Cisco :: (login) Command Bypasses RADIUS Servers
Jan 21, 2013
I have RADIUS servers configured to authenticate administrative users and authorize them at a low level. This is working well. I also have a local level-15 user in case all of my RADIUS servers time out and someone needs to change something. This also works well. The issue I'm having is that a low-level user can log on using the RADIUS severs, then issue the "login" command and enter the local level-15 user's credentials and then operate at level 15.
I do not want the local account to work at all, except in the case that all RADIUS servers are unavailable. What I've described above works around this. How to disable the "login" command or force it to try RADIUS servers first? This is for ASA 8.2
View 4 Replies
ADVERTISEMENT
May 26, 2011
is command accounting for Radius supported on ACS 5.2 ? provided vendor's radius implementation supports this capability.
View 1 Replies
View Related
May 15, 2011
Im trying to configure a 7204 for radius login authentication, although the router is also configured with radius for VPN access. How can I configure it for both using 2 different raidus servers? the login via radius is working fine on another router, although that one is not doing VPN access so there's no conflict.
My config:
aaa group server radius RADIUS_AUTH server x.x.3.11 auth-port 1645 acct-port 1646
aaa authentication login networkaccess group radius local
[Code]....
For some reason, this does not work. I cannot access the router and authenticate via x.x.3.11 radius server. I think there's a conflict between the VPN and the login authentication but im unsure how to resolve this.
View 3 Replies
View Related
Aug 13, 2012
'm able to setup my 3750e switch to login through a radius server with my company user id and password but would like to be able to set it up that when I log in it drops me on the enable prompt. Right now I have to type >en.Then the enable password.
View 1 Replies
View Related
Sep 11, 2012
Can we enable ssh on 3500 /3600 APs along with use radius for login authentication? idea here is to that ssh will provide another method to access the AP for troubleshooting purposes.I know with autonomous mode APs this should not be an issue but not sure with lightweight APs.
View 2 Replies
View Related
Jul 22, 2012
I´ve a little problem with the aaa authentication over RADIUS with a Cisco 3560G-48PS - IOS 12.2(58)SE2. When I try to log in to the Switch per Telnet, it didn`t works and my windows domain account is locked. Here the aaa config:
aaa new-model
aaa authentication login default local group radius
aaa authorization config-commands
[Code].....
View 1 Replies
View Related
Oct 2, 2012
I have 4 Cisco AP541N access points in a a cluster, and everything has been working great. We have been directed by our parent company to change our wireless to utilize RADIUS authentication with our wireless. I have been able to take an AP541N as a standalone (not clustered) and configure it to their standards, configure the 2 RADIUS servers they use with the RADIUS keys I was given for this access point, and everything works great with it. I was able to get them to setup their RADIUS server (which I have no access to) to allow authentication from the 3 other access points now, but they all have different RADIUS keys. I'm finding that when they are clustered they all seem to share the same RADIUS key, but I need them to have different ones.
So the question is, can I cluster 4 AP541N access points together, but allow each one to have it's own unique RADIUS key?
If not, then I think I'll either need to get the RADIUS admins to make them all the same key (which is not likely), or I'll have to uncluster them.
View 1 Replies
View Related
Mar 29, 2012
What is the maximum number of supported RADIUS servers on the Flex 7500 Cloud Controller?
View 2 Replies
View Related
Jul 20, 2010
I have several controllers, including a 4402 running 6.0.188.0 software and I need to modify the Radius servers that it uses. Currently I have three servers listed;
1 - 10.246.194.16
2 - 10.200.31.78
3 - 10.247.50.56
I would like to delete server 1 which is being retired and replace it with a new server 1. I suspect, once i get servwe 1 deleted, the server 1 option would become available when I create a new server. I went into the controller and disabled server one, but every time I try and delete it, I get the "Server in use either on a specific WLAN or Mesh Radius Server Configuration" error. I can't find anywhere this server is still in service and being used, either by a WLAN or a Mesh. I've tried several different variances to modify this. What I hope to avoid is the need to reset the controller. I have a total of seven controllers that I need to make this modification to, and It will be ugly if I have to reboot these units. Hospital mission critical stuff.
View 4 Replies
View Related
Feb 5, 2013
I have a customer that wants to restrict SSIDs that groups get based on their AD credentials. Currently, he is using Windows 2008 Radius Server and AD with Cisco 5508 WLCs. I found examples that shows this is possible but my question is if I have 2 user groups (teachers and students) in AD and apply a policy for the Radius to send SSID x to teachers and SSID y to students. Upon successfully authentication, would this deny teachers access to SSID y and students access to SSID x?
View 10 Replies
View Related
Apr 29, 2011
How can I block Ultrasurf Application?
I have configured Cisco ASA 5520 with Cisco CSC-SSM module.
I have blocked everything Except Business and banking activities.
But user can access A 2 Z traffic through Ultrasurf.exe application. which bypasses all possible firewalls.
How can I blocked this application?
