How to separate requests for authentication to GBA 4.2

Hello

I have a 4.2 ACS for AAA. Right now I use this server to authenticate users this connection for all my devices cisco (routers, switches, ASAs, APs) and also to authenticate users for remote access VPN to ASA.

The problem I have is that VPN users residing on another group in ACS are able to authenticate to log to manage network devices and it is a problem of security. I need the vpn users only being able to authenticate to the vpn and not be able to authenticate to connect to network devices.

Any ideas? is it possible to separate requests for access radius and vpn connection?

Hi Fernando,

Yes it is possible to restrict your users only VPN to VPN - ASA. If you want that they do not have telnet/ssh/http access with other devices in the network, then you can go for NAR (network access restriction).

The only thing you need to know what we are calling-station-id. I think it's an ip address. You can check this activity and reports > past authentication for VPN users.

Here are the steps:

GBA > go to the VPN group > Edit > search for NAR > under Ip based NAR > set the action to "DECLINED" > select the devices (routers/switches) you want to deny access to > put * for the port field and address > click on submit + restart.

Doing this will of users can connect through vpn and unable to do ssh and telnet.

I have attached the screenshot of the same thing (I did for 6509 switch)

HTH

JK

Please evaluate the useful messages-

Tags: Cisco Security

Similar Questions

  • How to eliminate requests for password Keychain with a log in

    Whenever I connect to Macbook Air multiple popups request password to keychain for different public services. How can I stop this from happening?

    Reset your keychain

    Keychain Access > Preferences > reset my default Keychain

  • 'main' arguments when starting program - how does communicate requests for file to Windows programs?

    Someone know what Windows up or sends to a program when it is first started? I don't know yet what to look under. In particular, if I double click on a document (say a data file that I generated with my LabWindows/CVI program) and I have my default program for this file under Windows, how is my program knows it when it starts? (I.e. a double-click on a Word document starts Word and opens this document.) In addition, what happens if my program is already running? No doubt, Windows sends a message to the programs telling them that the user has requested to open a file of the appropriate type.

    Windows passes the name of the file you clicked on the application as a command line parameter: the attached program lists simply all the command line arguments received in order to check how it works. I did a few tests by creating a '. '. XYZ"file and then associate this program with it. Then, I created a new operation 'Print', defined in this way:

    and received the correct settings, I simply double click on the file and when I click right on it and choose 'print '.

    (Note: argv [0] is always the name of the program itself: command line options, if any, starts at index 1).

    I can't say anything about your second question: I know that the CVI has a way to see if another instance of the application is running (see the CheckForDuplicateAppInstance command in the utility library), but I don't know how it is implemented.

  • ISE server receives requests for authentication of the bridge VLAN, not the IP Address of the switch management

    Hello

    A 3850 catalyst switch has VLAN 20 (10.18.4.32/29) defined on it, which has a 10.18.4.38 gateway:

    D01-01-BWY #show ip short int vlan 20
    Interface IP-Address OK? Method State Protocol
    Vlan20 10.18.4.38 YES manual up up

    A server of ISE (SNS3415) is connected to a port configured on VLAN 20, with IP address of 10.18.4.33.

    01-BWY-D01 has to a management interface of 10.18.4.17.

    I created this switch as a device network in ISE and activated the RADIUS config and then configured the switch with the following commands:

    RADIUS attribute 6 sur-pour-login-auth server
    RADIUS attribute 6 support-multiple server
    Server RADIUS attribute 8 include-in-access-req
    RADIUS attribute 25-application access server include
    dead-criteria 5 tent 3 times RADIUS server
    RADIUS-server host 10.18.4.33 auth-port 1812 acct-port 1813 borders 7 1521030916792F077C236436125657
    RADIUS-server host 10.18.4.35 auth-port 1812 acct-port 1813 borders 7 02350C5E19550B02185E580D044653

    radius of the IP source-interface GigabitEthernet1/0/1

    The problem:

