Desktop with NAC Cisco switch
Hello
I would like to implement the NAC (802.1 x) in my network, but I have a lot of loose switches not lying around.
Y at - it all 8021.x enabled the office (4 or 8 ports) switches?
Thank you
Tom
Cisco 2960 - 8 and 3560-8 support 802.1 x.
Tags: Cisco Security
Similar Questions
-
GANYMEDE + with 3560 cisco switch configuration issue
Hi Forum,
Here's my setup GANYMEDE + on my cisco 3560 switch and my question is, how can I configure the switch, if I would not type enable after I put the user name and password? with configs below, users will need to type activate whenever they connect to the switch in order to enter the user exec mode. Please let me know if there is something missing in my configs to help me avoid typing 'enable '.
Thanks in advance,
MacBookAir: ~ MacBook$ ssh [email protected]/ * /.
Password:
Switch > en
Switch #show run | include the aaa
AAA new-model
AAA server Ganymede group + mpcc
AAA authentication login default group Ganymede + local
activate the default AAA authentication no
AAA authorization exec default group Ganymede + authenticated if
AAA authorization commands 1 default group Ganymede + authenticated if
AAA authorization commands 15 default group Ganymede + authenticated if
start-stop radius group AAA accounting dot1x default
AAA accounting exec default start-stop Ganymede group.
orders accounting AAA 1 by default start-stop Ganymede group.
orders accounting AAA 15 by default start-stop Ganymede group.
AAA accounting system default start-stop Ganymede group.
AAA server RADIUS Dynamics-author
AAA - the id of the joint session
Switch #.
Hello
Add the level of privilege 15 control VTY line configuration.
line vty 0 4 [..] privilege level 15 !
Concerning
-
Configuration Wireless 3G as online backup with cisco switch layer 3?
Hi all
We have an existing GPRS modems for data transfer between 2 different sites, this connection is a bit slow to no more than approximately 114 Kbps, the idea is to add a 3G modem, so the solution will be based on a two-way communication lines which are 3G network and the GPRS network.
The line GPRS will be the main and 3G will be secondary, this redundancy offers a high level of availability of communication between the two sites.
is it possible to configure this redundancy with a cisco switch layer 3? If this is the case do you have a tutorial or a link which explain how to do this work with a layer switch 3 ciso?
all information will be useful for me, thanks
Hello
The config is one provided by anisaini, but you need to change your NAT like this:
IP nat inside source MAIN interface map route x/x main interface
IP nat inside source route-map interface o/o interface secondary SCHOOL
Interior int z/z interface
IP nat inside
int x/x
NAT outside IP
int y/y
NAT outside IP
access-list 99
permit x.x.x.x y.y.y.y where x.x.x.x is your home subnet addresses and y.y.y.y is the corresponding generic mask
PRIMARY route map
match ip add 99
match interface x/x
SECONDARY route map
match ip add 99
game interface y/y
Concerning
Alain
Remember messages useful rate.
-
Web authentication with RSA SecureID on a Cisco Switch
Hello
I recently searched by linking in our Cisco Switch of GB 2960 S with RSA SecureID via Radius
I already managed to tie in to ssh access
but I failed to make it work for http / web access to the switch
I think it's because we use 'single use' maximum security with RSA SecureID tokens
the web interface tries to authenticate several times against the Radius server RSA SecureID part
(agreement on the first authentication, but every time after that he's going to want a different code in token)
I was wondering if anyone knew a way around this? (if there is a way to get the right switch authenticate once instead of multiple times the radius server)
FYI, the switch is a WS-C2960S-24TS-L with IOS 15.0 (1) SE2
Hello Chris,
You can test the following configuration?
AAA webtac_grp radius server group
Server
expiration of cache 1
authorization cache profile httpauth
hiding authentication profile httpauth
!
AAA authentication login httpauth cache webtac_grp group webtac_grp
AAA authorization exec httpauth cache webtac_grp group webtac_grp
AAA authorization network httpauth cache webtac_grp group webtac_grp
AAA cache profile httpauth
all the
IP http server
IP http authentication aaa - authentication of the connection httpauth
IP http authentication aaa exec-authorization httpauth
RADIUS server host key *.
I know for sure the above configuration works when you use GANYMEDE + instead of RADIUS in order to avoid multiple guests due to the authentication of JAVA Applets to access the GUI of the IOS. I him have not tested against RSA acting as an authentication server.
NOTE: As "aaa authorization exec" is configured the RSA should send Service-Type attribute with administrative value for it to work as expected.
If this was helpful please note.
Kind regards.
-
connection with the base switch
im running windows server 2008 with cisco switches, but when I connect a switch to one of my drops and add more than one computer to the switch, that it is not connect the computer that a network is running the rest does not get why?
Hello joseconcepcion
Your question would be better suited for our Tech Net forums. Please post your question on the link below. Thank you.
http://social.technet.Microsoft.com/forums/en-us/category/WindowsServer/
-
I would like to know if the compatibility for the storage matrix Dell is updated regularly, especially for cisco switches.
We seek to deploy a few PS6210 with 10G connectiivity and here for use with switches Cisco 4500 X series. However these are not included in the doc. There are a few cisco switches that are the end of life (4948 and some nexus switches).Hello
Yes the guide is updated regularly, usually monthly or updates are available.
Since the x 4500 is not a Nexus series switch, you looking for correct DCB support?
In this case these Dell 'Level 3' offers better support for resonable effort. I'll make sure that use you the latest firmware IOS and EQL. There are other switches catalyst IOS in the guide. Configure it in this sense would be a great place to start. Ideally, the switch dedicated for iSCSI use, not VLANd with other types of traffic.
If you can first test before production, then support can see table diagnosis and SANHQ archive for any signs of network related issues. (retransmit rate and types for example)
Kind regards
-
Why I can't command show running on cisco switch
On a single switch, I found that some commands because they show execution or copy running-config tftp: on cisco switch WS-C2960X-24TS-L does not work it see more below. How I can use the command then show generally. Thank you.
Building1_FAA_6F_SW3 #sh run
Building configuration...Current configuration: 100 bytes
!
! No change since the last restart configuration
!
boot-start-marker
boot-end-marker
!
!
!
!
!
!
end---------------------------------------------------
Building1_FAA_6F_SW3 #copy running-config tftp:
^
Invalid entry % detected at ' ^' marker.OK, so the information you provided in your latest messages confirm that the privilege level you get via telnet/vty is different from the one you get via the console. This is due to the configuration of AAA which applies to the vty ports but not on the console port.
So if you want the same rules apply to the console port, then you must configure the port console for AAA as well.
If you don't want these rules then you need to remove the AAA configurations. The best way to remove these is by typing 'no new aaa - model' However, careful not to lock you out of the unit. Make sure you have local accounts with the privilege level 15 and you also know the active password/secret.
I hope this helps!
Thank you for evaluating useful messages!
-
Circuits on Cisco Switch SG200-50
Hi all
I'm trying to inter vlan routing using Cisco Switch SG200-50 with router Cisco 1941. The router I created three subinterface for VLAN1, 2, 3 and VLAN1 is vlan native. I have a LWAP with Cisco WLC connected to the same switch. I have activated assignemnet vlan dynamic using Windows /NPS. RADIUS Wireless successfully user can authenticate as well the vlan is assigned, but unable to ping the router subinterface.
On the switch, you must activate the trunk port connected to the router ports and AP, tried all means, what makes the trunk port and General, nothing worked. users are unable to ping the gateway.
If you have worked on this switch, pls help how to on this subject.
If the Cisco technical support team can help me, that would be great
Thanks in advance
Concerning
Joe
Hi Joseph, creating a general port and disable the input filter and label properly login vlan. Also make sure your sub interface are dot1q.
-Tom
Please mark replied messages useful -
C300 Cisco switches when Cisco is considering additional CDP?
Dear all,
When Cisco plans to support CDP on C300 switches?
I have it configured with LLDP based on the document "Adding a Cisco Switch series of 300 Business from small to SBCS 2.0", but this isn't the perfect according to me
Kind regards
Vellum Tsekov
Vellum,
We are very close. We anticipate releasing the firmware supporting CDP, CLI and several other new features this month - June 2011.
Ivor
-
MacBook as Cisco Switch profiles in 2.1
I'm experimenting with trying to Mac to the profile to the ISE. 2.1. I tried installing AnyConnect, and for some reason he sees it as a Nexus 7000 switch.
