ACS Cisco 1121 5.1

Similar Questions

• Cisco 1121 unit installed with ACS 4.2 SE version

  Hi all

  Sorry, we could install version to 4.2 on the Cisco 1121 device acs?

  Could we use 1120 ACS 4.2 image DVD to install on 1121?

  Or any workaround?

  THX!

  Calvin Su

  Hi Calvin,

  Unfortunately, 1121 hardware doesn't support version 4.2.0 acs so downgrade is not an option for 1121. It can only be used with ACS 5.x

  Kind regards

  Jousset

  The rate of useful messages-

• reinstallation of the server Cisco ACS CSACS-1121

  How can I reinstall the ACS server? This is the new installation, after installation is complete it may not work properly

  ACS / admin # acs reset-config

  Stub library could not be opened

  libCARSAcsCtrlCli.so: cannot open shared object file: no such file or directory *.

  ACS / admin # display the version of the acs application

  % Error finding application version information: acs

  ACS / admin # display application

           

  blank screen

  How can I reinstall it?

  Hello

  If you have the ACS 1121 device, you'll need the DVD to reinstall the recovery software is available from the Cisco page:

  Download software > Products > Security > identity management > Cisco Secure Access Control System > Cisco Secure Access Control System 5.3

  It is the name of the file:

  ACS_v5.3.0.40.ISO

  Here are the instructions for resettlement or reimage:

  http://www.Cisco.com/en/us/partner/docs/net_mgmt/cisco_secure_access_control_system/5.3/installation/guide/csacs_ins.html#wp1101132

  The 'acs reset-config' command removes only the configuration of the ACS GUI, but it is not re - install the software.

  Rate if this can help!

• ACS Cisco 1113 4.2 1113 configure auth. for Infoblox Appl.

  Hello

  I have a problem with Cisco ACS and an Infoblox appliance. We want to authenticate users, this connection on the Infoblox, through the Cisco ACS. After that the ACS should respond with authentication (RADIUS) passed and answer with an administrative groupname that the user belongs on the Infoblox. To do this, I have to import a VSA to have the option of the CSA to respond with this groupname. On the Infoblox, these groups are already done, and it must be the group that meets the CSA.

  Now I have imported the ASB and configured an AAA (infoblox) client to use the new RADIUS (VSA) to support the Infoblox. In the groupsetting, I lit the Infoblox-Group_info attribute and filled a specific groupname the authenticated user belongs. Now, here's the part where the news of group are returned, but the appliance Infoblox gives me a RADIUS error response message. As I see in the newspapers of the ACS user authentication part is fine. So there must be between the info ACS responds with, when the user connects.

  I have attached the VSA and a *.pcap of wireshark to see what is happening.

  Can we advice to suggest any option that can make this thing work.

  With respect,

  Richard Gosen

  Hi Richard,

  Please find attached the accountsActions to remove it, and you can use your original accountsActions to readd the ASB.

  Hope that works.

• Connection Error 1120 ACS cisco acs 5.0 web gui

  Hi all

  I installed the unit acs 1120 as follows

  entered in the installation in console mode command

  aiinstalle licensevia gui mode

  But when I access the gui mode it disconnect regularly

  When I ping ping is successful and shows life 128

  but after some time, the connection is estabalished and when I ping the TTL shows 64

  can someone help with this problem

  Thank you very much

  Hello

  I couldn't quite follow the description of your problem. Can clarify you the problem more in detail.

  You then mention access to the ACS GUI mode it to disconnect regularly. You lose any IP to GBA connectivity, or is the problem only through the user interface?

  Please can you include ACS cli:

  view the status of the acs application
  See the version

  Show tech

  Would also be relevant to see the output of 'display the acs application state"when the problem occurs.

  Additional troubleshooting, the support beam will also relevant information during problem occurrence timestamp. You need to enable the debug logs, for ex:

  GBA cli:
  admin #conf t
  exploitation forest admin (config) # loglevel 7
  exit admin (config) #.
  # acs admin - config
  After a few seconds,.
  You can then log in with the credentials of user/password for GUI of the CSA name.

  acsadmin(config-ACS) # debug level mgmt-acsview of-journal of debugging

  acsadmin(config-ACS) # debug level to debug-log duration
  output acsadmin(config-ACS) #.

  Following the appearance of the problem, the support beam then downloadable GUI Monitoring & Report Viewer > troubleshooting > ACS support Bundle.We will need to check on the timestamp of the problem newspapers.

  But for now, more details about the problem seem necessary as well as the output display orders of cli ACS mentioned above.

