There is an ASR1006 Router in the network that serves as an Intelligent Service Gateway (ISG). Subscribers are layer 2 connected and subscriber sessions are initiated on a DHCP request. ISG is configured as a DHCP relay agent. Wi-Fi clients connect to the WLAN using Open SSID and are being redirected to a Web Portal where they enter their login info. This info is sent to RADIUS server which checks if the user is allowed to use Internet service. All the APs are connected o WLC using CAPWAP. The question is the following: there is a requirement to track from which AP a particular Wi-Fi clients is connected. In this case ISG needs somehow to obtain AP’s mac address and send it to the Radius server (probably using attribute 30 – Called-station-id). One possible way for ISG to obtain AP’s mac is via WLC. But the thing is that when WLC is configured as DHCP proxy and Option 82 is set, a wireless client does not obtain IP address via DHCP. In this particular case there two DHCP relay/proxy in the network path between client and DHCP server. Is there any other away for ISG to obtain AP’s mac address?
I want to add Radius attribute to Rad ware devices , so I will have the option to grant "read only" permission to users. as I understand I need to add VSA for the "read only" permission, or configure specific "Service-Type value 255"
in the following picture you can see the required information from Rad ware:
I need to add OPNET Radius attributes in ACS 4.2. How should I add a new VSA in ACS? The google search is pointing me to CSUtil.exe, and I cannot find this utility in the ACS install files. These are the values that I need added for OPNET. When configuring the RADIUS server to support the ACE Live Appliance, use the following Vendor Code and Vendor Specific Attribute (VSA): Vendor Code: 7119 VSA: 33.
I need to add RADIUS attributes for a custom vendor under "Group Setup" page in ACS 4.2. As of now, I see Cisco Aironet RADIUS Attributes, IETF RADIUS Attributes etc in "Group Setup" page. How can I make sure that the RADIUS attributes for a vendor also appear on that page?
I'm trying to dynamically assign IP address for VPN users from AD (without IAS service). I know that there is a restriction that "Dial-in users are not supported by AD in ACS (note in "acsuserguide51") but Im not exacly sure what can and can't do with it. In "Authorization Profiles" in RADIUS Attributes tab I try to mannually add specific Attribute (Framed-IP-Address).
I have no problem (everything works just fine) with static address assignment in a way as below:
AD is already integrated with ACS and I've managed to download Directory attributes especially msRADIUSFramedIPAddress
When I change "Attribute Value" from static to dynamic type I see the option to select AD (but "Select" which should list all available attributes is empty)
I know that I can do it directly (ASA <-> AD attribute mapping) but I want ACS to do it
I am setting up Radius AAA for cat6K switch.For authentication its work and user can login to switch. But for the privilege level assignment, it does not work. After loging in, I always get privilege 1. I need your guide on how to configure on ACS 5.1, RADIUS Attribute.I follow the document to configure the cisco-av-pair for assign Privilege 15 and Privilege 5 , but it does not work.This attribute format was shown in document is to set Privilege 15, "shell:privlvl=15" it is correct way of configure it on ACS 5.1
Under 'Policy Elements/Authorization and Permissions/Network Access/Authorization profiles' I have defined a profile and the following Attribute:Attribute = F5-LTM-User-RoleType = Unsigned Integer 32Value = 300.
My question is:How can I define the same as above using 'Device Administration/Shell Profiles' ?
There is a Custom Attributes tab but I cannot figure out how to specify the 'Type' field. (Under Custom Attributes tab there is only space for 2 fields and not 3 fields).
I'm trying to find out the options for authenticating remote users via IMEI and MISDN values via ACS 5.3/I'm unfamiliar with the Radius attribute options here and what kind of request/response we can utilise. Also previously I could define IP pools on ACS 4 but can't seem to do that now. Is there a way have ACS 5.3 to provide a DHCP server address for the connection ?
I've been working on trying to get RADUIS authentication working for devices connecting to our corporate mobile APN. Out APN provider sends us Username & Password attributes which I can authenticate fine using ACS 5.2 but I'm having a problem using other attributes sent in the Access-Request. We have mobile SIM cards with an MSISDN value match with a physical device with an IMEI value. The SIM cards cannot be used in other devices, only their matched device. The provider passes us the MSISDN attribute under RADIUS-IETF 31 and the IMEI under a VSA of 3GPP-IMEI
What is the best way of being able to authenticate a user and match the MSISDN and IMEI associated to that user?
