ACS - LDAP or AD

Similar Questions

• NEED EXAMPLE AD INTEGRATION CONFIGURATION ON ACS 3.3, 5.3

  Hello

  Please give example of associated RADIUS in Windows server 2003 Active directory configuration.

  The same way need step by step configuration AD GBA.

  Please help on this. I searched a lot but do not receive the correct docs who say these two things.

  I need to configure end users (without thread or L3 device)--> ACS--> LDAP for authentication

  Kind regards

  Santana

  Before you integrate ACS 5.x to the announcement, make sure that the time zone, Date & time on the ACS matches that on the AD PDC. Also, set the DNS on the ACS server to be able to resolve the domain name of the ACS 5.x. complete these steps to configure ACS Application Deployment Engine (ADE-OS) 5.x:

  Please follow the link for step by step configurations below because it is not possible to paste here complete as follows:

  http://www.Cisco.com/en/us/products/ps9911/products_configuration_example09186a0080bc6506.shtml

• ACS 4.1 LDAP server is NOT accessible.

  Hello

  We have ACS 4.1 running. Everything seems to be (and is) works very well. But when I want to add a mapping of LDAP group I get message saying of error 'LDAP server is NOT accessible. Please check the configuration. The ldap authentications are working well, I can't add a groupmapping. Where should I start to troubleshoot?

  Regards Marco

  Marco,

  1 have we not many groups in an LDAP or AD structure?
  2 what is your Admin DN also right to query database?

  ACS authentication with a generic LDAP user database

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UsrDb.html#wp354562

  Setting up a generic LDAP external user database

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UsrDb.html#wp354805

  Also, if please download the softerra LDAP browser to fetch the correct information and configure accordingle.

  http://www.ldapbrowser.com/download.htm

  HTH

  JK

  The rate of useful messages-

• ACS with ldap Unix

  Hi, I'm in a project security information, and I think ACS software integration with ldap hosts in Unix machine: Samba

  his works?

  Is there a trial version of GBA? any version 4.2, 5.1, etc...

  Thank you

  Try this

  ACS 4.2

  http://www.Cisco.com/cgi-bin/software/tablebuild/doftp.pl?ftpfile=Cisco/crypto/3DES/ciscosecure/ACS/win/90-dayeval/eval-ACS-4.2.0.124-SW.zip&app=tablebuild&status=showC2A%3E

  ACS 4.1

  http://www.Cisco.com/cgi-bin/tablebuild.pl/ACS-win-eval

  ACS 5.1

  https://supportforums.Cisco.com/thread/2024417

• Using LDAP on ACS 4.1.1 device

  I want to configure it to use our LDAP server as opposed to separate Windows - ACS agent devices configuration. Is this possible? Is there a document out there that will allow me to do this and don't recommend it update 4.2 group before you configure this?

  Thank you

  Dwane

  Yups, you can keep the RA for registration only and authentication via the LDAP Protocol separately.

  Kind regards

  Prem

  Please rate if this can help!

• ACS 5.2 - authentication user 802. 1 x and MSCHAPv2 using LDAP Source identity

  Hello community,

  I use the ACS 5.2 as the solution of authentication in my network. I configured two situations: access with network access policies and peripheral Administration.

  Currently, I have a few configured devices: 1 ASA (using RADIUS), WLC-5508 (using RADIUS) 1, 1 2960 S (with GANYMEDE +). And I set up an external identity store, using LDAP (I can see and select all groups without problem).

  Everything works fine. My next step was to configure users to use 802. 1 x to authenticate using ACS with my LDAP database.

  Assuming that all configurations are correct on all computers (when I use an internal database works very well), these are the following newspapers/configurations in the ACS:

  

  

  

  

  At this point, we can see the error:

  22043 current identity store does not support the authentication method; He jumps.

