ACS server replication request

Similar Questions

• An error occurred while renewing interface wireless network connection: unable to contact your DHCP server. Request a expires.

  I use an Acer Asspire One with Windows XP. We have wireless through AT & T Uverse. The netbook has an Atheros AR5007EG Ethernet card.

  A number of things have taken place lately: I had not used the Acer for some time and the battery was dead and would not recharge. I could book until when it was plugged, but could not get on the Internet. I found online that the solution to the battery problem was to download a new bios that worked wonderfully and it is now loaded. Recently, our AT & T router died and was replaced. I put the new WEP keys in two other computers, and they connect to the Internet. I can't connect to the Internet with the Acer. I tried ipconfig / renew and get the error message: "an error occurred during renewal of the wireless network connection interface: unable to contact your DHCP server.» Request a expires. No operation can be performed on Local area connection while it has its media disconnected. "On the tab"Choose a wireless network", it shows my network and said"absorbing the network address"but nothing happens. When I do ipconfig I see that there is no IP address.
  I took the computer to Starbucks this morning, ran ipconfig / renew and she acquired the IP address and I was able to connect to the Internet. I brought the computer home and tried and failed to connect. The IP address is back to 0.0.0.0 and the error message appears when I try to renew it.
  I hesitate to make a lot of changes since it was working with a different network.
  Original title: IP address is missing
  These forums are wonderful. I tell myself that I've saved the cost of a new battery using the bios, I found on a forum!

  Hello

  DHCP - Dynamic Host Configuration Protocol is a protocol used by devices computer network (DHCP clients) that dynamically distributes the IP address of the destination host. Now the error indicates that your computer is not able to communicate with the server and assign the IP address.

  Method 1:

  Let us try to disable the firewall and check the issue.

  Note: Re-enable the firewall after checking the issue.

  Check whether the problem is resolved.

  Method 2:

  If the issue is not resolved, you can follow the steps from the link provided and check if that helps.

  How to reset the Protocol Internet (TCP/IP)

  http://support.Microsoft.com/kb/299357

  Hope this helps and let us know if you need more assistance.

• HTTP on ACS server

  Hello

  I installed a Cisco ACS server. I am able to use the "remote desktop" to http to the server, however, what can I do if I wanted http in the application of GBA directly?

  Rgds

  Hello

  http://: 2002

  HTH

  PJD

• SSH after ACS server "locked up" and had to be reconfigured is no longer works.

  Hello

  I have a VPN tunnel between an ASA5520, and a Cisco 891.

  I had the 891 configured with the following text:

  AAA server Ganymede group + VTY
  Ganymede IP source-interface Loopback0
  !
  AAA server Ganymede group + GANYMEDE-ACS
  Server 10.8.x.x
  Server 10.16.y.x
  !
  AAA authentication login CONSOLE none
  Connection authentication AAA VTY Ganymede + local group
  VTY AAA authorization exec group Ganymede + local
  AAA authorization commands VTY 0 group Ganymede +.
  AAA authorization commands 15 VTY Ganymede group.
  orders accounting AAA 15 VTY arrhythmic group Ganymede +.
  orders accounting AAA 15 CONSOLE arrhythmic group Ganymede +.

  !

  Ganymede IP source-interface Loopback0

  !

  RADIUS-server host 10.8.x.x touches yadayadayadayada 7
  RADIUS-server host 10.16.y.x touches yadayadayadayada 7
  RADIUS-server application made

  !

  line vty 0 4
  access-class 1
  authorization of VTY 15 orders
  exec authorization VTY
  accounting orders 15 VTY
  VTY login authentication
  entry ssh transport
  line vty 5 15
  access-class 1
  authorization of VTY 15 orders
  exec authorization VTY
  accounting orders 15 VTY
  VTY login authentication
  entry ssh transport

  I can't access device remotely. I'm sure it has to do with the ACS server, but don't know where to look.

  Any help would be greatly appreciated.

  Hello

  When you say you cannot remote access device you are not able to ssh to the device or there is no rechablity itself?

  Is ssh is the problem while you get a login prompt? Error message? Also have you checked ACS has no newspapers for all messages?

  Concerning

  Najaf

• PuTTY and password change issue ACS server

  When a new user is created with the checkbox 'Must change the password at the next logon' checked, ACS does not allow the user to change the password.  The password prompt displays a message access denied. Could someone point me in the right direction to solve this problem?

