Cisco VPN :: PIX515e / 713060 / Tunnel Rejected / User Not Member Of Group

Dec 17, 2011

I just configure VPN for end users in PIX515e with IOS 8 and get stuck with "Tunnel Rejected: User (msveden) not member of group (VPN-shared), group-lock check failed.". tell me how I add user to my VPN group?

View 1 Replies


ADVERTISEMENT

Cisco VPN :: Specific Tunnel-group With User On ASA 5510?

May 13, 2011

I would like to ask some question about VPN clinet and SSL VPN, on my ASA 5510 i have many tunnel-group it have around 5 tunnel-group and i have one SSL VPN,i also have user 20 user. let me show you that:
 
1- tunnel-group Staff-VPN remote-access
2- tunnel-group Manager-VPN remote-access
3- tunnel-group normalstaff-VPN remote-access
4- tunnel-group guest-VPN remote-access
5- tunnel-group other-VPN remote-access
and tunnel-group sslgroup type remote-access
 
and i have user around 20 user and i want to specific user to tunnel-groups like this
 
1- tunnel-group Staff-VPN remote-access
username AAA password AAA
username AAA01 password AA01
 
2- tunnel-group Manager-VPN remote-access
username BBB password BBB
username BBB01 password BBB01
 
3- tunnel-group normalstaff-VPN remote-access
username CCC password CCC
username CCC01 password CCC01
 
5- tunnel-group other-VPN remote-access
username DDD password DDD
username DDD01  password DDD01
 
So, How can i manag tunel-groups with user?

View 3 Replies View Related

Cisco Firewall :: PIX515E - No Translation Group Found For TCP

Mar 17, 2012

i wounder why i'm getting such log message whenever i'm trying to reach my remote site: No translation group found for tcp src outside XXXX dst dmz ZZZZ, i have a Cisco PIX515E firewall and that message is captured there, the traffic is going through a VPN tunnel (the VPN are up on both ends)

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS5.1.0.44 Authentication Base AD Group Member

Nov 25, 2012

I had a problem about authentication use AD group member.  Below webiside is the way I config on ACS.

[URL]

I'm using ACS 5.1.0.44 and this version has a bug , ACS cannot read AD group.  I have to add it manually .    After I change the access policy from Internal user to AD1. I can use anyone AD ID to pass authenticaiton. I finished all config from the website had same result.

I checked the access polices -- default device admin -- authorization  , the new rules I created had no hit count.  How can I make sure that I make a right config ?

View 2 Replies View Related

Cisco Wireless :: Max Number Of Mobility Member In Group With WISM 7.0

Dec 5, 2011

I have a customer buys 12 x WISM and build up a mobility, when I add the final WLC to mobility, it prompts that there mobility group has reached the max of mobility member, but the total member is 23, according the configuration guide, it should be allow to 24 member, do I hit some bug? My using version is 7.0.98.0.

View 5 Replies View Related

Cisco Switching/Routing :: Nexus 5000 IP Reachability Across VPC Within 4 Member HSRP Group

Nov 17, 2011

I have 2 pairs of Nexus 5000 units (pair 1 and pair 2).  A pair consists of 2 Nexus 5000 (A and B) connected to each other via a VPC containing 2 ports ie P1-5KA -- P1-5KB (vpc domain 6) and P2-5KA -- P2-5KB (vpc domain 10) [code] Hsrp exists between all four with a virtual address of 10.18.136.1.  P1-5KA is the Active with P1-5KB as Standby.
 
I can ping between the four using their SVI addresses.  I am unable to ping the HSRP virtual address .1 from P2-5KA or P2-5KB.I can ping ok only if I shut the VPC between P2-5KA or P2-5KB or define another mac address under the HSRP config other than the system default.  IP Packet debugs show that ping sourced from P2-5KB to P1-5KA loop between P2-5KA -- P2-5KB.  Pings sourced from P2-5KA to P1-5KA are transmitted but none of the 4 device debugs show a receive. both peer-gateway and delay restore 120 have been configured under all vpc domains and all units rebooted.

