ACS Ganymede + via generic ldap to AD

Similar Questions

• Department of foreign for GANYMEDE + via ISE - is RSA Secure ID the only option?

  I'm running Cisco Secure ACS to GANYMEDE and other things.  I have to move to another platform due to the requirements of PCI DSS 3.2.

  ISE is the head to replace ACS but I also have a requirement to implement a multifactor authentication (MFA) everywhere.

  2.1 ISE implementation guide says that RSA Secure ID is supported for the Ministry of Foreign Affairs with the GANYMEDE connections.  I did not have RSA Secure ID and probably never have it.

  The implementation guide and my provider Cisco also make the State more general that ISE will work with any solution of Ministry of Foreign Affairs which has a front end compliant RADIUS.  Well, it's because I already have one of these (SafeNet/SafeWord).  What they are not, is if it will work specifically to authenticate the RADIUS authentications.  The only docs I can find on this subject are all/only on ISE do this for the RADIUS clients such as ASA Cisco Anyconnect VPN client handling.

  Someone at - he obtained ISE GANYMEDE to work with the Ministry of Foreign Affairs with anything other than Secure ID? You have any links?

  Click on your name in the upper right to see your profile. Then choose the 'Message' tab and click 'New Message'.

• How to turn off turn on privilege for ACS Ganymede +.

  I have an MSFC with the following configuration.

  AAA new-model

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local

  orders accounting AAA 15 by default start-stop Ganymede group.

  I have an ACS v3.0 under NT.

  I have setup an advanced option of GANYMEDE + in the ACS which can activate the privileges for users. However, the user can still connect to the MSFC and question 'enable the command '.

  Is there a better way on the ACS to refuse a user to run the 'enable' command so that it can not go mode even though it may have the secret password that is located in the MSFC.

  Thank you

  David

  David

  You can make consent orders and refuse this command 'enable '.

  So now the router, you will have:

  AAA authorization commands 0 default local taca group

  The GBA, so that the user, under the authority of command, add the command like enable, deny arguments. '. Make sure you also unlisted arguments have denied.

  Once permission to order had been enabled on the router, each user will be checked for authorization. So for other users, in the GBA box, make sure that you have - unmatched orders Cisco IOS updated allowed and also arguments unlisted allowed nec.

  Make first Chang on GBA and then add the router config.

  Thank you

  Nisha

• ACS 5.3 use LDAP. for one SSID and use IS HOST. for a different SSID

  I have 2 SSID on WLCs

  I wish I had 1 point SSID to the radius of the acs using LDAP store and the 2nd point SSID to the radius of the acs using identity store of the host for mac filtering.

  both scenarios are working, but not all.

  If I set the order of the rule I can get an SSID, but then the other fails.

  Authentication failed                                                                                 :

  22056 object was not found in the identity of the point of sale.

  Access matched Service selection rule:	Rule-1
  Comparative political identity rule:	Rule-1
  Some identity stores:	RBLDAP

  Evaluate the politics of identity

  15004 Matched rule

  15013 selected identity store-

  24031 sending request to the primary LDAP server

  24017 Looking up host in LDAP - 04-xx-xx-xx-xx-xx Server

  24009 host not found in the LDAP server

  22056 object was not found in the identity of the point of sale.

  22058 advanced option that is configured for a unknown user is used.

  22061 the option 'Refuse' Advanced is set in the case of a request for authentication has failed.

  11003 returned RADIUS Access-Reject

  If I move the mac add rule before the rule of ldap, but then the ldap authentication fails

  Request for access received RADIUS 11001

  11017 RADIUS creates a new session

  11027 detected host Lookup UseCase (Service-Type = check call (10))

  Assess Service selection strategy

  15004 Matched rule

  Access to Selected 15012 - MAC filter network access service

  Evaluate the politics of identity

  15004 Matched rule

  15013 selected identity Store - internal hosts

  24209 Looking internal host IDStore host - 04-xx-xx-xx-xx-xx

  24211 found internal host IDStore host

  Authentication 22037 spent

  I tried to install the following without result.

  It seems to me that there should be a simple process to do what happens. I thought that if the rule does not match it would be to move on to the next rule etc...

  I might be able to live with the first ldap control and if it does not pass to the db of the local host, but seemingly ineffective.

  https://supportforums.Cisco.com/thread/2133704

  You can create a sequence of identity store so that if the end point is not present in the ldap database, then it can check its database of the local host.

  Or you can create a condition in your selection of service such as if rule called-station-id ends with (AIDS) then you can have it match the rule that uses the appropriate rule pointing to ldap, another rule when called-station-id ends with (ssidB) match the rule that points to the rule that uses the database of the local host.

