Cisco ACS 5.1 Machine Auth problem

Similar Questions

• ISE 2.0 domain domain not machines Auth problem

  Hello

  Anyone can suggest me for authorization policy of ISE 2.0 for computer in domain domain & no.

  Requirement: Computer in domain to authenticate domain user id & password using the PEAP Protocol. but the machine not domain should not authenticating using domain credentials begging Windows.

  I tried using the parameter user or computer and selecting the authorization (computers in the domain & domain users) policy

  Thank you

  Kamlesh

  If you make a substitution VLAN on the invited guests? The reason why I ask is because I've never been able to get this feature works well. Instead, I always preferred to use DACLS (Switched invited) and Named-ACL (WLCs).

  If you use this feature I suggest to increase the timers a little and see if it works.

  For your question of license:

  The license of Cisco ISE is counted as follows:

  • A basic or advanced license is consumed based on the function that is used.
  • An endpoint with multiple network connections can consume more than one license per MAC

  address. For example, a laptop computer connected in wired and wireless at the same time. Licenses

  for VPN connections are based on the IP address.

  • Licenses are allocated on the simultaneous, active sessions. An active session is the one for which a

  RADIUS Accounting Start is received but RADIUS Accounting Stop has not yet been received.

  Note Sessions without activity of RADIUS are automatically purged from the list of Session Active each

  5 days or if endpoint is deleted from the system.

  To avoid service interruptions, ISE Cisco continues to provide services to the endpoints that exceed the license

  right. Cisco ISE relies instead on RADIUS accounting functions to keep track of the simultaneous on endpoints

  the network and generate alarms when the endpoint number exceeds the authorized amounts:

  • 80% info
  • 90% WARNING
  • 100% critical

  Thank you for evaluating useful messages!

• Limit of Cisco ACS 4.2 Max Auth/authentication devices.

  Hi guys.

  Can someone tell me how many devices can an ACS works with GANYMEDE 4.2 +?.

  Is there a limit? and if there is, who he is and whence Cisco publishes.

  Has spent a whole morning and without success, reaching for the info.

  Ty in advance.

  Carlos.

  Hello

  I did a search for it and after that I found that GBA 4.2 Solution can support up to 35000 device. Here is the link where I got the information:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5712/ps5338/qa_c67-453393.html

  A Cisco Secure ACS appliance server at least follows the same performance of the scalability of a server based on Windows Cisco Secure ACS. Cisco Secure ACS guidelines and performance analysis show that each ACS server can support anywhere from 20 000 to 80 000 users per server and can evolve to support up to 35 000 devices, according to configuration scenarios, the platform and its use

  In-house but we have also seen that it is recommended to use a 500 by NDG.

  I hope this helps.

  Thank you

  Waris Hussain.

• Problem with certifcate on Cisco ACS

  We want to authenticate our internal wireless users using our Cisco ACS running 5.3.  GBA questions our Active Directory environment for the user name and password provided.  I created a CSR on GBA and it provided to Entrust.  They gave me a root certificate, string and server.  I've linked the server certificate to the CSR under System Administration > Local Server Certificates > local certificates.  I then added the chain and the root certificates to the users of the site and identity stores > autorit├⌐s.  When I try to connect to a laptop client he asks a user name and password, but after entering this information, I am presented with the warning on this certificate below.  This certificate is to Entrust and I see the certificate root in the root store on the laptop.  Any ideas what would cause this.  TAC does not seem to have all the answers.  They say it's a problem of the client machine.

  

  In case you want to check your configuration settings.

  http://www.Cisco.com/en/us/products/ps10315/products_configuration_example09186a0080bd1100.shtml

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• Problem with Cisco ACS and different areas

  Hello

  We are conducting currently a problem with Cisco ACS that we put in place, and I'll try to describe:

  We have ACS related directory AD areas, where we have 2 domains and appropriate group mappings.

  Then we have our Cisco switches with the following configuration,

  AAA new-model

  AAA-authentication failure message ^ CCCC

  Failled to authenticate!

  Please IT networks Contact Group for more information.

  ^ C

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local

  AAA authorization network default group Ganymede + local

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  !

  AAA - the id of the joint session

  But the problem is that with the users in a domain, we can authenticate, but not the other. Basically, the question is that when we check on the past of authentication, two authentications are passage and the display of 'Authentic OK', but on the side of the switch, there is a power failure.

  There may be something wrong with the ACS?

  Thank you

  Jorge

  Try increasing the timeout on IOS device using radius-server timeout 10.

  Do we not have journaling enabled on the ACS server remotely?

  -Philou

• Cisco ACS installation problem

  Hello everyone.
  I have Cisco acs 4.2 on windows 2008 64 bit installation and get a very strange error when installing. V: ismg_israel_acs it gives some encryption error.
  Can someone please help me on this who have encountered the same problem. My project is stopped cause of it.
  Thanks in advance.

  Sent by Cisco Support technique Android app

  Hi Rizwan,

  If you're upgrading some version prerequisites ACS then I think you get something like this V:\ismg_israel_acs\Acs\Crypto\init.cpp

  You need to locate the old CryptoAPI container used by ACS, which may still be on the system.  This is normally located in C:\Documents and Settings\username that installed ACS> \Application\Data\Microsoft\Crypto\RSA.