  Thank you

  Alex

• 4.2 ACS Cisco with Active Directory integration

  Hello

  I m new in the administration of the ACS, we have recently implemented on ACS version 4.2 Server

  to manage all the authorization of users in our network.

  We are in an environment with at least one Active Directory server, group, and users.

  Now, I m just able to create a new user in ACS and work with the switch of the customer, do I have to do, is to integrate my 4.2 ACS with Active Directory.

  to work with the user and group that a registry in my ad.

  Can someon help me please?

  Hello

  If you use windows server for CE 4.2 Installing you just need to do this the domain member server.

• Replacement of Cisco ACS Solutions 4.2 engine

  Hello

  Our ACS (Cisco 1113) is dead and it is not cost-effective to replace because it will serve only until the end of this year.

  Is it possible to get the Ganymede software to install on a Windows Server? How can I go on the procurement software as the original documentation is no longer available? The fact that I have a dead unit will be sufficient evidence for a copy of the software? We are currently running v4.1

  Thank you.

  Here's a path to download the Eval of ACS 4.2 windows.

  Cisco.com > downloads Home > Products > Security > access control and

  Policies > policy and access management > Cisco Secure Access Control

  Server for Windows > Cisco Secure ACS for Windows 4.2 > secure access

  Control (ACS) server for Windows - 4.2.0.124 > scroll down

  and you will see a file named

  ACS v4.2.0.124 90-Days Evaluation Software

  EVAL-ACS - 4.2.0.124 - SW.zip

  ACS installation under windows

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/Windows/install.html

  Once installed, you can restore the previous backup on windows server.

  Restore from a backup ACS file

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/User_Guide/SCBasic.html#wp222758

  Jatin kone

  -Does the rate of useful messages-

• ACS Auth: Use of group data for the authentication of the user-> security problem?

  IM only using a VPN-installation (router, ACS, Cisco VPN Client) and I noticed that the name of the Group and the Group decrypted password can also be used in the second step of the authentication (the extent of authentication or authentication of users), which is a big security concern. What wrong with my setup.

  For the test I have set up a VPN configuration as described in cisco documents. Here, it also works. The identification information of the Working Group in the authentication of the user, too, which is quite logical, because the group credentials are also a user in the database of GBA. Of course, this user can be authenticated in the user authentication process.

  Who is wrong? How other admins to solve this problem? Am I wrong in my approach?

  Thank you!

  Yes, permission will have password for "cisco", at least for isakmp and pki. The group will send its name and password Cisco to receive the av pairs (ASA has a function to create a "good word of different past" but he's not here on IOS, AFAIR)

  It is a restriction known - you should not use the same server for authentication and authorization, with IOS and ASA.

  Did you give this property (either / or):

  -local isakmp authorization

  -l' authentication certificate (Group)

  -sharing features for authentication and authorization between servers.

  I don't think we can do much wise configuration to prohibit this behavior.

  Edit: spelling correction.

• ACS - AnyConnect 3.0.5080 Network Access Manager (NAM) by selecting the right certificate

  Hello

  We are authenticate our users of portable Windows7 wireless using Microsoft CA issued certificates from computer to Server v4.2 ACS Cisco successfully using EAP - TLS

  However AnyConnect 3.0.5080 is installed and Network Access Manager (NAM) runs on laptops that Nam appears to be selecting details in the bad certificate for EAP - TLS authentication to the ACS server, it selects username details in a personal certificate on the computer of users that is used by LYNC 2010 and does not use the installed machine certificate.

  Newspapers of ACS that indicate this is attached.

  NAM will always use the details obtained from a personal certificate of feedback a computer certificate (if they both have the same domain name that they contain).

  Nothing specific that I should be looking.

  Thanks in advance for any help.

  No problem Jim

  If you could please update this thread as you progress, this will help a lot of customers in the future!

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Cannot be reset CSA 5.7 Administrator password of CLI

  Hello

  Can someone advise me please on the following...

  I need to reset the password for administrator CLI on an ACS 5.7 system runnning on a Cisco 1121.

  I went through the process to boot from the recovery CD, but when you get to the option to reset the Admin password, I get the following error:

  Cannot find the configuration of ADE-OS starting

  Unable to proceed to the recovery of password

  Leave the password utility

  Can someone please advise how to solve this problem that we desperately need to enter in the CLI to change the IP address.

  Thank you very much

  I suggest try reinstall the ADE-OS software and / or do an upgrade to the latest version of maintenance.  And then try the reset password again.

  Otherwise, I would say a case of opening with TAC.