    When I test the functionality of RADIUS using the following command, it fails. HOWEVER, the customer (switch) IP listed in the error log in the front door of the VLAN 20 (!):

    test the aaa group RADIUS server 10.18.4.33 auth-port 1812 Capita123 user radius acct-port 1813! new-code

    10.18.4.38 is the gateway IP address of the VLAN that hosts the servers of the ISE, I don't understand why its listed in error as IP device logs!

    ource Timestamp 2016-06-22 16:38:02.826
    Receipt of timestamp 2016-06-22 16:38:02.841
    Policy Server GLS-ISE-01
    Event 5413, accounting RADIUS-Request dropped
    Reason for failure 11007 could locate no device network or Client AAA
    Resolution Check if the device network or AAA client is configured in: Administration > network resources > network devices
    First cause Could not find the network device or the AAA Client while accessing NAS by IP during authentication.
    Type of service Box
    NAS IPv4 address 10.18.4.38

    Other attributes

    ConfigVersionId 118
    Port of the device 1646
    DestinationPort 1813
    Protocol RADIUS
    ACCT-status-Type Update-intermediate
    ACCT-Delay-Time 15
    ACCT-Session-Id 00000000
    ACCT-Authentic RADIUS
    AcsSessionID GLS-ISE-01/255868885/32
    IP address of the device 10.18.4.38

    If I reconfigure the switch to the ISE - peripheral network and give it the IP address of 10.18.4.38 (the ip of the gateway), my radius authentication tests suddenly becomes successful.

    can someone clarify the situation what is happening here?

    I need to be able to define multiple switches by their unique IP addresses.

    Thanks for your time

    m

    Hello

    The only time I saw that it was due to use a deprecated command: radius server host.  There was a bug on the IOS XR platform as well.

    Could you please reconfigure your order of RADIUS by using the new command: radius server? And test again?

    The doc of Cisco for the new order:

    http://www.Cisco.com/c/en/us/products/collateral/iOS-NX-OS-software/iDEN...

    Thank you

    PS: Please do not forget to rate and score as good response if this solves your problem

  • How to separate shortcuts for DW

    Hi, I use Dreamweaver 2015.1 Build 7851 in a Windows 7 Enterprise with Service Pack 1.

    By default the shortcut Ctrl + K is assigned to the window of the extract, but I wanted to re-assign-la to something else.

    Now I have a custom keyboard layout currently selected, if I check in there, there is nothing related to the command Extract and Ctrl + K is assigned to my custom code snippet. But if I hit Ctrl + K I see always the extract window open anyway.

    Any help would be appreciated.

    Thank you
    Tiny

    Looks like it's a little sticky...

    Try this:

    Go to Edition > keyboard shortcuts

    Ensure that the Menu is selectedfrom the drop-down list controls

    Highlight the option extract under window
    Click on the keys Ctrl + K in shortcuts
    Click - button to delete the shortcut

    Then go to your snippet
    Click the field press the key, and then press Ctrl + K
    You should always get a warning that it has associated with extracted (even if you just remove it)
    Click OK
    A warning should appear asking if you want to associate the shortcut for the snippet instead, hit Yes/OK

    This shortcut should now only give you the extract at the time of impact.

  • How to ignore requests for password when creating the DB with the DBCA shel scripts

    When generate a database with scripts automatically passwords DBCA asks 1 2 times at the beginning and 1 initializing ora.ini DB.

    I should replace the lines as
    Connect "SYS" / "' & & sysPassword ' as SYSDBA"
    with the password that is real because it's a public password to test databases.

    P. S.
    If these questions are not apropriate and a burden for the cmmunity you can inform me.
    Up to now, if I can't find something on common search keywords, I add it, believing it to be a contribution to the knowledge base of the Oracle communities

    I found the solution. As MarkDPowell has pointed out, invited because ACCEPT input so have to comment on it.

    And I can pass my own password public as a variable to SET - http://docs.oracle.com/cd/B10501_01/server.920/a90842/ch13.htm#1008884

    P. S.

    I'm trying not to let the non-answered son.

  • How to write request for that given information?

