Integration of CSM 3.3 and ACS 5.1

Similar Questions

• Installation of ISE and ACS

  Hi all

  I have a problem to install ISE and ACS on VM server. Linux Redhat Enterprise is detected by the system when the iso file is selected.

  But some dependencies of the package are noticed as openssl kernel-devel or cisco...

  The installation will stop from print virtual daemon.

  Any help!

  OK, I recommend:

  1. check that all the VM gusts are configured to meet the required specifications (RAM, CPU, disk space, etc.)

  2 re - download the ISO file and try the installation again

  3. download and try OVA

  Let us know how it goes :)

  Thank you for evaluating useful messages!

• 5.2 WCS and ACS 4.2

  Is it possible to get the admin of WCS users authenticated on GBA? I was not able to make it work and I found a page of FAQ http://www.cisco.com/en/US/products/ps6305/products_qanda_item09186a00807a60f0.shtml#apr6

  say it is not supported. Is this correct? As I was not able to get the WCS to authenticate to the ACS. I don't get passed or failed attempts. The ACS is currently authenticate other users / devices and the GBA and WCS can both communicate with each other.

  You can integrate the WCS and ACS for local users of WCS.

  Add WCS to an ACS server:

  http://www.Cisco.com/en/us/docs/wireless/WCS/5.2/configuration/guide/5_2admin.html#wpmkr1064286

  Configuration of the server credentials ACS View:

  http://www.Cisco.com/en/us/docs/wireless/WCS/5.2/configuration/guide/5_2mon.html#wpmkr1171779

  Configuration of RADIUS servers:

  http://www.Cisco.com/en/us/docs/wireless/WCS/5.2/configuration/guide/5_2admin.html#wpmkr1054014

  GANYMEDE server configuration:

  http://www.Cisco.com/en/us/docs/wireless/WCS/5.2/configuration/guide/5_2admin.html#wpmkr1053935

  Import tasks in ACS:

  http://www.Cisco.com/en/us/docs/wireless/WCS/5.2/configuration/guide/5_2admin.html#wpmkr1064285

• Upgrade CSM and ACS

  1. cisco ACS /Solution Engine, according to me, the dedicated device, unknown version)

  2 cisco Security Manager 3.1

  Are updates possible, or buy the latest version of the product is the only way out?

  What do we need for the upgrade?

  Are there specific codes or new need to buy new products?

  In case of purchase of new products, which are the configurations?

  Your response will be appreciated.

  The GBA unit has been released with at least three different major versions - 3.x, 4.x and 5.x. If you have ACS 4.2 on a device of 1120, you can proceed to the last (5.3) on the same hardware. Anything else will be require a new device (or use a VM solution).

  Please see guide to orders and the migration guide for this information.

  For the CSM, to upgrade you would need to go to 3.3. First, then to the current version of CSM (4.2). The necessary licenses are described in this product bulletin.

  It would probably be easier and more own just build a new facility in both cases. Architecture products both db schema have changed significantly. The SKU upgrade probably will save in licensing fees, even though the two products have undergone changes in how they are allowed.

  Note that CSM will come out with a new version 4.3 more later this spring.

• First and ACS View Server Integration

  Can someone point me in the right direction for a good doc on implement first (1.3) with a display ACS (5.1) Server?

  Guy: I was doing a little research on this topic and I just wanted to add that there is not much config, that we have to do on ths ACS.

  All you have to have this command on ACS CLI "view of acs config-web-interface to activate".

  On the first, we already have information ip and port view ACS server. In addition, include the first with ACS using a privileged account super admin. Default acsadmin has super admin rights, so we can use it on the preferred side or you can create a specific account on GBA and assign the super admin under system administrator rights > directors > accounts > new account.

  Once this done, please try to shoot balls of NCS and let me know how it goes.

  Jatin kone
  -Does the rate of useful messages-

• ASA5520 and ACS 4.0 - AnyConnect WebVPN (Clientless SSL Tunnel) does not downloadable ACLs (DACL)

  I'm having a lot of problems called "Clientless SSL-Tunnel" AnyConnect VPN sessions - i.e. those that are enacted by visit https:// via a browser, and let the Java/ActiveX plugin will automatically run Fat Client AnyConnect VPN for you - downloadable ACL honor.

  Our installation is integrated via RADIUS Cisco ACS 4.0.

  Dynamic group-> connection profile strategy seems to work for either (direct according to AnyConnect VPN Client heavy or indirectly via a browser-> /Java Client ActiveX), however, our only downloadable ACL take affect if the user instantiates the SSL VPN via AnyConnect VPN Client Fat; first of all, users who access the site through the "Browser-> https://" route seem to have no ACLs applied to all?