Here's the debug info
Attribute: AAA-server value: ise-2
Attribute: Airespace-Wlan-Id value: 5
Attribute: AllowedProtocolMatchedRule value: EAP_Chaining_Wireless
Attribute: AuthenticationMethod value: MSCHAPV2
Attribute: AuthorizationPolicyMatchedRule value: default
Attribute: BYODRegistration value: unknown
Attribute: CacheUpdateTime value: 1465417705907
Attribute: Called-Station-ID value:20-3a-07-66-96-20
Attribute: Calling-Station-ID value:a4-5e-60-cf-81-83
Attribute: CreateTime value: 1464896196500
Attribute: DestinationIPAddress value: 10.10.207.156
Attribute: Value DestinationPort: 1812
Attribute value: DetailedInfo: authentication succeed
Attribute value: IP address: 10.10.204.114
Value of the attribute identifier: Device:
Attribute value: device Port: 32772
Attribute: Value Type Device: Device Type #All Types of devices
Attribute: DeviceCompliance value: unknown
Attribute: DeviceRegistrationStatus value: NotRegistered
Attribute: value:A4-5E-60-CF-81-83 EndPointMACAddress
Attribute: EndPointPolicy value: Cisco-switch
Attribute value: EndPointPolicyID: 4afc4ae0-6d8e-11e5-978e-005056bf2f0a
Attribute: EndPointProfilerServer value: ise-2
Attribute: EndPointSource value: RADIUS probe
Attribute: FailureReason value: 5440 abandoned Endpoint EAP session and began again
Attribute: FirstCollection value: 1464896196418
Attribute: value Framed-IP-Address:
Attribute: value Framed-IPv6-Address:
Attribute: IdentityAccessRestricted value: false
Attribute value: IdentityGroup: profile
Attribute value: IdentityGroupID: b132c920-6d8d-11e5-978e-005056bf2f0a
Attribute: IsThirdPartyDeviceFlow value: false
Attribute: LastActivity value: 1465417705904
Attribute: LastNmapScanTime value: 1465245395228
Attribute: value: a place #All locations
Attribute: LogicalProfile value: infrastructure network devices
Attribute: MACAddress value: A4:5E:60:CF:81:83
Attribute value: MDMServerID:
Attribute: MatchedPolicy value: Cisco-switch
Attribute value: MatchedPolicyID: 4afc4ae0-6d8e-11e5-978e-005056bf2f0a
Attribute: Value MessageCode: 5440
Attribute: NAS-IP-address value: 10.10.204.114
Attribute: NAS-identifier value: WLC-3
Attribute: NAS-Port value: 1
Attribute: NAS-Port-Type value: Wireless - IEEE 802.11
Attribute value: Network Device Profile: Cisco
Attribute: NetworkDeviceGroups value: location #All locations, Types of devices Device Type #All
Attribute: NetworkDeviceName value: WLC-3
Attribute value: NetworkDeviceProfileId: 8ade1f15-aef1-4a9a-8158-d02e835179db
Attribute: NetworkDeviceProfileName value: Cisco
Attribute: NmapScanCount value: 1
Attribute: NmapSubnetScanID value: 0
Attribute: YES value: Apple, Inc.
Attribute value: PhoneID:
Attribute: PolicyVersion value: 32
Attribute value: PortalUser:
Attribute: PostureApplicable value: Yes
Attribute: PostureAssessmentStatus value: NotApplicable
Attribute value: PostureExpiry:
Attribute: PostureStatus value: unknown
Attribute: RadiusFlowType value: Wireless802_1x
Attribute: RadiusPacketType value: AccessRequest
Attribute: RegistrationTimeStamp value: 0
Attribute value: response: {RadiusPacketType = drop ;}
Attribute: SSID value:20-3a-07-66-96-20
Attribute: SelectedAccessService value: lack of access to the network
Attribute value: SelectedAuthenticationIdentityStores: the internal users, ise-2, All_AD_Join_Points
Attribute: SelectedAuthorizationProfiles value: DenyAccess
Attribute: Service-Type value: box
Attribute: StaticAssignment value: false
Attribute: StaticGroupAssignment value: false
Attribute: StepData value: 4 = standardized Radius.RadiusFlowType, 5 = EAP_Chaining_Wireless
Attribute value: TLSCipher: ECDHE-RSA-AES256-SHA
Attribute: TLSVersion value: TLSv1
Attribute: TimeToProfile value: 44
Factor of certainty attribute value: Total: 30
Attribute value: UniqueSubjectID:
Attribute: UpdateTime value: 1465245396597
Attribute: allowEasyWiredSession value: false
Attribute: Host-name value:
Value of the attribute: ip:
Attribute: value operating system switch: Cisco Nexus 7000 (NX - OS 4.2.6) (99% accuracy)
Attribute: result of operating-system value: Cisco Nexus 7000 switch (NX - OS 4.2.6) (99% accuracy)
Attribute: SkipProfiling value: falseYes you must add the ISE server in your help-dhcp (dhcp relay) in order to obtain information about the DHCP request to profile correctly the devices.