  Here is the section on the configuration of the sequence of identity store, don't forget to select continue if user not found.

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_sys...

  Thank you

  Sent by Cisco Support technique iPad App

• Announcement for the external database - Secure ACS 5.2 or LDAP

  I'm working on the project with Secure ACS 5.2.  I'm trying to determine the external database appropriate to use.  LDAP or directly to the AD?

  In addition, the field in which I connect to a several subdomains.  All users are currently in the subdomains, but will move to the root domain later.  How do I set up the connection, I have to connect to each subdomain or can I connect just to the root?

  Thank you

  Hello

  If you are using PEAP (mschapv2) [password based authentication] your best bet is to tie ACS to AD, because PEAP-mschapv2 is a hash mechanism that is only supported when you bind to AD, it will not work if you use the ldap integration.

  Your best option is to connect ACS for the root domain, so he can use the transitive trust relationships to find the information in its subdomains.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Impossible to authenticate the user to ACS 5.1 with LDAP as identity outdoor store

  Hi, I have a server and Open-LDAP running ACS on my corporate network.
  Now, I'll set up a new linksys WAP - 54G and select WPA2-Enterprise with ACS as radius server.
  the first thing first, I created new internal user to ACS and trying to join the network wireless from my computer. I did it...

  then I move on an external entity (LDAP server). I set up the sequence of configuration and the LDAP identity, also select the access service.  but when I tried to authenticate from my computer, an error has occurred. I received:
  the following error 22056 object was not found in the store identities applicable (s)

  Ask me ' bout this thing, I implemented a cisco router 1841 to become customer of AAA. and surprise... it works!
  Yes, there is problems to authenticate to the windows of ACS (pointing to LDAP) platform?
  any suggestion?
  Thank you

  Hello

  Looks like you haven't mschap authentication is enabled on the ldap server. You can use eap - gtc instead, but need you:

  1 enable eap - gtc under protocols allowed on your ACS access policy

  2. install an eap - gtc "supplicant" on the windows box - if you have a wireless network card intel, the intel proset client supports eap - gtc

  This could mean a fair bit of work according to the number/type of wireless clients you have - could be useful on the LDAP mschap authentication activation.

  HTH

  Andy

• The MacBook Pro via generic ethernet adapter connection

  I am using a generic USB adapter to connect my MacBook Pro to Ethernet. It does not work. Any ideas?

  Contact the developer or visit their Web site for a suitable driver for your operating system.

  these things aren't always Plug and play.

• SSH via generic connection?

  I have not been able to get this working.  I choose port 22 and have checked SSH works locally.

  I copy the generic connection link and try the commands such as:

  SSH xlx-1-91092-6667-f84f35aff2df.1-dfw-xlx.cisco-onplus.com:11701

  cisco-l ssh xlx-1-913092-6667-f47f35aff2df.1-dfw-xlx.cisco-onplus.com:11701 ssh

  I get the error back like this:

  SSH: could not resolve hostname xlx-1-91092-6667-f47f53aff2df.1-dfw-xlx.cisco-onplus.com:11701: nodename nor servname provided, or not known

  Telnet on the same device works, but I don't want to telnet enabled for obvious reasons.  All ideas are welcome.

  Thanks in advance,

  Brandon

  Hi Brandon,.

  The standard syntax for ssh to indicate the port is '-p', that is:

  SSH xlx-1-91092-6667-f84f35aff2df.1-dfw-xlx.cisco-onplus.com Pei 11701

  -mike

• Cisco ISE 1.1.2.145 Admin authentication via the LDAP protocol

  I have configured the LDAP protocol and able to retrieve our LDAP directory structure. Now, I'm trying to point authentication "Admin Access" Source 'External identity', which is the new LDAP IS I created. But I couldn't find an option to authenticate locally if for some reason the LDAP configuration does not work. I learned that the ISE can automatically return to local auth as external sources Idenitity are inaccessible. How can I test the LDAP authentication with breaking them our Admin Access? I thought to open two parallel sessions, one with Super Admin account Local and one with the domain account. But I noticed that ISE communication is smart enough for the closing session/connection no matter what other sessions in different browsers so, basically, I can't open two parallel sessions the same machine to test. Suggestions? or am I missing something here?

  Thanks in advance.

