Another ACS group

Similar Questions

• ACS group mapping

  Hello

  We use ACS4.2 to authenticate network administrators to access the switches and routers. ACS is integrated with Windows Active Directory.

  If we map groups of ads to groups of the ACS and we specify the access restriction in the ACS groups.

  now, we want to use the ACS to authenticate wireless users. Wireless use their AD accounts.

  so I think that we should create a new internal group GBA and map AD mobile users to this group. using the Radius attributes, we can put these users in one vlan individual.

  But what happens if a network administrator will access the wireless network? It will use the AD account that belongs to two groups: group admin network and wireless.

  then ACS will do in this case? she contributes the first group or the second, or maybe both?

  Network administrators can access the wireless network? If so, that you need not additional servers. Do you use national plans of action on GBA?

• Authentication of Windows with ACS groups

  I try to authentication of connection configuration on all of our Cisco switches. I created a group of AD Windows called NetworkAdmins and the correct users added to this group. Inside of the CSA, I did a group mapping and mapped my ACS group called NetworkAdmins to my group NetworkAdmins of Windows.

  I have set up my Cisco 3750 with the following commands for authentication.

  AAA new-model

  AAA authentication login NetworkAdmins group Ganymede + local

  AAA authorization exec NetworkAdmins group Ganymede + local

  AAA accounting update newinfo

  AAA accounting exec default start-stop Ganymede group.

  AAA accounting update newinfo

  AAA accounting exec default start-stop Ganymede group.

  AAA - the id of the joint session

  Authentication works, but it authenticates from any user, not just for users in the NetworkAdmins group. How can I tell the switch to authenticate only on the NetworkAdmins group?

  Thanks for the help!

  ACS, under your group settings to configure NAR to allow clients of the AAA. Under the default group GBA configure NAR to refuse all AAA clients (or necessary).

  Hope that helps.

• Cisco Secure ACS groups 5.1 Active Directory and RSA Authentication Manager 7.1 for profiles

  / * Style definitions * / table. MsoNormalTable {mso-style-name: "Table Normal" "; mso-knew-rowband-size: 0; mso-knew-colband-size: 0; mso-style - noshow:yes; mso-style-priority: 99; mso-style - qformat:yes; mso-style-parent:" ";" mso-padding-alt: 0 cm 0 cm 5.4pt 5.4pt; mso-para-margin: 0 cm; mso-para-margin-bottom: .0001pt; mso-pagination: widow-orphan; font-size: 11.0pt; font family: 'Calibri', 'sans-serif"; mso-ascii-font-family: Calibri; mso-ascii-theme-make: minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-make: minor-fareast; mso-hansi-font-family: Calibri; mso-hansi-theme-make: minor-latin ;}"}

  Hello

  I'm deploying an ACS connected to an RSA AuthManager (that is connected to an Active Directory domain)

  I create several groups within the Active Directory server, I try to give to users for their groups different access rights.

  I tried to define an access policy "NetOp/NetAdm" and two authorization rules:

  Rule-1 AD - AD1:ExternalGroups contains all dir. INTRA/groups/NETOP 'Auth for net operators' 0

  Rule 2 AD - AD1:ExternalGroups contains all dir. INTRA/groups/NETADM 'Auth net admin' 0

  Default: refuse

  In the identity, I have configured the RSA identity source, so that users get authenticated by the RSA Authentication Manager.

  But I still refuse to get access, RSA authentication is successful, but the group membership, active directory does not work, even with the unix attributes or group principal defined for the user.

  My question is this valid configuration scenario? Is there another way to define several profiles according to the Group of users of external source?

  The stages of monitoring:

  Measures

  Request for access received RADIUS 11001

  11017 RADIUS creates a new session

  Assess Service selection strategy

  15004 Matched rule

  Access to Selected 15012 - NetOp/NetAdm service policy

  Evaluate the politics of identity

  15004 Matched rule

  15013 selected identity Store - server RSA

  24500 Authenticating user on the server's RSA SecurID.

  24501 a session is established with the server's RSA SecurID.

  24506 check successful operation code

  24505 user authentication succeeded.

  24553 user record has been cached

  24502 with RSA SecurID Server session is closed

  Authentication 22037 spent

  22023 proceed to the recovery of the attribute

  24628 user cache not enabled in the configuration of the RADIUS identity token store.

  Identity sequence 22016 completed an iteration of the IDStores

  Evaluate the strategy of group mapping

  15006 set default mapping rule

  Authorization of emergency policy assessment

  15042 no rule has been balanced

  Evaluation of authorization policy

  15006 set default mapping rule

  15016 selected the authorization - DenyAccess profile

  15039 selected authorization profile is DenyAccess

  11003 returned RADIUS Access-Reject

  Thank you

  Christophe

  I think you need to do is to create a sequence of identity with RSA as a selection in

  Authentication and recovery research list of attributes and AD in the additional attribute list recovery research. Then select this sequence as a result of the politics of identity for the service

• Changing names of ACS group

  I work at a customer site that is running a fairly recent version of ACS.  They have a few old group under network names that they want to change than their more valid descriptions.  Is it possible to change the names of ACS network device group?  How do you change just "group names".