  I created a new account on cisco ACS server and check the box "user must change password at the next logon". I then used ssh to test the newly created using PuTTY user account. When I ssh to the cisco devices [switch or router] password prompt appears and ask me to type the new password. Once I did this I get a message access denied.

  It worked well with secure CRT. But users do not have secure CRT, they are supposed to use PuTTY. Users can connect in devices using PuTTY. The problem is that when we try to change the password.

  ACS Version: ACS 4.0

  Thank you

  Nachi

  When a user connects in SSH to the system and uses an expired password GANYMEDE, he is prompted to change their password. However, this password change does not work correctly.

  To resolve this problem, you must have the SSH v2 with "Keyboard interactive" authentication for SSH v2 game. Cisco bug ID CSCin91851 addresses this problem.

  Symptom:

  When you use the router as a ssh server is authenticating with a normal SDI/RADIUS, work of authentication backend. However, neither the new BUGS mode or mode next token dialogues completes successfully.

  Conditions:

  Problem only occurs in mode again PIN or next token dialogue mode.
  Specific SSHv2

  Workaround solution:

  Use telnet for authentication or to define vty lines to authenticate against RADIUS
  (non - SDI) server instead.

  Other Description of the problem:

  Not all ssh clients are supported the dialogue for the new PIN mode or next token to work.

• Enable AAA fails on the second ACS server

  I have 2 servers Windows 2003 4.2 ACS, who authenticate with AD. I have configured authentication GANYMEDE + both for my PIX 515 running version 7.24. GANYMEDE + authentication works fine on both. However, when I use the 'aaa authentication enable console LOCAL ProsperAdminAuth', the enable password only works with the first ACS server. When the first server is unavailable, it fails on the second ACS server and authentication failed on ACS "ACS invalid password" reports. It does not allow the LOCAL password. I checked all the password and there is no problem there. I know that for you, because GANYMEDE auth works. Someone at - he seen elsewhere issue or know what I might try?

  Thank you

  Vivek

  Hello

  Configuration of external database is not replicated between servers ACS so my guess here that is on your ACS secondary if you go to the external-> unknown user policy user databases, you will find that under configure enable password behavior you are on "internal data" instead of "The database which the user profile is required."

  -Jesse

• Design of ACS server question 4.2 - role - based is a limit?

  Currently, I've implemented this ACS server.

  An ACS group maps to a group of active live in AD. For example, the Group ACS router_access maps to AD group called $f (gbr) raccess. If the user tries to connect to a router and it has this group in its profile AD, that it will be accepted and if not rejected.

  If for example, I want to revoke, allow access to some features I use NARS (for example accept connections from devices switch and router).

  It works - but this apparently isn't the way I do things.

  The best way is to have a group of ads by device group.

  EG for access to the router, you must $g (t) of group routers in your AD profile

  To get access to switch the Group $g (t) must spend in your AD profile

  Now, we hit the problem - the EC will use the first group in your AD profile to apply for pass/fail.

  Let as well as John has $g routers and switch (t) $g (t) group in its AD profile. When he tries to connect to a switch, the ACS attempts to use routers $g (t) because it's the first ACS AD Group in his profile. Subsequently, it fails, which means that ACS will not look through several AD strategies.

  I hope this makes sense.

  Anyway, I can't get it to work because it keeps failing!

  Hi Will,

  This is a limitation of how ACS 4.x performs operations. It defines everything based on your local user group on ACS as opposed to your ad groups - so the mapping of the group comes first and then everything else comes later.

  If you use Radius (this does not apply to the GANYMEDE) you may be able to use the network access profile feature to substitute some access. If for example you can tell if the user is in the local group, but authentication comes from a certain type of device, you can transmit different attributes. However, in terms of blocking, it is always based on the local group you are a member. He can do some additional checking of LDAP group, but I don't know if that will solve your problem.

  Is 5.x ACS to a new level - the entire platform is built as the network access profiles - so you can make rules as granular as you want - that is to say: If you are in a specific ad group (do not need to map - we can draw external groups) and it is a router then go down a permission set with a Pass. If it is a different ad group (or a different device type), then send a failure.

  Thank you

  Nate

• AAA / adding additional ACS server

  Hello guys,.

  You need to install AAA proposed plan as attaché. We used the current configuration for a very long time for our facilities and data centre devices. Now we want to add a more updated ACS apart from the existing two and need to point out all the data center on the new ACS server devices.

  Is it possible to set up groups of many materials and separate ACS server for defined groups? If possible please let me know the commands, and if not, please let me know the two ways.

