Favorites of ACS 5 reports

Similar Questions

• ACS standard reports: must see attrib [04] "NAS-IP-Address.

  Hello

  We have the following topology.

  NAS--> another RADIUS of the seller (proxy)--> ACS 4.0

  AUTH works very well, but we have problems with the standard reports offered by ACS.

  The past auth report that we must see the address IP SIN original, attrib [04]. The radius of third party (acting as agent) send the attrib as expected (we check using sniffer captures GBA).

  What selection need allows us to see this attrib on report?

  thnks

  Juan

  Ahhh. I see the problem.

  The report "past authenications" uses the internal dictionary ACS (who manages the two RADIUS & GANYMEDE +).

  When CSRadius writes a sound entry using the AAA client ip address (IE peer address) as the value for NAS IP rather than the actual NAS-IP-Address attribute.

  Years ago I coded this part and I don't remember why I chose to use peers instead of the nas IP address. I suspect its because in the network config, you add the address of peers (existantespourlesproduitsphytopharmaceuti) and not to the original device. If the the auths newspaper spent has peripheral origin ip would not match the network configuration.

  I think that this can be corrected, ACS has an attribute called "Source NAS" but which I think has been added, never used. The service of CSRadius could stuff the nas-ip-address there.

  But of course I do not work for Cisco more - so you don't have to ask them to make the change!

  Mounira

• Accounting on ACS 5 report event

  Hi all

  I remember GBA 4.2, we can see all orders of this type of user in the console of the router cisco for example, after the user to connect to a router (with orders of AAA and ACS) when we saw on the newspaper article. When the user type "show run" on the log of account you can see. but GBA 5.1 where and how we config and see them?

  Thank you

  Kamal,

  First, you must configure the device to send info credit aaa to GBA box.

  GBA 5.x, you can find the info of accounting to the next place.

  Monitoring & reports >

  ... >

  Reports >

  Catalog >

  AAA Protocol

• AAA GANYMEDE + accounting - CLI question by user not appear in the report of the ACS.

  Can I know why CLI cancelled by the user does not show on GANYMEDE ACS accounting report. The length of time is displayed, but I also wanted to connect what is the commands issued by the user.

  WHA is missing here?

  enable AAA authentication login VTY P1_ACS local group

  Group default AAA authorization exec local P1_ACS authenticated by FIS

  AAA authorization exec CONSOLE none

  AAA exec by default start-stop accounting P1_ACS group

  AAA commands 5 default start-stop accounting P1_ACS group

  AAA commands 15 arrhythmic default accounting P1_ACS group

  Accounting logs command is stroed in the newspapers of the administration of Ganymede.

  There is also a known issue on ver 4.1.1 and we must

  apply the ACS 4.1.1.23.5 patch to fix the problem.

  Patch for the unit is available on

  http://www.Cisco.com/cgi-bin/tablebuild.pl/ACS-Soleng-3DES

  The patch name: ACS SE 4.1.1.23.5 rollup

  Acs hotfix for windows is available on

  http://www.Cisco.com/cgi-bin/tablebuild.pl/ACS-win-3DES

  The patch name: ACS 4.1.1.23.5 rollup

  CCIE Security

• ACS 5.8.0.32.2 only empty site Cumulative Patch 2 reports

  Hi, I applied on our 5.8.0.32 ACS server the new Patch 2

  hostname/admin# show version
  
  Cisco Application Deployment Engine OS Release: 2.2ADE-OS Build Version: 2.2.2.015ADE-OS System Architecture: x86_64
  
  Copyright (c) 2005-2015 by Cisco Systems, Inc.All rights reserved.Hostname: hostnameVersion information of installed applications---------------------------------------------Cisco ACS VERSION INFORMATION-----------------------------Version : 5.8.0.32.2Internal Build ID : B.442Patches :5-8-0-32-15-8-0-32-2

  After installing the patch, I did the reboot of the device, and all services were running successfully. I could connect to ACS server bot when I want to open the report page, I get only a blank screen / white. See the screenshot I attached. capture.PNG I tried with different browsers (Firefox / Internet Explorer/chrome), make everything the same. Then I removed the new patch and restart the services. Then the reports page is now functional again. Is anybody else having the problem too?

  to close the loop here. The following CDETS is associated with this issue

  CSCuz40534 5.8 ACS p2-report showing a blank page for a specific user

  If a user Admin has selected as dynamic role assignment, the user is not able to view the reports, because it shows a blank page.

  If a user has role as static assignment, the problem does not occur.

  This wil be resolved in ACS 5.8 patch3 which should be available in about a months time

• IP Phone + dot1x + ACS 3.2

  Hello everyone!

  The main idea: I need to authenticate Cisco IP Phone connected to C3750 and put it in voice VLAN. Authentication in v.3.2 ACS using the phone IP MAC address.

