PEAP configuration ACS 5 vs 4 ACS

Similar Questions

• Peap in ACS configuration affect my connections Ganymede?

  So I've just set up peap (certs and eap - tls) on ACS 4.0. However since I can't connect to my routers more. I see the authentication on the ACS logs, but the router always tells me it's authentication has failed. I have a local user name and password, but who all of a sudden stopped working too. If I restart the ACS server I can connect to my routers then while it's down. Once he returns to the top, the authentication will fail again... ideas?

  It is a known issue, workaround is to disable the remote logging feature entirely.

  Bug have been collected for that matter,

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?caller=pluginredirector&method=fetchBugDetails&bugId=CSCeg40355

  CSCeg40355 Details of bug

  Authentication failures when remote logging fails.

  Kind regards

  ~ JG

  Note the useful messages

• authentication PEAP-TLS ACS

  Hello

  in fact I use ACS 5.8 as NPS server to my computer by using the certificate issued by AD CS. so I need to know what protocols allowed that must be activated on my ACS allowing the OmniPass computer through PEAP-TLS

  Thank you.

  Yes, you must select MSCHAPv2 as internal method for PEAP-MSCHAPv2.

  Concerning

  Gagan

  PS: rates as correct if this can help!

• Configuration/ACS database consolidation

  Hello

  I have two ACS servers.

  One is the 2.4 version and the other is the 3.0.2 version.

  My wish is to install a third ACS 4.0 server which will replace the other two.

  I had planned the following steps:

  1 - upgrade versions 2.4 (srv1) and 3.0.2 (srv2) for 3.0.4.

  2 - export using tool CSUtil configuration of these two servers data;

  3. manually consolidate all data;

  4. install the new server with the version 3.0.4.

  5 - import using CSUtil data consolidated on the new server.

  6 - update the new server after version 4.0 recommended upgrade path.

  All comments on these steps?

  Y at - it no special mechanism/tool to consolidate the configuration from two separate servers for GBA?

  Thanks in advance.

  Kind regards

  Ricardo

  Ricardo,

  We cannot export devices with csutil. What we can do is to search for devices on GUI and download a CSV of the search result.

  DBSync does not database between ACS servers synchronize. DBSync uses a csv file to add devices/users in bulk. So if we create a CSV of users and devices we can import in ACS. More info about dbsync to: -.

  http://www.Cisco.com/univercd/CC/TD/doc/product/access/acs_soft/csacs4nt/acs33/user/sad.htm#wp756877

  Kind regards

  Vivek

• How 2 Configure ACS 4.2 to delegate authentication to the radius server

  Hello

  We need run the following scenario:

  Cisco VPN client (or any connect, Cisco SSL VPN client)---> Cisco ASA 5520---> Cisco ACS 4.2---> CAT Authentication Server

  The CAT authentication server is a Radius server. It can receive Radius authentication requests and respond. It is used for strong authentication TFA WBS similar to RSA OTP tokens.

  The question is: how we set up the 4.2 ACS to delegate authentication request to another Radius server.

  Thnx

  Add the RSA server as an external database, configure the drop user profile or a group to authenticate on the new external database rather than ACS DB Local (or Windows DB).

  Easy as pie!

  Please rate if this is useful.

• How to configure ACS 4 with 802. 1 X

  Hay

  How to set up my ACS server to support 802. 1 X with PEAP.in to authenticate the me (PC).

  Thank you initially

  You can skip the part of the certificate.

• How to configure ACS 5.2 to manage the Junos 10.4R6.5 fwl via GANYMEDE.

  Hi all

  I have a camera ACS 5.2 newly installed, integrated with our announcement and his work with cisco product, routers switches and etc.  Now I would like to include Juniper firewalls so to be authenticated via ACS 5.2 either via ssh and web access.  Can someone share me how to initiate this, creating policies.

  FYI: I have 14:00 groups regionaladm and regionalops, read/write and read-access, respectively.