  I understand that I can change the custom "Cisco VPN/3000/etc" parameters RADIUS, such as 'WebVPN-filters' and 'WebVPN-Access-List' to apply an ACL configured locally on the firewall of the SAA, but what I have to configure to make the sessions ' WebVPN/Clientless-SSL-Tunnel"to honor the DACL that sends our ACS?

  It is a known problem with some Software ASA Versions see bug cisco CSCtv19046 - DACL is not applied to acre during connection via the Web portal. You probably need to update your ASA 8.4 (4.1) or a later version.

• Integration of the Bulletin Board and microsoft surface?

  Toshiba think integration Bulletin Board with microsoft surface?
  It would be very cool!

  Unfortunately, I can not comment on your question but would like to say that I love your posts and your comments.
  There is not a lot of people who have made suggestions how to improve things on this forum.

  I think Toshiba lend more attention to the own customers.
  Let's see what will happen with the Bulletin Board. In any case, I can imagine that Toshiba will continue to develop it with new features.

• Integration of the server project and AX 2009

  Hello
  We use MS Dynamics AX 2009, I want to have Project 2007 server integration. I installed
  (1) connector business Dotnet
  synchronization for project server service 2)
  proxy server of project 3)
  Project Server 4)
  When I try to project server (project server integration -
  (> Set up the integration of the Microsoft project-> integration server) shows the status of the installation 'in progress' and I was not able to activate when I try to activate the integration is throwing the following error message: "integration cannot be enabled for project server until all installation components have been installed completely" kindly guide me to solve this problem.

  Microsoft Dynamics support, this not the right forum for your question, the following link will take you to the appropriate community:

  Microsoft Dynamics Community - AX home

• Ploblem with 2950 and ACS

  Hi all

  I have configured the 2950 as below and properly configured ACS and I can connect to the 2950 using this configuration, the problem lies after that I go to enable and try any command, I get approval to next error command failed.

  What I missed out the config that will allow me to execute commands?

  AAA new-model

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local authenticated by FIS

  AAA authorization commands 15 default group Ganymede + authenticated if

  AAA authorization network default group Ganymede + local authenticated by FIS

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  AAA accounting network default start-stop Ganymede group.

  GANYMEDE server host ***. ***

  radius-server key 7 *.

  Thanks in advance.

  Bruno

  Hi friend

  AAA of the switch seems ok, maybe you need to take a look at your ACS.

  Check the following information, where you have to apply it in your ACS config:

  http://www.Cisco.com/en/us/products/sw/secursw/ps5338/products_configuration_guide_chapter09186a00801fd6fc.html#wp676529

  If it helps, please note or ask another question.

  Kind regards

  Rafael Lanna

• Integration of the IPCC CRM and third party

  Hello

  We integrate a CRM (opencrm) software with the business of the IPCC. How is it possible. I know that cisco has provided plugins for CRM, but not for this one. is there a way for the integration of the two? or is there a workaround or we are ristricted to those specified by Cisco?

  Thank you

  Hello

  You can use the OCX and Java libraries provided with the Toolkit ICT Cisco. With these libraries you van do the integration, but be aware if the CRM allows the use of libraries.

  In this way, you may need to set, but the integration you need might be esay to make.

  For a complete description of the API, take a look at this link:

  http://www.Cisco.com/univercd/CC/TD/doc/product/ICM/icmentpr/icm70doc/ctidoc7/ctios7d/cti70dev.PDF

  Hope this helps,

  Juan Luis

• East - CSM 4.4 and above all the supported server certificate?

  Dear all,

  We have Cisco CSM 4.4. I want to know instead of a self-signed certificate, can we import CA certificate or Certificate Server internal?

  Please let me know if a newer version of the CSM supports this feature...

  Thank you & best regards

  Ahmed...

  You ask on the certificate for the server CSM itself? To do this, CSM only supports self-signed certificates generated during installation. Reference.

  The same restriction applies even on the current version of CSM 4.7. I doubt he will be changed as this product will probably end-of-sales in the next 12-18 months (in favour of the mash-up of PRSM and product obtained through the acquisition of SourceFire Defense Center).

• 3.3 of the ACS, changed the password of domain and ACS beat

  I do not set up the GANYMEDE. I want to disable the AD administrator account, but it seems to require ACS.

