order ACS 5.6 syslog

Similar Questions

• Accounting ACS logs to Syslog server

  Dear Experts,

  We use the Cisco Secure ACS 4.2 in our Organization, where accounting Ganymede has been turned on AAA cleints. Currently, ACS connects with the accounting information accurate cli.

  Is it possible to repel these accounting logs to syslog server. For example, here's a scenario.

  User connected to the Cisco device at 10:00 and configured the device with 5 orders and logg unit at 10:05. These must be alerted/connected to the ACS syslog server.

  Kindly advice...

  Best regards

  Shiji

  Shiji,

  Yes you can.

  Go to system-> logging configuratoin and page you can configure which opens a session must be sent to the syslog server.

  

  HTH

  Amjad

  Rating of useful answers is more useful to say "thank you".

• What do I have to apply RADIUS server?

  We intend to implement server GANYMEDE +.

  I need to know what exactly I need to set up this server? what I have to buy GANYMEDE + appliance based provider or I can just buy the software and install it on one of my new or existing server. is there any software to open source very good that I can use? What advantages and disadvantages of each options?

  I'm the management of hundreds of routers and switches on our society and on customer sites via internet.

  one last question: is Cisco ACS 5.5 material or can be installed in any server?

  I know it's very long or issues, but I know that you are very friendly and nice people :)

  1.] most of the large company or class operator network device manufacturers supported by GANYMEDE. Some providers that are supported on the GANYMEDE Protocol + are: Adtran, Alcatel/Lucent, Arbor, Aruba, Brocade/Foundry, Cisco/Linksys, Ericsson/Redback, Extreme, Fortinet, HP/3Com, Huawei, Juniper, Netgear, Nortel and others. However, I personally would say ACS 5.x

  Source - http://tacacs.net/faq.asp

  2.] cisco Secure ACS 5.5 is available as a closed and hardened based on Linux SNS 3415/3495 device or as an image for VMware ESX/ESXi 5.0/5.1operating system.

  Cisco Secure ACS 5.5 supports two distinct protocols for authentication, authorization and accounting (AAA): RADIUS access control network and GANYMEDE + to access network device control.

  3.] for more information about the product and the license, you must go through the links listed below.

  Order ACS 5.5 Guide

  Data sheet ACS 5.5

  Kind regards

  Jatin kone

  * Does the rate of useful messages *.

• Syslog on device ACS

  is it possible to configure syslog on ACS appliance running ver 3.3?

  Hello

  No, ACS 3.3 does not support syslogging.

  This feature has been added to the ACS 4.1

  Auditing and Reporting:

  Release notes:

  http://www.Cisco.com/en/us/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/release/notes/RNacs41.html#wp37403

  You can get logging remotely (method to store logs on a machine where the remote agent is installed) that ACS has a limited storage capacity.

  HTH

  Kind regards

  Jousset

  Please evaluate the useful messages-

• Search ACS 4.2 order unknown user from database

  Hello

  I have several user databases in the search order for the unknown user policy. Ignoring the manual (http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UnknUsr.html#wp277530), which States that, after the failure of authentication from the first database (Windows) the ACS does not continue to look for the second database, a RADIUS server. I see that, with the failure in the first user, database stops the ACS research and fails to the user authentication with an authentication failure code "external DB password invalid.

  Documentation not going or is this a bug in the ACS v4.2.1? How can I make the ACS to continue to seek the second database user?

  Hello Roberto,.

