5.2 ACS with different RADIUS authentication servers

Similar Questions

• WLC with RADIUS authentication servers

  I WLC user authentication with Cisco ISE which is linked with LDAP, now ISE is not accessible. Will be wireless users could always connect and use the Services of WLC?

  Hello Irshad-

  All customers who have already been authenticated will continue to work and to be allowed on the network until they leave the network and/or re-auth, idle, etc type timers expire. At that point, customers will not be able to join the SSID and won't have access to the network.

  To avoid that from happening, you can:

  1. create a redundancy by having more than one node of ISE

  2. create a secondary authentication via another RADIUS or LDAP server

  I hope this helps!

  Thank you for evaluating useful messages!

• [ACS 5.4] PEAPv1 authentication with MAC filtering

  Hello

  Our WiFi use the PEAPv1 authentication.

  It works very well with different devices (computer, tablets, smartphones).

  Now, I want to filter the devices of the company. We have all the MAC addresses of these devices.

  Is it possible to activate authentication PEAPv1 combined with MAC filtering in Cisco ACS?

  I don't want to filter addresses MAC on WLC...

  Thank you

  Patrick

  Hi Patrick,

  See if this helps:

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008084f13b.shtml

  https://supportforums.Cisco.com/thread/2163123

  Agentless network access:

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.3/user/guide/common_scenarios.html#wp1053005

  Ed

• Distributed replication of file system between servers with different performances

  If the published file system replication is set between servers with different performances. What will happen with the fastest server performance? The performance will shrink to match the performance of the server in the slower string?

  This issue is beyond the scope of this site and must be placed on Technet or MSDN

  http://social.technet.Microsoft.com/forums/en-us/home

  http://social.msdn.Microsoft.com/forums/en-us/home

• Hyper-v replication between servers with different performances

  If the replication of Hyper-v is set between servers with different performances. What will happen with the performance of the fastest servers? The performance will shrink to match the performance of the server in the slower string?

  This issue is beyond the scope of this site and must be placed on Technet or MSDN

  http://social.technet.Microsoft.com/forums/en-us/home

  http://social.msdn.Microsoft.com/forums/en-us/home

• Autonomous AP521 can be configured for authentication WPA/TKIP with no radius server?

  The AP521 can be configured for authentication WPA/TKIP with no radius server?

  the datasheet, wpa with tkip and wpa2 with aes are supported.

  you want to use (no RADIUS) wpa - psk with tkip. WPA2-psk aes and tkip not use.

• Using CHAP with RADIUS authentication

  Hello

  I configured a Cisco 877 router to send the RADIUS requests when a user connects to the console (Console line) or VTY Line using the following configuration:

  AAA new-model

  Group AAA authentication login default RADIUS

  Group AAA authentication ppp default of RADIUS

  RADIUS-server host 10.0.0.1 auth-port 1812 acct-port 1812 mysharedkey key

  When I connect the RADIUS packets I see the Cisco router sends the initial AccessRequest using PAP.

  How can I configure my router to send it's original AccessRequest package with CHAP?

  My apologies if this has already been discussed, I searched high and low for an answer.

  Thanks in advance.

  John

  Hi John,.

  PPP connection supported by CHAP because a configuration command to activate the CHAP protocol as Protocol of stimulus / response. However, the Console VTY connections and to THE will always go on PAP when using RADIUS authentication. There is no command to activate the CHAP protocol for these types of connections.

  Best regards.

• ACS with AD-with authentication of twins

  Hi gurus

  I want to integrate my 5.1 ACS with AD, my request is to check first for the machine authentication. If the machine authentication passes the customer name to username/password must be validated and customer should be in VLAN X. If the computer authentication fails, the user/password customer name must be validated. If authentication is successful the customer should be put into VLAN Y

  Let me know if this is possible

  Thank you

  NikhiL

  Nikhil,

  You can set a condition in your authorization policy and check whether the machine authentication has been made and your result out of this basic requirement.

  Here's a guide that corresponds to your questions:

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1235978

  Thank you

  Tarik Admani

• RADIUS across servers

  Is it possible to with a switch / router configured for a x Ganymede 2 servers in different places. They are not grouped, they are on the same network, but different areas and in different countries and use different credentials

  You can configure several ACS in your routers and switches. No matter where these servers are located as long as they are accessible by the AAA client. If the two servers are running with different credentials, I have re them with different guests so that the administrator can see which server is requested.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• WLAN 4402 for Radius Authentication

  Hi guys,.

  Please help me on how I can install my WLAN 4402 controller for Radius Authentication, if you have links or procedures that you can share, which will be very appreciated. :-)

  Thanks in advance.

  It depends on if you are using Cisco ACS or Windows IAS. Controller configuration is the same but the side RADIUS is different.

  Also what you are trying to configure, systems users, PEAP etc. through RADIUS

  PEAP via ACS is here

  http://www.Cisco.com/en/us/partner/products/ps6366/products_configuration_example09186a00807917aa.shtml

  PEAP via IAS is here

  http://www.Cisco.com/en/us/partner/products/ps6366/products_configuration_example09186a0080921f67.shtml

  Hope that helps

• ACS5: method of different external authentication for each user account

  ACS4 I could specify a different external authentication for each user account. I'm trying to find a way to do the same thing to the ACS 5? When I go under identity in Access Services, I see the system requirement: username I can use to identify the user who logs in, so that I can directly to a source of different identity, but the separate political configuration for each user is very inconvinient and would require hundreds of policies, in our case.

  I was hoping that we can create a kind of attribute for each user. SysAdmin > Configuration > dictionaries > identity > internal users. I created the new attribute called 'Storage of identity' with the enumeration type, which has 4 values: internal, Entrust Token, Token RSA, counts AD and checked the box "add a political Condition." I can then go under each user and select the storage of identity for each user. But now I can't find where I can use under part of identity of an access policy. I can use it under "Group mapping" but that maps to one group and not to an identity store. I need to use it under the identity somehow, but I can't find how.

  Hello Roman,

  The attribute you created will be available when the user is authenticated through internel ID store, so that you cannot use to select the store ID.

  The best way to do this would be to use other attributes to differentiate the identity store.
  Allows you to create a sequence of identity store so that for each user, ACS will try to authenticate by using multiple identity store.

  For example, you can use these:

  Network status

  > End Station filter

  > Device filter

  > Devide filter Ports

  Here you can import filters from a file and it would therefore be more scalable.

  Hope this helps.

• VPN Site to Site Secret shared and can co-exist RADIUS authenticated VPN?

  Hello

  I have a setup VPN site to site between two offices on 515Es PIX (v.6.2 software) and has recently added a vpngroup/shared secret based VPN remote access to one of the offices. Given that just forced me to add a number of different policies to my existing crypto card, it was a plant direct and easily implemented. For more security, I want to use a RADIUS server to give to each remote user their own connections and profiles rather than a group on all password is configured. To do this, however, it seems that I have to add the following additional commands to my existing crypto card:

  client configuration address map mymap crypto initiate

  client card crypto mymap RADIUS authentication

  These do not correspond to the policy number (my site-to-site is 10, and remote access policy is political 20), so I don't know what the effect would be if I added the. It would cause my connection from site to site for authentication RADIUS request (a very bad thing)? If so, do I need another interface to bind a new encryption card to? The answer to this would be greatly appreciated!

  Also, if anyone knows an example configuration for a similar configuration, I can look at, please let me know! Thank you.

  -A.Hsu

  For the site to site connection, you change line isakmp keys and add the parameters of "No.-xauth No.-config-mode" at the end of this one, which tells the PIX not to do the auth RADIUS or assign an IP address, etc. for the specific site-to-site tunnel.

  Example of config is here:

  http://www.Cisco.com/warp/public/110/37.html

  Note that there is no command options I have just said, I just sent an email to the web guys to fix this. Basically, your config will look with the options "No.-xauth No.-config-mode" on the line «isakmp x.x.x.x key...» "for LAN-to-LAN tunnel.

• several circle (with different diameters) on graph xy

  Hi, I'm looking for a solution to the problem posted above. I did searches and returns results using "Draw Circle by radius.vi" but I like it to be shown on an XY graph that has many circles with a different RADIUS (a bit like a fly).

  I also found an alternative with the loop for which a "PI" multiply with the iteration of loop divided by 50 and the values are passed through Sine and cosine with it functions delivered to be broadcast on graph XY. But I have no idea how to do to control the RADIUS to make it smaller or larger.

  Help please

  The outputs of the sine and cosine will give you a circle of RADIUS 1.  If you want a different RADIUS, then you must multiply the output of your desired RADIUS.

• I want to clone my hard drive and this clone allows you to configure a new computer, how do I do this for several PCs with different versions of XP?

  I am trying to replace 15 PCs.  They all have XP because their BONES, bought with different SPs at different times.  They all have been updated to SP3...  They have all MS 2003, upgaded to MS 2007.  I would use a clone as image.  I do not support different key codes?  Although the XP are authentic, I may not all key codes.  My predessor has not keep good records, and stickers on some had labels of Vista.  Even if the PC was bought with XP downgrade.  I need to use XP because of some other software requirements.

  What is the best way to represent all the PC so that I can get back them to my users?

  Hello

  I suggest you to refer to this link and check if it helps:

  http://answers.Microsoft.com/en-us/Windows/Forum/windows_xp-windows_install/cloning-Windows-XP-Pro-to-new-hard-drives-ready-to/b7edf501-6ae6-4bc1-94BB-39a4177d8b71

  It will be useful.

• RADIUS authentication question

  Hello world

  I'm learning the Radius Authentication. Here are my updated laboratory in place:

  R1 (107.107.107.10)-(107.107.107.4) - WIN2008 (RADIUS SERVER)

  Here is the config of RADIUS on the R1:

  AAA authentication login default local radius group

  RADIUS-server host 107.107.107.4 auth-port 1645 acct-port 1646
  key cisco RADIUS server

  I have a few questions:

  (1) above, I do not specify encryption on R1, R1 will use this as the default encryption?

  In the attached file, we see the password is encrypted, but there is no config on R1 to use particular encryption

  (2) we also see "authenticator", which is I think is R1 host name i.e encrypted with the shared secret. I'm wrong?

  Much appreciated and have a great weekend!

  Hello

  The Protocol Radius encrypts the password for the default user. I think that Radius uses MD5.

  The authenticator is a random string generated by the client and is used in the encryption of the password process.

  Thank you

  John