Authorization vs. authentication?

Similar Questions

• Authorization without authentication

  Hello

  From Java code, is it possible to query Weblogic LDAP users/groups without requiring a password?  I use an application Java with Weblogic 12.1.2 configured to point to an external LDAP server.  From a java client, I would use the Windows user name, and the query LDAP to view the groups to which the user is in.  It seems that this is possible by using SessionContext.getCallerPrincipal () but I always get 'Anonymous', I think just because the user has not been authenticated.  Is there a way to get information from a user/group LDAP using the Weblogic Server Java without an authenticated user?

  Thanks for any information!

  It is not possible to make an authorization without authentication of the user first.

  In the case of Kerberos, it uses authentication that is already at the computer level (when you connect to the system).

  So I think that Kerberos is the only option.

• AS5300 - authorization without authentication

  Hello

  I would like to send requests for aaa authorization to an external Radius server.

  However, it seems that an authentication step is required before processing the authorization.

  When I use "none" authentication on a line configuration (see below), the AS5300 is not even send any request to the radius server. The authorization immediately process a situation of FAILURE...

  AAA new-model

  LOGINTTY AAA authentication login no
  radius of group AAA authorization exec LOGINTTY
  AAA - the id of the joint session

  line 1 120

  authentication of the connection LOGINTTY

  exec authorization LOGINTTY

  But if I set up a step of authentication (local, or ray or line...), then permission is properly treated after the success of the authentication.

  Is it not possible to configure aaa authorization without be requested a name of user and password on AS5300?

  Thank you for your help.

  Concerning

  RM

  Hello

  Authentication is an essential step prior to authorization.

  Ray has no separate process for authentication and authorization. It's all part of the same package.

  Authentication is therefore essential for authorization to occur.

  hope that helps.

  Kind regards

  Anisha

  P.S.: Please mark this thread as answered if you feel that the complaint is resolved. Note the useful messages.

• Authorization and authentication external Weblogic Portal

  In our project we use Weblogic portal 10.3 and Oracle 11 g as a backend. During the creation of the field, I specified Oracle as backend. All schemas relevant portals are created in the Oracle database. For our application, we created a specific schema. In a specific scheme of project, we have the table user containing fields like username, password, e-mail, and other relevant areas. How to configure in weblogic to access this table for authentication instead of the user portal schema table? As well as I need to know, in a console of Directors if a new user is created, and then details will be stored in a table schema portal or a project schema user table? In the end, I want to configure specific project table to store the information of the user when the user created through the administrative console.
  
  It's urgent.

  Hi Renon
  Basically, you need to authenticator custom to store and authenticate all your users to your own specific Tables DB (with information from the user). For this you need to develop custom authenticator. Please note that this has nothing to do with the portal. It's core weblogic security stuff. I have compiled a few links for you. Incase if Oracle Support, open a ticket with them have Oracle support work entirely custom authenticator sample of RDBMS that stores and authenticates users of specific set of custom tables. They will send you immediately. I hope that someone in these forums can have this example also in their personal blogs/forums.

  And, Yes, you can force your custom authenticator to be one by default and to store users when you create new users in the administration Console. Essentially, when you create new users, you should see the option as to create users in what way authentication provider.

  http://download.Oracle.com/docs/CD/E12840_01/WLS/docs103/dvspisec/ATN.html (authentication providers)

  http://download.Oracle.com/docs/CD/E12840_01/WLS/docs103/dvspisec/ATN.html#wp1145342 (do you need to develop a custom authentication provider?)

  http://download.Oracle.com/docs/CD/E12840_01/WLS/docs103/dvspisec/ATN.html#wp1089150 (how to develop a custom authentication provider)

  http://download.Oracle.com/docs/CD/E12840_01/WLS/docs103/secmanage/ATN.html#wp1204261 (by changing the order of authentication providers)

  Thank you
  Ravi Jegga

• Authorization and authentication ADF

  Hello world
  
  I have a request for the adf, including the following files:
  
  MyLogin.html that is my login page (post to j_security_check) and two jsf pages.
  