    I have table (employees) like this

    Hire_date Salary
    4 January 19912000
    05-mar-19911300
    12 sep-19912400
    February 19, 19923000
    17 Apr-19921000
    November 23, 19921200
    January 25, 19931000
    June 6, 19931200

    I want to get an output like this

    Hire_date Salary Years in the range total
    4 January 19912000
    05-mar-19911300
    12 sep-199124001 January 1991 to 31-dec-19915700
    February 19, 19923000
    17 Apr-19921000
    November 23, 199212001 January 1992 to 31-dec-19924200
    January 25, 19931000
    January 6, 199312001 January 1993 to 31-dec-19932200

    Give me a few ideas guys

    Hey Gopi,

    This is the final query.

    SELECT res.employee_id

    res.salary

    decode(res.rnum,1,res.total_sal)

    decode(res.rnum,1,res.years_in_range)

    FROM (select e.employee_id

    e.salary

    , TRUNC (hire_date, 'YYYY'): ' to ' | (add_months (TRUNC (hire_date, 'YYYY'), 11) + 30) years_in_range

    Salary on (partition of to_char (e.hire_date, 'YYYY')) total_sal

    row_number() on rnum (partition by to_char (e.hire_date, 'YYYY') order by ASC e.salary)

    e employees) res

    See you soon,.

    Suri ;-)

  • How can I make Apple sent an official request for Andorra in the list of international codes?

    Apple acknowledges that Andorra Telecom (Mobiland) is an approved operator.

    However it does not include the international dialing code of Andorra (+ 376) in the list of phone prefixes in the country.

    This prevents verification services, such as in two steps and two-factor authentication.

    How can I make Apple sent an official request for Andorra in the list of international codes?

    Thank you.

    Return of goods - Apple

  • How can I separate pagination for a world region?

    I had a delightful time using a common region, set to a page global when I found that the paging parameter has been start transported from one page to another.  Arghhhh!  Thus, for example, if I've paged to the second series lines (11-20) on 1 Page (page) and then I go to Page 2, the second series (page) of lines (11-20) appears here.   If I go on a page that only has a first set of lines (1-10), I get the pagination error "Invalid rowset requested, the data source of the report have been changed. Reset the Pagination.  And when I click on reset, it takes just the error.  [I guess he's trying to show again the second series or rows (11-20) - that does not exist.  What about crazy?]

    How can I separate pagination for a world region? I want what he operarate as he would if she did not share a common region.  So if I'm looking to lines (11-20) on page 1, I can go to any other page with lines 1-10 Start, it.  Then back to page 1 where I left with 11-20 displayed lines.  One solution is NOT to paginate, but this isn't my favorite solution.

    Howard

    Howard(...inTraining) wrote:

    My task, as assigned, is to replace the output in an EXCEL worksheet.  If I followed closely the L & F of the spreadsheet, I would have all the displayed lines, and this problem should disappear.  But alas, I'm giving him the 'Nice' air of pagination.  No, it's not an APEX 'report '.

    Columns... lines... paging... sure sounds like a report of duck.

    [I turn the original question to the question you raised.] Is the Page Global of formatting that I want to keep reusable.   There are 8 eight identically formatted pages.

    Is a generic page not possible? Which requires that there be eight?

    Columns of perhaps 10 to display and data 4 to 175 lines.  The data display is dense and I worked, for literally months, to get a similar format.  (This is the reason for all the questions of formatting, I asked).   Some link columns to edit pages.   I went to a global Page so that changes could be made in one place and will appear in all 8 pages.   If I need to change the width of a column, I don't want to make that 8 times.  Or having to check 8 different pages to make sure that I have all the same.

    All reusable formatting techniques?

    Templates, CSS, chains of substitution and the reusable SQL above.

    Suggest to offer a concrete example on apex.oracle.com and see what we can achieve.

  • How to activate Windows/NTML authentication for SOAP LiveCycle services?

    Our LC Server is configured to authenticate with Active Directory. I have a c# application that calls the SOAP services on the server. I wish that my request to move the current credentials on users instead of using Basic authentication.

    Is this possible?