  Hi Srinivas,

  Even if you configure LDAP as a source of external identity of admin access, you can always internal relief without having locked. According to the ISE user guide:

  During the operation, Cisco ISE is designed to "fall back" and try to perform the internal identity database authentication, if the communication with the external identity store has not been established, or if it fails. In addition, whenever an administrator for which you have configured external authentication launches a browser and initiates a logon session, the administrator must still the option authentication of demand through the local Cisco ISE database by choosing 'Internal' to the Selector drop-down storage of identity in the Connect dialog box.

  http://www.Cisco.com/en/us/docs/security/ISE/1.1/user_guide/ise_man_identities.html#wp1351543

  Please see the attached screenshot by my lab ISE:

  

  I configured the admin authentication against AD, but I still see both 'Internal' and 'AD' at the time of the connection.

  I hope this helps.

  Thank you

  Aastha

• ACS-GANYMEDE 4.2 to 5.2 upgrade

  Hello everyone, see us run the Services ACS on a stand-alone server from IBM 346 runnig Windows 2008 32-bit server and I would like to 5.2 we have another box of IBM identical spare and would like to if it can be used. Anyone had problems ranging from 4.2 to 5.2 with an intermediate upgrade?

  5.2 is my best bet?

  Thank you!

  5.4 ACS does not support automatic installation of the evaluation license.  Therefore, if you need an evaluation of GBA 5.4 version, then you must get the Cisco.com evaluation license and manually install the ACS 5.4.

  If you don't have a valid contract of SAS with all products of the ACS, you will not be able to download the image ISO of Cisco.com. In this case, you must contact your local partner or cisco representative for the ISO image.

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.4/release/notes/acs_54_rn.html

  Jatin kone
  -Does the rate of useful messages-

• A configuration user ACS - GANYMEDE + activate password

  When a user logs on for the first time that I need to go in the change and configuration of the user the GANYMEDE + activate password of "password separate use" for 'use password database external' - how can I do this by default?

  Once this change has been made, everything works fine but I want this piece to be automatic.

  Thank you very much!

  It is certainly a change that would be useful - which is a group of installation command option that allows global configuration of the enable command to use the same password as external DB password. Unfortunately at the moment, this option is not available.

  Jeff

• ACS 4.1 LDAP server is NOT accessible.

  Hello

  We have ACS 4.1 running. Everything seems to be (and is) works very well. But when I want to add a mapping of LDAP group I get message saying of error 'LDAP server is NOT accessible. Please check the configuration. The ldap authentications are working well, I can't add a groupmapping. Where should I start to troubleshoot?

  Regards Marco

  Marco,

  1 have we not many groups in an LDAP or AD structure?
  2 what is your Admin DN also right to query database?

  ACS authentication with a generic LDAP user database

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UsrDb.html#wp354562

  Setting up a generic LDAP external user database

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UsrDb.html#wp354805

  Also, if please download the softerra LDAP browser to fetch the correct information and configure accordingle.

  http://www.ldapbrowser.com/download.htm

  HTH

  JK

  The rate of useful messages-

• Is it possible to authenticate 2 or more domains Active Directory via acs solution engine v4.2?

  Hello

  Is it possible to authenticate ACS solution engine v4.2 against 2 or more Active Directory domains by using the generic LDAP configuration?  One scenario would be to geographic distribution where 1 area would be for the USA and the other would be an another say country Canada (e.g. US.corp and CA.corp).

  Thank you

  James

  Hi James,

  It is possible to configure multiple servers authentication LDAP, one for each area. I can tell you that it is much more efficient configuration and administration viewpoint experience and end-user to use AD as an external database Microsoft if your installation is actually all in the same namespace for example amer.CompanyName.com and canada.companyname.com.

  To configuration LDAP multiple databases, go to the external user databases > generic LDAP > create a BITTER called, then do the same for CANADA.

  Cordially, Jeremy

• Using LDAP on ACS 4.1.1 device

  I want to configure it to use our LDAP server as opposed to separate Windows - ACS agent devices configuration. Is this possible? Is there a document out there that will allow me to do this and don't recommend it update 4.2 group before you configure this?

  Thank you

  Dwane

  Yups, you can keep the RA for registration only and authentication via the LDAP Protocol separately.

  Kind regards

  Prem

  Please rate if this can help!

• ACS with ldap Unix

  Hi, I'm in a project security information, and I think ACS software integration with ldap hosts in Unix machine: Samba

  his works?

  Is there a trial version of GBA? any version 4.2, 5.1, etc...

  Thank you

  Try this

  ACS 4.2

  http://www.Cisco.com/cgi-bin/software/tablebuild/doftp.pl?ftpfile=Cisco/crypto/3DES/ciscosecure/ACS/win/90-dayeval/eval-ACS-4.2.0.124-SW.zip&app=tablebuild&status=showC2A%3E

  ACS 4.1

  http://www.Cisco.com/cgi-bin/tablebuild.pl/ACS-win-eval

  ACS 5.1

  https://supportforums.Cisco.com/thread/2024417