View 8 Replies View Related

Cisco :: LMS 4.0 User Defined Group

Aug 3, 2011

I'am a novice with LMS 4.0.I create 4 device group in Group Management, I restarted my server and since this reboot, I haven't any device in my groups. I would like to use the archive synchronization but I can't see my device in my groups.

View 6 Replies View Related

Cisco VPN :: 5510 - Authenticate One User In Only 1 Group?

Oct 20, 2011

I have two tunnel groups using WEBVPN , I have local users at ASA 5510 version 7.2.

How can I authenticate one user in only one group?Now with local users I can loggin in both tunnel groups

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 User Group Mapping?

Sep 12, 2012

We are using ACS 4.2.1.15 with patch 8 on ACS 1113 SE box.
 
Our requirement is to assign ACS loal group to user on basis of windows Nt group. Which means I dont wants to create individual users in ACS rather when user will login, the auth request will be forwarded to AD(remote database). Depeneding on the remote database group the user should be mapped to local database.
 
For this I have configured "database group mapping" according to following cisco guide. [URL] 
 
However when ever my AD users are authenticating they are getting the membership of default group as configured in "Default" profile. I am using TACACS+ protocol in my routers and switches for authentication.
 
whether "Group mapping by External user database"  works with TACACS+ or only with RADIUS protocol. If it works with TACACS+ what else configuration need to be done so that my ACS can map users to proper groups instead of default group.

View 4 Replies View Related

Block Multimedia Stream Per User Group?

Oct 1, 2012

I need to block the multimedia streaming to a certain group of users accessing my wireless connection.I'm using squid as my proxy server and the users are registered on a LDAP database. A RADIUS server provides authentication.

View 1 Replies View Related

Cisco VPN :: ASA 5520 / Restricting End User To One Specific Group With AnyConnect?

Feb 6, 2013

I just started configuring AnyConnect with ASA 5520 that uses Cisco SecureACS to pass radius authentication.  I configured two profiles with different split tunnel restrictions and what I discovered is that when the client connects to the ASA, they are provided a choice of these two groups (I guess there is no way to restrict this) and I can log into either one with any user account.  How do I restrict this so that the user can only use one profile?  Currently users capable of VPN would be placed in one specific AD group so that is what SecureACS checks.  Is there a sample configuration guide to handle multiple profiles with different levels of access?

View 3 Replies View Related

Cisco :: LMS 4.0.1 Authenticate User On Group Base And Assign Different Privilege?

Sep 7, 2011

having LMS 4.0.1 is it possible to authenticate user on a group base and assign different privilege to different groups?. The user's group are available in the LDAP server.Do I have to use a TACACS/RADIUS server between the Ciscoworks LMS and the LDAP repository?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.1- Shell Command Works Under User But Not Group

Jul 27, 2011

This question might actually belong under tacacs server but it's only happening with the ACE.  I've configured tacacs on the 4710 and configured the tacacs server per the documentation. If I enter the shell:<context>*Admin default-domain under the group settings when I login with my tacacs ID my role is set to Network-Monitor.  If I set the shell in my specific tacacs ID I'm assigned the correct role as Admin.  We're running ACS ver 4.1 and the ACE is A4(1.1)

View 1 Replies View Related

AAA/Identity/Nac :: ISE 1.0.4 Machine / User ActiveDirectory Group Retrieving

Mar 6, 2012

We are migrating our ACS 5.1 to ISE 1.0.4.
 
- On ACS we were doing 802.1x Authentification over an Activedirectory, assigning Vlan according to computer/user group. In some case the user vlan could be different from the computer vlan (ex admin account connecting to a user account). This works great with ACS.I tested the same function with ISE and the behaviour is a bit different :
 
- When the computer boot, I can see the computer account being authenticated on ISE. The logs show the AD groups the computer belongs to and the Authorization profile is well applied according to the AD group.
 