  /Secure1/Secure1.JSPX
  / secure2/secure2. JSPX
  
  I have configured the adf security and created two users, user1 and user2, application roles two, aRole1 and aRole2 and two roles of enterprice, eRole1 and eRole2.
  
  I configured policies the adf for two pages, which gives a read access to /secure1/Secure1.jspx to aRole1 and /secure2/Secure2.jspx to aRole2.
  
  When I run the application and try to access Secure1.jspx, I get redirected to the login page. When I try the User1 credentials, am poster page, and that's fine.
  
  However, if I try to access the page Secure1.jspx with the credentials of user 2, I get error 401. Also when I try to provide the weblogic user credentials, yet once I get 401.
  
  How can I capture and customize the 401 error?
  
  Thank you
  Antonis

  Antonis,

  Have you tried to put code like this in your web.xml file?

  
  401
  /error.jsp
  
  

  John

• Authorization and authentication in FLEX

  To what extent is it possible to feed my webservice call with a user name and password for the back-end system?
  
  I tried the bot the SetCredentials and SetRemoteCredentials on my webservice object, but somehow flex ignores.
  
  Any idea?

  Hello
  I don't know if this can help, in your case, but in my webservice is used ws security username and password Im sending in header:

  var qname:QName = new QName (wsseNamespace, 'Security');
  var header: SOAPHeader = new SOAPHeader (qname, {object with username and password});
  myWebService.addHeader (header);

  LK

• MAB Cisco phones successfully authenticated, VLANASSIGN assigned and failed authorization?

  I'm getting a strange behavior with a Catalyst switch and 802. 1 x. I use multi-auth, with a PC and phone Cisco patched in. The two devices to authenticate correctly, but only the PC is allowed depending on the switch logs.

  Switch terminal logs:

  Apr  7 09:27:37.836 EDT: %AUTHMGR-5-START: Starting 'mab' for client (001b.d585.205e) on Interface Fa0/1 AuditSessionID 0A0A050E000003B93EBE2E09Apr  7 09:27:37.945 EDT: %MAB-5-SUCCESS: Authentication successful for client (001b.d585.205e) on Interface Fa0/1 AuditSessionID 0A0A050E000003B93EBE2E09Apr  7 09:27:37.945 EDT: %AUTHMGR-5-VLANASSIGN: VLAN 100 assigned to Interface Fa0/1 AuditSessionID UnassignedApr  7 09:27:37.970 EDT: %AUTHMGR-5-FAIL: Authorization failed for client (001b.d585.205e) on Interface Fa0/1 AuditSessionID 0A0A050E000003B93EBE2E09Apr  7 09:27:39.295 EDT: %AUTHMGR-5-START: Starting 'dot1x' for client (0015.c547.7069) on Interface Fa0/1 AuditSessionID 0A0A050E000003BA3EBE5082Apr  7 09:27:43.775 EDT: %DOT1X-5-SUCCESS: Authentication successful for client (0015.c547.7069) on Interface Fa0/1 AuditSessionID Apr  7 09:27:43.783 EDT: %AUTHMGR-5-VLANASSIGN: VLAN 212 assigned to Interface Fa0/1 AuditSessionID 0A0A050E000003BA3EBE5082Apr  7 09:27:45.570 EDT: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0015.c547.7069) on Interface Fa0/1 AuditSessionID 0A0A050E000003BA3EBE5082

  Config switch:

  aaa authentication dot1x default group RADIUS-DOT1Xaaa authorization network default group radius ip radius source-interface Loopback0 radius-server vsa send accountingradius-server vsa send authenticationdot1x system-auth-controldot1x guest-vlan supplicant

  Configuration interface:

  interface FastEthernet0/1 switchport mode access srr-queue bandwidth share 10 10 60 20 priority-queue out  authentication event fail action next-method authentication event server dead action authorize voice authentication event no-response action authorize vlan 999 authentication host-mode multi-auth authentication order dot1x mab authentication port-control auto authentication periodic authentication violation protect mab mls qos trust cos auto qos voip trust  dot1x pae authenticator no mdix auto spanning-tree portfast

  NPS Windows Server policy:

  radius_attributes.PNG

  

  
  and
  
  

  vendor_specific_attributes.PNG

  

  Hello Jim,

  Try to use the domain host instead of multi-auth mode multiplayer.