  --

  Please do not forget to select a correct answer and rate useful posts

• 8021 x security after acceptance of Radius Access Violation

  Hello

  I'm running a CEP to enable DOT1X on our switches. We use on laptops and ACS Cisco 5.8.1 server certificates.

  We are at the point where the ACS server sends an acceptance of switch to DOT1X demand access, but then the port goes to error disable it with an error found a new mac address on the port, and yet it is the mac address of the device that it just authenticated.

  Here are the relevant parts of her debugs:

  *****************************************************************************************************
                
  09:53:04.619 31 May: RADIUS: receipt id 1645/133 10.5.20.230:1645, Access-Accept, len 205

  *****************************************************************************************************

  09:53:04.619 31 May: RADIUS: authenticator C2 1A 2A F6 62 34 59 20 - 3D EA 68 E1 B8 67 53 FB
  09:53:04.619 31 May: RADIUS: username [1] 11 "UB-HY-002.
  09:53:04.619 31 May: RADIUS: [25] the 34 class
  09:53:04.619 31 May: RADIUS: 43 41 43 53 3 a 53 57 41 43 53 31 31 32 31 2D 2D [CACS:SW - ACS-1121]
  09:53:04.619 31 May: RADIUS: 2F 32 35 33 38 39 37 39 34 32 35 39 32 35 37 2F [/ 253897942/59257]
  09:53:04.619 31 May: RADIUS: EAP-Message [79] 6
  09:53:04.619 31 May: RADIUS: F2 03 00 04 [?]
  09:53:04.619 31 May: RADIUS: Message-Authenticato [80] 18
  09:53:04.628 31 May: RADIUS: E9 b CB 87 77 1 1a A2 CE E0 30 61 C1 0d 2 a E1 F0 [? w? 0? *?]
  09:53:04.628 31 May: RADIUS: vendor, Microsoft [26] 58
  09:53:04.628 31 May: RADIUS: MS-MPPE-Send-Key [16] 52 *.
  09:53:04.628 31 May: RADIUS: vendor, Microsoft [26] 58
  09:53:04.628 31 May: RADIUS: MS-MPPE-Recv-Key [17] 52 *.
  31 May 09:53:04.628: RADIUS (00000002): receipt of id 1645/133
  09:53:04.628 31 May: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes

  *************************************************************************************************************************

  31 May 09:53:04.628: dot1x-package: received success EAP on the FastEthernet0/24 for mac 5882.a895.510b
  31 May 09:53:04.628: dot1x - sm:Posting EAP_SUCCESS client = 1A3DFE8
  31 May 09:53:04.628: dot1x_auth_bend Fa0: during the auth_bend_response State, had 11 (eapSuccess) event
  09:53:04.628 31 May: @ dot1x_auth_bend Fa0: auth_bend_response-> auth_bend_success
  09:53:04.628 31 May: called dot1x-sm:Fa0/24:5882.a895.510b:auth_bend_response_exit
  09:53:04.628 31 May: called dot1x-sm:Fa0/24:5882.a895.510b:auth_bend_success_enter
  09:53:04.628 31 May: called dot1x-sm:Fa0/24:5882.a895.510b:auth_bend_response_success_action
  31 May 09:53:04.628: dot1x_auth_bend Fa0: idle during the auth_bend_success State
  09:53:04.628 31 May: @ dot1x_auth_bend Fa0: auth_bend_success-> auth_bend_idle
  09:53:04.628 31 May: called dot1x-sm:Fa0/24:5882.a895.510b:auth_bend_idle_enter
  31 May 09:53:04.628: dot1x - sm:Posting AUTH_SUCCESS client = 1A3DFE8
  31 May 09:53:04.628: dot1x_auth Fa0: during the auth_authenticating State, had 12 (authSuccess_portValid) event
  09:53:04.628 31 May: @ dot1x_auth Fa0: auth_authenticating-> auth_authc_result
  09:53:04.628 31 May: called dot1x-sm:Fa0/24:5882.a895.510b:auth_authenticating_exit
  09:53:04.628 31 May: called dot1x-sm:Fa0/24:5882.a895.510b:auth_authc_result_enter

  **************************************************************************************************************************

  31 May 09:53:04.628: % DOT1X-5-SECURITY_VIOLATION: security breach on interface FastEthernet0/24, the new MAC address 5882.a895.510b is seen.
  31 May 09:53:04.628: % PM-4-ERR_DISABLE: error in security breach detected on Fa0/24, putting the Fa0/24 in State of err - disable

  It's the dot1x of the switch configuration and the port that we test are as follows:

  Group AAA dot1x default authentication RADIUS

  Group AAA authorization network default RADIUS

  start-stop radius group AAA accounting dot1x default

  interface FastEthernet0/24
  switchport access vlan 420
  switchport mode access
  switchport voice vlan 321
  SNMP trap added mac-notification
  Mac-removed SNMP trap notification
  SNMP trap-the permitted link status duplicates
  dot1x mac-auth-bypass
  dot1x EAP authenticator
  self control-port dot1x
  multi-domain host-mode dot1x
  dot1x tx-timeout 3
  spanning tree portfast

  Any help would be appreciated. Thanks in advance.