  Header 1

  Request for access received RADIUS 11001 11017 RADIUS creates a new session Assess Service selection strategy 15004 Matched rule Access Service - access Police selected 15012 11507 extract EAP-response/identity 12500 prepared EAP-request with EAP - TLS with challenge 11006 returned Challenge RADIUS access Request for access received RADIUS 11001 11018 RADIUS re - use an existing session 12301 extract EAP-response/NAK asking instead to use PEAP 12300 prepared EAP-request with PEAP with challenge 11006 returned Challenge RADIUS access Request for access received RADIUS 11001 11018 RADIUS re - use an existing session 12302 extracted EAP-response containing PEAP challenge-response and accepting as negotiated PEAP 12318 has successfully PEAP version 0 12800 first extract TLS record; TLS handshake has begun. 12805 extracted TLS ClientHello message. 12806 prepared TLS ServerHello message. 12807 prepared the TLS certificate message. 12810 prepared TLS ServerDone message. prepared 12305 EAP-request another challenge PEAP 11006 returned Challenge RADIUS access Request for access received RADIUS 11001 11018 RADIUS re - use an existing session 12304 extract EAP-response containing PEAP stimulus / response 12318 has successfully PEAP version 0 12812 extracted TLS ClientKeyExchange message. 12804 message retrieved over TLS. 12801 prepared TLS ChangeCipherSpec message. 12802 prepared TLS completed message. 12816 TLS handshake succeeded.

  12310 full handshake PEAP completed successfully
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response

  12313 PEAP inner method started

  11521 prepared EAP-request/identity for inner EAP method
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  11522 extract EAP-Response/Identity for EAP method internal
  11806 prepared EAP-internal method call offering EAP-MSCHAP VERSION challenge
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  11808 extracted EAP-response containing EAP - MSCHAP VERSION challenge response to the internal method and accepting of EAP - MSCHAP VERSION such as negotiated

  Evaluate the politics of identity

  15006 set default mapping rule

  15013 selected identity store-

  22043 current identity store does not support the authentication method; He jumps.
  22056 object was not found in the identity of the point of sale.
  22058 advanced option that is configured for a unknown user is used.
  22061 the option 'Refuse' Advanced is set in the case of a request for authentication has failed.
  11815 inner EAP-MSCHAP VERSION authentication failed
  11520 prepared EAP-failure of the inner EAP method
  22028 authentication failed and advanced options are ignored.
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response

  Authentication PEAP 12307 failure

  11504 prepared EAP-failure

  11003 returned RADIUS Access-Reject

  So, what can be the cause? Compatibility with LDAP?

  Plinio,

  Watch this doc,

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/eap_pap_phase.html#wp1014889

  There is a table which indicates that LDAP is not a database compatible with our EAP type (MSCHAP VERSION-2).

  LDAP, you can use with TLS, PEAP-GTC, and EAP-FAST-GTC.

  TLS uses certificates on both sides, suplicant, and server authentication server.

  * GCT if I'm not mistaken is a WBS system to use with the EAP protocol.

  Authentication Protocol EAP compatibility of database user and table B-5

  Identity store	EAP - MD5	EAP-TLS 1	PEAP-EAP-MSCHAPv2	EAP-FAST MSCHAPv2	PEAP-GTC	EAP-FAST-GTC
  ACS	Yes	Yes2	Yes	Yes	Yes	Yes
  Windows AD	NO.	Yes	Yes	Yes	Yes	Yes
  LDAP	NO.	Yes	NO.	NO.	Yes	Yes
  RSA identity store	NO.	NO.	NO.	NO.	Yes	Yes

  Identity of DEPARTMENT store

  NO.

  NO.

  NO.

  NO.

  Yes

  Yes

• ACS 5.2 assignment of authorization with nested groups in LDAP

  I have a Cisco Secure ACS 5.2 on a virtual machine. We use it for administrative access to our equipment Cisco GANYMEDE +. I use LDAP to authenticate with acitive directory. I currently run when a user is directly in the group that is assigned.  I change the way in which assign us group permissions and have created nested groups.

  For example:

  -User1 is a member of group1

  g -roup1 is a member of the "Group 2".

  I have card group2 to have access to my devices. However, User1 is not get mapped to the Group of law and access is denied.

  When I go to the monitoring, reporting and authentication GANYMEDE + details, under other attributes where it shows the outside groups the user is a member, I don't see group2, only group1.