  Kind regards

  Marlon

  Marlon,

  I stuck in a config below file I made for our ScreenOS Firewall work with Cisco ACS v5.2.  This configuration may not work because yours is Junos, but it could bring closer you reach to understand.  Also, if you have not been on the Juniper J-Net ask autour, give it a shot. (forums.juniper.net)

  Good luck!

  -Chris

  Title: Example configuration - GSU of Juniper and Cisco ACS v5.x

  Product: SSG320M juniper (Cisco ACS v5.x)
  

  Version: 6.3.0r10.0 ScreenOS (Cisco ACS v5.2.0.26.8)

  Network topology:

  [Juniper SSG320M]-[Cisco 3560 Switch]-[Cisco ACS VM]
  

  Description:

  Goal - authenticate GSU administrators using GANYMEDE + instead of local connections

  Description - This configuration for Cisco ACS v5.x, JTACS had only configuration v3.3.

  ACS v5.x is a VM based on Linux with a completely new user interface and structure.

  Configuration:

  Configure the Juniper (CLI)

  1. Add configuration Cisco ACS and GANYMEDE +.

  Set id CiscoACSv5 of auth-server 1
  set the auth-CiscoACSv5 server ServerName 192.168.1.100
  set server CiscoACSv5-type of admin account
  set the server CiscoACSv5 auth type Ganymede
  Define auth-server CiscoACSv5 Ganymede secret CiscoACSv5
  define CiscoACSv5 Ganymede 49 auth-server port
  Set the server auth admin CiscoACSv5
  Set admin auth distance primary
  Remote admin auth root set
  define outer-get administrator privileges

  Configure the Cisco ACS (GUI) v5.x
  1. navigate to elements of strategy > authorization and permissions > peripheral Administration > Shell profiles
  Create the profile of Shell of Juniper.
  Click the button [create] at the bottom of the page
  Select the general tab
  Name: Juniper
  Description: Custom for Juniper SSG320M attributes
  Select the custom attributes

  Add the vsys attribute:
  Attribute: vsys
  Requirement: required
  Value: root
  Click on the [Add ^] button above the field for the attribute

  Add the attribute of privilege :

  Attribute: privilege
  Requirement: required
  Value: root

  Note : you can also use "read-write", but then the local admin does not work correctly
  Click on the [Add ^] button above the field for the attribute
  Click the button [send] at the bottom of the page

  2. navigate to access policies > Access Services > default device Admin > authorization
  Create the authorization policy of Juniper and filter by IP address.
  Click [customize] at the bottom right of the page
  In terms of customize, select IP address in the left window
  Click the [>] button to add
  Click the [OK] button to close the window

  Click the button [create] at the bottom of the page to create a new rule
  In general, the name of the new rule Juniper and make sure that this option is enabled
  In Conditions, check the box next to IP address
  Enter the ip address of the Juniper (192.168.1.100)
  Under results, click the [Select] button next to the Shell profile field
  Select "Juniper" and click the [OK] button
  Under results, click the [Select] button under the command field sets (if used)
  Select "allow all the" and make sure all other boxes are not CHECKED
  Click the [OK] button to close the window
  Click the [OK] button at the bottom of the page to close the window
  Check the box next to the policy of Juniper , and then move the policy to the top of the list
  Click on the [Save] button at the bottom of the page

  Audit:

  Connect to the CLI of Juniper and GUI using an ACS internal user account and try to change something to check the level of privilege.

• TLS and PEAP on ACS

  Hi all

  I would like to ask a question here. In our production use us EAP - TLS for cable 802. 1 x (with ACS for authentication), but we are about to change for PEAP. Is it possible that these two can coexist together on ACS until we completely remove TLS? Unfortunately, we do not have test environment to test and of course I would avoid all users not being PC not able to authenticate.

  Thank you

  Radim

  Hi Ramdin,

  The GBA, you can enable the TLS and PEAP at the same time. This will make both tls and peap machine to connect successfully.

  I'm taking into account the fact that you do not change your certificate provider.

  Kind regards

  ~ JG

  Note the useful messages.