View 4 Replies
View Related
Sep 3, 2011
I can not access my hotmail account through msn.com, nor can I login to msn messenger as before. I get error message as follows:The requested URL /login.srf was not found on this server.Apache/2.0.59 (Unix) DAV/2 PHP/4.4.5 Server at [URL]Port 80
View 1 Replies
View Related
Feb 22, 2013
I came across an interesting issue and thought I would see if anyone else has encountered it before contacting TAC.I have two Cisco Catalyst WS-4510R-E switches with a single Supervisor V module in each chassis. Both Sup cards are now running 12.2(54) SG1; ipbasek9 firmware; yes, I plan to move both switches to 15 code but that's another story. Anyways, prior to the upgrade the one switch was running 12.2 (33) code; I suspect the code was never upgraded; running ipbase non - K9 code. The other switch was running 12.2(44) with K9 prior to upgrade to 12.2(54).
View 2 Replies
View Related
Apr 23, 2012
I have two Cisco Catalyst WS-4510R-E switches with a single Supervisor V module in each chassis. Both Sup cards are now running 12.2(54) SG1; ipbasek9 firmware; yes, I plan to move both switches to 15 code but that's another story. Anyways, prior to the upgrade the one switch was running 12.2 (33) code; I suspect the code was never upgraded; running ipbase non - K9 code. The other switch was running 12.2(44) with K9 prior to upgrade to 12.2(54). With the background set, one switch reports the following:SwitchA (config)#r?radius-server redundancy regexp represourc rmon route-map router.
View 4 Replies
View Related
Oct 14, 2012
On my old 2511 access server, I could issue "clear line x" to close a session on an existing line.this doesn't seem to work on my new 2600XM with NM-16A access server (12.3(20)IOS), any command in newer IOS?
View 4 Replies
View Related
May 22, 2011
After setting thru set time command, error message is display on server 'synthetic time issued'.
View 2 Replies
View Related
Nov 5, 2011
what i type in run box to increase INTERNET speed i saw my net provider doing this just little bit time he just type in run box ping o (.......................)/ and some numbers like IP address and then black window opened and INTERNET speed increase tell me what i type in my run box to increase speed.
View 2 Replies
View Related
Mar 21, 2011
the way i find mac address remotely is by using this methodarp -a ip addressshould give you a mac address of the following ipsunil pindoria
View 2 Replies
View Related
Feb 10, 2012
I have a website account with fatcow. I created the website with Dreamweaver software and uploaded it to fatcow via port 21.My internet connection was via xplornet and I had no access problems. I upgraded to xplornet's new g4 system and now I can no longer access my account online or upload to my website.We have two computers. The first is a desktop system that has the dreamweaver software. The second is a laptop which connects wirelessly. We share the signal through a dlink router. The modem is a viasat Surfbeam 2 residential satellite modem.1. When I attempt to login to the fatcow control panel, the tab shows successfully authenticated and then re-directs me back to the login page. This happens on both the laptop and the desktop.
I have tried bypassing the router and the problem still exists.I took the laptop to the computer center and I can login to the account no problem.I used a free proxy server page on the internet and can login from my home system on my desktop no problem.I have completely turned off virus scan and firewalls. It doesn't work. I have tried IE7, Chrome, Firefox and they all have the same problem. The laptop runs IE8 and has the same problem.I can ping the page successfully. I can traceroute the page successfully. I can't nslooup any site at all. I get the domain not existant message.My ip and dns settings are the automatically find option.I have renewed ips and dumped the dns cache.Using alternate dns addresses doesn't rectify the problem. When I attempt to upload via dreamweaver, I connect but within seconds I get a Dreamweaver message that says "Connection to remote host has been lost. Click refresh to continue" and the log reads "FTP Error. Dreamweaver could not connect to server." I haven't taken my desktop anywhere to try to see if it works on a different network. I'm in a remote location (hence the satellite internet)and it is an hours drive to the nearest private internet connection and a 2 hour drive to the nearest public connection.
View 19 Replies
View Related
May 9, 2013
We have a Linksys WRT120N wireless router set up at one of our small offices. I noticed recently when trying to log in to the router to make some admin configurations that it will not accept the login credentials when trying to log in from IE10 browser. Works fine from Chrome, IE9, ect. logging in to a linksys router with IE10?
View 3 Replies
View Related
Jun 11, 2013
We are planning to split the Private servers from the DMZ Servers and configure an additional Interface and segment for this purpose.
Private Servers Segment: 192.168.4.0/24 (there is no DHCP all servers' IPs are statically configured)
DMZ Segment: 192.168.3.0/24 (This is a future deployment)
LAN Segment: 172.17.0.0/16
Both, Private Servers and DMZ Servers are in a collocation as well as the ASA5520. There are multiple Branch offices that uses subnets within the 172.17.0.0/16 Network and they are connected to the ASA5520 via Metro-E.