  There will be one or more files will be very long filenames hexdecimal. You must identify the right one.

  Open a command prompt in that folder and type "findstr /I CiscoSecure *.» ' * ' - the file name that appears should be the

  old container of ACS.

  Let me know if you will be able to search for any file.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• Cisco ACS 5.2 VMware 'Management' process hangs

  Hello

  We recently purchased the Cisco ACS 5.2 VMware must be installed on VMware ESXi 4.1.  However, after commissioning the virtual machine with the requirements set out in the Cisco installation guide, GBA is unable to start properly.

  We don't get messages visible error, but when checking on the process of the CSA, I see that the process of 'management' is suspended in the "initializing" State

  Any ideas how to solve this problem?

  Thank you

  Gilbert

  ESX 4.1 is not supported with ACS 5.1

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.2/device_support/sdt52.html#wp75825

  Virtual Machine requirements

  The minimum configuration for the virtual machine must be similar to the hardware configuration of the server series CSACS-1120.

  Table 6-1 lists the minimum system requirements to install ACS 5.2 on a VMware virtual machine.

  Table 6-1. minimum system requirements

  Type of requirement	Minimum requirements
  CENTRAL PROCESSING UNIT	Intel Core2; 2.13 GHz
  Memory	4 GB OF RAM
  Hard drives	500 GB of disk storage
  NIC	1 GB NETWORK interface
  Hypervisor	VMware ESX 3.5 or 4.0

  Installation of ACS 5.2 on VMware

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.2/installation/guide/csacs_vmware.html#wp1057864

  Kind regards

  Jousset

• ACS 5.3 and Auth command

  I am deploying more late 5.3.0.40.6 patched ACS 1121 in redundant pair mode.   I auth user base build without problem, but am having a problem with the auth command.  Once I have add the auth command to test router and change the profile of the shell and the command set for privilege 1 nd 15, none of the commands are authenticated and the report indicates the value default 'DenyCommand '.  I followed the user guide and the step by step of security solutions. (link below)

  I don't always get no joy.   Cisco also changed the GUI and how are constructed from sets of commands

  (http://www.security-solutions.co.za/Cisco-ACS-5.2-Role-Based-Authentication-Authorization-For-Different-Privilege-Levels-Configuration-Example.html )

  Any help would be appreciated

  Patrick Connor

  Patrick,

  Can you check this doc to see if the set option command is enabled? It is hidden by default (it's what I wanted to confirm).

  https://supportforums.Cisco.com/docs/doc-26768

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• ACS + Wired dot1x machine authentication

  Hello

  I'm trying to configure computer authentication wired in function. I followed this guide

  http://www.Cisco.com/en/us/products/sw/secursw/ps2086/products_configuration_example09186a00805e7a18.shtml#req

  However I simply get the same error all the time on ACS.

  Authenticator of invalid message in the request of the EAP

  Switch configuration;

  interface GigabitEthernet0/46

  switchport access vlan 20

  switchport mode access

  media type rj45

  dot1x EAP authenticator

  self control-port dot1x

  dot1x re-authentication

  dot1x comments - vlan 20

  I am trying to corresponding installation group to make the assignment of vlan however, I walked just under the strategy of the unknown user at the min with no configuration of vlan assignment.

  No matter which shed some light on this, all I want to do is authenticate a machine by issuing certificates an id vlan based on the computer name and AD Group. No authentication of the user, this can be done via the PDC.

  Purely using machine auth.

  See you soon

  Scott

  Scott,

  I recommend you to change/retype the secret shared on the ACS server and the switch for the

  AAA Client and AAA server.

  Kind regards

  ~ JG

  Note the useful messages

• Cisco ACS server

  Hello

  I currently have a Cisco ACS 3.3 Server. I want to upgrade the server to the latest version and cluster with one another so that we can have a redundant infrastructure because if one fails it also includes...

  Can provide you a solution for this?

  Thank you

  Hello

  The latest version is 4.1 ACS. You can upgrade 3.3.3 build 11 directly to 4.1.

  Then, you can install an another ACS 4.1 on a different machine and replication configuration between these two. In this way, you will need to make changes to only one that ACS and the secondary will be automatically updated.

  Once these two are defined, you can set both of these servers as a server Radius/Ganymede on devices and there will be a redundancy.

  Kind regards

  Vivek

• Cisco ACS 5.8 CLI admin account lockout

  Hi all

  We recently deployed device Cisco ACS 3495 and running on a version 5.8.

  Everything seems well while our for the CLI admin account was locked out.

  Found a bug in Cisco for the same problem with version 5.5, but no solution yet...

  ACS 5.5 CLI Admin account locked and no Log Message
  CSCur37203
  Someone out there who might have encountered the same issue and can help advise?
  Thank you and best regards,
  NDA

  Hello

  Unfortunately, the only solution for this is the DVD of password recovery.

  Once fixed, you can increase the car locked out amounted to something greater than the default value of Cisco.