  Jim

  Oh yes, the train (55) is the way to go if you're not on the 15.x. thank you for taking the time to provide the solution to the problem! (+ 5 from me)

  Now, given that your issue is resolved, you must mark the thread as "answered" :)

• 802.1 x and authentication methods

  Hello

  I got 5.2 ACS, Cisco 4507 switches and AD domain environment.
  Planning on running only computer authentication and no authentication of users.
  I have the following device types:

  1. Windows XP SP3 and higher on the AD domain
  2 devices with installed with third-party applicants because they are not natively
  support 802.1 x.

  If I don't know the type of device 2 and don't take into account that the type of device 1, I am able to simply configure
  802. 1 x for machine-based authentication against AD, without having to use a
  certificates at all?

  Device type 2 account, since the devices are not on the field and I did not
  want to manually enter the details in the TAS, can I use the certificate for authentication?

  Thank you

  Hello

  > Using PEAP wouldn't I need certificate installed on GBA? Or it may work without any certificate at all.

  [YEARS] Yes, you still need to certificate the GBA but it can be a self-signed certificate that you can do in 2 clicks on GBA itself. machines of OC client, you have to make sure you have the supplicant configured to not 'Validate server certificate"so that you don't have any other complication with CERT.

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  > I thought for devices that not on the field, to load the certificate on the computer.

  If I had to have two devices of type 1 and 2, would it be possible to have domain authentication devices using the machine against the AD authentication and the field not devices authenticated using the certificate installed on each device?

  [YEARS] Yes, you can. No peripheral field could be authenticated simply by trusting to the CA that issued the certificate to the device. Imagine that you have this 'JEDI' certification of the unit. You can configure the ACS to validate authentications by trusted CA "JEDI". If a device tries to connect, it will send the certificate, the ACS simply checks the certificate authority that issued the certificate and if it is approved, it will accept authentication.

  In this scenario, you will need to use a method of methods that uses client certificates for authneitcation such as EAP - TLS.

  HTH,
  Tiago

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• restore the configuration of the cisco ACS 1121 ver 5.2 to SNS 3425 ver 5.6

  Dear all,

  We currently have Cisco ACS 1121 ver 5.2 in our production, then we will replace it with the new devices using SNS 3425 ver 5.6.

  Please good to want to help someone can tell you how to restore all the old configuration of devices (ACS 1121 ver 5.2) for the new Member States?

  Best regards

  Yudibagam

  Hello! You must upgrade the current device to a min of v5.4 for restoration work and be supported.

  http://www.Cisco.com/c/en/us/TD/docs/net_mgmt/cisco_secure_access_control_system/5-6/release/notes/acs_56_rn.html

  However, if you're going to go through the upgrade problems then I would say that you upgrade all the way to 5.6 just to be sure :)

  I hope this helps!

  Thank you for evaluating useful messages!

• Version of Cisco ACS 1121 5.3 - logging

  Hello

  I am new to Cisco ACS 5.X. What I've read, the Cisco ACS can act as a logging server. Does this mean, all messages from syslog to all other network and ACS devices can be stored by ACS? I'm a little confused on that part.

  Finally, I understand that Cisco ACS has many or perhaps 2 instances? When we use these instance? What is this instance?

  Kind regards

  RAM

  In the deployment, you must specify an acs as the Logcollector server. All other servers send the logs to the Logcollecter.

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_sys...

  In a distributed deployment, each acs server is an instance. If you have a main instance and multiple secondary instances.

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_sys...

  Sent by Cisco Support technique iPad App

• [Cisco ACS] Memory usage limit

  Hello

  We have 2 CSACS 1121 with Cisco ACS 5.2.0.26.10

  The main server manages authentication 20000 + per day.

  Its memory usage is growing every day.

  It's now 83%

  Is there a limit?

  What happens when memory use reaches this limit?

  What can we do to purge the memory usage? (reboot, restarting the service...)

  Thanks for your help

  Patrick

  Check the secondary collector newspaper. This will help to balance the load between the two nodes and you will see the memory usage decreases.

  Thank you