Group mappings

Similar Questions

• ACS - external replication for DB Group mappings

  We have two engines Solution ACS (4.0), which essentially act as primary and secondary AAA servers. Is there a way to replicate the external database from an ACS group maps to another? The replication is currently copy the internal primary to our secondary server ACS group successfully, but we still create the external database group mapping on both primary and secondary devices. It's kind of tediuos, and I'm afraid that someone can configure the mapping on the primary and don't forget to set up on the secondary. Any help is appreciated.

  Thanks in advance.

  Try to reproduce the network access profiles. I recall that includes pretty much everything!

  Mounira

• Setting up authentication by using ad group mappings

  Hello

  I recently installed ACS 5.3 and I try to configure as follows:

  (1) devices are separated in places and device types.

  (2) ACS performs authentication by using AD.

  (3) the user must be in the specific ad group in order to access a device specific type/location.

  I'm testing my setup with WCS. The server has been added to the list of network devices and placed in the appropriate place/device type.

  Under the rules of access, I have set up a named (NAAS-WCS) Access Service that has an identity and mapping group structure.defined as follows:

  * Identity: Condition (NDG:Device Type-> in all Types of devices: WC), results (identity store: AD1).

  * Mapping group: (Condition: AD1:ExternalGroups), results (identity group: all groups: SBD-SEC-ENG).

  What I'm trying to implement is the following rule:

  If (device in device type WC) and (the user in the Group G-CRP-SEC-ENG) then allow access otherwise block.

  I added the groups in the AD of the server configuration and used this group in the definition of the rules. The error I get from Ganymede when I try to open a session is attached in jpeg format.

  Anyone know where I am going wrong? It's the first time I used the new ACS system.

  Thank you

  Sami Abunasser

  I had a similar problem, since any request came as CHAP/MD5, which is not the same as MS-CHAP v1 and v2 that we chose the GBA.

  How do you try to authenticate users? Web page or dot1x? If it's a web page, choose PAP as authentication and you should be fine.

• ACS 5.1 - can external users be members of groups inside?

  Currently I use ACS4.1 to authenticate access admin network routers and switches. Users are authenticated against a Microsoft AD domain but belonging to a group is managed by the Association because we are unwilling to deal with bureaucracy AD company on the ad groups.

  I'm migrating to ACS 5.1 due to its much more effective and more flexible policy problems try to get external users belong to groups inside?

  I don't REALLY want to have to create ad groups and do things in whole group mappings. Am I missing something obvious or I'm he overthinking?

  Thank you

  Nathan Spitzer

  SR Network Communications analyst.

  Lockheed Martin

  This is possible by creating a sequeuence of indetity:

  Users and identity stores >... > sequence identity store

  (1) select 'password base' as an authentication method

  (2) in "Authentication and recovery search attribute list" select AD1

  (3) in the "search for the recovery of additional attribute list", select InternalUsers

  (4) select the Advanced Option"

  If the internal host not found or disabled user then quit sequence and treat it as "User Not Found".

  This can then be selected as the result of a politics of identity. What it does authenticate using Active Directory. If authentication fails is considered an authentication failure. If authentication is successful, it will then look for the user in the internal user database. If there is no active users in the internal user database then sequence identity will be treated as if it has failed with the "authentication status" of "UnknownUser.

• User in several Windows/ACS group. Deny a permit

  I have several groups on ACS each tied to a group of AD windows.

  I have a VPN concentrator and a wireless Lan controller.

  I use ACS to authenticate access to the time, but I would like some VPN users have wireless users too, not all.

  If I use NAR to limit the "VPN users" to access WLC device all users with access to the VPN is not wireless, even those who are in the wireless group.

  Is - it there anyway to operate?

  This is how it works.

  Lets say you have three different groups on ad for NetworkAdmin, RouterAdmin,.

  Wireless.

  Go to the external user database == database group mappings == Windows NT/2000 == select the field

  to which you log == Add mapping.

