from the drop down box for my ldap domain. As a condition, it shows up as DomainName:External Groups. I set the permission to Permit Access.
Originally, I was failing authentication and I was receiving Subject Not Found in Store. I adjusted the Identity Sequence and now I receive a the following error:
15039: Selected Authorization Profile is Deny Access. So it must not be associating my account with the group with the Permit Access and using the Default Permissions.So it does match the correct Access Service, and Identity Store.
We have users using a GPRS connection authenticating against ACS :
Fields received in radius package : Username & Calling-line_id
We have an ldap directory containing the same 2 fields : userPrincipalName & TelephoneNumber
1)Is it possible to match the 2 fields received in the radius package against the 2 fields in LDAP, and based on that granting/denying access ? (some sort of mulitple key).
2)Is it possible to match the calling-line-id against an ldap attribute (authorization section) ?
The issue is that we have 3000+ GPRS users, and creating 3000+ entries in the end user filter is not really an option.
We have ASA 5520 acting as the VPN Server and Cisco 1941 router as EZVPN client. Since last few days client is not able to establish vpn connection. 1941 router is continuously generating the below log messages
001569: Jul 22 12:19:05.883 ABC: %CRYPTO-4-EZVPN_SA_LIMIT: EZVPN(VPNGROUP) Split tunnel attributes(51) greater than max allowed split attributes(50)
001574: Jul 22 12:19:07.835 ABC: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client) User=vpn_user Group=VPNGROUP Client_public_addr=<client public ip> Server_public_addr=<server public ip>
004943: Jul 22 11:32:42.247 ABC: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer1: the fragment table has reached its maximum threshold 16
I have working config for 2003 server:
aaa-server DC1 protocol ldap
aaa-server DC1 (inside) host 172.25.29.9
ldap-base-dn DC=KIEV,DC=CC
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn CN=ASA_LDAP,OU=aides,OU=IT,DC=KIEV,DC=CC
server-type auto-detect
ldap-attribute-map LDAPVPNMAP
But when i created another aaa-server DC2 with the same config (different ip and name only), which is running under 2008 Server, i've got at debug:
I have a problem with LDAP authentication. i have an Cisco Asa5510 and windows 2008 R2 server. i create LDAP authentication.
aaa-server LDAPGROUP protocol ldapaaa-server LDAPGROUP (inside) host 10.0.1.30 server-port 389 ldap-base-dn dc=reseaux,dc=local ldap-naming-attribute sAMAccountName ldap-login-password ***** ldap-login-dn CN=user,OU=Utilisateurs,DC=reseau,DC=local server-type microsoft
but when i test, i have an error (user account work directly in server)
test aaa-server authentication LDAPGROUP host 10.0.1.30 username user password *****
INFO: Attempting Authentication test to IP address <10.0.1.30> (timeout: 12 seconds)ERROR: Authentication Rejected: Unspecified
i have following problem. I configured on a Cisco ASA5510 VPN authentication with LDAP. It works fine but one thing doesnt works.If i configure on my Active Directory the user for "User must change Password at next login" the message for password change is coming (look screenshot AnyConnect1), but if the user want to change his password, the password will not accepted by the system(look screenshot AnyConnect2).In the Group Policies on my Active Directory i disabled all features(look screenshot Pic1)I tried all combination for the password, but nothing will accepted.i configured LDAP over SSL and in the Tunnel Group i enabled the password management with "NOtify User 2 days prior to password expiration".
