ACS 5.1 doesn't have to undress Username Prefix\Suffix in Peap?

Hello

We got the ACS 5.1 VMWare.

We try to only send the user name to the proxy RADIUS after ACS strip the Kingdom of Prefix\Suffix.

But ACS 5.1 could not strip the prefix\suffix in the Peap authentication method.

If we put the NAS authentication method to PAP_ASCII then ACS can strip the prefix\Suffix @.

(Conditions were matched and we could see the ACS did send requests to its proxy radius server extension.)
Any idea?

Hi Ed,

The point is that while the ACS can process and strip the domain name of the RADIUS Username, which is not used for PEAP authentication properly in the external RADIUS.

The reason is that the credentials used for authentication are inside the PEAP TLS tunnel, thus GBA acting as a proxy is just transmitting this information and it doesn't have access to this information.

Consider the RADIUS Proxy to present works even if you forward the EAP methods that are not supported by AEC, then in this case, what ACS is not supposed to touch what's inside the package of RADIUS.

I think that in your case the only solution is to configure the field stripping on the external RADIUS server, which is the one that will be able to extract the credentials of the TLS tunnel and to transform this info.

If it is feasible or not is based on the features of the RADIUS server for external use, but I think that you can not do much more on the side of the ACS using RADIUS.

Examine how RADIUS proxy works and the fact that you cannot even use the external RADIUS the two ID because you can't do the field stripping and you cannot use MSCHAPv2 based auth protocols (though this would work with PAP or EAP - GTC), you are dealing with is the PEAP username on the external server or... you must instead use another way to access the announcement.

This would open up different scenarios and maybe go away from this post

I hope that's clear on what makes ACS and why the field is not stripped by FAC on the internal credentials.

Thank you

Fede

Tags: Cisco Security

Similar Questions

Maybe you are looking for