  Hope you could understand my needs and the current configuration. PFA...

  Thanks in advance!

  Best regards

  Anurag.K

  Hi Anurag,

  You can add the new ACS/Ganymede server and have this server in the upper part of the sequence.

  10.16.2.10 RADIUS server host

  10.16.2.8 RADIUS server host

  10.16.2.9 RADIUS server host

  GANYMEDE server key xxxxx

  If you really want to create a separate group for the new ACS/Ganymede server then you must have under configuration shown.

  AAA server Ganymede group + Group1

  Server 10.16.2.8

  Server 10.16.2.9

  AAA server Ganymede group + group2

  Server 10.16.2.10

  AAA authentication login default group GROUP1 GROUP2 line

  I want to knoiw if you have doubts.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• local user name and password if the ACS server fails

  Hello

  I have every router and switch configuration for authentication of the connection via the ACS server.  I used these 12 lines below and it works very well.  Each engineer has their own account.

  AAA new-model
  AAA of default login authentication group Ganymede + activate
  the AAA authentication enable default group Ganymede + activate
  AAA authorization exec default authenticated if
  AAA authorization commands 15 default group Ganymede + authenticated if
  AAA accounting exec default start-stop Ganymede group.
  orders accounting AAA 15 by default start-stop Ganymede group.
  Default connection accounting AAA power Ganymede group.
  AAA - the id of the joint session

  RADIUS-server host x.x.x.x
  RADIUS-server application made
  radius-server key, regardless of

  ----------------------------------------------

  I would add to this a local username and password so that if the ACS server was offline engineers have yet to connect with a knowledge of username and default password

  username privilege 15 secret mypassword MYUSERNAME

  line vty 0 4
  local connection

  Q. How do I make ACS a first preference and connection server only local users username and password if the ACS server is down?

  Kind regards

  Kevin

  Now you have the password to enable as the fall back method:

  AAA of default login authentication group Ganymede + activate

  Change 'enable' for 'local' and the local (to the router) database of user names and passwords is used.

  The same works to activate authentication (the second line "authentication, aaa... ("in the config that you posted).

• Configuring the ACS server on windows server

  Hello

  I started to prepare my CCNA security and tried to configure AAA using ACS 4.2 on windows server 2003.

  I have configured the router to use the AAA authentication with the laboratory of cbtnuggets from ACS server.

  I checked the accessibility of the ACS server to client router and vice versa and also configuration.

  The problem is I'm not able to authenticate using ACS server, the router uses local authentication and I have no why the router communicates not eith ACS server.

  Help PLZ.

  Configuration of my router from AAA.

  ===============================================

  AAA new-model
  !
  !
  AAA authentication login default group Ganymede + local
  exact AAA authentication login group Ganymede + local
  AAA authorization exec default local

  RADIUS-server host 192.168.1.25 single-connection key ciscoacs--> (192.168.1.25 ACS, the key configured on the ACS server server is also ciscoacs)

  line vty 0 4
  exact connection authentication

  ================================================

  I created a user on ACS server and I believe that when I'm trying to telnet to the router I should use the user name and password configured on the ACS server.

  When I try to use, authentication fails, and also if the router accepts locallly configured user details then I think there was no communication between the router and the other GANYMEDE ACS server + will be used for authentication and if no communication between the router and acs server then only it should be the responsibility of local user

  Please help me.

  reports and activity--> passed authentication

  reports and activity--> failed attempts

  Rating of useful answers is more useful to say "thank you".

• ACS server not availble

  PIX 525 configured for authentication Ganymede + for telnet, ssh etc. access Pix... If Cisco ACS server is not available I can use the Local user database as I do in the world of router. I saw no reference to this

  failback AAA was introduced in the 6.3 (4) BONE of PIX. This isn't something I've tried, but this excerpt from a discussion earlier can help you

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1dd60f3e/0#selected_message

  See you soon

• Whence the ACS server get the DNS Info for the IP pools?

  I'm changing the DNS servers that my VPN users are assigned from the pools of IP on the ACS server. Where IP pools Gets the DNS server information. I changed the IP addresses of the DNS on windows server and rebooted. But VPN clients are always assigned the old DNS servers.

  ACS ip pools do not grow the DNS server information

  It is either transmitted from the setup of group for the VPN concentrator or

  It is to be send to the setup of the user/group ACS > attributes Radius (VPN 3000) > [026/3076/005] primary DNS.

  I hope this helps.