View 3 Replies View RelatedI'm actually require authentication for users who are coming from the PublicVLAN (the vlan associated with the wireless hotspot) to authenticate themself to the LDAP server via my firewall ASA 5510
View 12 Replies View RelatedASA 5510 ASA 8.0 ASDM 6.1 I want some remote users to have split-tunnel connection, others not. I used Cisco Document ID 100936 "Allow Split Tunneling for AnyConnect VPN Client on the ASA Configuration...". I created a new Group Policy with split-tunnel enabled. I created a new Connection Profile and assigned to it the new Group Policy. When I authenticate at the AnyConnect client I get a dropdown of the 2 connecton profiles, to choose the one I want. Each of them works, enabling or disabling split-tunnel. But I want to assign a connection profile to the particular user, not give the user a choice. The problem is I'm using LDAP authentication. The Local Users I set up before LDAP are obsolete, assigning them a Group Policy does nothing. I really don't want to give up LDAP and force people back to another local password. But the LDAP authentication to Active Directory just says yes or no, it won't assign a connection profile. At the AnyConnect Connection Profiles page I have set a switch "Allow user to select connection profile, identified by its alias, on the login page. Otherwise, DefaultWebVPNGroup will be the connection profile". If I clear that switch every user will be assigned the same default profile, which does not work.
View 2 Replies View RelatedThe last three new APs I have received from our supplier (official Cisco 1142 LAPs) have all successfully connected to our 4400 series WLCs but are all reporting as being in an Operational Status of 'Down' ie their A/B/G/N radios are not broadcasting even though the APs are all in an enabled state. Furthermore, there is no steady green light showing on the APs - there is no light showing whatsoever (although they were displaying the familiar red-orange-green lights while they were pulling down the IOS images from the WLCs).
The only strange thing I have noticed is that in the AP config screen, the ‘Mini IOS version’ is shown as being v7.3.x. The other – working APs – we have of the 1142 series show v3.x. I know that controller code v7.2 and above only work with the newer 5500 and 7500 series WLCs. Could this be the issue and have any of you seen this issue previously? I am running WLC code v7.0.230.0.
I have set up a 2811 with seperate VLANs for phones, and another for computers/printers. Fa0/0 is trunked to a 3560 switch, which has all end devices plugged in. I have enabled the IP Routing commands on both devices, and from advice turned off proxy-arp on the VLANs on the router (unsure if this is causing the issue). The setup is as follows
Computer VLAN = 192.168.20.0
Phone VLAN = 192.168.50.0
Both on the same subnet, along with a router loopback address in the same subnet, at 192.168.10.1.I am having an issue understanding why, but if I try to ping a phone from a PC it times out. Or if I try to type the phone's IP into an internet browser to get the phone's GUI on screen, it fails. This should not be happening as IP routing has been enabled on both, and everything is in the same subnet, correct? PC's can ping other PC's and network printing works fine. Phones register and operate fine, but the two VLAN's will not interoute.Furthermore if I try and ping the router's loopback from the switch, it fails. But the trunk is up and operational because DHCP and devices work within their own VLAN. If I try to ping end devices from the switch, it returns 100%. There seems to be an issue with the router looping the different networks together.
Why does my belkin f7d4401 playmax router: allow iTunes and iPad/iPhone to see my Airplay B&W zeppelin Air when connected wireless but will not allow iTunes or my iPad/iPhone to see my Airplay Marantz NR1603 when connected via cat 5 cable. (I know the connection is fine on the NR1603, as it streams from internet radio with no problem at all)It seems to be just airplay that is not operational through the router.
View 2 Replies View RelatedI have a 6509-E with redundant 3000W power supplies (WS-CAC-3000W) but one supply is current non-operational.From the outputs I'm not sure whether the issue is (more likely to be) with the supply to the PSU or the PSU itself, i.e. whether my first action should be to get an electrian to check the supply or fault call the PSU with our maintenance providers and have it replaced?
View 3 Replies View RelatedWhat is the difference between administrative mode & operational mode in cisco 3560/3550 ?
View 6 Replies View RelatedI want to add Radius attribute to Rad ware devices , so I will have the option to grant "read only" permission to users. as I understand I need to add VSA for the "read only" permission, or configure specific "Service-Type value 255"
in the following picture you can see the required information from Rad ware:
I need to add OPNET Radius attributes in ACS 4.2. How should I add a new VSA in ACS? The google search is pointing me to CSUtil.exe, and I cannot find this utility in the ACS install files. These are the values that I need added for OPNET. When configuring the RADIUS server to support the ACE Live Appliance, use the following Vendor Code and Vendor Specific Attribute (VSA): Vendor Code: 7119 VSA: 33.