We have ASA 5520 acting as the VPN Server and Cisco 1941 router as EZVPN client. Since last few days client is not able to establish vpn connection. 1941 router is continuously generating the below log messages
001569: Jul 22 12:19:05.883 ABC: %CRYPTO-4-EZVPN_SA_LIMIT: EZVPN(VPNGROUP) Split tunnel attributes(51) greater than max allowed split attributes(50) 001574: Jul 22 12:19:07.835 ABC: %CRYPTO-6-EZVPN_CONNECTION_DOWN: (Client) User=vpn_user Group=VPNGROUP Client_public_addr=<client public ip> Server_public_addr=<server public ip> 004943: Jul 22 11:32:42.247 ABC: %IP_VFR-4-FRAG_TABLE_OVERFLOW: Dialer1: the fragment table has reached its maximum threshold 16
I have been tasked with migrating from ACS 4 to ACS 5.3. I havent had any training and so i am finding it a bit different. Currently i have this issue -
I have a group in the ACS 4 for users accessing via wireless on the ACS - Code...
We have: ASR1000-RP2 ASR1000-ESP40 ASR1000-SIP40 SPA-10X1GE-V2 SPA-10X1GE-V2 ! Kiwi Syslog Server
ASR performs the function of ISG. The number of subscribers until 10000. This number is constantly growing. Because of the economic address space subscribers surf the Internet through NAT.
Now the task to keep logs of all translations or binds. Need to store the information about what time, certain internal IP address using the external IP.
I've tried: ! ip nat log translations syslog ! logging trap debugging logging host xx.xx.xx.xx transport UDP port xxx no logging console (so as not to load the CPU) !
Error stopped publishing but logs do not come. I think of the huge number of translation per second, it can not send them as fast. How can this problem be solved or otherwise obtain and store information about a translations?
In a 6500 or 7600 a 'show module' gives a run down on all the modules in the slots, their HW and SW versions and status. But I can't find a similar command in the ASR1006.
I'm trying to configure and DMVPN architecture with two routers ASR1006 to server a bank remote offices, one ASR in CO building and the other in CA building (CO: Operational Center; CA: Recovery Center).Each ASR have two LAN connections to internal network and two WAN links to remote office. Each WAN links belongs to differents provider.Each remote office has a router with two WAN links connected to that WAN providers.We are configuring the DMVPN considering two primary tunnels in the CO building and two failover tunnels in CA building.We made the configuration (schemas and configuration attached) but we only get two tunnels up at a time. We cannot ping from office router to four tunnels interfaces in both hubs.
We made some test disabling some tunnels and we could get communication only with two tunnels interfaces. We got communication through tunnels when we have just two.We want to have the four tunnels for high availability. We would like to know how to troubleshoot and make a design review because the examples and documentations are very limited.
why I would see packet loss when BGP comes back up.We have 2 ASR1006's both running full tables of BGP to the same upstream ISP. We load balance the 2 links to them. the ASR's have an OSPF connection between them.When one pipe goes down we see not packet loss; however, when that pipe comes back up we see packet loss until the BGP table fully loads in that router again.
I want to do something with IP SLA and started by estabilishing a baseline.
I'm trying to check history on an ASR. I tested same config on a 3845 and was forgetting the "history filter all". After this I could see history table on 3845 but still history is empty on the ASR1006. The operation started because I can see information with "show ip sla statistics".
know if i missed something or maybe this is not supported in ASR1006?
re-ld-tcc-02_ASR1006#show vers Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-ADVIPSERVICESK9-M), Version 15.2(1)S2, RELEASE SOFTWARE (fc1)
ASR performs the function of ISG. The number of subscribers until 10000. This number is constantly growing.Because of the economic address space subscribers surf the Internet through NAT.Now the task to keep logs of all translations or binds. Need to store the information about what time, certain internal IP address using the external IP.
We have an ASR1006 and I'm just discovering net flow aggregation cache.
I tried prefix aggregation and worked fine. But i cant get any information when checking AS aggregation. All I get is 0 in source and destionation AS. [code]
I have cisco router ASR 1006 .... i need to create PPPOE connection via Ethernet ... and can do that on the management port ???? and what is the type of adapter that use in the Giga Ethernt interface to connect it to fiber ???? hint :- my interface hardware SPA-10X1GE-V2
When trying to configure ERSPAN on a ASR1006, I'm not getting any traffic on the destination port. ERSPAN flavour is LOCAL SPAN, as described in:
[URL]
Configuration used, is the following:
monitor session 1 type erspan-source no shut source interface GigabitEthernet0/0/2 destination erspan-id 10 ip address 10.10.10.1
[code].....