    Looks like that's not possible. However, an acceptable solution is to enable SSO instead. Assuming your server is on a private network then you can send the current user Id or username login only for authentication. As long as they are in the Active Directory database, then they are authenticated.

    So I do not use the real Kerberos delegation, but I don't mind because LiveCycle on a private network. The SSO authentication works for HTML, Ajax, and SOAP requests.

    How this helps someone.

  • How can I add a separate apple for the iphone and ipad wife id

    How can I add a separate apple for the iphone and ipad wife id

    Hi, are the measures already implemented? If they are, you need to configure them again and establish a Apple ID at this time.

    Apple ID - Support official Apple

  • How can I prevent any request for download on icloud in clock mode?

    How can I prevent any request for download on icloud in clock mode?

    What is "clock"? Do you mean when you have an active clock on the screen? Applications where?

  • How to add a second iPhone number to account for help a separate activity for both phones?

    All,

    My wife and I share the same apple id account. How do I add additional phone number, so we can separate the activity such as a phone log and imessage?

    We all have two iPhone 6s.

    Thank you...

    mac2jayb wrote:

    All,

    My wife and I share the same apple id account. How do I add additional phone number, so we can separate the activity such as a phone log and imessage?

    We all have two iPhone 6s.

    Thank you...

    share the same for imessage or facetime apple ID is how you separate, is not by adding an additional phone number.

    You can use the family sharing the music and applications

  • How to stop demand for files compressed in my Outlook Express? This request appears on my screen of many times while I'm working.

    How to stop demand for files compressed in my Outlook Express? This request appears on my screen of many times while I'm working, even when I go on the internet, it always appears & crashes me typing.  I have a lot of emails and I don't want to compress their files.

    original title: HOW can I STOP ASKING to COMPRESS the FILES in OUTLOOK EXPRESS

    How to stop demand for files compressed in my Outlook Express? This request appears on my screen of many times while I'm working, even when I go on the internet, it always appears & crashes me typing.  I have a lot of emails and I don't want to compress their files.

    Compress, (Compact in American English), removes waste of space, not your messages. Please read below, but if compact you and still get the prompt, after return. It is another question.

    Why OE insists on compacting folders when I close it? :
    http://www.insideoe.com/FAQs/why.htm#compact

    Compacting your folders periodically is a must to keep OE works fine and at some point, you may lose all your saved messages if you do not. When you delete or move messages, the space they used remains until you compact.

    Never touch anything until the compression is finished.* *.

    See:
    www.oehelp.com/OETips.aspx#2

    With SP2, Automatic compaction in the background has been removed because of problems he has caused. Now, you will get a prompt to compact after 100 closures of OE, you need to do, and do not touch anything until it's finished. If you compact manually, at your convenience, this will also set the counter to zero. See this for more information:
    http://www.insideoe.com/files/maintain.htm#compact

    If you are fully patched, you will now see a copy of your dbx files copied to the Recycle Bin as BAK files. If something goes wrong when compacting, the messages can be easily restored from this backup. A compact manual resets also the counter in the back of the registry to zero now.

    For more information, see the information framed in red here:
    www.oehelp.com/OETips.aspx#2

    To keep things running smooth and harden faster:

    Do not archive mail in default OE folders. It will eventually become corrupt and you may lose mail. Create your own folders defined by the user for mail storage and move your mail to them. Empty the deleted items folder regularly. Keep user created folders under 300 MB, and also empty as is possible to default folders.

    And backup often.

    Outlook Express Quick Backup (OEQB Freeware)
    http://www.oehelp.com/OEBackup/default.aspx

  • IBM think centre @ request for initialization of the system user password and a genius set the bios to lock keyboard can it is bypassed and how?

    Original title: IBM think centre @ start request.

    IBM think centre @ request for initialization of the system user password and a genius set the bios to lock keyboard can it is bypassed and how?

    Hi brandon1980,

    I recommend you contact your computer manufacturer for assistance. The manufacturer would be able to give details about the BIOS (Basic Input Output System) and find out if this feature can be disabled.

    Hope the helps of information.

Maybe you are looking for