Cisco Secure ACS groups 5.1 Active Directory and RSA Authentication Manager 7.1 for profiles

Similar Questions

• Cisco ACS 5.1 and RSA Authentication Manager 6.1

  Hi all

  We recently had a Cisco Secure ACS 1120 and I improved the Unit 5.1 5.0 with all your support

  Now, I need to integrate Cisco ACS 5.1 with RSA Authentication Manager 6.1. I have config file of RSA ACE Server successfully downloaded and exported to 1120 ACS.

  I also added as NetOS Agent ACS in the RSA server during the process, I found a few warnings. The ACE Server is not able to resolve the IP address to the name (is it necessary?).

  I have not created any file of secret key for communication between FAC and RSA and I used encryption is FOR.

  Now, when I log into ACS and search for devices in the identity store sequences I am not able to get Sever Token RSA.

  Let me know what was wrong, where can I fix and also please tell me what is the communciaction between the RSA and ACS?

  Hoping that you guys help me as usual when I'm in a hurry...

  Sree

  Were you able to successfully create the RSA identity server. After selecting the sdconf.rec and you press on submit what happened? The RSA instance created OK?

  If you go to

  Users and identity stores > external identity stores > RSA SecurID Token servers, what do you see in the list?

• Cisco Secure ACS Solution Engine ping

  1. I installed Cisco Secure ACS Solution Engine with V3.3 and I can access via the http port 2002 but I can't it ping from anywhere in the network, but the server can ping every thing, is this normal.

  2. If I can't ping haw I can define the service keeplaive to load balance 2 ACS engine using CSS

  By the way, I forgot that ACS 3.3 device has a CSA integrated. This agent is enabled by default. He explains why you can't ping it.

  For enable/disable it, go to "System Setup Configuration - device. Toggle the checkbox enabled the CSA according to needs.

  http://www.Cisco.com/en/us/partner/products/sw/secursw/ps5338/products_user_guide_chapter09186a008023361d.html#wp859228

  Rgds,

  AK

• With Cisco Secure ACS for Windows GANYMEDE +, authentication fails with AD

  I'll put up a Cisco Secure ACS 4.2 server to act as a RADIUS server for switches and routers I use Windows 2003 server for the candidate countries.
  and an Active Directory of Windows 2003 server.  The ad server is very good, it is used for many other things.

  I've implemented ACS as defined nit it installation guide, including all the steps in the "Member Server" section of the installation guide
  When you use AD as an external database (e.g. setting up services to run with a domain administrator account, set up a machine called "CISCO"
  on the field, etc.).

  I've set the unknown user policy to use the database of Windows, if the internal database does not contain the details of the user.

  If I add a user to the internal database, authentication goes through fine, with an entry in the journal "Authentication," spent

  02-24-2010, 05:07:03, authentic failed, eXXXX, Network Administrators (NDG), X.X.X.X, (default), internal error, (get the internal error error message)

  I scoured google etc and just cannot come up with any reason why this should be the case.
  I followed all of the installation to the letter guides.  I need to get this up and running as soon as possible,
  so am eager to know if someone can help me with this one!

  Thanks and greetings

  Sharan

  George,

  Internal error is fairly generic, but a common situation, we see this error is when ACS is installed on a

  64-bit computer.  ACS would not work with the active Manager when it is installed on the 64-bit before machines

  ACS 4.2.1.

  -Jesse

• Cisco Secure ACS 4.2 Windows authentication of different domain

  Hello

  I have a Cisco Secure ACS for Windows Server 4.2. The server belongs to a domain and the domain, the users belonging to a certain group are authenticated.

  Now, I have to change the configuration of the server and reassign it to another area. There is no trust relationship between two domains and I would like to know if users can always be authenticated against the previous domain.

  Hello

  First of all, take backup (by measure of precaution in order to restore config if something goes wrong) then continue witht the following:

  -Remove the configuration of the windows domain (group... mapping etc) from the server before changing the field.

  -Change the domain membership, and then restart.

  -follow the missions post-disiez for ACS (see this link): http://tiny.cc/zr6huw.

  -Configure the external database again on GBA (group mapping, strategy unknown user... etc).

  You should note that if the new domain controller is Windows Server 2008 R2, which is not supported by ACS 4.x.

  HTH

  Amjad

  Rating of useful answers is more useful to say "thank you".

• Cisco Secure ACS vs IAS in Windows

  Hi all

  I need deploy an AAA for the following situations.

  (1) remote access via Cisco VPN Clients.

  (2) AAA for wireless windows PC in remote areas

  (3) AAA for Cisco switches and routers in remote areas

  (4) authentication with a windows domain

  The the Windows IAS would be virtually free that we already have Windows 2003 domain controllers at each remote site. However, Cisco Secure ACS might also be an option. Not all have experience in these two?

  What are the positives\negatives of each? and limits?