Apparently everything is configured in the proper way, however I’m not getting any traffic in the destination port. Also I’ve noticed the following in the details from ‘Session 1’:
I have problems in exporting translations of NAT from my router through NetFlow v9 ASR1006, to my server nfdump, any opensource or licensed software (collector) that I recommend.
ip nat log translations flow-export v9 udp destination 10.1.1.15 1181
We have found the following issue configuring radius attributes for network access with packeteer appliances.with PAcketeer-AVPair attribute , value --> access=touch Login fails and we see this
PacketShaper# radius login user password "user" RADIUS Authentication Fail Vendor-Specific: ccess=touch <--- value is bad
PAcketeer is not receiving vendor-specific value correctly, As workaround , we put other character before value -- xacces=touch
PacketShaper# radius login user password "user" RADIUS Authentication OK Vendor-Specific: access=touch
is there a way to have multiple instances of user custom attributes and insert those as multiple instances of the A/V Pair in the authorisation profile in ACS 5.2/5.3 ?Background: We have to migrate a ACS 4.2 to 5.3. In ACS 4.2 our client used the multiline attribute
Number #Name #Description #Type of Value #Inbound/Outbound
[code]....
to specify multiple routes to various networks in the RADIUS reply spcific for every single PPP username of routers dialing in.Using the internal user database, extended by a string attribute and using that attribute as source of a dynamic value in the access-policy works basically. But as I have only ONE single line instance of the attribute for every user, I can only return ONE framed-route.We have lots of cases where multiple routes have to be assigned to one router.I 'd like to avoid defining a seperate access profile for every remote RAS router for external PPP Dial-In...[URL]
I'm looking into starting a file sharing server (think this is what its called) which will allow people to login into one of my PC's over the internet and download my files. My goal is to allow family members and friends to access my files and only specific files on this PC. The files could be family videos as well as pictures. Some video files will be in excess of 10gb along with typical jpegs and what not. I'll probably be running windows server 2008 on it. I'm also considering allowing people on some other forums that I'm a member on (cars, hobbies, ect) and allowing people to host vids on my server. My current IP provider is Comcast and I'm on a Dynamic IP so wondering how easy this is or if its recommended I get a static IP.
I' am looking for some articles that you'd recommend on this. I'd also like to have password protection / or login criteria so car members aren't able to view all my family videos, but can only log into some folder labeled (cars) and not my folder labeled family. Or another option would be that people have to login before they are able to even see what folders are accessible.For instance car members could only see car folders Family members could see anything stored on the PC?
I'm in router setting in 1921, I have 40 remote VPN group profile attributes, but I can only connect simultaneously at 30, I wonder if there is a maximum limit of groups configured on a router 1900 IOS
We have a WLC 2504, since a few months, it was working fine, we have a guest Wlan configure with web authentication and the DHCP scope for this in the WLC. The problem today is that its no redirecting the web browser to 1.1.1.1, we try it with 3 laptops and they recieve a correct IP from the DHCP but still can not get redirect to the web authentication portal. Have the default configuration Internal (Default).
In laptops we check the firewall, dont have a proxy activate and have google DNS.. 4.2.2.2 8.8.8.8. In fact this laptops connected to this ssid before.
I upgraded the firmware on my wap121 and the URL redirect option is now gone. The docs all talk about using Captive portal but that is only on a wap321. How can I get the redirect back so customers who connect to my network see the site for our bar before they go on the internet?
I upgraded from the 1.0.0.3 to the latest (1.0.2.3)
we're using openldap for authorising our user to connect to the webvpn via our ASA.We'd like to rely on operational attributes to do some DAP matching. This is an example of how a user record looks in our LDAP tree:
# extended LDIF # # LDAPv3
[Code]......
Are LDAP operational attributes supported at all by the Cisco ASA?
So we have multiple ISE Servers with differing personals. I was having an issue with our new ISE setup not identifying AD Group Attributes when using them in Authorization rules. We have 2- 3395 appliances running Admin and Monitoring/Troubleshooting Personas and 2- 3395 appliances running as Policy server personas. We are running v1.1.1.268 with the latest two patches. I was unable to pull Active Directory Group Attributes in any of my Authorization rules. After Resyncing all the boxes with the Primary Administration box I was able to do this. There is no bug listings for this occurrence nor do we have Smartnet to call support for other reasons.