Even after setting correctly ISE in your DHCP relay, you aren't able to profile?
-
Turn on the mtu on cisco switch and cisco user server
Hi all
someone got bad luck turning on the mtu on their cisco switch? I guess I need to turn it on for all because the command is for all ports on cisco catalyst and my server switch is nearby to my user of switches and a broadband bandwidth 6 G or 6 ports, I need to turn it on for all user ports?
Thanks for any comments, that you can add.
I assume you mean Jumbo frame support! You shouldn't have any problems with that. Please take a look at for example http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a008010edab.shtml for more details and the configuration of the different switches. According to the model, the parameters are for dedicated ports only or the entire switch. In the case of the switch everything you will need to reload (reboot) switch, so be careful.
André
-
My Ipad air2 does not start. Tried hold it together switch with on/off switch. Apple logo appears for about 15 seconds and then turns off again.
Is there another way to start the IPAD?
Try the steps here:
-
How to drag a desktop with the magic trackpad icon?
How to drag a desktop with the magic trackpad icon? It is coupled with a Mac Mini El Capitan 10.11.4 running.
Thank you.
Place the cursor on the icon then press on and hold and drag your finger across the surface of the touchpad.
If problem, then check your trackpad preferences.
Note also you maybe isn't able to move them they will break again) if other that None is selected in the sort by if you hold with two fingers and choose
-
Have Windows 7 running on Parallels Desktop with a Mac. Get "setup.exe is not a valid Win32 application" when trying to download a program with Windows Explorer. I can download from these sites with Vista and XP with other computers. Now, I can't download the programs that are supposed to solve the problem! including FoxFire
Try to download from this site:
- Firefox 8.0.x: http://www.mozilla.com/en-US/firefox/all.html
-
I can't get firefox to place a website icon in my desktop with it goes generic
I can't get firefox to place a website icon in my desktop with it goes generic
If you drag a link or a favicon on the left end of the address bar on the desktop to create an internet shortcut shortcut then gets the icon of the default browser.
If you want a different icon (favicon) then you must assign you this icon for the shortcut on the desktop (right click: properties).
You can usually get the favorite icon if you add 'favicon.ico' to the main area of a website (for example http://www.mozilla.com/favicon.ico ) to display favorite icon in a tab and save this image to a folder or see if you can find it in "tools > Page Info > media.
Maybe you are looking for
-
After the upgrade to the latest version, Firefox won't open
I am running Windows 7. After updating to the latest version, Firefox opens. I get a notice when I try to open Firefox, saying "failed to load XPCOM. Is there any way I can cancel the update, so I can get Firefox to open. This is my favorite browser.
-
New HDD on my Satellite P500-1F1
Nice dayPlease can someone advice me, if this HARD drive fits in my laptop is a bit higher? HARD drive: Toshiba MK1059GSM 1 TB SATA 2.5 "portable hard drive (standard height of 12.5 mm)Laptop: Toshiba Satellite P500-1F1 Thank you! Jan
-
Satellite P500 overheats constantly all game
I had the laptop for about 3 months now and for the last 6 weeks, he was constantly overheating.I brush the air vents to get rid of the dust, but it doesn't seem to help. The temperature will constantly be at 47%, then suddenly it will overheat after
-
Equium M70: The keyboard does not work
I have a problem with my keyboard. The letters M, J, U, 7 do not work. I had intermittent problems until this morning, which were easily resolved by restarting: now there is nothing NADA. This came at a very bad time - I have a huge presentation tomo
-
How to uninstall McAfee? Standard "uninstall/change" does not work.
McAfee expires 06/16/11. Bought Norton, understood he could delete McAfee. Installed Norton, but - and I have - could not uninstall McAfee. In addition, McAfee does not entirely - open only a blank white rectangle appears - so can't access the pro