  I changed the admin PW and GANYMEDE stop. ACS windows services all begin to use the administrator account. If I change to use a different domain administrator account, they start, but disabling administrator again breaks GANYMEDE.

  Ideas?

  Thank you

  I'm not sure your point.

  Yet once, your windows services ACS are led by administrator Windows AD account. ACS will use this account to connect to AD for authentication of the user. If you disable the window AD admin account or change its password, ACS could not access AD to authenticate the user. This is probably the reason that GANYMEDE authentication failed after you changed windows AD admin account. In configuration of the ACS external DB user, you should see the windows of the AD.

• What is the difference between Cisco NAC and ACS?

  I am currently part of a new construction project and my Cisco account manager and sales engineer recommend Cisco NAC for our new MDF. I'm confused because I don't clearly know the difference between a Cisco ACS and the NAC. What is the difference?

  Thank you

  Chris

  Chris,

  The two are completely different, maybe the sales rep could present you with more information and application. Each offers a variety of services tailored to the specific needs. I think that we need to read more in depth on the proceeds of the NAC. NAC seems an excellent solution for authentication authorization but other regulatory compliance.

  When you see ask your representative to sales for more information/demo.

  ACS is more widely use as a central point to access control to network devices routers, an example is for acs accounting management and the authority to order on all devices on the network using acs as RADIUS server. Considering that the NAC is over a central point of safety inspection on earlier systems of access to your network by via LAN or outside, an example of these respected regulatory defined could be inspections could be virus definition checks before getting lan access thus preventing access to the LAN if the system does not have regulatory compliance defined in NAC access is denied. Another example could be the unknown local host connections etc... So, it seems that NAC is a much broader product that provides endpoint security internal, not only the authentication authorization as acs... ACS has been there for a long time, NAC is rather new product.

  NAC

  http://www.Cisco.com/en/us/NetSol/ns466/networking_solutions_package.html

  http://www.Cisco.com/en/us/solutions/collateral/ns340/ns394/ns171/ns466/ns617/net_qanda0900aecd800fdd6f_ns466_Networking_Solutions_Q_and_A.html

  ACS

  http://www.Cisco.com/en/us/products/sw/secursw/ps5338/index.html

  Rgds

  Jorge

• SSL VPN from Cisco ASA and ACS 5.1 change password

  Dear Sir.

  I am tring configure ASA to change the local password on ACS 5.1. When the user access with ssl vpn if the ACS 5.1 password expiration date. ASA will display the dialog box or window popup to change the password. But it does not work. I'm tring to Setup with the functionality of password management on the SAA. When I enable password management it will not work and is unable to change the password. Could you tell me about this problem?

  Thank you

  Aphichat

  
  Dear Sir,
  I'm tring to setup ASA to change local password on ACS 5.1. When user access with ssl vpn if password on ACS 5.1 expire. ASA will show dialog box or pop-up to change password. But It don't work. I'm tring to setup with password management feature on ASA . When I enable password management it don't work and can't to change password. Could you advise me about this problem?
  Thank you
  Aphichat
  

  Hi Aphichat,

  Go to the password link below change promt via AEC in ASA: -.

  https://supportforums.Cisco.com/docs/doc-1328;JSESSIONID=A51E68318579261787BD60DDA0707819. Node0

  Hope to help!

  Ganesh.H

  Don't forget to note the useful message

• Question about the attributes Active Directory and ACS 5.2

  To authenticate on our wireless, our ACS server checks to ensure that a node is a member of a specific group of computers.  When we disable the computer account, the continuous ACS server to spend despite the account being disabled the authentication. This isn't the only thing that is checked, we also checked for a valid certificate issued by our CA.  Regardless, if the computer account is disabled I would like for the ACS server to the authentication failed.  Is it possible to map an attribute of the computer account to a radius attribute?  Or simply configure the ACS server to check a flag on the AD attribute?

  Specifically, here's what we see in the steps in the section for a machine that's account has been disabled:

  24475 account user or host is disabled; setting the IdentityAccessRestricted flag to true.

  I want to let him see this 'true' flag and fail authentication, but it does not work.  Any suggestions?

  The IdentityAccessRestricted attribute that is referenced in the steps is an additional attribute that can be used in conditions of approval

  It is set to true if access to the account is disabled, outside the period of access etc.

  This gives flexibility when AD attributes are retrieved for use in licensing requirements and will allow the application to be refused if the flag is set.

  To do this add a new condition in the authorization policy

  If (AD1-> IdentityAccessRestricted) == TRUE select profile permission to deny access to the suite