- When the user login, I can see the user account being authenticated on ISE, BUT the logs show the AD groups of the previous authentication, the one belonging to the computer not the user. So the authorization profile is the one from the computer not the user.
 
It seems that the AD group attributes are not well updated :

- AD logs show the second authentication doesn't engage a new group parsing from AD
- Shutting down the switch port when user is logged engage a new authentication a AD group are well updated.
- Bug toolkit reference the same bug but for WLC CSCto83897 so I suspect it's present in other case.

View 0 Replies View Related

Cisco VPN :: Automatic Tunnel Group Selection Through Radius On ASA 5.3?

Aug 20, 2012

I try to let Cisco ASA automatic select a tunnel group for users, after user input username and password. I try to do this without user selection a connection profile on login page. Authentication on ASA<>ACS 5.3<>MS AD. How i can will do this? Radius attribute class=group_policy don't work.

View 1 Replies View Related

Cisco :: 6506 Switch - SNMPv3 User Without Group Setting Showing

Sep 4, 2012

Why is it that when SNMPv3 user "TestV3-User" was added to my SNMPv3 implementation on my 6506 switch, the group/MD5/Emcryption settings are missing for this user (See "sh snmp user" output)???
 
router#sh snmp user
User name: TestV3-User
Engine ID: 80000009030000249706EFC0
storage-type: nonvolatile        active access-list: test

[Code]....

View 3 Replies View Related

Cisco VPN :: 5505 - Can Single Local User Belong To 2 Group-policies

Jan 13, 2013

I have a Cisco ASA 5505 that I've setup with an SSL VPN. This is for personal use, and I therefore don't have need for anything more than local authentication. [code]
 
I'd like to have one profile/policy where I only encrypt data going to my split-tunnel ACL, and I'd like to have one profile/policy where I encrypt all traffic.
 
The issue ive been fighting is - it doesn't seem like its possible to associate more than one group policy per user. If it IS possible - can you tell me how I associate both groups to my local account?

View 1 Replies View Related

Home Network :: Setting Up A Wireless User Group In Town

Aug 29, 2011

We want to set up a wireless user group in our town between a few friends and new people who are interested to join. As far as I heard I don't need a ICASA License for the 5.8GHz Frequency if we are using it for a non profit orginization, so we may use that.

1 x Routerboard
3 x Radio Plugin Boards
3 x 120degree Antennas

to set up a 360degree HS (Highsite).Then at each person's house we will need:

1 x Routerboard
1 x Radio Plugin Board
1 x Whichever Antenna

Is that correct? Then also if we wanto run VoIP on our network, how do I do that? Basicly we want to use it for gaming, file sharing and VoIP. No Internet of anything else.

View 2 Replies View Related

Cisco Firewall :: ASDM Access Through S2s Tunnel Group On ASA5510

Feb 7, 2012

For years now we've had an ASA5510 running an old version of ASA/ASDM (7.0/5.0) and couldn't access ASDM through a modern system with a recent JRE, so we didn't bother with this.
 
However, we've recently upgraded ASA/ASDM for purposes of adding failover and want to be able to access ASDM through our site to site tunnel. The site to site tunnel gives us access to the VLAN that the firewall is the gateway for, but not access to the firewall itself.
 
This side of the network is the 10.1.55.0 subnet, and that side of the network is the 192.168.1.0 subnet. I can ping devices on the 192.168.1.0 subnet, but not the firewall, (not that I really need to) and devices can ping me back. I can access ASDM through RDP or ssh into a server on the 192.168.1.0 subnet, but not directly from the 10.1.55.0 subnet.
 
This is the current config relative to the 10.1.55.0 subnet:
 
access-list trust_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.1.55.0 255.255.255.0
access-list untrust_cryptomap_600 extended permit ip 192.168.0.0 255.255.0.0

[Code]....

As far as I'm aware, the tunnel comes into the firewall through the untrust (public) interface, because that is the destination of the tunnel on the 10.1.55.0 subnet side.
 