  There are configuration port on C3750:

  interface GigabitEthernet1/0/2

  switchport mode access

  switchport voice vlan 12

  dot1x mac-auth-bypass

  dot1x EAP authenticator

  self control-port dot1x

  multi-domain host-mode dot1x

  spanning tree portfast

  end

  GBA I created the group "IP telephony", and in its configuration, I checked:

  (1) support Voice-over-IP

  (2) IETF RADIUS attributes:

  Tunnel-Type [064] = VLAN

  [065] tunnel-Medium-Type = 802

  [081] tunnel-private-Group-ID = 12

  There is 000d65707e7a of the user (the IP phone MAC address) in this ACS group.

  When I connect the IP phone to the GigabitEthernet1/0/2 interface, it don't you voice VLAN.

  C3750 #show interface mac address table gigabitEthernet 0/1/2

  Mac address table

  -------------------------------------------

  VLAN Mac Address Type Ports

  ---- ----------- -------- -----

  1 000d.6570.7e7a STATIC drop

  12 000d.6570.7e7a STATIC drop

  In ACS choose 'Reports and activity'-> "Has no tent", I see an error:

  Failure of authentic - 000d65707e7a - access denied the Group Voice-over-IP

  What's wrong? How to configure a group ACS to authenticate IP phone by it of MAC-address and put it in voice VLAN 12 on C3750?

  Thanks for any help!

  7940 will never be 802. 1 X. Neither will 7960. New phones will be.

• Download ACL for VPN users. ACS 4.1 & 1841 router

  Hello

  I have configured the router 1841 as a VPN server. All VPN users get authenticated using RADIUS ACS 4.1

  I need to apply downloadable ACLs by user.

  I configured the Downlodabale ACL ACS. Same ACS event report shows that the ACL is applied to the authenticated user, but traffic is not blocked or past accordingly.

  What is your configuration?

  I think that the more easy to do is to use IPSEC TIV in interfaces, as well as the aaa authorization network and on the radius server, use ip:inacl to the cisco av pair, as

  IP:inacl #1 = permit tcp any any eq 80

  IP:inacl #2 = permit tcp any any eq 443

  ...

  Some documents:

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gtIPSctm.html#wp1090634

• ACS 5.2 authorization policy

  Hello

  is there a method to control access to the WLAN (PEAP) different on the same ACS 5.2 and WLC?

  In other words, ago 14:00 one of the groups have access to the domain network only the other group only have access to the internet
  and maybe a third group with access to both networks.

  Currently if I add new authorization policy, the user will have access to two networks...

  Thank you, in advance.

  Yes HRT is possible, the ssid is transported in the station id called which is an av pair sent in the access-request packet. The called-station-id format is, so you can combine this with the AD1:ExternalGroups and assign the result of access permit or deny access depending on your implementation, you can build your strategy for leave to a compound affection of "called-station-id ends with ssid". Also, the ssid is case-sensitive when acs makes its decision so keep that in mind.

  If you look at the ACS authentication report, you can see the ssid that I am referring to the id of the station called the newspaper.

  Hope that helps

  Tarik Admani
  * Please note the useful messages *.

• AAA accounting records to the RADIUS server

  Im trying to activate recods orders accounting to be send to my server ACS on all my devices, I activated this orders accounting for each level of privilege to follow who types what on my devices, now the problem is that the files are not displayed on my ACS accouting reports, I get everything except the records for the typed commands , any suggestions on what order the put value on my devices to enable this feature... ?

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=security&topic=AAA&TopicId=.ee6e1fe&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cbfe9b8

  The head about it. It points you to a patch for a 4.1 Setup that I assume that you are using.

  See you soon

• The user records.

  Hi, I have a question. When I create a new user to the shared services some users have folder tree (databases, favorite desktop computers, profiles, reports).
  When it is created? We don't have it for some users.
  
  Best regards
  Grzegorz

  Hello

  I think that they are normally created when the user interacts with the workspace - connects, creates preferences or launches Web Analytics.

  Cheers, Iain

• Cannot open reports ACS 5.6

  Hello

  When opening reports in ACS 5.6 I poster a blank page. I use IE 11.0.14 and Java 7 update 17 version. Content of Java is enabled in the browser.

  Any ideas why its failure? I don't see others having the same problem...

  Hello

  I had the same problem. I upgraded from ACS 5.4 (latest Patch) to 5.6 (latest Patch).

  Could it be, that the ACS 5.6 needs Flash to reports Page? (ISE needs Flash, and the new reports Page looks a lot like ISE) Flash is disabled on our platform remotely and on the site of the customer because of security concerns.

  @frodestra: you have active Flash?

  Also, I rebooted GBA surveillance and tried different browsers.