  Select the ad NetworkAdmin group and ciscosecure Group 1 card select the ad RouterAdmin group and map it to ciscosecure Group 2

  Select the ad wireless Group and map it to ciscosecure Group 3

  Mappings of working groups in the order in which they are defined, first set up mapping is

  considered first and then second, third and so on. If a user is in AD Group NetworkAdmin and

  which is mapped to the ACS 1 group and it's the first configured mapping is

  First of ALL (if there is a user in the Group NetworkAdmin, it is always mapped to ciscosecure

  1 and NO further mappings for this user group is enabled and the user is authenticated or

  rejected)

  Scenario: If you have a user called cisco, group NetworkAdmin, cisco1 in RouterAdmin

  Group and cisco2 wireless. They will be always dynamically mapped to group 1, 2 ACS

  and 3 respectively as above mappings.

  You can see the mappings on authentication passed to users as to which group are

  they are mapped to.

  SCENARIO:

  Now if you want a NetworkAdmin user to authenticate to the NetworkAdmin devices and not

  devices or wireless RouterAdmin you should apply NARs for Group 1 because

  NetworkAdmin users connect to this group. Which will allow you access on the Group

  basis for a particular NetworkAdmin NDG or NetworkAdmin individual NAS device.

  NOTE:

  If you are applying NARs for VPN or wireless devices, you must configure two IP

  Base AND CLI/DNIS founded together as NARs were originally designed for cisco IOS for

  routers and switches.

  IMPORTANT: If a user authenticates successfully to the database AD once, his user name is cached on the database of ACS (NOT password) the only way to remove the previously cached user name is to go to usersetup find this user and manually remove it.

  ACS will not support the following configuration:

  * A user active directory which is a member of the 3 AD groups (groups A, B and C) * 3 people

  groups are mapped within FAC as follows-> A Group1, Group2-> B and group 3-> C.

  * The user is in the 3 groups, however it will be always authenticated by Group 1 because

  This is the first group, it appears in, even if there is a configured NAR summons

  the group-specific AAA clients.

  However there are if your maps are below order...

  Groups NT groups ACS

  A, B, C ===> Group 1

  A ===> group 2

  B ===> group 3

  C ===> Group 4.

  You can create a rule DIFFERENT for users a, B, C by configuring the NARS in Group1.

  This rule applies for use ONLY if it is present in ALL three groups (A, B and C).

  You can create a rule for users in Group A (Group 2)

  You can create a rule for users in Group B (Group 3)

  You can create a rule for users in Group C (Group 4)

  Here I am also attaching links related to the group mapping in the user guide:

  Order of group mapping:

  http://www.Cisco.com/univercd/CC/TD/doc/product/access/acs_soft/csacs4nt/acs33/user/QG.htm

  #wp940485

  Kind regards

  ~ JG

  Note the useful messages

• Mappings related inventory system SRM question

  Hello

  I was curious to know what the expected behavior should be with the inventory of the network related mappings in the following example scenario:

  Group mappings of protection previously configured at the protected Site

  Recovery plan already set up on recovery Site

  I am currently connected to the virtual Center on the "Protected" site server and access the mappings of the inventory of my groups that I have configured previously. I now want to change the virtual network vswitches that uses these virtual machines protected in a failover scenario in respect of the Dr. I created a new virtual switch on the site of DR already before entering the SRM tab on the protected site.

  At this point, I have to do to change the vswitch that will be used on all vms preserved my at a newly created the DR site. The change is successful without error.

  I now have to connect to the virtual Center Server at my place of DR and go to one place holder vm objects which is part of the recovery plan and note that it is still configured to use the previous vswitch just change once connected on the protected site.

  My question is this. These should automatically place holder VMs has been updated to use the new vswitch configuration? If they were to be updated automatically, what would be the reason why they are still configured to use the old vswitch?