What am I missing here that would allow asdm access through the untrust interface for the 10.1.55.0 subnet?

View 27 Replies View Related

Cisco VPN :: To Match Tunnel Group With ASA 8.2 And VPN Client IPSec Authorization

Apr 15, 2010

I have configured a lab for RA VPNs with a ASA5510 software version 8.2 and VPN Client 5 using digital certificates with Microsoft CA on a Windows 2003 server. I did the configuration based on this document from Cisco website: URL
 
Now the vpn works just fine, but now I need to configure different tunnel-groups so I can provide different services to different users. The problem I have now is that I don't know how to configure it so the certificate matches the tunnel-group name. If i do a debug crypto isakmp on ASA I get this error messages:
 
%ASA-7-713906: IP = 165.98.139.12, Trying to find group via OU...%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload:   Unknown%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IKE ID...%ASA-3-713020: IP = 165.98.139.12, No Group found by matching OU(s) from ID payload:   Unknown%ASA-7-713906: IP = 165.98.139.12, Trying to find group via IP ADDR...%ASA-7-713906: IP = 165.98.139.12, Trying to find group via default group...%ASA-7-713906: IP = 165.98.139.12, Connection landed on tunnel_group DefaultRAGroup

So basically when using certificates I always connect the RA VPN only with the default group DefaultRAGroup. Do I need to use a different web enrollment template for certificate request instead of the user template??? How can I define the OU on the User certificate so it matches the tunnel-group???

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS5.2 - Establish Independent User Group / Only VPN Username And Password

Mar 28, 2012

My question is on ASA and ACS5.2 users.Have my ASA SSL VPN and IPSEC VPN, the my ACS5.2 many users, for example, wireless user.I would now like to establish an independent user group, only the VPN user name and password, while both the ASA VPN can only allow users in this independent group of ACS5.2 VPN login, how to configure?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: 5510 Assigning A User Group Using RSA Secure ID RADIUS Server

Feb 3, 2007

We have several ASA 5510 firewalls which are being used as VPN gateways.RSA SecurID is the authentication mechanism using native SDI connectivity. No ACS server is being used.Is it possible to assign user Group and other attributes (such as ACL), using the SecurID RADIUS server? I know this is what the Cisco ACS is for, but is it possible using the RSA RADIUS server itself?

View 11 Replies View Related

Remove Start Menu User Link - Windows 7 Group Policy?

Sep 29, 2011

I'm running a Windows Server 2008 Enterprise Edition server that is currently the domain controller, and a Windows 7 Ultimate client. I have a 'Test' user for messing around with group policy - anyway, on the client Start Menu it has 'Test User' which leads to some form of libraries folder. Is it possible to restrict the link without removing their name?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Use Radius On ASA 5505 To Block Outgoing User Access By Username In Group

Jan 15, 2012

Can I use AAA Radius on a ASA 5505 to block outgoing user access by user name in a group?

View 2 Replies View Related

Linksys Wireless Router :: WRT610N Storage Link User / Group Creation?

Dec 30, 2008

I just got the WRT610N and I really like it so far, I'm playing with the NAS option and I can't get it to create any new users or groups. I click on the link, fill out the form and click on 'modify user' (The set-up guide has a button there for 'save settings') and nothing gets created. I tried this several times and there are no new groups or users. I checked the storage.info file and there is no additional users or groups there either. I think I can edit that file but I'm not too sure what these last 2 lines mean
 
nas_login@admin:admin:admin: off guest:guest:guest: onusers_content@admin:admin:admin:admin: off guest:guest:guest:guest: on

View 8 Replies View Related

Cisco VPN :: 5540 Stop Split Tunnel For Only One User

Apr 18, 2013

 i have cisco asa 5540, users access vpn through anyconnect, i have applied split tunnel so that all users accessing internal network (10.0.0.0) grows through tunnel and other traffic through internet.. working fine.i want to fully tunnel one user so that all his traffic goes through the tunnel, what is the best way to do it, "is there any guide (step by step)"