  If the external database returns an invalid username/password, then it is intended for ACS is not to check the following data in the sequence and the failure of authentication:

  http://www.Cisco.com/en/us/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UnknUsr.html#wp277502

  "For authentication requests, ACS applies the unknown unknown user policy to users. ACS does not backup to the known or discovered users authentication failure unknown when user authentication support. »

  If you want that ACS to verify the following database, even if a response from the invalid username/password has been received, you will need to explicitly set this on the external Windows database configuration page, in the section entitled 'Strategy for the unknown user' (but on the database configuration page specific Windows, not covered by the unknown user policy) :

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/User_Guide/UsrDb.html#wp354338

  In addition, on the previous screenshots, I could see that you have configured both as a result of database:

  Windows database

  RADIUS Server token

  So we may be running into a situation where the authentication method used is not supported by the tokens, Radius servers, and therefore impossible to check the second database in the list:

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/User_Guide/UsrDb.html#wpxref36799

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/User_Guide/Overvw.html#wpxref846

  Kind regards

  Fede

  --

  If this helps you or answers to your question if it you please mark it as 'responded' or write it down, if other users can easily find it.

• Order history / Syslog

  Hello

  I use a router 1812

  (1) how can I find the commands have been entered on a router?

  (2) how can I connect all of these commands in a file / syslog?

  (3) I'm looking for, let's say, last 10 connection attempts?

  Thank you

  Hello

  1.) enter the history to see the order

  2.) set the logging x.x.x.x where x = IP Addr. your file / or syslog server

  3.) set the userinfo logging, where the user no longer has to change his Login Disable to activate Modus.

• Cisco ACS 4.2 providing display orders only

  I am trying to create a user so that I can give him only to run see command nothing else.

  (1) created a user in ACS

  (2) create Shell permission Set - ReadOnly command

  Unmatched orders - deny

  Commands added

  Show

  output

  3) established a group - support with the following parameters of GANYMEDE.

  Shell (exec) is checked

  Privilege level is check with 15 as the assigned level

  Assign permission to command Shell Set for any network - selected device

  ReadOnly - set current shell command authorization

  I set up on my router

  AAA authorization config-commands

  AAA authorization commands 0 default group Ganymede + local

  AAA authorization commands 1 default group Ganymede + local

  AAA authorization commands 15 default group Ganymede + local

  But still the user can run config t and other commands. Someone help me how to solve this problem

  Hello

  I'm trying to figure out what might be the case. That's why ask you the question.

  Which option is checked the

  Configuration of a Shell command authorization set for a user

  is this Group?

  Configuration seems fine for me. Just for a configuration can more you please check whether the configuration is based on the link:

  http://www.Cisco.com/en/us/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

  Kind regards

  Anisha

  P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.

• Order of installation during upgrade of patch in the deployment of small ACS

  Hello

  I am upgrading to 2 ACS of 4.1.4.13 for 4.1.4.13 patch 20 devices. They are configured as main and secondary. In the documentation, I don't see any restrictions that should be the first machine to be upgraded. Must a be the first to be placed on level and therefore, the 'new' primary backup?

  Thank you very much.

  Assuming that all devices are the primary ACS IP-oriented, you must stop the replication, upgrade the backup, then upgrade the primary and then enable replication. Although I see no problem with upgrade from the first primary after replication has been stopped.

  HTH,

  Atif

• Order of syslog for associations customers

  Hello.

  For WLC 5508 software version 7.0.235.0, does anyone know what command is required to get the WLC sending syslog messages to each time a customer associated wireless and desassociate?

  Greettings.

  go to management > SNMP > SNMP commands > choose customer > activate the checkboxes there.

• ACS - monitor Services

  Hello

  Currently using Windows ACS 4.0 and 1113 Ver4.2 with SNMP patch to allow ping.

  We want control services using Solarwinds APM, you fix the template above, you can see details of SNMP from the ect server and Services.  But it seems to require a user name and password to monitor services, which is not a Windows user name and password.  I tried to add Administrators user name and the password of the ACS, but does not control the services.

  Is there a certain procedure to monitor the Services of the CSA with a 3rd party like Solarwinds product?

  Concerning

  Craig

  The ACS SE 1113 is a server, locked in order to describe how the services are done with a third-party utility, it would very probably install some type of agent to look/monitor/or even send traps SNMP for the ACS Services (that are installed on the operating system).

  ACS already does in itself, if you go to the System Configuration > ACS Service Management > you could configure ACS to contact you in the event of a service failure. You may also send the report of these alerts to a Syslog server: System Configuration > Logging > change the case report.

  Just realized that there is also an SNMP Agent (System Configuration-> Configuration of the device--> SNMP Agent), this could provide some additional information:

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/SCBasic.html#wp288047

  Keep in mind:

  Documentation of the ACS CSCsj18497 device doesn't not list SNMP MIB support

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj27225

  Hope this helps,

• Cisco ACS 5.3 patch 8 Volume OPT

  Hello

  We currently have 12 ACS unit with one of them being a dedicated newspaper collector. We have authentication of 802. 1 x configured for network and Wi - Fi ports. We are authenticating desktop, laptops, smart phones, etc. on our network.

  The problem we have is the volume of the OPT exceeding 30% volume size recommended by Cisco TAC after a few months. We have recently added more resources on our network (fusion). We are now on the size of 30% in about 1 month.

  In the past, we called Cisco TAC when we had problems with performance Log Collector. It's time was also authenticate clients 802.1 x. We have added a new device and is a dedicated Log Collector. They would check the volume of the OPT and to find that it was about 70% use the size. They launch the Console Root patch and delete the DB and then re-create. We did about 2 times before starting to monitor the size of the volume OPT.

  This last time, we ran in the 30% the size of volume more rapid then we had previously. I got a Cisco TAC volume of the OPT to delete and recreate it.

  Cisco TAC recommended that we reduce the amount of logs that are sent to the collector of the newspaper. We are currently investigating this option.

  The questions I have is:

  What percentage of size for the volume of the OPT should be concerned until it starts impacting on the performance of the Log Collector?

  Is there another thing we can do to reduce the amount of logs that are sent to the Log Collector?

  We have data purge set to 30 days. We are complete and incremental database backups. We also have local send logs to a Syslog server.

  We test them make changes to send only AAA Audit logs and statistics system of Log Collector.

  Thank you

  In the distributed configuration, its recommended to set up a secondary server dedicated as a collector of newspaper. However you have a large deployment, so I'm sure that authentication rate would be too high causing Dungeon size view-basic data on the increase.

  In order to avoid running out of disk space, we need to manage. This means identifying the files that are created and written by processes on the system, allocate a budget to space them as if the files remain in their budget all the services can be supported without interruption, then define and implement the necessary facilities so that these files in their budget.

  There are two mechanisms to reduce this size and prevent it from exceeding the maximum limit.

  1. air scan: this mechanism the data will be purged based on the retention period of data configured or arriving at the upper limit of the database.  In Patch 6 new provided option to demand purging as well.

  2. compress: this mechanism frees up unused space in the database without deleting all records. Before the compress option can only be performed manually.  GBA 5.3 Patch 6 there are improvements so it will automatically work every day at a preset time, when specific criteria are met.

  What percentage of size for the volume of the OPT should be concerned until it starts impacting on the performance of the Log Collector?

  The TAC recommendations are right. You will be able to use all the ACS function if / opt is less than 30%.

  Is there another thing we can do to reduce the amount of logs that are sent to the Log Collector?

  It seems that you use most of the features/mechanisms to have / low opt. However, you may be interested to read more about scrub data and data compression improvements http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/release/notes/acs_54_rn.html

  S ' Please use System Administration > Configuration > journal Configuration > Logging categories > Global to configure only the logs required the sending to the ACS View log-collector.

  -Provide the cool screenshot of the page Configuration Monitoring > System Operations > Data Management > removal and backup.

  -With the below listed command you can check real and physical terrain database size

  ACS-config

  Username: acsadmin

  Password: *.

  acsview show-dbsize

  There are some known defects on the same subject. However, the version you use improves database management process.

  CSCto47203: ACS 5 runs out of disk space

  CSCua51804: see backup fails even when there is disk space

  Jatin kone

  -Does the rate of useful messages-

• Topology change syslog, how to disable messages?