  Kind regards

  Poonam Garg

• The AAA authorization

  Im trying to configure the authentication of AAA using username privililege password 15 xxxx xxxxx. I would like to make sure he users with the privilege level 15 go straight to activate the mode, and users with level 1 prvilege will go directly to the router > read-only. Currently the conly orders I typed are user name

  xxx xxxx privilege 15 password

  AAA new-model

  Do I need to configure anything else. I tried to put the privilege under int vty level but then all users mode privilege. I want to only use AAA I don't want to set up a server radius or teacs to have3. Thanks in advance.

  To use privilege levels, you need to set the authorization and authentication. The following should do the trick for you:

  username cisco password 0 privilege 15 glenn

  username fred privilege 1 0 password cisco

  !

  AAA new-model

  AAA authentication login default local

  AAA authorization exec default local

  Now if I connect:

  > telnet 10.66.79.100

  User access audit

  Username: glenn

  Password:

  Router #sho priv

  Current privilege level is 15

  Router #q

  >

  >

  > telnet 10.66.79.100

  User access audit

  User name: fred

  Password:

  Router > sho priv

  Current privilege level is 1

  Router > q

• ISE IOS CLI authentication Quandry

  Im trying to push the limits of the ISE, as Ganymede + is not yet supported. The goal is to authenticate the switches and routers using RADIUS against ISE. I think I'm on the right track, since I can connect against ISE. However, when I login to activate the journal of ISE permissions shows lack of status of RADIUS, with an attempt failed to use $enabl15$.

  I have my unit added to ISE. An authorization profile has been created for each privilege level, I use strategy games and have the correct authz and the autht policies. Some examples of my configuration of ISE and configuration of the router. I hope that helps to solve my problem, or it can help the next troll successfully their own configuration.

  Profile of AUTH: When you choose priv-lvl = 15 after hitting save, web auth is automatically selected.

  

  Strategy game:

  policyset.PNG

  

  the router configuration

  RADIUS AAA server group Rad_AUTH1
  name of the server Rad_Auth
  !
  local authentication AAA CONSOLE connection
  AAA authentication login Rad_Auth group local Rad_AUTH1 no
  Group AAA authentication enable default Rad_AUTH1 allow none
  default AAA authorization exec no
  Group AAA authorization exec Rad_Auth if authenticated Rad_AUTH1
  start-stop radius group AAA accounting exec by default
  !

  Server RADIUS Rad_Auth
  ipv4 x.x.x.x address auth-1645 acct-port of 1646
  timeout 3
  touch 7 052F302B3B7E491B41

  line vty 0 4
  session-timeout 30
  exec-timeout 30 0
  exec authorization Rad_Auth
  authentication of the connection Rad_Auth
  entry ssh transport

  Glad that you got your own problem solved! Also, thank you for taking the time to come back and post the solution here! (+ 5 from me).

  Given that the problem is resolved you must mark the thread as "answered" :)

• Some General Questions about the externalization of authentication

  We plane to outsource the APEX authentication so that it would be linked to the credentials of the end-user network. Were do because:
  
  It is more in line with the expectations of the users.
  It will simplify maintenance by the user.
  When the user leaves the ice, their APEX access will be automatically disbanded as their network connections are disabled.
  
  We found some very good articles on the subject, for example http://www.greenit.li/greenIT/Willkommen_files/Oracle_APEX_ProofOfConceptNTLMPLSQL.pdf (other suggestions would be welcomed and encouraged). However; We have a few questions:
  
  The first is authentication and authorization. We get how end users can be authenticated based on Active Directory. However, within the APEX now, create us a new user and specify if who are developers, who, team development Application Builder, SQL workshop, they can access. schemas are accessible to them, etc. This page requires, of course, a password.
  
  How will this work if the authentication is outsourced? We always create the same user in the APEX?
  If so, what should we put the password related areas?
  If this is not the case, how do we control authorization once authentication completed successfully?
  If not, how to make the application available for users (authenticated network) and not others?
  If the application allows the user to pass a password (assuming that they are properly connected to the network), what should happen when a person clicks on logout?
  
  Thank you for any input,
  
  -Joe

  Joe Upshaw wrote:

  One of the elements of game here (great requirements above) is to make sure that the APEX applications are directly linked in the cycle of creation/decommissioning of the user of the organization. In other words, the desire is that deleting or disabling a user account in the central directory (Active Directory) have the effect of disabling access to all enterprise systems. We do not expect to allow some "heavy" end users the ability to access the SQL browser. Is there something that can be done, perhaps with the authorisation schemes, which would allow their access is automatically revoked if it network id have been revoked? Can authorisation schemes be applied to the APEX development pages maybe?

  Laughing out loud

  The only thing that comes to mind is running a scheduled task on your databases which retrieves users APEX in the APEX_WORKSPACE_APEX_USERS view, checks the user account is still valid in AD using dbms_ldap (assuming that the user IDS match, or there is a convention to get from one to the other) and removes , expires or to block those who are not using the APEX API. The problem which is the

  To perform this procedure, the current user must have administrator privileges in the workspace.

  restriction to the user of apex_util API. Comply with the scheduled job will have to Re: create a session programmatically (that is to say, outside the APEX)., who is skating on or above the line about the API without papers/not taken in charge. This may be frowned upon by the great above and Oracle. (However, in this case it is less of a concern that the use of such methods in your APEX applications, which certainly, I would not recommend.)

• Authentication after the homepage

  I want my request to have a homepage that is accessible to the public which will display the information of the database read-only, but authorized users will need access to a login page to update the database. What I can tell, this is not an option. I either have to first make the connection of users, or the entire application is public. Am I missing something?

  You can view 1 Page with read-only permission scheme information - no. Page set no authorization required
  Authentication: Page is Public
  Add button that performs a redirection without submitting the page and set the target to Page 101/Login Page
  Make the following pages all the 2,3,4, container: do not be Public user

  Then edit page 101. During processing of the Page change the anonymous PL/SQL connection block:
  Change the flow of the page (P_FLOW_PAGE) to a specific page after login. In this example, change it from 1 to 2:

  (wwv_flow_custom_auth_std). Login
  P_UNAME =>: P101_USERNAME,
  P_PASSWORD =>: P101_PASSWORD,
  P_SESSION_ID-online v ('APP_SESSION'),
  P_FLOW_PAGE =>: APP_ID | » : 2'
  );

• Implementation of VPN

  Hi all

  Two years ago I had (finally) updated vpn in place, but I had to nuke the configuration later (for a long time to remember why).

  My configuration:

  Accelerator edge of Cisco ASA 5505 (revision 0 x 0)

  Base license.

  Cisco Adaptive Security Appliance Software Version 8.4 (2)
  Version 6.4 Device Manager (5)

  I created a DMZ and an indoor and outdoor area.

  All servers are Linux servers without a head.

  (I recently had to re - create the servers because of a damaged drive).

  So Setup is as follows:

  A main linux server also works as virtualbox host.

  A dmz-www-server and a server-ftp-dmz.

  I'll add a server linux for git and a few others.

  My first goal is to be able to reach the primary server with SSH. Second, to reach other servers on the network.

  I also want to use the cisco vpn client open source Linux and cisco VPN client which I also use to connect to other customers.