View 3 Replies View Related

Cisco VPN :: ASA 5510 - How To Enforce User Internet Traffic To Tunnel

Jun 4, 2011

here is my situation:
 
home users ------ internet ------ ASA 5510----- CORP LAN
 
we have anyconnect VPN and remote Ipsec VPN, i think the solution should works on both of them. my question is : "How to enforce home user internet traffic to VPN tunnel ?" we have "split tunnel" to pass only ""interesting traffic" to VPN tunnel access CORP LAN. but now , i need enforce all user traffic (internet +CORP LAN) pass through VPN tunnel. so far , i did what i know :

1. remove "split tunnle" from group-policy

2. the address in "remote VPN user address pool" are could be NAT/PAT through ASA5510

but i don't get that why it doesn't work.

View 9 Replies View Related

Cisco VPN :: 5550 - Smart Tunnel Link On User Home Page?

Apr 25, 2011

Two part question:  First is there a way to create a smart tunnel link on a user's home page like you have on the main portal page of the ASA 5550?  I see the code that it is using but have not been able to get this to work.  Here is that code;
 
<a href="javascript: parent.doURL('756767633A2F2F70676B636562712E7070757A702E6265742F50766765766B2F4B72614E63632F6E6867752F79627476612E6E66636B',[{name : 'user', value : 'CSCO_WEBVPN_USERNAME'},{name : 'password', value :

[Code]....

Second question when will MACs be able to auto start smart tunnel when the user first logs into WebVPN?  Right now the only way I know of starting a smart tunnel on a MAC is a link on the main portal page. I am running code 8.3.2.13

View 5 Replies View Related

Cisco :: IronPort C160 - Rejected By RAT

Nov 12, 2011

If something is rejected from the RAT and needs to be fixed..you would add to RAT or Relay list or...

View 12 Replies View Related

Cisco Routers :: RVS 4000 IPS V1.5 Rejected By Router?

Mar 10, 2012

I attempted to load RVS4000_WRVS4400N_IPS_Signature_v1.50.zip and received an error message "Signature file is not the correct type of version for this device". I have firmware version 1.3.3.5, and and current IPS version 1.42. why IPS v1.5 is rejected?

View 1 Replies View Related

Cisco WAN :: ACS 5.3 - Authentication Rejected / Unspecified Error

Mar 14, 2012

i received the below output,how to start a troubleshooting? the aaa server is cisco ACS 5.3
 
ERROR: Authentication Rejected: Unspecified.

View 1 Replies View Related

Cisco :: Command Sw Mode Trunk On C3560 Was Rejected?

Apr 16, 2012

recently i do some lab about trunking protocol using Layer 3 switch C3560 and layer 2 switch C2960, but i face a problem that i cannot configure trunk port on my C3560 using "switchport mode trunk" command, and after looking for the answer from google i found that i have to "remove" the "auto" mode of C3560 using "switchport mode dynamic desirable" and after that we can enter the "switcport mode trunk" command successfully.

and my question are, whether the "auto" trunk mode in switch layer 3 is a default mode or not? and why i should enter "sw mode dynamic desirable" command before "sw mo trunk" command ?

View 5 Replies View Related

Cisco WAN :: Inbound SMTP To Our Exchange Server Through 1841 Rejected

Jan 10, 2011

I am deploying a Cisco 1841 in place of our basic DSL router.I have an ADSL WIC and FA0/0 connected to our LAN.LAN IP ADDRESS range is 192.168.1. 0/ 24 I have dynamic and static NAT configured.  At this point although I have ACL's configured I have NOT implemented them as yet for the following reason.  I am unable to recieve inbound SMTP traffic - now  know my MX records are correct as this all owrks happily on our basic DSL router.  I can send external emails no problem and all internal email works fine. [code] I am in the process of defaulting the router and programming the barbones to get the link working and see if inbound SMTP works then start building the blocks again.

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved