connection via Cisco ACS 5.0 limit

Similar Questions

• [Cisco ACS] Memory usage limit

  Hello

  We have 2 CSACS 1121 with Cisco ACS 5.2.0.26.10

  The main server manages authentication 20000 + per day.

  Its memory usage is growing every day.

  It's now 83%

  Is there a limit?

  What happens when memory use reaches this limit?

  What can we do to purge the memory usage? (reboot, restarting the service...)

  Thanks for your help

  Patrick

  Check the secondary collector newspaper. This will help to balance the load between the two nodes and you will see the memory usage decreases.

  Thank you

• Access to Motorola RF controller via Cisco ACS

  Hi all

  I want to be able to use authentication on our Motorola RF using Cisco ACS 5.2 controllers remotely. We have the responsible ASB and you can choose different user roles outside of "Super User".

  The reason is that the ID attribute for the role of 'Super user' is 32768 and but ID attribute within the ACS can take only 3 digits (see fig. 1 gasket)

  Anyone had any experience of this or know how to edit this field for more than 3 digits?

  Any help will be much appreciated.

  Thank you

  John

  I can see the issue you are referring to and does not seem to be a bug - dig when it exist and if is not open

  An entire book would not use an enumeration attribute Type but rather an unsigned integer

  Then you must enter the value directly in the authorization profile rather than selecting from a list

• Unable to connect via the Cisco VPN Client

  Hello

  I have configured remote access VPN to ASA and tries to connect via the Cisco VPN Client 5.0

  I am not able to connect and watch the journal on the SAA

  ASA-3-713902: Group = xxxxx, IP = x.x.x.x, withdrawal homologous peer table is placed, no match!

  ASA-4-713903: Group = xxxxx, IP x.x.x.x, error: impossible to rmeove PeerTblEntry

  ASA does not support the K9 i.e. VPN - DES is enabled and VPN-3DES-AES is disabled.

  What could be the reason.

  Concerning

  Hi, I had this same problem, here is the solution:

  When you perform a debug crypto isakmp 255, so you see that the cisco vpn client does not support SHA +, you must use MD5 + AN or sha with 3DES/AES.

  Be careful, this debugging is very talkative, but that's the only way I found to get ITS proposal on debugging.

  Well, change your strategy using MD5 isakmp / OF would do the trick.

• Cisco ACS 5.2 authentication and authorization processes

  I am designing a network and I asked me a few questions that I don't know how respond to those so I thought putting it in the forum to see if I can get help.

  First, thank you very much for reading this post and thank you if you can add comments to help out me.

  installation program:

  Two ACS on each center data in Server and application to the switches by dc + hybrid mode the Ganymede and fold to the other on the failure scenario.

  ACS - version 5.2 planning upgrade to 5.8, if she is stable.

  Result of the will

  If users fails authentication AD then it should be rejected.

  If defective AD on ACS and ACS needs to check the other ACS and other ACS has connection AD, then it should demand more diver ACS...

  I'm sure it is not possible, but that it was the main application... I disputed so now the new request

  If AD fails ACS should fall back to the local database. If the local database is not authenticte then it should allow to switch to interrogate the same request of ACS secondary rather then to reject the application.

  Litt: local database is reserved for the network admin but maybe some contractor need to access switches and other devices and they will have the entry in listing so if fails AD, they can always authenticates agaist DC2 AD via DC2 ACS.

  I think to set up

  Authentication rule 1 - authenticate again AD,

  If authentication failed - Reject

  If usernot has been found - reject

  If the process failed - continue

  This should take by default which will be the internal database.

  If authentication failed - Reject

  If the user has not found - drop

  If the process failed - drop

  This should give no answer to switch and then switch should try the second radius server in the list...

  Please someone explain this flow chart for me... and it's correct assumptions...

  I would like to know if there are a few good diagram that I can refer to see the whole process and can use in my presentation...

  Thank you very much for reading and you answer it...

  Hello

  I'm not sure I get your question, but I will try to answer in the way that I understood.

  If you send a drop as a result, this means that ACS deposited the request, causing the AAA client to try again another failure on toward another AAA server.

  A tree had fallen on the community a few years ago:

  (https://supportforums.cisco.com/discussion/11811801/aaa-servers#3931298)

  

  

  I hope that's what you are pregnant.

• Cisco ACS 5.6

  Hello

  I wonder if anyone can help me? Our server team recently installed the Cisco ACS (version 5.6) on a VM server. I can connect to the Web GUI OK account using the account ACSAdmin. The team of the server informed me that they scheduled the same password for the CLI admin account as they did on behalf of GUI ACSAdmin, but I get "access denied" when I try to SSH to the server (with the username admin).

  I looked at different messages and documentation, but it seems to me that the CLI SSH account can be managed via the Web UI?

  Does anyone know a way to hack the account SSH, or should I just ask the server to be rebuilt? I can see some tips of password recovery, but this seems to apply to a physical server not a VM.

  Thank you very much

  Hello

  Boot from iso GBA 5.6 and reset the console password

  Thank you

  John

• With the help of Cisco ACS 5.2 (GANYMEDE +) with other than Cisco devices

  Hi all

  I was hoping that someone could help me with what might be a silly question. I'm trying to implement a solution whereby an operator can control all their nodes (other than Cisco) network via GANYMEDE + involved nodes are

  Juniper M10i running Junos 9.2, M120

  M320 running Junos 8.5 Juniper

  Extremes of BD8810 and BD8806 running 12.4.1.17 XOS

  3804 Alpine extreme Extremeware 7.8.3.5 running

  My question is, can I use Cisco ACS 5.2 (or 4.2) to authenticate using GANYMEDE + to these other than Cisco devices. Has anyone else done this or I have to use RADIUS? If someone has done this are problems of interoperability with Cisco CS and Junos or XOS extreme. Thank you

  / John

  John,

  We have a very large deployment of Juniper (T-series, series MX, etc.). We use Cisco ACS and GANYMEDE to manage these devices. The configuration of the ACS is fairly simple. You'll want to create users to connect and match them to the classes on your JUNOS routers. Here is an example:

  set system login user uid of engineering 2000
  Set system login user engineering genius-class class
  set the connection user uid to NOC 2001 System
  Set system login user AC AC-class class

  define the system connection Engineering-class idle-timeout 15
  define a connection system class engineering-class permissions all
  define the system connection AC-class idle-timeout 15
  define the connection class AC system class view permissions
  Set connection AC-class permissions see the system configuration

  We use two classes of genius and NOC. One is defined as a read / write and the second read-only. This is in turn then mapped in ACS (in our case version 4.2) by user or group (preferred). First, you change the configuration of the interface and add a Ganymede junos-exec service and do not enter the Protocol field. Then, you change the attributes of the user group. I've attached screenshots for both on this subject.

  Hope this helps.

  Derek

• Droid Turbo could not connect the Cisco access point

  Greetings.

  Since the upgrade to a droid turbo, I was unable to connect to the network without wire of my work. I work in the it Department, but my experience with Cisco technologies and wireless is limited, so I tried to understand why. My previous bike x worked fine. We have a network of all the access points managed by a controller Cisco 4402 running version 7.0.98 of the BONES. I was able to connect to another wireless network that I could meet outside of work, and I am able to connect to the network of my work if I connect it is unsecured guest SSID. Only connections to our 4 secure networks fail. The controller reports that my phone cannot all simply to authenticate. The controller is configured for WPA2 / AES using a key 284 on the particular network, that I am trying to connect. I entered this key manually both via copy and paste. As far as my phone goes, I only tried to withdraw and time networks like tent to start it in safe mode without success. I read on various forums android that maybe it's a problem related to Kit Kat and this kind of problem has appeared on other handsets from other manufacturers, but nothing definite.

  Any suggestions would be much appreciated.

  -Josh

  Let me direct you to two other discussions here on the Droid Turbo forum and the other from Cisco which may help.

  Unable to connect to company wifi

  https://forums.Motorola.com/posts/af633eb3e4

  DROID WiFi Turbo questions

  https://forums.Motorola.com/posts/06a2f3c5ca

  Connectivity issues with Cisco and Moto X (Gen 2) allowed RMC controllers (probably related)

  https://supportforums.Cisco.com/discussion/12331486/connectivity-issues-Cisco-controllers-and-PMF-enabled-Moto-x-Gen-2

  I hope this helps!

• To connect via PPPoE (dialer) Wireless ADSL

  Hello

  I have a WAG200G Annex-A Wireless G modem router ADSL residential, I used as a wireless router. Now I've changed suppliers (Auntie Indicom - in India), and they have a 'new technology '. Basically, instead of giving me a DSL line in my house, now they directly give me an Ethernet cable in my house (they have a local DSL box somewhere on the roof with various Cisco switches for each household). Then, they want to connect via PPPoE by starting a Dialer on my computer, this particular Ethernet cable is connected.

  Now, that works all very well, but we have more than one computer at home, and I would like to use Wifi instead of being connected at all times via the cable on my laptop.

  So now my question is:

  Can I configure the Linksys router so that IT don't the PPPoE dial for me? Basically this means plug the Ethernet cable provided by my ISP in one of the ETHERNET Ports and set up allowing to switch on (since there is no cable "line" adsl connected more) with my user name and password.

  Anyone know how to do this, or if this is possible?

  Thank you!

  P.s.: I've set up the Internet connection sharing via ad-hoc wireless, which works very well, but is only a temporary solution because I don't want to use my laptop as a router...

  It is not possible to configure WAG200G without ADSL line.

• Problem with certifcate on Cisco ACS

  We want to authenticate our internal wireless users using our Cisco ACS running 5.3.  GBA questions our Active Directory environment for the user name and password provided.  I created a CSR on GBA and it provided to Entrust.  They gave me a root certificate, string and server.  I've linked the server certificate to the CSR under System Administration > Local Server Certificates > local certificates.  I then added the chain and the root certificates to the users of the site and identity stores > autorit├⌐s.  When I try to connect to a laptop client he asks a user name and password, but after entering this information, I am presented with the warning on this certificate below.  This certificate is to Entrust and I see the certificate root in the root store on the laptop.  Any ideas what would cause this.  TAC does not seem to have all the answers.  They say it's a problem of the client machine.

  

  In case you want to check your configuration settings.

  http://www.Cisco.com/en/us/products/ps10315/products_configuration_example09186a0080bd1100.shtml

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• slow when they are connected via anyconnect VPN, ASA OS 9.0

  Hi guys

  My users are complaining that they are experience slowness when they are connected via vpn anyconnect for ASA os 9.x, 5 Mb files tikes 15 mts rough with them, even if these users also have a connection broadband on their place

  any guy insight

  Thank you

  Hi Ibrahim.

  My first suggestion to you is to follow the recommendations of Cisco, associated with latency problems.

  hostname (config) #-group attributes policy
  hostname (config-Group-Policy) #webvpn
  hostname (config-group-webvpn) select #svc dtls
  hostname (config-group-webvpn) #svc df-bit-ignore enable
  hostname (config-group-webvpn) #svc routing-filtering-ignore enable
  hostname (config-group-webvpn) mtu #svc 1200
  hostname (config-group-webvpn) #svc compression no

  (a more recent version, you can use the command "anyconnect" instead of "svc")

  If after this the problem persists please let me know when is the right time to reproduce the problem and collect the balls, debugs and catches. I also need the current configuration of the SAA (see technology in a txt file)

  Kind regards

  Aditya

  Please evaluate the useful messages.

• Cisco ACS SE GANYMEDE + accounting fails

  Hello

  I'm under Cisco ACS SE 4.1.23.5. My problem is that the ACS don't Jrnl of the remote switches. I have configured the following accounting commands:

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 0 arrhythmic default group Ganymede +.

  orders accounting AAA 15 by default start-stop Ganymede group.

  Default connection accounting AAA power Ganymede group.

  When I enable aaa accounting debugging, I get the following logs on the switch.

  001091: 12 sep 12:06:06.464 TSB: AAA/ACCT: user johndoe, acct type 3 (2684940942): method = Ganymede + (Ganymede +)

  001092: 12 sep 12:06:06.665 TSB: TAC +: (2684940942): received the status of response acct = SUCCESS

  001093: 12 sep 12:06:11.128 TSB: AAA/ACCT/CMD: user johndoe, tty2, 15 private Port:

  'show running-config '."

  001094: 12 sep 12:06:11.128 TSB: AAA/ACCT/CMD: find the "default" list

  001095: 12 sep 12:06:11.346 TSB: AAA/ACCT: user johndoe, acct type 3 (1583033889): method = Ganymede + (Ganymede +)

  001096: 12 sep 12:06:12.000 TSB: TAC +: (1583033889): received the status of response acct = SUCCESS

  001097: 12 sep 12:08:16.303 TSB: AAA/ACCT/CMD: user johndoe, tty2, 15 private Port:

  ' configure terminal '."

  001098: 12 sep 12:08:16.303 TSB: AAA/ACCT/CMD: find the "default" list

  001099: 12 sep 12:08:16.303 TSB: AAA/ACCT: user johndoe, acct type 3 (1098049616): method = Ganymede + (Ganymede +)

  001100: 12 sep 12:08:16.504 TSB: TAC +: (1098049616): received the status of response acct = SUCCESS

  001101: 12 sep 12:08:29.884 TSB: AAA/ACCT/CMD: user johndoe, tty2, 15 private Port:

  It seems that the switch is well a response but the CSA record. I have updated the ACS for the latest patch (4.1.23.5), which is supposed to resolve this known bug.

  Is there something that I am missing?

  Thank you.

  ESD

  And what you get in the newspapers of Ganymede Administration?

  Kind regards

  Prem

• RADIUS does not not on Cisco ACS SE v4.1 (1)

  Hello

  I have a CiscoSecure ACS version 4.1 (1) build 23.

  I can't configure the Cisco ACS for granular control of access router. I have a Netopia Router that is configured to use RADIUS to authenticate remotely for a telnet connection. The router sends the request to access the Cisco ACS SE RADIUS and a sniff on the side of the ACS shows the application of GBA, but I see no response from the ACS. RADIUS authentication to work with a Windows 2003 server.

  I configured an AAA client and a user of the ACS and use the default group. I use IETF RADIUS. Should what attributes I configure. In Windows, I use Service Type framed and Framed-Protocol PPP. This does not work with the Cisco ACS SE. Nothing shows up in the newspapers. It shouldn't be so difficult, but for some reason I can't make it work.

  Thanks for any help.

  Jutta Kullmann

  Jutta,

  Good to know it works very well. Please mark this thread as solved so other can benefit from.

  Kind regards

  ~ JG

• Cisco ACS 4.1 for external advertising for authentication

  Hello

  We have just configured Cisco ACS 4.1 solution engine and using a Windows 2003 domain controller as a remote agent.we use as Protocol Ganymede.

  Users that are created in ACS himself are able to connect to various network devices. but users in domain (active directory) can not connect. We get the access denied message. same time we get external DB is not operational message in ACS.

  Active directory server where agent that runs in CSWINAgentlog, we get the following error 'NDLIB'... FOUND 0 TRUSTED DOMAIN.

  Could you please help us to isolate the problem.

  Thank you & best regards

  Make sure that the worm of acs and remote agent software is the same. And also execution of remote agent account must have special domain administrator rights, like the act as part of operating system and log in as a service.

  Kind regards

  ~ JG

• Cisco ACS 5.2 with NX - OS (Nexus) devices user - questions

  Hey, I have a really strange problem with Cisco ACS 5.2 and Nexus NX - OS devices.

  I create an account on ACS, let's call him User1 and give privilege 15. With User1, I am able to access on all our IOS, IOS - XE, ASA and PIX devices with privilege 15.

  When I use the User1 account in our NEXUS devices, I do NOT receive the access privilege 15. As you probably know, the NEXUS devices have roles: predefined or custom roles. So I assumed I would get the role of "network-admin" (15 private read/write) User1 when you connect, but instead I got the role of 'vdc-operator' (private 1 read-only).

  Then I tried to twist User1 and give network-admin under profile Shell > Custom Attributes. I logged in the NEXUS and of course I was able to get a network-admin access. However, my access to ALL other devices (IOS, ASA, PIX, etc.) does NOT work! I am not even able to connect with my login and my password for these devices.

  Has anyone ever experience this problem? Help, please!

  Thank you

  neocec

  This is a common problem when you mix with RBAC and IOS devices authorization policies, the pair av that you created must be set 'optional' instead of 'compulsory', please make this change and you will be able to access all your devices.

  Thank you

  Tarik