  Best regards

  Michael

• ACS report problem

  Hello...

  I have GBA 2.6 (4) 4 and all the problems are happening:

  Authentication and authorization of the NAS work normally, but the accountants do not work properly. If I use accounting only exec, in the report connected' GBA users appears; OK, if I add the accounting level 0, 1 or 15 commands, users appears in the report is 'connected', but if I use any command (enable, show..., debug, etc.) users disappears in the report and that commands are presented in TAC + administration. I tried using ACS 3.1 and accounting works normally.

  Is this a BUG? If not, why I solve this problem?

  the configuration of my equipment is:

  ======

  Cisco IOS 2620 (C2600-I-M), Version 12.1 T7 (5)

  ======

  Console rate-limit logging 10 except errors

  AAA new-model

  AAA authentication login default group Ganymede + local

  AAA authentication ppp default to group Ganymede + local

  authorization AAA console

  default AAA authorization exec group Ganymede + none

  default network AAA authorization group Ganymede + none

  AAA accounting update newinfo

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 0 arrhythmic default group Ganymede +.

  orders accounting AAA 1 by default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  AAA accounting network default start-stop Ganymede group.

  Default connection accounting AAA power Ganymede group.

  ====

  TKS.

  Yep, it's a bug.

  See http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCdv61239

• No report of Directors GANYMEDE + after upgrading to 4.1 ACS

  Hello

  I was running ACS 4.0 demo version. Everything worked very well.

  After the upgrade, and keep the old configuration, I can't see logs in the reports of the directors of GANYMEDE. I kept the configurations of the router and get the same thing, so I think that the problem lies in the ACS software.

  I tested a few debug, and it seems that the router sends the command that is typed to the ACS.

  Here is the config I have? m using:

  AAA new-model

  GANYMEDE-Server 192.168.X.X XXXXXXXXXXX host key

  AAA authentication telnet connection group Ganymede + activate

  enable console AAA authentication login

  the AAA authentication enable default group Ganymede + activate

  AAA accounting send stop-record an authentication failure

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 1 by default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  AAA accounting arrhythmic telnet connection group Ganymede +.

  Line con 0

  exec authorization no.-AUTH

  console login authentication

  line vty 0 4

  exec authorization AUTH

  authentication telnet connection

  AUTH AAA authorization exec group Ganymede + none

  AAA authorization config-commands

  No.-AUTH AAA authorization exec no

  AAA authorization commands 0 default group Ganymede + none

  1 default AAA authorization commands group Ganymede + none

  default 15 AAA authorization commands group Ganymede + none

  Hello

  It is a known issue, you must apply the hotfix ACS 4.1.1.23.5 to solve the problem.

  Patch for the unit is available on

  http://www.Cisco.com/cgi-bin/tablebuild.pl/ACS-Soleng-3DES

  The patch name: ACS SE 4.1.1.23.5 rollup

  Patch for windows acs is available on

  http://www.Cisco.com/cgi-bin/tablebuild.pl/ACS-win-3DES

  The patch name: ACS 4.1.1.23.5 rollup

  That should solve the problem

  Kind regards

  Jagdeep

  Note: If this answers your question, then please mark this thread as solved, so that others can benefit from.

• Error of org.xml ACS 5.3 Exception when executing reports

  Hello

  5.3 GBA running on a device of 1121

  When you run a report's RADIUS authentication, accounting, etc. is all report, I get the error attached image (org.xml.sax.SAXParseException...). I have not yet found a solution. I'm running another ACS 5.2 device that does not have this error

  If the upgrade to a newer version will solve this problem, the license (5.3) will suffice.

  Any help is appreciated

  Kind regards

  MOE Shea

  Hello Mo,

  I have this error either a browser problem, I recommend you watch the ACS 5.3 release notes and confirm if you are currently using a supported browser:

  http://www.Cisco.com/c/en/us/TD/docs/net_mgmt/cisco_secure_access_contro...

  A restart of services can take care of it as well in case you are using a supported browser.

  Note: Please mark as answer as appropriate

• Export of data in reports ACS 5.7

  Dear team,

  I deal with server ACS 5.7 and can not find a way to export the radius aaa authentication logs.

  When I click on the export from the reports window-->---> authentication RADIUS AAA Protocols, GBA asks a repository, if I understand correctly this is an external server. Isn't?

  Anyone know if it is possible to download exported directly?

  Thanks in advance.

  Gabriele

  Hi Gabriele,

  This feature has been changed since version 5.6 of the CSA, the only option is by uploading it to a repository and options to download it directly from the GUI is no longer available:

  http://www.Cisco.com/c/en/us/TD/docs/net_mgmt/cisco_secure_access_contro...

  Note: Please mark as answer as appropriate