  However when User1 is a member of group2 directly, the user is able to log on.

  GBA 5.2 not does support permissions allow this how to use nested groups?

  Mapping of nested groups is not supported by LDAP (because users containing that attribute memberOf groups just above them, are not nested). It is a behavior deafult when we use nested with LDAP groups. You must add subgroups for GBA and both respective authorization rules.

  Kind regards

  Jousset

  The rate of useful messages-

• ACS Ganymede + via generic ldap to AD

  Hello

  I have configured ACS to use ldap generic access to active directory via radius. It was very, very easy.

  How can I configure the same via Ganymede +? Is it possible to use generic ldap to AD via Ganymede +?

  Tnax for help

  BB

  In this case, try and set up a generic LDAP external user database, as you have no doubt already:

  http://www.Cisco.com/univercd/CC/TD/doc/product/access/acs_soft/csacs4nt/acs41/user/usrdb.htm#wp491718

  and configure the unknown user policy Option to check in this database.

  As long as you do not NAPs Ganymede should work.

  http://www.Cisco.com/univercd/CC/TD/doc/product/access/acs_soft/csacs4nt/acs41/user/unknusr.htm

• ACS 4.2 RSA Authentication and LDAP group mapping

  Hello

  I have a firewall, PaloAlto, with overall protection enabled (SSL - VPN) feature

  I use Cisco Secure ACS as a proxy for the RSA SecurID authentication.

  After authentication is try to map ad through LDAP query groups.

  The question I've found, is that the user I get with user authentication has no field:

  Show user ip-user-mapping all | mbm60380 game

  10.240.1.24 vsys1 UIA 2388 2388 domain\mbm60380

  10.240.1.1 vsys1 UIA 2101 2101 domain\mbm60380

  10.240.250.1 mbm60380 2590859 2590859 vsys2 GP

  But the list of users that I receive from the LDAP query includes the domain prefix:

  See the user group name domain\group1 property

  short name: domain\group1

  [1] domain\aag60368

  [2] domain\ced61081

  [3] domain\jas61669

  [4] domain\mbm60380

  [5] domain\pmc61693

  [6] domain\vcm60984

  I would like to create the user with the area of GBA but it must delete the domain before querying the RSA server, as it does not support field stripping.

  I tried to fix this on the Palo Alto firewall without success.

  I'm trying to run Cisco Secure ACS 4.2 changing, but it did not work either:

  RSA servers are configured as an external database.  They are not defined in the groups of network devices.

  Can I set up domain stripping for queries servers RSA?

  Thank you

  Hello

  I think it should work, but it is a bit awkward:

  Create an entry in the Distribution of Proxy in the Network Configuration.

  DOMAIN\\USER *.

  Prefix

  Before returning to the AAA server, from there to authenticate to the server RSA without the domain prefix.

  Make sense?

  Thank you

  Chris

• ACS 4.1 - LDAP integration

  We want to use ACS as raduis server and use it to authenticate the VPN users

  Remote access VPN user--->---> ACS v4.1---> LDAP ASA5510

  ASA is already configured for the VPN, I'm a newbie with ACS. Can someone explain how to configure ACS as radius server and integrate it with LDAP.

  When a user enters his user name and password, the SAA should send that ACS and ACS should compare to LDAP.

  Thank you

  How to configure ASA to Radius configuration and VPN authentication

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00808c18ff.shtml#CLI

  How to configure the ASA on ACS as a radius client:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00808c18ff.shtml#ACS

  Check the authentication Test between ASA and ACS

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00808c18ff.shtml#Veri

  ACS and the LDAP integration database

  

  After that set the host name (such as the LDAP server's IP), Port 389 and Admin username and password.

  Kind regards

  Jousset

  The rate of useful messages-

• ACS 5.3 use LDAP. for one SSID and use IS HOST. for a different SSID

  I have 2 SSID on WLCs

  I wish I had 1 point SSID to the radius of the acs using LDAP store and the 2nd point SSID to the radius of the acs using identity store of the host for mac filtering.

  both scenarios are working, but not all.

  If I set the order of the rule I can get an SSID, but then the other fails.