  Thank you

  Kevin

  Hey Kevin,

  It seems that you may have about ACS 4.x. IF this is the case, then Yes, we can change the name NDG.

  Editing a group of network devices

  To change a NDG, you must first access the NDG. To do this, click the name of the NDG in the table of groups of network devices. Click change properties at the bottom of the page.

  To change the individual aaa client we remove and it readd.

  Kind regards

  ~ JG

  Note the useful messages

• User in several Windows/ACS group. Deny a permit

  I have several groups on ACS each tied to a group of AD windows.

  I have a VPN concentrator and a wireless Lan controller.

  I use ACS to authenticate access to the time, but I would like some VPN users have wireless users too, not all.

  If I use NAR to limit the "VPN users" to access WLC device all users with access to the VPN is not wireless, even those who are in the wireless group.

  Is - it there anyway to operate?

  This is how it works.

  Lets say you have three different groups on ad for NetworkAdmin, RouterAdmin,.

  Wireless.

  Go to the external user database == database group mappings == Windows NT/2000 == select the field

  to which you log == Add mapping.

  Select the ad NetworkAdmin group and ciscosecure Group 1 card select the ad RouterAdmin group and map it to ciscosecure Group 2

  Select the ad wireless Group and map it to ciscosecure Group 3

  Mappings of working groups in the order in which they are defined, first set up mapping is

  considered first and then second, third and so on. If a user is in AD Group NetworkAdmin and

  which is mapped to the ACS 1 group and it's the first configured mapping is

  First of ALL (if there is a user in the Group NetworkAdmin, it is always mapped to ciscosecure

  1 and NO further mappings for this user group is enabled and the user is authenticated or

  rejected)

  Scenario: If you have a user called cisco, group NetworkAdmin, cisco1 in RouterAdmin

  Group and cisco2 wireless. They will be always dynamically mapped to group 1, 2 ACS

  and 3 respectively as above mappings.

  You can see the mappings on authentication passed to users as to which group are

  they are mapped to.

  SCENARIO:

  Now if you want a NetworkAdmin user to authenticate to the NetworkAdmin devices and not

  devices or wireless RouterAdmin you should apply NARs for Group 1 because

  NetworkAdmin users connect to this group. Which will allow you access on the Group

  basis for a particular NetworkAdmin NDG or NetworkAdmin individual NAS device.

  NOTE:

  If you are applying NARs for VPN or wireless devices, you must configure two IP

  Base AND CLI/DNIS founded together as NARs were originally designed for cisco IOS for

  routers and switches.

  IMPORTANT: If a user authenticates successfully to the database AD once, his user name is cached on the database of ACS (NOT password) the only way to remove the previously cached user name is to go to usersetup find this user and manually remove it.

  ACS will not support the following configuration:

  * A user active directory which is a member of the 3 AD groups (groups A, B and C) * 3 people

  groups are mapped within FAC as follows-> A Group1, Group2-> B and group 3-> C.

  * The user is in the 3 groups, however it will be always authenticated by Group 1 because

  This is the first group, it appears in, even if there is a configured NAR summons

  the group-specific AAA clients.

  However there are if your maps are below order...

  Groups NT groups ACS

  A, B, C ===> Group 1

  A ===> group 2

  B ===> group 3

  C ===> Group 4.

  You can create a rule DIFFERENT for users a, B, C by configuring the NARS in Group1.

  This rule applies for use ONLY if it is present in ALL three groups (A, B and C).

  You can create a rule for users in Group A (Group 2)

  You can create a rule for users in Group B (Group 3)

  You can create a rule for users in Group C (Group 4)

  Here I am also attaching links related to the group mapping in the user guide:

  Order of group mapping:

  http://www.Cisco.com/univercd/CC/TD/doc/product/access/acs_soft/csacs4nt/acs33/user/QG.htm

  #wp940485

  Kind regards

  ~ JG

  Note the useful messages

• How to change the filter to the filter by another column - group calendar page 1

  Any version of the Summit either 4.2 or 5.0 - windows 7 OS

  I know it's a very simple question, but I can't understand this.

  I want to change the filter on the group calendar page 1 of the default "Event status" below

  

  The only code that I find is shown below.

  

  I added my own selection list of the button with the following code bar

  < tt > Select GroupName, group_id from EBA_CA_EMAIL_GROUPS ORDER BY GroupName < /tt >

  But when I change the selection list from one option to the other that the calendar is not sorted by events that have particular GroupName. I tried to replace the code in the default selection list and it did not work. There must be another code, check the filter.