  Here is my current setup:

  interface Ethernet0/0
  switchport access vlan 2
  Speed 100
  full duplex
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5

  switchport access vlan 300
  Speed 100
  full duplex
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  DHCP IP address
  !
  interface Vlan300
  prior to interface Vlan1
  nameif dmz
  security-level 50
  IP 192.168.2.1 255.255.255.0
  !

  passive FTP mode
  clock timezone THATS 1
  clock to summer time recurring CEDT
  DNS lookup field inside
  DNS domain-lookup outside
  DNS domain-lookup dmz
  DNS server-group DefaultDNS
  name-server 192.168.1.8
  Server name 193.75.75.75
  Server name 193.75.75.193
  Name-Server 8.8.8.8
  domain name to inside - sport.no
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  the object to the Interior-net network
  subnet 192.168.1.0 255.255.255.0
  network dmz webserver object
  Home 192.168.2.100
  Web server host object description
  network dmz-ftpserver object
  Home 192.168.2.101
  Description purpose of FTP server host

  network of the DMZ.net object
  Subnet 192.168.2.0 255.255.255.0
  Service FTP object
  tcp source eq ftp service
  service object WWW
  tcp source eq www service
  outside_access_in list extended access permit tcp any host 192.168.2.101 eq ftp
  outside_access_in list extended access permit tcp any host 192.168.2.100 eq www
  inside_access_dmz list extended access permit tcp any object DMZ.net 1 65535 range
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 dmz
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  NAT (dmz, external) source service interface static Web WWW WWW server dmz
  NAT (dmz, external) source service interface static dmz-ftpserver FTP FTP
  !
  network obj_any object
  NAT dynamic interface (indoor, outdoor)
  the object to the Interior-net network

  NAT dynamic interface (indoor, outdoor)
  network of the DMZ.net object
  NAT (dmz, outside) dynamic interface
  Access-group outside_access_in in interface outside
  Access-group inside_access_dmz in dmz interface
  Route outside 0.0.0.0 0.0.0.0 173.194.32.34 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  the ssh LOCAL console AAA authentication
  AAA authentication enable LOCAL console
  AAA authentication http LOCAL console
  LOCAL AAA authorization command
  AAA authorization exec-authentication server
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ca trustpoint _SmartCallHome_ServerCA
  Configure CRL
  Crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
  308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
  010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
  30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
  13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
  0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
  20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
  65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
  65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
  30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
  30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
  496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
  74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
  68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
  302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
  63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
  010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
  a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
  9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
  7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

  15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
  1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
  18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
  4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
  81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
  082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
  7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
  ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
  45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
  2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
  1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
  03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
  69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
  02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
  6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
  c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
  69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
  1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
  445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
  1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
  2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
  4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
  b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
  99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018

  481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
  b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
  5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
  6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
  6c2527b9 deb78458 c61f381e a4c4cb66
  quit smoking
  Telnet timeout 5
  SSH 192.168.1.0 255.255.255.0 inside
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH timeout 30
  Console timeout 0
  management-access inside

  dhcpd dns 192.168.1.1 193.75.75.75
  dhcpd inner - sport.no
  dhcpd outside auto_config
  !
  dhcpd address 192.168.1.20 - 192.168.1.49 inside
  dhcpd dns 192.168.1.1 interface inside
  dhcpd sport.no area inside - inside interface
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection

  no statistical threat detection tcp-interception
  WebVPN
  Bernard of encrypted foooo privilege 15 password username
  th baaar of encrypted privilege 15 password username
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny

  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  anonymous reporting remote call
  Cryptochecksum:88cf7ca3aa1aa19ec0418f557cc0fedf

  If you are looking for just a remote access VPN configuration, you could do something like the following just change the names and IP addresses as needed:

  local IP 10.10.10.1 VPNPOOL pool - 10.10.10.10

  IKEv1 crypto policy 5
  preshared authentication
  aes encryption
  sha hash
  Group 5

  Crypto ipsec transform-set ikev1 VPNSET aes - esp esp-sha-hmac

  Dynamic crypto map DYNMAP 65535 ikev1 set transform-set VPNSET
  Dynamic crypto map DYNMAP reverse-route value 65535
  card crypto VPNMAP 65535-isakmp dynamic ipsec DYNMAP
  VPNMAP interface card crypto outside

  Crypto ikev1 allow outside

  tunnel-group VPNGROUP type remote access
  IPSec-attributes tunnel-group VPNGROUP
  IKEv1 pre-shared key PASSWORD

  management-access inside

  --

  Please do not forget to select a correct answer and rate useful posts

• ASA - 1 > en password: *, stuck at this point

  Hello

  I'm stuck at this point, pls advise, 9.x, OS

  ASA - 1 > sh curpriv
  Username: admin1
  Current privilege level: 1
  Current Mode/s: P_UNPR
  ASA - 1 > en
  Password: *---> > the enable password is cisco, but does not work
  Password:

  Here is the config

  Console to enable AAA authentication LOCAL ACS
  Console Telnet AAA authentication LOCAL ACS
  authentication AAA ssh console LOCAL ACS
  ACS LOCAL console for AAA of http authentication
  AAA accounting command privilege 15 ACS
  AAA accounting enable ACS console
  AAA accounting ssh console ACS
  Console telnet AAA accounting ACS
  AAA authorization exec-authentication server

  enable password cisco

  Thank you all

  Hi Ibrahim.

  It seems that your enable password is configured to be extracted from ACS server.
  Console to enable AAA authentication LOCAL ACS

  Please check on ACS or reset your password. If you have access to the consoles and remove the command and test.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• Unable to switch to the privilege level using password set using ACS enable

  Hi all

  I am not able to not be able to visit the privilege level to help enable password set using ACS 1121 (5.4.0.46).

  Please find details of the ASA-

  ASA5580-20
  version of the software - 9.1

  LAB - FW / see the law # run | I have aaa
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + (inside) host 192.168.x.x
  GANYMEDE + LOCAL console for AAA of http authentication
  Console telnet authentication GANYMEDE + LOCAL AAA
  AAA authentication enable console LOCAL + GANYMEDE
  authentication AAA ssh console GANYMEDE + LOCAL
  Console telnet accounting AAA GANYMEDE +.
  AAA accounting console GANYMEDE + ssh
  AAA accounting enable console GANYMEDE +.
  No vpn-addr-assign aaa

  I created the Shell profile so & given privilege 15 it.please find wink 1 similarly in word doc attached

  However, when I try to create the service profile I get the error message, please find snap 2 in word doc attached.

  Kindly share your expertise.

  Hello Dominic,.

  For authorization privileges to take effect, you must add the following command to your configuration on the ASA:

  AAA authorization exec-authentication server

  After adding it, the ASA will take into account the level of privilege that are sent by the ACS.

  Associated with the error you are getting on the graphical interface of the ACS, please make sure that you are using a browser supported for ACS 5.4 version based on the release notes:

  http://www.Cisco.com/c/en/us/TD/docs/net_mgmt/cisco_secure_access_contro...

  Note: Please mark it as answered as appropriate.

• Integration of ASA with ACS

  Hi all

  I try to incorporate some ASA (8,6) with ACS (5,7), here is the configuration of the SAA.

  SH run | in aaa
  RADIUS Protocol RADIUS AAA server
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + (management) host 10.243.14.24
  GANYMEDE + LOCAL console for AAA of http authentication
  authentication AAA ssh console GANYMEDE + LOCAL
  Console telnet authentication GANYMEDE + LOCAL AAA
  AAA accounting console GANYMEDE + ssh
  AAA accounting command 15 GANYMEDE privilege +.
  Console telnet accounting AAA GANYMEDE +.
  AAA authorization exec-authentication server
  AAA authorization GANYMEDE + loCAL command

  The problem is that I can get connected to ASA, but I can't type all commands in the CLI, I get the error message "failure of command approval.

  I have the same sets of commands and the shell profiles created for switches and it works perfectly.

  This is the behavior of ACS journals

  1. once I am having authenticated, I can see the logs in ACS with my username
  2 but when I type any commnds, is put down my permission and I see in the newspapers of the authorization of the CSA that this username is "enable_15".

  Can someone help me identify what the problem is

  Thank you
  Reverchon

  This happens when we have control permission enabled on ASA and try to run any command level 15 on SAA. To correct this problem you must check enable authentication of a user against GBA / GANYMEDE.

  AAA authentication enable console LOCAL + GANYMEDE

  After above listed licensing order, ASA will start to check the enable password against ACS/Ganymede and you use Ganymede activate the password that we can put on by user.

  ~ Jousset