View 2 Replies View RelatedWe have found the following issue configuring radius attributes for network access with packeteer appliances.with PAcketeer-AVPair attribute , value --> access=touch Login fails and we see this
PacketShaper# radius login user password
"user" RADIUS Authentication Fail
Vendor-Specific: ccess=touch <--- value is bad
PAcketeer is not receiving vendor-specific value correctly, As workaround , we put other character before value -- xacces=touch
PacketShaper# radius login user password
"user" RADIUS Authentication OK
Vendor-Specific: access=touch
I have been tasked with migrating from ACS 4 to ACS 5.3. I havent had any training and so i am finding it a bit different. Currently i have this issue -
I have a group in the ACS 4 for users accessing via wireless on the ACS - Code...
I need to add RADIUS attributes for a custom vendor under "Group Setup" page in ACS 4.2. As of now, I see Cisco Aironet RADIUS Attributes, IETF RADIUS Attributes etc in "Group Setup" page. How can I make sure that the RADIUS attributes for a vendor also appear on that page?
View 2 Replies View Relatedis there a way to have multiple instances of user custom attributes and insert those as multiple instances of the A/V Pair in the authorisation profile in ACS 5.2/5.3 ?Background: We have to migrate a ACS 4.2 to 5.3. In ACS 4.2 our client used the multiline attribute
Number
#Name
#Description
#Type of Value
#Inbound/Outbound
[code]....
to specify multiple routes to various networks in the RADIUS reply spcific for every single PPP username of routers dialing in.Using the internal user database, extended by a string attribute and using that attribute as source of a dynamic value in the access-policy works basically. But as I have only ONE single line instance of the attribute for every user, I can only return ONE framed-route.We have lots of cases where multiple routes have to be assigned to one router.I 'd like to avoid defining a seperate access profile for every remote RAS router for external PPP Dial-In...[URL]
I'm looking into starting a file sharing server (think this is what its called) which will allow people to login into one of my PC's over the internet and download my files. My goal is to allow family members and friends to access my files and only specific files on this PC. The files could be family videos as well as pictures. Some video files will be in excess of 10gb along with typical jpegs and what not. I'll probably be running windows server 2008 on it. I'm also considering allowing people on some other forums that I'm a member on (cars, hobbies, ect) and allowing people to host vids on my server. My current IP provider is Comcast and I'm on a Dynamic IP so wondering how easy this is or if its recommended I get a static IP.
I' am looking for some articles that you'd recommend on this. I'd also like to have password protection / or login criteria so car members aren't able to view all my family videos, but can only log into some folder labeled (cars) and not my folder labeled family. Or another option would be that people have to login before they are able to even see what folders are accessible.For instance car members could only see car folders Family members could see anything stored on the PC?
I am doing MAB (MAC authentication bypass) for IP phones and printers.
But these devices are authenticated with different identity stores (IP phones with AD, printer local host on ACS)
Is there any specific AV Radius attributes that i can use in the compound conditions selections which is specific for the IP Phones?
so when doing the Authentication, i could seperate each type (IP phones or Printers) with the appropriate database.
I'm in router setting in 1921, I have 40 remote VPN group profile attributes, but I can only connect simultaneously at 30, I wonder if there is a maximum limit of groups configured on a router 1900 IOS
View 0 Replies View RelatedI'm trying to dynamically assign IP address for VPN users from AD (without IAS service). I know that there is a restriction that "Dial-in users are not supported by AD in ACS (note in "acsuserguide51") but Im not exacly sure what can and can't do with it. In "Authorization Profiles" in RADIUS Attributes tab I try to mannually add specific Attribute (Framed-IP-Address).