  Authentication failed                                                                                 :

  22056 object was not found in the identity of the point of sale.

  Access matched Service selection rule:	Rule-1
  Comparative political identity rule:	Rule-1
  Some identity stores:	RBLDAP

  Evaluate the politics of identity

  15004 Matched rule

  15013 selected identity store-

  24031 sending request to the primary LDAP server

  24017 Looking up host in LDAP - 04-xx-xx-xx-xx-xx Server

  24009 host not found in the LDAP server

  22056 object was not found in the identity of the point of sale.

  22058 advanced option that is configured for a unknown user is used.

  22061 the option 'Refuse' Advanced is set in the case of a request for authentication has failed.

  11003 returned RADIUS Access-Reject

  If I move the mac add rule before the rule of ldap, but then the ldap authentication fails

  Request for access received RADIUS 11001

  11017 RADIUS creates a new session

  11027 detected host Lookup UseCase (Service-Type = check call (10))

  Assess Service selection strategy

  15004 Matched rule

  Access to Selected 15012 - MAC filter network access service

  Evaluate the politics of identity

  15004 Matched rule

  15013 selected identity Store - internal hosts

  24209 Looking internal host IDStore host - 04-xx-xx-xx-xx-xx

  24211 found internal host IDStore host

  Authentication 22037 spent

  I tried to install the following without result.

  It seems to me that there should be a simple process to do what happens. I thought that if the rule does not match it would be to move on to the next rule etc...

  I might be able to live with the first ldap control and if it does not pass to the db of the local host, but seemingly ineffective.

  https://supportforums.Cisco.com/thread/2133704

  You can create a sequence of identity store so that if the end point is not present in the ldap database, then it can check its database of the local host.

  Or you can create a condition in your selection of service such as if rule called-station-id ends with (AIDS) then you can have it match the rule that uses the appropriate rule pointing to ldap, another rule when called-station-id ends with (ssidB) match the rule that points to the rule that uses the database of the local host.

  Here is the section on the configuration of the sequence of identity store, don't forget to select continue if user not found.

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_sys...

  Thank you

  Sent by Cisco Support technique iPad App

• Announcement for the external database - Secure ACS 5.2 or LDAP

  I'm working on the project with Secure ACS 5.2.  I'm trying to determine the external database appropriate to use.  LDAP or directly to the AD?

  In addition, the field in which I connect to a several subdomains.  All users are currently in the subdomains, but will move to the root domain later.  How do I set up the connection, I have to connect to each subdomain or can I connect just to the root?

  Thank you

  Hello

  If you are using PEAP (mschapv2) [password based authentication] your best bet is to tie ACS to AD, because PEAP-mschapv2 is a hash mechanism that is only supported when you bind to AD, it will not work if you use the ldap integration.

  Your best option is to connect ACS for the root domain, so he can use the transitive trust relationships to find the information in its subdomains.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Impossible to authenticate the user to ACS 5.1 with LDAP as identity outdoor store

  Hi, I have a server and Open-LDAP running ACS on my corporate network.
  Now, I'll set up a new linksys WAP - 54G and select WPA2-Enterprise with ACS as radius server.
  the first thing first, I created new internal user to ACS and trying to join the network wireless from my computer. I did it...

  then I move on an external entity (LDAP server). I set up the sequence of configuration and the LDAP identity, also select the access service.  but when I tried to authenticate from my computer, an error has occurred. I received:
  the following error 22056 object was not found in the store identities applicable (s)

  Ask me ' bout this thing, I implemented a cisco router 1841 to become customer of AAA. and surprise... it works!
  Yes, there is problems to authenticate to the windows of ACS (pointing to LDAP) platform?
  any suggestion?
  Thank you

  Hello

  Looks like you haven't mschap authentication is enabled on the ldap server. You can use eap - gtc instead, but need you:

  1 enable eap - gtc under protocols allowed on your ACS access policy

  2. install an eap - gtc "supplicant" on the windows box - if you have a wireless network card intel, the intel proset client supports eap - gtc

  This could mean a fair bit of work according to the number/type of wireless clients you have - could be useful on the LDAP mschap authentication activation.