  If they were not to be updated automatically, is still once it is reasonable to assume that I'll just have to "Edit configuration" on each of the VM reserved space to use the new vswitch and everything should be good?

  Thanks for any info you can provide

  Hello

  Existing placeholders are not supposed to get automatically updated when they change the mappings of an inventory. Mappings of the inventory are 'default' for new protected virtual machines.

  If I remember correctly, recovered VMs will be attached to the 'old' portgroup during a failover.

  I believe that the same is true when you manually reconfigure the placeholder.

  Probably, you need to restore the virtual machines.

  Michael.

• WLC Flex connect local authentication does not work

  Hi guys,.

  I'll give you a brief description of our current flexconnect configuration. We have APs configured mode flexconnect in the remote office and in local mode in the local office. Wireless LANs are the same in both locations and we have detected a problem in one specific SSID. It is a voice SSID and configured in 802.1 x mode that authenticates to a RADIUS server in the remote desktop.

  We detected only when the WAN line gets collapsed the IP phones unplugged wireless SSID and when the WAN line become free, reconnected.

  We have seen that we can configure Flexconnect local auth mode to avoid this problem, but it of esn can't work properly. We have set up APs in remote site with an IP address static and configured as NAS in the RADIUS server, but we did not see any which authenticayion in th RADIUS server package when change us the SSID to «FlexConnect auth» local

  Can you give me an idea to help solve this problem?

  Thanks in advance.

  Joel

  I suppose that clients connected by access points Flexconnect have problems where the WAN connection is down (?)

  It depends on your current configuration and security policy what are the feasible options in this scenario. If there is an available RADIUS server - who can still authenticate your users while the WAN line is down, you can configure your access points to access this server directly. You must use a FlexConnect for this group and configure the external server on the general tab, in the menu "AAA". You already made the point of access-static IP addresses and add them as clients on the RADIUS server, then it should work.

  Another option is that in the event of failure, access points to will authenticate the client based on a local data base and/or certificate. Also, this requires a FlexConnect group and the option 'Enable local authentication AP'. For example: If you are using PEAP and a specific user for VoWLAN account you can download the server and the certificates of CA to the WLC and add the credentials of this account to build the same configuration with the external server. Downside of this is the lack of central logging that may not match your security policy.

  Remember that the access point itself can't remember the relationship between the access point and FlexConnect group, in both scenarios, you need to configure all controllers manually with these MAC to the Group mappings. This behavior is different in comparison with the "groups of AP" what access point you remember during the passage of the controllers.

  The "FlexConnect local authentication" option on the SSID itself forces always use local authentication that has been configured on the FlexConnect group even if the connection with the WLC is available. I don't think that it is feasible to use it in your scenario.

  Please rate helpful messages... :-)

• Problem with Cisco ACS and different areas

  Hello

  We are conducting currently a problem with Cisco ACS that we put in place, and I'll try to describe:

  We have ACS related directory AD areas, where we have 2 domains and appropriate group mappings.

  Then we have our Cisco switches with the following configuration,

  AAA new-model

  AAA-authentication failure message ^ CCCC

  Failled to authenticate!

  Please IT networks Contact Group for more information.

  ^ C

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local

  AAA authorization network default group Ganymede + local

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  !

  AAA - the id of the joint session

  But the problem is that with the users in a domain, we can authenticate, but not the other. Basically, the question is that when we check on the past of authentication, two authentications are passage and the display of 'Authentic OK', but on the side of the switch, there is a power failure.

  There may be something wrong with the ACS?

  Thank you

  Jorge

  Try increasing the timeout on IOS device using radius-server timeout 10.

  Do we not have journaling enabled on the ACS server remotely?

  -Philou

• Fabric connecting LDAP authentication

  Hi guys,.

  I am running 2.0(2q) UCSM

  I was wondering if there was a way of configuring LDAP authentication by logging in via SSH to the FIs?

  I installed all group mappings and adds users to these groups without any problems, but I can't seem to figure out how to get LDAP for authentication when you use a session SSH on the FI.