• Cisco ACS SE GANYMEDE + accounting fails

  Hello

  I'm under Cisco ACS SE 4.1.23.5. My problem is that the ACS don't Jrnl of the remote switches. I have configured the following accounting commands:

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 0 arrhythmic default group Ganymede +.

  orders accounting AAA 15 by default start-stop Ganymede group.

  Default connection accounting AAA power Ganymede group.

  When I enable aaa accounting debugging, I get the following logs on the switch.

  001091: 12 sep 12:06:06.464 TSB: AAA/ACCT: user johndoe, acct type 3 (2684940942): method = Ganymede + (Ganymede +)

  001092: 12 sep 12:06:06.665 TSB: TAC +: (2684940942): received the status of response acct = SUCCESS

  001093: 12 sep 12:06:11.128 TSB: AAA/ACCT/CMD: user johndoe, tty2, 15 private Port:

  'show running-config '."

  001094: 12 sep 12:06:11.128 TSB: AAA/ACCT/CMD: find the "default" list

  001095: 12 sep 12:06:11.346 TSB: AAA/ACCT: user johndoe, acct type 3 (1583033889): method = Ganymede + (Ganymede +)

  001096: 12 sep 12:06:12.000 TSB: TAC +: (1583033889): received the status of response acct = SUCCESS

  001097: 12 sep 12:08:16.303 TSB: AAA/ACCT/CMD: user johndoe, tty2, 15 private Port:

  ' configure terminal '."

  001098: 12 sep 12:08:16.303 TSB: AAA/ACCT/CMD: find the "default" list

  001099: 12 sep 12:08:16.303 TSB: AAA/ACCT: user johndoe, acct type 3 (1098049616): method = Ganymede + (Ganymede +)

  001100: 12 sep 12:08:16.504 TSB: TAC +: (1098049616): received the status of response acct = SUCCESS

  001101: 12 sep 12:08:29.884 TSB: AAA/ACCT/CMD: user johndoe, tty2, 15 private Port:

  It seems that the switch is well a response but the CSA record. I have updated the ACS for the latest patch (4.1.23.5), which is supposed to resolve this known bug.

  Is there something that I am missing?

  Thank you.

  ESD

  And what you get in the newspapers of Ganymede Administration?

  Kind regards

  Prem

• Cisco ACS 4.1 for external advertising for authentication

  Hello

  We have just configured Cisco ACS 4.1 solution engine and using a Windows 2003 domain controller as a remote agent.we use as Protocol Ganymede.

  Users that are created in ACS himself are able to connect to various network devices. but users in domain (active directory) can not connect. We get the access denied message. same time we get external DB is not operational message in ACS.

  Active directory server where agent that runs in CSWINAgentlog, we get the following error 'NDLIB'... FOUND 0 TRUSTED DOMAIN.

  Could you please help us to isolate the problem.

  Thank you & best regards

  Make sure that the worm of acs and remote agent software is the same. And also execution of remote agent account must have special domain administrator rights, like the act as part of operating system and log in as a service.

  Kind regards

  ~ JG

• Cisco ACS 5.2 with NX - OS (Nexus) devices user - questions

  Hey, I have a really strange problem with Cisco ACS 5.2 and Nexus NX - OS devices.

  I create an account on ACS, let's call him User1 and give privilege 15. With User1, I am able to access on all our IOS, IOS - XE, ASA and PIX devices with privilege 15.

  When I use the User1 account in our NEXUS devices, I do NOT receive the access privilege 15. As you probably know, the NEXUS devices have roles: predefined or custom roles. So I assumed I would get the role of "network-admin" (15 private read/write) User1 when you connect, but instead I got the role of 'vdc-operator' (private 1 read-only).

  Then I tried to twist User1 and give network-admin under profile Shell > Custom Attributes. I logged in the NEXUS and of course I was able to get a network-admin access. However, my access to ALL other devices (IOS, ASA, PIX, etc.) does NOT work! I am not even able to connect with my login and my password for these devices.

  Has anyone ever experience this problem? Help, please!

  Thank you

  neocec

  This is a common problem when you mix with RBAC and IOS devices authorization policies, the pair av that you created must be set 'optional' instead of 'compulsory', please make this change and you will be able to access all your devices.

  Thank you

  Tarik

• restore the configuration of the cisco ACS 1121 ver 5.2 to SNS 3425 ver 5.6

  Dear all,

  We currently have Cisco ACS 1121 ver 5.2 in our production, then we will replace it with the new devices using SNS 3425 ver 5.6.

  Please good to want to help someone can tell you how to restore all the old configuration of devices (ACS 1121 ver 5.2) for the new Member States?

  Best regards

  Yudibagam

  Hello! You must upgrade the current device to a min of v5.4 for restoration work and be supported.

  http://www.Cisco.com/c/en/us/TD/docs/net_mgmt/cisco_secure_access_control_system/5-6/release/notes/acs_56_rn.html

  However, if you're going to go through the upgrade problems then I would say that you upgrade all the way to 5.6 just to be sure :)

  I hope this helps!

  Thank you for evaluating useful messages!