  Concerning

  Rohit

• Help! Could not resolve the address of the server: the requested name is valid, but no data of the requested type was found.

  Hello

  So I started with a Horizon view, so I apologize if this is a noob question. I wanted to try to put a security server in our DMZ, but before I put it in the DMZ I wanted to test whether customers would be on our network. So here's my setup:

  Overview of VMware View Administrator 5.3.2 generation-188719

  Same version for security server.

  Windows Firewall is activated 'On' on all profiles on security and the server connection. (this might be important later)

  Laptop with Horizon installed Client, Version 3.2.0 build-2331566

  IPad Air2 with Horizon Client Version 3.2.0 build-2331566

  On the Administrator display > display Configuration > Security servers > change on the Security Server

  I PCoIP Secure Gateway set to the IP address of the Security Server (say its 192.168.1.10:4172)

  Connection servers > edit on the login server

  I also have the Security server defined as PCoIP Secure Gateway (192.168.1.10:4172)

  Yet once I wanted to test it before I put it in the DMZ

  So when I connect with the iPad, it works fine, I can connect, see all my connections and connect to just fine.

  On the laptop, when I try to connect, I get the login screen where I put my user name and password (correctly, I might add ) and when I try and I get a connection error.

  "Error: could not resolve the address of the server: the requested name is valid, but no data of the requested type was found."

  I found the article KB VMware goes around the question: KB 2085365 (without help)

  I changed the Secure Gateway on both safety and the connection to the server at each IP I can think of, but it still does not work.

  Can someone give me an idea what can be wrong?

  What is my firewall to connect to the server? (I don't remember if I had turned on firewalls when I installed the login server while they could not properly configured summer when I install?)

  Any help would be amazing!

  Thanks for reading!

  I found the problem, it turns out that the network port to the Security server has been set for public and not private in the firewall. Thanks for the help!

• Cisco ACS server

  Hello

  I currently have a Cisco ACS 3.3 Server. I want to upgrade the server to the latest version and cluster with one another so that we can have a redundant infrastructure because if one fails it also includes...

  Can provide you a solution for this?

  Thank you

  Hello

  The latest version is 4.1 ACS. You can upgrade 3.3.3 build 11 directly to 4.1.

  Then, you can install an another ACS 4.1 on a different machine and replication configuration between these two. In this way, you will need to make changes to only one that ACS and the secondary will be automatically updated.

  Once these two are defined, you can set both of these servers as a server Radius/Ganymede on devices and there will be a redundancy.

  Kind regards

  Vivek

• ACS server installation issues

  I have a client of the remote site that is replacing their ACS servers and several questions:

  (1) what version we should be installed?

  (2) where we can get a clean binary installer (or do you start with 3.x or 4.0 & upgrade-if upgrade, use us the latest hotfix installer, or do we apply successive patches?)

  (3) replication between versions? Current servers have version 4.1 (1) build 23 Patch 5-do these need to be upgraded to the current version, or can move us later & replicate current?

  (4) is it possible to use different DNS (ex rtpacs.corpnet2.com) name for the site of 'real' server name (e.g. us2sawn00232.us1auth.xxxx.com)?

  (5) how to use GSK signed cert? Have previously tried & failed - something special here?

  Thanks for any help you can give.

  RO

  
  I have a remote site customer that is in the process of replacing their ACS servers,and have several questions:
  1) What version should we be installing?
  2) Where can we get a clean binary installer (or do we have to start with 3.x or 4.0 & upgrade-if upgrade, can we use latest patch installer, or do we have   to apply successive patches?)
  3) Cross-version replication? Current servers have Release 4.1(1) Build 23 Patch 5-do these need to be upgraded to current version, or can we install latest & replicate from current?
  4) Is it possible to use different DNS name (ex rtpacs.corpnet2.com) for website than server's 'real' name (ex. us2sawn00232.us1auth.xxxx.com)?
  5) How to use GSK-signed cert? Have tried previously & failed-anything special here?
  Thanks for any help you can give.
  RO
  

  Hi Richard,

  For your queries for replication ACS should be the same version, only then you can replicate between the ACS patner, if you have the same version, so your first and third query got the answer.

  For your fourth query, you can use the DNS server to host your web servers as when the user access the traffic of your web site will land in your DNS server where it will redirect to the origin server so that the DNS server should be authority server for your Web site.

  For a binary installation clear I would say check out this link http://openacs.org/forums/message-view?message_id=1245671 I hope this helps.

  So useful note valauable post.

  Concerning

  Ganesh.H