I do not know if this is possible but what I want to do is this:
In order to avoid the change of internal DNS records I want to mask the DMZ servers with a Private Server IP when a Private server or LAN host wants to access it like this:
The FTP server in the DMZ has the IP address: 192.168.3.100. But when a PC from the LAN wants to reach the FTP server it should points to its old IP: 192.168.4.100. This way the PC sends a packet to the ftp.corporate.net (192.168.4.100) the ASA recieves the packet and translate it to the (192.168.3.100) and send it out through the DMZ Interface.
Also if the Private Servers wants to reach the same FTP the ASA will act like a proxy-ARP and send the paquet to the DMZ by means of the translation of the IP.
View 6 Replies
View Related
Mar 20, 2012
I Have exented vlan 120,121 from DC-1 to DC-2,the DC-1 and DC-2 are connected using L2 Trunk over fiber terminated on Cisco 6513 on both site ,the distance around 40 Km ,on the DC-2 i just assigned server-1 TO VLAN 120 while server-2 in vlan 121 ,but these servers unable to communicate neither with DC-1 Servers or betwen them locally on DC-2 ,pls note that the servers at dc-2 rely on DC-1 for routing.
View 7 Replies
View Related
Apr 16, 2011
i'm trying to connect 5 servers together to create a private network.Each server has a network of it's own and i'm trying to make all 5 servers communicate with each other to share and search data simultaneously..
View 16 Replies
View Related
Oct 30, 2011
I am currently useing ACS 5.2 and have no problem using Tacacs+ with AD access.
But with Radius it seems I can only get the Local identity store to work, need to do something special to get Radius to work with active directory with Cisco ACS?
View 10 Replies
View Related
Apr 10, 2013
Cisco WLC 5508
Software Version: 7.4.100.0
Windows Server 2008R2
I've got everything setup on the Windows Server 2008 side of things (certificates, radius clients, etc). I added the radius server on the WLC, and configured a new W LAN to use it. Both are on the same sub net. When trying to connect to the W LAN it kept failing. I installed wire shark on the server to monitor the radius traffic, and to my surprise there was no radius traffic showing up on the server. The radius statistics on the WLC are at 0 as well, so it's like the WLC isn't even attempting Radius.
I re verified that the server was enabled on both the security tab and the W LAN itself on the WLC. Rebooted the controller and the server, all to no avail. I used a radius test client, and can successfully send radius commands to the server using that utility. Frustrated, I just kept trying to reconnect on my wireless device, and after about the 15th try, finally I saw radius activity on wire shark. It rejected my access, but at least I saw activity. It also registered radius statistics on the WLC as well.
So now if I keep trying to connect repeatedly, about every dozen or so times the WLC actually will send a radius request to the server.
View 8 Replies
View Related
Apr 25, 2011
I am running ASA version 8.4(1), and anyconnect version 3.0.1047. My SSL VPN works fine, but i run into an issue with one user . his account did not work , and everytime users logged in it got this message "VPN Server could not parse request".
I found the problem after getting a user information meaning his username and password. His password had "&" as one of the special characters. when we change it to something that does not have that , it works just fine.
We are using microsoft NPS server as radius. but when i run a test within CLI it works just fine, only when anyconnect asks to authenticate it fails.
View 5 Replies
View Related
May 1, 2012
Any free radius server for lab purpose?
View 5 Replies
View Related
Aug 6, 2012
Any software to measure Authentication time between client and Radius serverr.
View 8 Replies
View Related
Jan 25, 2012
Does anyone have or know of a tried and true method of configuring a Windows Server 2008 box to provide authentication/accounting services for Cisco devices. I've read a few websites already and a lot of them seem to be geared toward VPN and some of the settings each site goes through are different.I've got NPS installed and a RADIUS client configured with the shared key. Right now I'm in the process of creating the Network Policy which only allows a Windows "admin" group to log in. Curious about the "Constraints" section where the NAS Port Type is selected and the "Settings" section where the service-type and vendor specific options are configured.
View 18 Replies
View Related
Oct 15, 2012
How to configure Radius server on router in packet tracer
View 1 Replies
View Related
Jun 5, 2012
Configuring radius authentication on Nexus 7k?I have heard once you have configured the radius you are only able to run show commands on it.
View 1 Replies
View Related
May 24, 2012
I'm having some weird issues where I cannot ping from the WLC to the IAS RADIUS server. All of my clients cannot connect, but from the switch, router, RADIUS server, and hard wired clients, I can ping to the WLC and RADIUS server. The only thing that cannot ping the RADIUS server is the WLC itself. Nothing in the FW is blocking connectivity. [code]
View 11 Replies
View Related
Nov 22, 2011
I have been trying to get our IPS (ASA-SSM-10 and 4260) to authenticate with Cisco Radius ACS 5.2 and they are not working. However, I was able to get them working with Microsoft Radius. Below is the logs from the IPS:
evStatus: eventId=1321566464942057375 vendor=Cisco originator: hostId: NACAIRVIDLAB1 appName: authentication appInstanceId: 350 time: 2011/11/23 17:50:38 2011/11/23 09:50:38 GMT-08:00 controlTransaction:
[Code].....
View 0 Replies
View Related