  I have a number of switches BNT/Lenovo (8124, 8052, 8264) and all are connected to our central syslog server. I have quite a few switches in the same vlan, and I get a lot of topology messages of change like this:

  2016 03-11 T 05: 39:01.143556 - 07:00 Mar 11 05:39:07 switch-1 ALERT switch OS : STG 44, changing topology detected

  I don't necessarily need to see this. I would like to delete this message without Gohan other messages such as the STP root bridge changes. Is this possible? These seem to be my options from the side of the switch:

  8052b Journal (config) #logging?
  all all
  BGP BGP
  cfg Configuration
  cfgchg Configuration change notify
  CLI command line interface
  Console Console
  difference of Configuration monitoring difftrak
  dot1x 802. 1 x
  failover failover
  Hyperlinks Hotlinks
  IGMP IGMP-Group
  IGMP-mrouter IGMP mrouter
  applicant applicant IGMP IGMP
  IP Internet protocol address
  IPv6 IPv6
  LACP Link Aggregation Control Protocol
  system port link
  LLDP LLDP
  management management
  MLD MLD
  NETCONF NETCONF Configuration Protocol
  Time protocol NTP network
  OpenFlow enable logging of Protocol Openflow
  OSPF, OSPF
  OSPFv3 Ospfv3
  private - vlan, private VLAN
  RMON remote monitoring
  Syslog server server
  SLP Service Location Protocol
  Spanning-tree-group group Spanning tree
  SSH Secure Shell
  System
  Vlag Virtual Link Aggregation
  VLAN, VLAN
  VM Virtual Machine
  VRRP Virtual Router Redundancy Protocol
  Web Web

  I looked in the CLI guide for "journal of logging", but all I get is the following:

  [None] Journaling log []
  Displays a list of the features for which syslog messages can be generated. You
  can choose to turn on or off specific features (such as VLANs, stg, or ssh).
  or enable/disable syslog on all available functions.
  Control mode: global configuration

  There is no detail on the option does what exactly.

  I know that I probably can filter messages from syslog server-side but I would rather start the level for the switch.

  Thank you.

  Today, there is no way to delete these specific messages.

  They should not be too many and are often very useful to determine the cause of a failure.

  In order to reduce drastically the TCN BPDU is to put all the host ports such as 'edge' or 'portfast '.

  This setting prevent BPDUS and messages production when a host disconnect or connect to the switch.

  Then, only the 'real' TCN is recorded and useful for diagnosis.

  Ciao, Maurizio.

• Order of authorization number.

  Hello.

  I use the authorization of Cisco Secure ACS 4.1 commands. This morning I put the MOTD and entered fail because my banner starts with a space.

  The set of shell commands that I use is "unmatched orders permit."

  Any idea?

  Thank you.

  Andrea

  What you feel is a known defect:

  CSCtg38468 cat4k/IOS: exec banner failed with white characters

  Symptom:

  % PARSE_RC-4-PRC_NON_COMPLIANCE:

  The error of the parser above can be seen with the traceback, when you configure a banner containing an empty character at the beginning of the line.

  Conditions:

  The problem occurs when the AAA authorization is used in conjunction with GANYMEDE +.

  Workaround solution:

  Make sure that there is no space character at the beginning of the line of the message of the banner.

  Details of the problem: try to configure exec banner with empty character at the beginning of the line failed.

  This occurs when you configure the banner via telnet/ssh exec!

  When you configure the exec banner even through the console port, all right.

  Note the white characters at the beginning of each line. When you remove those, exec banner works very well.

  Again, it was working until IOS version 12.2 (46) SG.

  Beginning with 12.2 (50) SG1 and upward, the behavior has changed.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• Help create messages Syslog uses the router host name

  We currently have an IP SLA related to the EEM scripts that work great to send syslog messages to alert purposes.  However, I would like for each router that sends a syslog to send its host name using wildcards instead of the specified host name.  I'm guessing some sort of filtering would do the trick, but I can't find any good documentation on this topic.  That's what I currently have:

  ALS IP 1
  echo ICMP - 172.24.50.1 source-interface GigabitEthernet2
  threshold 250
  timeout of 1000
  frequency 5
  IP SLA annex 1 point of life to always start-time now

  !