I have no problem (everything works just fine) with static address assignment in a way as below:
AD is already integrated with ACS and I've managed to download Directory attributes especially msRADIUSFramedIPAddress
When I change "Attribute Value" from static to dynamic type I see the option to select AD (but "Select" which should list all available attributes is empty)
I know that I can do it directly (ASA <-> AD attribute mapping) but I want ACS to do it
We have a 1231 AP and a Freeradius Server.Now we are using MAc authentication.The thing is that the AP sends two parameters to the RADIUS:
User-Name = "000ff855df2e"
User-Password = "000ff855df2e"
both are the MAC of the wireless client.I want that the AP send:
User-Name = "00-0f-f8-55-df-2e"
User-Password = "mykey"
Note that the MAC is dash separated and the password is forced to the key that I want.
So we have multiple ISE Servers with differing personals. I was having an issue with our new ISE setup not identifying AD Group Attributes when using them in Authorization rules. We have 2- 3395 appliances running Admin and Monitoring/Troubleshooting Personas and 2- 3395 appliances running as Policy server personas. We are running v1.1.1.268 with the latest two patches. I was unable to pull Active Directory Group Attributes in any of my Authorization rules. After Resyncing all the boxes with the Primary Administration box I was able to do this. There is no bug listings for this occurrence nor do we have Smartnet to call support for other reasons.
View 3 Replies View RelatedWhile user's connecting through AnyConnect, AnyConnect doesn`t check endpoint attributes. I've configured checking process of "notepad.exe", but it doesn`t work. There is no checking process of "notepad.exe" in output debug dab trace (see attach).
ASA 5520 ver 8.4(1)
AnyConnect 3.1.02040
HostScan 3.1.02043
CSD 3.6.6234
Under 'Policy Elements/Authorization and Permissions/Network Access/Authorization profiles' I have defined a profile and the following Attribute:Attribute = F5-LTM-User-RoleType = Unsigned Integer 32Value = 300.
My question is:How can I define the same as above using 'Device Administration/Shell Profiles' ?
There is a Custom Attributes tab but I cannot figure out how to specify the 'Type' field. (Under Custom Attributes tab there is only space for 2 fields and not 3 fields).
There is an ASR1006 Router in the network that serves as an Intelligent Service Gateway (ISG). Subscribers are layer 2 connected and subscriber sessions are initiated on a DHCP request. ISG is configured as a DHCP relay agent. Wi-Fi clients connect to the WLAN using Open SSID and are being redirected to a Web Portal where they enter their login info. This info is sent to RADIUS server which checks if the user is allowed to use Internet service. All the APs are connected o WLC using CAPWAP. The question is the following: there is a requirement to track from which AP a particular Wi-Fi clients is connected. In this case ISG needs somehow to obtain AP’s mac address and send it to the Radius server (probably using attribute 30 – Called-station-id). One possible way for ISG to obtain AP’s mac is via WLC. But the thing is that when WLC is configured as DHCP proxy and Option 82 is set, a wireless client does not obtain IP address via DHCP. In this particular case there two DHCP relay/proxy in the network path between client and DHCP server. Is there any other away for ISG to obtain AP’s mac address?
View 8 Replies View RelatedI am trying add custom attributes for Juniper Netscreen TACACS+ authentication to a v5.2 ACS. The advice is to add it to the group as follows:
ervice = netscreen {
vsys = root
privilege = read-write
} I know how to add this to a version v4.x ACS
However, I do not know how to apply this to the custom attribiutes to a v5.x ACS?do I add the vsys and privilege attribute seperately or together? What should be the attribute name? netscreen? Should it be mandatory?
I've been working on trying to get RADUIS authentication working for devices connecting to our corporate mobile APN. Out APN provider sends us Username & Password attributes which I can authenticate fine using ACS 5.2 but I'm having a problem using other attributes sent in the Access-Request. We have mobile SIM cards with an MSISDN value match with a physical device with an IMEI value. The SIM cards cannot be used in other devices, only their matched device. The provider passes us the MSISDN attribute under RADIUS-IETF 31 and the IMEI under a VSA of 3GPP-IMEI
What is the best way of being able to authenticate a user and match the MSISDN and IMEI associated to that user?