  How can I add my own list of selection and filter calendar events based on that select list option is selected?

  Richie V wrote:

  Any version of the Summit either 4.2 or 5.0 - windows 7 OS

  I know it's a very simple question, but I can't understand this.

  I want to change the filter on the group calendar page 1 of the default "Event status" below

  I added my own selection list of the button with the following code bar

  Select GroupName, group_id from EBA_CA_EMAIL_GROUPS ORDER BY GroupName

  But when I change the selection list from one option to the other that the calendar is not sorted by events that have particular GroupName.

  Probably you meant 'filtered' rather than 'sort '?

  I tried to replace the code in the default selection list and it did not work. There must be another code, check the filter.

  In the Group APEX 5.0 calendar application, the filter is implemented in line 20 of the schedule area source query:

  select e.event_id,
        case when et.display_color is not null then
              'apex-cal-'||
              (select lower(cp.color_name) from eba_ca_color_prefs cp where cp.bg_color = et.display_color)
        end css_class,
        e.event_name,
        case when e.display_time = 'N'
              then trunc(e.event_date_time)
              else e.event_date_time
              end event_date_time,
        to_char(e.event_date_time,v('APP_TIME_FORMAT')) disp_time,
        substr (
        case when to_char(e.event_date_time,'MI') = '00' then
              ltrim(to_char(e.event_date_time,'HHam'),'0')
          else
              ltrim(to_char(e.event_date_time,'HH:MIam'),'0')
          end|| ' '||e.event_name,1,255) disp_col
    from EBA_ca_events e,
        EBA_ca_event_types et
  where (:P1_EVENT_TYPE = e.type_id or :P1_EVENT_TYPE is null)
    and e.type_id = et.type_id (+)
  

  with P1_EVENT_TYPE being included in the property of the region and by using the action Elements of the Page to send dynamic update schedule to trigger a refresh of partial page in the calendar area.

  How can I add my own list of selection and filter calendar events based on that select list option is selected?

  1 create your filter as a copy the item P1_EVENT_TYPE item.

  2. replace the LOV definition by the code you need.

  3. Add the necessary filter predicate in the WHERE clause of the query source region.

  4. Add the name of your filter element to the region of the Items property of the Page to send.

  5. Add the name of your item to the Items property in the when section of action Dynamics to update the calendar .

• ASM Migrage disk to another cluster group

  Hi all

  I have an Oracle Cluster with 2 knots in our DC env. We use ASM and have a disk group named EAM DC-DATA. This disk group is external redundancy and was created from 1 LUN named DC-DATA-LUNS

  I have an another Oracle Cluster with 2 knots in our DR env and I use the replication technology from storage to replicate DATA - DC LUN-LUN DC to DR with name DR-DATA-LUNS

  So my question is:

  When I stop the replication of storage, I can mount LUN DR-DATA-LUNS to the cluster in the Dr and mount the Group ASM to Dr. cluster disks?

  There should be no problem to clone (LUN) storage media for use in another system or ASM instance. ASM retains information about disk groups in the headers of storage media. ASM on the other instance will recognize the headers and so identify the disks and open groups of disks.

• Networking of 4 computers together; Special access from 1 computer to one 5th in another working group.

  Hey everyone, I had a question on networks linked to the sharing of files and folders in XP.  I have 4 Professional computers on the same network.  Desktop of the CEO needs access to a 5th computer connected to the same router/switch, but on a different working group. I want to keep computer Chief Executive Officer, connected to the main network, but also have access to files and folders on the computer of 5th.  Is there a way to do this?  If yes how can I to do?  His small business, but he needs to access certain files and programs on both networks.

  If I understand correctly, you want only the head of the it Department to access the 5th computer.  If the 5th computer has Windows XP Professional, you can disable simple file sharing.  Then, only a user with an account on the computer 5 will be able to access.  Ron Lowe and I wrote a web page with all the details: Windows XP Professional file sharing .

  Boulder computer Maven
  Most Microsoft Valuable Professional

• clicking a LinkID I want to update another setting Group zo Layout Panel

  Hello
  
  I want to refresh a component located on the same jsf page by clicking linkID component in another fragment of how do

  Hello

  linkID component

  Is it a component command?, then I have this component's actionListener method find the UiComponent (CMP to update) in the tree of components and add it as a partial target

  FacesContext vFacesContext = FacesContext.getCurrentInstance();
            UIViewRoot vUIViewRoot = vFacesContext.getViewRoot();
            UIComponent vTheInputFileComponent = vUIViewRoot.findComponent("theInputFileId");
                                  AdfFacesContext.getCurrentInstance().addPartialTarget(vTheInputFileComponent);
  

  Kind regards

• Transfer data to another disk group

  Version: 10 gr 2
  Platform: Sun OS 5.10
  
  We have a database of CARS 2 knots with 4 terabyte of shared storage. Current size of the DB is only 1 TB stored in Diskgroup DATA1.
  Can I create a new disk group and move all of the data in DATA1 (1 to) to the newly created disk group?
  