  LAN_interface_Link_down event manager applet
  syslog "Interface GigabitEthernet2, state change downstairs" event model
  order cli action 1 'enable '.
  Action 2 syslog priority to information msg "command, LAN_interface_Link_down is running on C1-GrandView-PA-CSR1000-Recover... »
  3 wait 5 action
  Action4 cli command "configures terminal.
  action 5 'interface range t3 - 4 cli command.
  action 6 'closed' cli command
  Action 7 cli command 'end '.
  LAN_interface_Link_up event manager applet
  syslog event model "Interface GigabitEthernet2, altered state until.
  order cli action 1 'enable '.
  action 2 cli command "configures terminal.
  action 3 'interface range t3 - 4 cli command.
  Action4 "not shut" cli command
  Action 5 cli command 'end '.
  6 wait 15 action
  Action 7 syslog priority to information msg "command, LAN_interface_Link_up is running on C1-GrandView-PA-CSR1000-Recover... »
  Next_Hop_LAN_Unreachable event manager applet
  event track 10 low maxrun 40
  order cli action 1 'enable '.
  Action 2 syslog priority to information msg "command, Next_Hop_LAN_Unreachable is running on C1-GrandView-PA-CSR1000-Recover... »
  3 wait 5 action
  Action4 cli command "configures terminal.
  action 5 'interface range t3 - 4 cli command.
  action 6 'closed' cli command
  Action 7 cli command 'end '.
  Next_Hop_LAN_Reachable event manager applet
  event track 10 status place maxrun 40
  order cli action 1 'enable '.
  action 2 cli command "configures terminal.
  action 3 'interface range t3 - 4 cli command.
  Action4 "not shut" cli command
  Action 5 cli command 'end '.
  6 wait 15 action
  Action 7 syslog priority to information msg "command, Next_Hop_LAN_Reachable is running on C1-GrandView-PA-CSR1000-Recover... »

  You can use the action of information to gather the hostname:

  routername type info action 1.0

  message from syslog to action 2.0 "my name is $_info_routername.

• ACS 5.1.0.44 GUI connection failed!

  Dear guys,

  I'm trying to configure Cisco ACS (5.1.0.44) to the VMware Workstation in order to test/study. Installation went well. I can connect via SSH, but the failure of the connection of GUI with the same credentials. Please find the attached images.

  Any help will be very appreciated!

  _______________________________________________

  Connect as: admin

  Keyboard-interactive authentication.

  Password:

  Last login: kills Oct 30 17:31:24 2012

  ACS - LAB / admin # show running-config

  Building configuration...

  !

  ACS - LAB host name

  !

  IP - testlab domain name

  !

  interface GigabitEthernet 0

  IP 10.10.10.50 255.255.255.0

  !

  8.8.8.8 IP name-server

  !

  default IP gateway - 10.10.10.254

  !

  time zone UTC

  !

  !

  user name, password hash $1$ HRi10i.R admin $LHqyKJWVqDxfrcmaWGPOM1 admin role

  !

  Service sshd

  !

  password policy

  Lower-box-required

  Upper-case-required

  numbers required

  No - username

  Disable-cisco-passwords

  length-password - 6 min

  !

  exploitation forest localhost

  exploitation forest loglevel 6

  !

  CDP timer 60

  180 CDP hold time

  CDP run GigabitEthernet 0

  !

  ICMP echo on

  !

  ACS - LAB / admin #.

  __________________________________________________________________________-

  Thank you.

  Hello

  The first time you access the GUI of the ACS, you need to use the default credentials:

  Username: acsadmin

  Password: default

  After that the server will ask you to change the password. Please try it and let me know how it goes.