  Someone at - he put in place before?

  Thank you

  Doug,

  Are you sure you are using the correct syntax when connecting via CLI?

  If AD authentication works through the GUI, it should work in CLI.

  http://www.Cisco.com/en/us/docs/unified_computing/UCS/SW/CLI/config/Guide/2.0/b_UCSM_CLI_Configuration_Guide_2_0.PDF

  

  Kind regards

  Robert

• Don't allow the computers in the domain to connect to the WLAN

  I'm going in circles here.  First of all, I apologize for posting this question if it has been included in the past (if you have another thread to offer, I invite you to point me to it!)  I did a little research on several forums and articles and support sites.  But I'm missing something.

  I work with HP Procurve 420 access points (they bought these before starting.)   I have Cisco Secure ACS for windows 4.2 installation.  I have configured the external database group mappings to active directory and vlan assignment by group dynamics.  I have install the certificate from the ACS, and CA is our own ca on our network server.  Users can successfully authenticate and connect to the vlan appropriate right now.  That's where I'm stumped.  I want only our computers to connect.

  1 how/what/where can I go from here if I want only to allow computers on our domain to connect to the connection wireless company?   Set up some kind of another certificate that gets distributed by GPO or something?  Or is there something in ACS I can change?

  2. What is the ACS certificate, I already installed on the ACS server do?  Is it encrypt the authentication process that takes place when a user establishes a connection?

  3. How do you guys did this on your own networks?  I go about it the wrong way? What do you suggest me?

  The final goal is that I want a user with a laptop of society must be able to connect to the wireless network and to authenticate and to be placed in the appropriate vlan (which works now), but I won't be able to do it with any device, I would like to some how manage and restrict computers can connect.  Help, please!

  1. I think that you can use the group mapping (see page 603 of the ACS 4.2 user guide) to use the domain computers group.  Deny access to any other group (via the No. Access Group)

  2. to the Spiderbeam of each EAP conversation, the ACS server will provide the certificate as proof of who he is.  If the client trusts the cert, then the client will continue authenticatin process.  It's how you help ensure that your clients connect only to your network.  If you configure clients to ignore the cert, and someone else is a network with your SSID, your customers can try to connect.

  3. many companies to complain about not being able to contol that devices connect to their networks.  It is a way to do it.  By simply using PEAP with user accounts, any portable computer iPhone/iPad/staff / anything that can connect to your wireless network, if the user knows how to set up.

  If go you ahead with this, please post back and let us know how it works.

• Secondary ACS authenticates not to dynamic users

  Hi all

  I have two ACS server for windows with version 4.2. My problem is that, if the primary ACS server is down, dynamic users from the database windows in unable to authenticate with the ACS secondary. Please note that if a user is added to the ACS, this user can authenticate with the windows database. Only the dynamic mapping is not the case with the second ACS server.

  A quick response will be appreciated.

  What is in the database of Windows in both the points of the unknown user policy? Dynamic users are active under the unknown user policy?

  Are these servers ACS for Windows or the ACS SE with a Remote Agent installed on a member of the AD Server?

  If they are remote Agents, see the external database > Windows Configuration > selection of the Remote Agent. The same remote Agent is selected on both ACS servers?

  Please be aware that if you change the order of the RA he would remove all your group mappings.

• ACS Appliance Agent remote problem

  Hello

  We have depending you on the situation:

  -2 x ACS SE

  -2 x ACS Agents on member servers remotely

  -2 x ASA

  We would like to authenticate the VPN users connecting to the ASA via the ACS and active directory.

  I have configured the remote agent following this link:

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/3.3/installation/guide/remote_agent/Rawi.html#wp289426

  But we are not able to pick up groups active directory to the AEC gui--> user external database > database group mappings > Active Directory > new Configuration.

  On the domain controller, we get the error ID 1030 and 1058, someone had these problems too?