  If this is not possible in 10 gr 2, is it possible in GR 11, 2?

  Hi Pete,.

  Can I create a new disk group and move all of the data in DATA1 (1 to) to the newly created disk group?

  I think the best way to do this is:

  When you add new disks in the same diskgroup, and then remove the old drives.
  ASM perform the automatic migration of data to new disks without having to create a new diskgroup, whitout donwtime. (on 10g you can do)

  If you need to rename the diskgroup in Oracle 11 g R2 you can do.

  If this is not possible in 10 gr 2, is it possible in GR 11, 2?

  Yes... its possible. (if you can migrate partial data)

  http://www.idevelopment.info/data/Oracle/DBA_tips/Automatic_Storage_Management/ASM_36.shtml

  Kind regards
  Levi Pereira
  Please close your message when you get the solution to your problem.
  
  Check the answers answer 'useful' or 'right' answer which will help others with the same problem.
  
  Thank you for doing your part to make this community as valuable as possible for everyone!
  

• ACS - external replication for DB Group mappings

  We have two engines Solution ACS (4.0), which essentially act as primary and secondary AAA servers. Is there a way to replicate the external database from an ACS group maps to another? The replication is currently copy the internal primary to our secondary server ACS group successfully, but we still create the external database group mapping on both primary and secondary devices. It's kind of tediuos, and I'm afraid that someone can configure the mapping on the primary and don't forget to set up on the secondary. Any help is appreciated.

  Thanks in advance.

  Try to reproduce the network access profiles. I recall that includes pretty much everything!

  Mounira

• ACS 4.2 Wired and wireless group mapping

  Hello

  User1 connects to the switch, it belongs to the Group AD Domain_user and are mapped to ACS Group1 wich send the radius attribute to change the VLAN, this part works fine.

  My problem is when the same user connects with its wifi card... He is still part of the domain_user and get still mapped to group1 on acs but now, RADIUS values are bad for the wireless.

  Wired production vlan = 20

  Prod wireless vlan = 120

  What I want to do, it is something like:

  ADGroupX Connect_type plus ACS Group1

  ADGroupX + Connect_type2 = ACS group2

  I tried to use the connection profile but the group mapping are not performed at this level. Ditto for NAR, my user must be able to log user wired or wireless and get the right vlan not get restricted by the NAR.

  Another way would be to set up a username/password wireless on the internal database and add it to the ACS group good but which involve password management and not all client 802 support auth password (without user intervention)

  Any idea?

  Hi... this scenario is exactly what network access profiles are designed to address. Essentially, NAP to create a complete configuration based on network service.

  So default ACS is a unique system of NAP (well I guess that 2 If you include RADIUS, and GANYMEDE) where any network service all RADIUS users would assume to use a single device type. NAP allows you to configure a service, the authentication, the mappings of groups and permissions Protocol.

  The first part of the PAN you have to differentiate requests for authentication for each network service. This could be as easy to use the ip address of the AAA Client or NDG. If this is not possible, you can start looking at the attributes in the RADIUS request to find the attribute values that are unique to the switch or wlan.

  Assuming you have managed to do is a matter of implementation of authenticattion and authorization policies-, but the main thing is that you will be able to send any returns RADIUS attributes to the device for the same user.

  The user interface can take a little usual, then read the docs online and stick to it!

  www.extraxi.com for all your reports ACS needs

• ACS 4.1 engine lists NT but not the NT users groups

  Hello

  I have the following problem. I can access using remote agent Win NT ad groups but the GBA engine does not list users in groups after ACS group mapping. What could be the problem?

  AD runs on Win 2 K sp4.

  Hello

  ACS does not list the user in the groups until you do 1st authentication with this user.

  Then ACS will list the user as a user "mapped Dynamics" in this group.

  Concerning

  Rohit Chopra

• In an another (trusted) domain bij Agent ACS ACS authentication

  Hello

  I had two areas. Domain A is the top level domain. B is the child domain of the domain A.

  The ACS Agents are installed on two domain controllers in domain A.

  Authentication of clients in domain A is ok.

  Authentication of clients in domain B is a problem.

  I created a universal group in the field. In this universal group, I put a global group of users from the domain b. authentication not ok.

  The ACS "Journal of authentication failed": SAIS: "external DB account Restriction".

  What is the problem here?

  Gr.

  Remco

  Check if users are not mapped to a group of people with disabilities. Do not map several windows for ACS group groups. The following link can help you

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.0/user/guide/QG.html