  Does anyone have any information on case study etc. in comparing the two?

  Your help is greatly appreciated.

  Kind regards

  Andy

  PS: There is a limitation in Windows 2003 Standard edition, which limits the number of Radius clients to 50. Although we have more than 50 potential clients in society, no site has more than 50 altogether.

  MS IAS allows you to implement the solution using only the RADIUS protocol

  ACS offers the feature to use RADIUS as well as GANYMEDE.

  Looking 4 solutions you want to implement, only 3rd solution will be a little easier with GANYMEDE, but even once it not something you can not implement using RADIUS.

  On the limitation of Radius client, ACS offers a large database that you can use for customers, so limiting to 50 customers. In addition many many features, you'll love to integrate into your network as the NAP/NAC implementation, made it easier.

  So you need to check if you have the budget, you can go to ACS, IAS on the other can work well for all solutions (except limitation of radius client, I m sure that MS can provide a workaround solution).

  the following link can help you with information on sales of ACS:

  http://wwwIn-nmbu.Cisco.com/thevault/files/1027/5/ACS4.1-Sales-guide%20April%204%202007.htm

• Cisco Secure ACS 4.2 on VMware ESX 4.0.

  We must move from ESX 3.5 to ESX 4.0 a virtual machine running Cisco Secure ACS for Windows version 4.2.

  This solution is compatible and supported by Cisco?

  Thank you.

  Andrea

  ACS Windows 4.2 is not supported by Cisco, when installed on VMWare ESX 4.0 in accordance with the following documentation:

  http://Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/device/guide/sdt42.html#wp37898

  Only ACS 5.1 is supported on ESX 4.0:

  http://www.Cisco.com/en/us/partner/docs/net_mgmt/cisco_secure_access_control_system/5.1/installation/guide/csacs_vmware.html

• Cisco Secure ACS 5.3 SNMP agent does not

  Hello

  I have problems with the SNMP on Cisco Secure ACS 5.3 agent (patch level 5) stop, is there a quick way to restart the SNMP daemon via the command line?

  Robert,

  I understand where you come, I encountered the following bug:

  CSCte39351

  The process of the SNMP agent in demon device ACS stops.

  and reboot the box will bring him back to the top and after about 3 days, he'd stop. I just want to see if it's the same bug that could be back in patch 5. The best thing to do at this stage is to plan a quick down and restart the box to see if the snmp process starts again. If this then gives IT a week to see if the snmp Protocol falls down. If it does then make reference to this bug and open a new case of tac for repair. If not, then you should be in the clear.

  Thank you

  Tarik Admani

• Active Directory and domain controller on old customer Windows 2003 and Windows 7.

  Hi all

  I have Active Directory and the domain on old Windows 2003 and Windows 7 client controller. I enabled "User must change password at the next logon" for the customer user on AD account.

  When the user tried to connect to Windows 7, after that they have got the change password screen and type new password, then they received message "the user password must be changed before logging on the first time," user get password screen change again, then they get the same massage. Looks like he's going to loop and user cannot change password and connect to the computer.

  Hello

  To help you with your concerns, you can see the article below:

  Error message: the password must be changed before logging on the first time

  Let us know how it goes.

• Cisco Secure ACS appliance - impossible to edit... Reason: The host no longer exists.

  Hi team,

  I have 2 camera which I am not able to remove a group of network devices home device.

  When I try to remove the device after error is thrown

  Impossible to edit INMUM-VPE-T1-3rdFloor-3750-S...  Reason: The host no longer exists.

  Running on Version: Cisco Secure ACS4.2.0.124

  One would come in all of these issues. someone knows the solution.

  Concerning

  Vineeth

  Hi Vineeth

  Yes, you can do through GUI.

  The GUI:

  1 ACS gui > network configuration > click on 'Search', then click 'Search' again.

  2. complete list of all network devices. On top, you will see an option "Download".

  Download the complete file.

  Let me know if it helps.

  Thank you

  Nelson Saha

• ACS 5.1 using Active Directory to manage the strategy of network device Admin

  Hi guys, we have configured an ACS 5.1 and integrated with active directory Win2K3, we created two AD groups to manage devices network for administrators and one for operators (read-only), so we have configured a device admin strategy and the two groups work very well, but now we are facing a little problem any user that exists in the AD can connect (user exec mode) network devices and we want to cancel the connection with politics, but we do not know how.

  Is there a way to get a user authenticated against acs internal or external group, but at the user level, everything as you can make it to GBA 4.X?

  Thanks for your help!

  Best regards

  Oscar

  Yes, you can change that, it's a profile of shell by default. You must create a new one with privilege level "not in use" and select the new profile of the shell (no Directors or Operartors) under Default Device Admin > authorization profile > edit and make changes.

  I hope this helps.