  Thanks in advance and best regards

  Dominic

  Most likely, this is a Permission problem. What OS and SP you use.

  Have you tried to run the remote agent by using the LOCAL account instead of the service account that you created?

  Kind regards

  ~ JG

  Note the useful messages

• How to create a custom page for ADF security?

  Dear all,
  
  Now I am developing an application. I am facing the problem of security. Now I need to guarantee me the application (user, group, role etc...)
  
  Oracle recommends me to use internal LDAP WebLogic or OID. But how to create custom for this security management pages? Are there examples?
  
  Reason:
  (1) the customer does not have LDAP
  (2) Admin or Manager client without having to access Weblogic server (no sense).
  
  We need to create pages on my request and is managing the internal users, role and group using LDAP or OID.
  
  Thank you.

  You don't need to create an additional custom page for the use of LDAP. Just set up security WLS and group mappings to use users configured on the LDAP server (any).

  If you already use the ADF security, you should have a created even when custom login page. This can be used. (as described here: http://www.oracle.com/technetwork/developer-tools/jdev/ccset29-all-089763.html)

  HTH,
  -olaf

• Group to the Windows database mappings

  Hello

  I am trying to create a series of mappings between a single Windows group groups and one group ACS. I use a unit of ACS 4.0 with a Remote Agent ACS for Windows on a 2003 member server.

  I can add the database with success and map to the domain. When I create a new configuration, the Windows groups list correctly, but when I try to create the map, I find myself with the NTGroups mapped to "All other combinations" and my group of CiscoSecure put to that I've selected. I'm unable to add other mappings to simply replace the premiera. It behaves as if this database of Windows is actually another format that allows only one mapping?

  I noticed there is a limitation on the user, being member of more than 500 groups and I was wondering if this is applied at the point where the groups are listed, or when the user actually attempts to open a session. I'm reasonably sure that I have more than 500 groups.

  I was able to do 1:1 mappings in previous versions of ACS and Windows product.

  Thank you

  Scott

  Hi Scott

  This seems to be a question of Java applet. Try to upgrade your Java.

  Yor map 13:00 group a group ACS but the GUI (web interface) sends that information to the ACS. ACS is the default mapping.

  Try to make the mapping again & again. It will work at any given time.

• Mappings of dynamic interface of SSID in the AP groups

  Hello, I have a few questions about the mapping of the SSID to the interfaces within the AP groups.  My controller runs 7.4.110 and has about 150 APs configured on the controller.

  5508 pair UNIQUE for all APs authentication mode

  50 are on the same campus as a controller. (APs in Local Mode)

  100 are 40 other WAN sites. (APs to FlexConnect Central, site based authentication DHCP)

  3 SSID broadcast to all sites

  Corp - 802. 1 x

  Warehouse - Auth WPA2-PSK-Mac

  Reviews - wide opening with a Cs & Ts that you accept very similar to a hotel

  Controller interfaces

  Management interface

  The warehouse - dynamic interface

  Customer interface - dynamic

  I have set up groups of AP for each remote location. My question is this:

  For these places distant in the AP group configuration, should I maps all the SSID to the management interface, or I should map it to the dynamic interface?  I.e. to Corp.--> Management, warehouse--> warehouse, guest--> comments.

  For local access points, I do the SSID mapping for each interface, but I don't know that it's important for my remotes.

  Help is greatly appreciated.

  For your remote offices FlexConnect APs.

  If WLAN is configured for local switching, then users will get IP of the interface that you corresponding in the mapping section vlan in the AP configuration. (interface by default yield under general WLAN or the AP group WLAN configuration section is not a problem)

  If WLAN is configured for central switching, then you must assign a correct dynamic interface under the WLAN-> General section or AP group WLAN configuration.

  Below material Ciscolive will give you good overview of all the available option & design guide.

  BRKEWN-2016 Branch Office Architecture wireless

  HTH

  Rasika

  Pls note all useful responses *.