  HTH

  Andy

• ACS 5.8: Using AD vs LDAP

  Hello world

  I'm migration between 4.2 and I'm interested to know what are the benefits of joining the field rather than simply perform LDAP queries on a research base.

  (1) it is especially a problem for RADIUS authentication, and not for GANYMEDE +, and if so is it at all useful for deployment GANYMEDE + only?

  (2) is there a significant performance difference, and if yes, then which is the best?

  (3) are there any pitfalls to join the domain rather than using LDAP?

  Thanks for your thoughts!

  HoD,

  We use a performance wise there is not as such difference and decide which database to use depends on the type of authentication. A protocol like mschap is not supported by LDAP snack so you wireless authentication using PEAP, AD Protocol will work.

  Here is the table of compatibility of Protocol,

  http://www.Cisco.com/c/en/us/TD/docs/net_mgmt/cisco_secure_access_contro...

  Kind regards

  ~ JG

  Note the useful messages

• ACS 5.1 - AD authentication LDAP VS

  Any help on this would be great

  I can manage to get my account record in the thinking of Active Directory configuring cisco switch in the external identity stores but not my setup LDAP here are a few successful newspapers, log in and unsuccessful newspaper with ldap.

  AD-SETUP

  Selected identity store - AD1

  Current identity store does not support the authentication method; He jumps.

  GANYMEDE + will use the global configuration GANYMEDE password +.

  Returned GANYMEDE + authentication response

  Received authentication GANYMEDE + CONTINUE application

  Using the previously selected Access Service

  Political identity was assessed before; Sequence identity continues

  Authentication of user in Active Directory

  Recovery of the Active Directory user groups succeeded

  Active Directory user authentication succeeded

  After authentication

  Access policy
  Access service:	Default device Admin
  Identity store:	CDs
  Shell selected profile:	Privilege mode
  Active Directory domain:	Blah.com/results.htm
  Group membership:
  Access matched Service selection rule:	Rule-2
  Comparative political identity rule:	By default
  Some identity stores:	CDs
  Application identity stores:
  The selected application identity stores:
  Mapping of matching rule group strategy:
  Matching rule permission policy:	Rule-1

  The only problem with this configuration is that I can only add the domain blah.com/results.htm example and I get massive latency since the authentication process will over State to other domain instead of the local controllers.

  I can tell by the STATUS of the AAA in track because of dashboard that latency is about 8000ms and the slow, log on to the switch.

  LDAP-SETUP

  In my LDAP configuration I have a primary host name and secondary closer to home to avoid latency I do a test of bind that returns successfully on both hosts. Configure my Orgainzation tab directory and do a test configuration to get a return of the Group > 100 > 100 topic.

  I have reset my indenities to instead of AD LDAP stores and try again, but for some reason that I get 22056 object not found error! I can't just that work on here are the details

  Corresponding rule

  Selected Access Service - Admin default device

  Evaluate the politics of identity

  By default matching rule

  Selected - identity store

  Current identity store does not support the authentication method; He jumps.

  GANYMEDE + will use the global configuration GANYMEDE password +.

  Returned GANYMEDE + authentication response

  Received authentication GANYMEDE + CONTINUE application

  Using the previously selected Access Service

  Political identity was assessed before; Sequence identity continues

  Send the request to the primary LDAP server

  User authentication against the LDAP server

  The user's search ended with an error

  Main server failover. Switching to the secondary server

  Send the request to the secondary LDAP server

  User authentication against the LDAP server

  User not found in the LDAP server

  Object was not found in the identity of the point of sale.

  The advanced option is configured for a unknown user is used.

  The option 'Refuse' Advanced is set in the case of a request for authentication has failed.

  Returned GANYMEDE + authentication response

  Are there ideas, I can try so that it can find my account as the structure of the AD did? ideas please?

  see you soon

  HI Ed,

  Try using a standard LDAP browser (www.ldapbrowser.com ) to view LDAP structure.  Verify base DN used for searches matches
  
  structure.
  
  Regards,
  
  ~JG
  Do rate helpful posts