• DISCONNECTED in Cisco Secure ACS AD

  We have ACS

  5-3-0-40-8

  As disconnected Active Directory showing connectivity

  We faced the same problem when he was 5.x, we went to

  5-3-0-40-8

  After 2.5 months now, we have faced this problem. Permanent any solution for this.

  Restarting the service got suspended and where we rebooted the server to fix.

  Please help on this as soon as possible.

  Thank you best regards &,.

  Sakthivel M

  You questions'are running one of the code and patch of ACS more stable if we are talking about ACS - AD. I don't know that it should not be a problem with the ACS. Something is not configured correctly. Most likely a problem of DNS or NTP.

  In order to deepen and to know what might be the causes, you will need to provide some information and newspapers when it happens again.

  1.] we have ACS currently running on the machine or Vmware?

  2.] when you say that it is in the disconnected state, you see do both authentication failed or it shows just disconnected status. In case of failure, what is the error, we get in the section logging ACS? In addition, you can see test connection arrive at positive results?

  3.] what is the status of the customer-ad on the CLI service, can be verified with "view the status of the acs application" when you say its disconnected?

  4.] in addition, when you try to join again while it is disconnected, you see an error? can you share?

  5.] more importantly, debug level logs would tell us the real story. Before you reproduce the problem, we must look at the newspapers to the debug level. (If this can not be reproduced then wait the issue reproduce)

  Go to the ACS CLI:

  ACS / admin # acs - config

  Escape character is CNTL/D.

  Username: acsadmin

  Password: XXXXXXXX

  ACS/admin(config-ACS) #.

  Set newspapers ACS desired debugging level.

  ACS/admin(config-ACS) # debug level to debug-log duration

  ACS/admin(config-ACS) # enable debug-adclient

  NOTE: once you have finished, put newspapers.

  Generate the support beam and download it here. Talk about the timestamp when the questions has been reproduced, it will help me track down the newspapers concerned.

  Jatin kone
  -Does the rate of useful messages-

• ACS integration with Microsoft Active Directory Services

  Hi all

  I was responsible for developing the integration of GBA with MS AD. What I want to know is below assuming I have a software ACS or ACS device and the authentication protocol's RADIUS

  -What is the criterion of the announcement to integrate with ACS to device software

  -Should that AD hosted on the domain controller or not?

  -Otherwise, on what (DC, tree, forest, branch, flower, Fruit) the announcement must be hosted on?

  -What should I do to authenticate users logging into Cisco ACS Security Manager integrated with AD?

  -Are there other dependencies that I'll have to speak categorically in my description?

  Thank you

  Rishi

  First of all, I love the flower fruit one keep it up.

  If ACS is for windows, it can be installed on the domain controller or member server. For detailed information about installation tasks post must have full integration, please see the following link that contains fancy things you are looking for:

  http://www.Cisco.com/en/us/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/Windows/postin.html#wp1041202

  If ACS is soultion engine then you need piece of software called remote agent to be installed either on the domain controller or member server, also check the following link for more details on how to integrate it with AD:

  http://www.Cisco.com/en/us/partner/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/remote_agent/Rawi.html

  I hope this was informative for you.

  -----------------------------------------------------------------------------

  Please ensure good answers to rate

• Cisco Secure ACS 5.1 and strong authentication ACS administrators?

  Hello

  Is it possible to authenticate administrators using an RSA SecurID token?

  There is no indication on this issue in the Panel "System Administration > directors > settings > authentication.

  (I'm under Server Secure ACS 5.1.0.44)

  Thank you

  Christophe

  Hi Christophe,

  Unfortunately not.

  The DB supported only for accounts of Administractors is the internal DB of GBA.

  I hope this helps.

  ARO
  Tiago

• Question about the attributes Active Directory and ACS 5.2

  To authenticate on our wireless, our ACS server checks to ensure that a node is a member of a specific group of computers.  When we disable the computer account, the continuous ACS server to spend despite the account being disabled the authentication. This isn't the only thing that is checked, we also checked for a valid certificate issued by our CA.  Regardless, if the computer account is disabled I would like for the ACS server to the authentication failed.  Is it possible to map an attribute of the computer account to a radius attribute?  Or simply configure the ACS server to check a flag on the AD attribute?

  Specifically, here's what we see in the steps in the section for a machine that's account has been disabled:

  24475 account user or host is disabled; setting the IdentityAccessRestricted flag to true.

  I want to let him see this 'true' flag and fail authentication, but it does not work.  Any suggestions?

  The IdentityAccessRestricted attribute that is referenced in the steps is an additional attribute that can be used in conditions of approval

  It is set to true if access to the account is disabled, outside the period of access etc.

  This gives flexibility when AD attributes are retrieved for use in licensing requirements and will allow the application to be refused if the flag is set.

  To do this add a new condition in the authorization policy

  If (AD1-> IdentityAccessRestricted) == TRUE select profile permission to deny access to the suite