• NEED EXAMPLE AD INTEGRATION CONFIGURATION ON ACS 3.3, 5.3

  Hello

  Please give example of associated RADIUS in Windows server 2003 Active directory configuration.

  The same way need step by step configuration AD GBA.

  Please help on this. I searched a lot but do not receive the correct docs who say these two things.

  I need to configure end users (without thread or L3 device)--> ACS--> LDAP for authentication

  Kind regards

  Santana

  Before you integrate ACS 5.x to the announcement, make sure that the time zone, Date & time on the ACS matches that on the AD PDC. Also, set the DNS on the ACS server to be able to resolve the domain name of the ACS 5.x. complete these steps to configure ACS Application Deployment Engine (ADE-OS) 5.x:

  Please follow the link for step by step configurations below because it is not possible to paste here complete as follows:

  http://www.Cisco.com/en/us/products/ps9911/products_configuration_example09186a0080bc6506.shtml

• Configuration of multiple Sources of identity in the politics of identity (ACS 5.3)

  Hello

  I have a 5.3 ACS cluster that is configured to use AD. There are a few features wireless and control tools that have no AD accounts. I would like to configure ACS to check first AD for the authentication of the user, and if that fails to derail the local identity source (internal users) where I can set these user accounts.

  It seems that when authentication hits the rule of the order of the initial identity, he never moves to the next if the first fails.

  Fasteners are screenshots that show how I'm set up for the test, I have a defined local user and I'm trying to log in to the firewall.

  -Identity definition: screenshot of the definition of main ACS for the rule that I test that does not

  -Identity rule 1: the configuration of the rule 1, that if she doesn't need to go to rule 2.

  -Log Output: Screenshot for one of the attempts failed since the ACS server view log.

  Reason why I need to set it up this way is:

  -Authenticate users wireless using AD user accounts. Some portable scanners do not support only and will have to authenticate by using the MAC address.

  -L' authentication for managing network devices use the AD accounts. We have monitoring tools that have no AD accounts and must be able to connect to network devices to issue certain commands (examples: first Cisco LMS and NCS, Infoblox NetMRI).

  Any suggestions on how to get this set up?

  Thank you

  Sami Abunasser

  The reason why the current definition does not work is because it is the condition even in the two rules in the policy. Once a condition corresponds to a policy, that he will not move to any subsequent regulations in politics. It's a first match policy.

  How to solve this problem is to use a sequence of identity.

  A sequence of identity can hunt through a series of databases that is the username and authentication can be performed

  To do this for the above scenario as follows:

  -Users and identity stores > sequence identity store

  -Create a sequence of identity. Select the solution "based on the password" then in "authentication and recovery research list of attributes" first AD1, then «internal users»»»

  This sequence of identity can now be selected as the result in the rule of identity strategy

• ACS appliance fails to recognize an installed certificate

  When I install a certificate from CA - Windows Server, following the procedure of "Wired Dot1x version 1.05 Config guide" (Document ID 64068) and the 'Guide user to ACS,' I have the following problem. If I want to change the "overall authentication settings', I get the warning"could not initialize the PEAP or EAP - TLS authentication protocol because the certificate authority is not installed. Install the certification authority using the ACS Certification Authority Setup page".

  But if I check "install Certificate", it is said that the certificate is installed correctly and it is also added to the "Configuration page of the authority.

  I already found the following in the as 4.1.4 release notes: "turn off the Security agent, reinstall the certificate in accordance with the procedure and then re - activate the security officer.

  I did it but I still have the same error, even if the security officer is disabled (I checked it in the console with the command 'show' and the CSA is off).

  Can someone help me how to recognize the installed certificate?

  P.S. I also see 2 devices in the AAA-server list:

  -ACS01 (the name I gave him in the initial configuration). This one has an IP address of the DHCP server, even if I said NOT to use a DHCP server, but a static IP!

  -Self: this one has the static IP I configured via the console...

  I can't remove one of the AAA servers. Is it normal that there are 2 servers?

  Bert,

  It seems that the certification authority that you have installed is damaged or poorly installed. I want do you is remove the certicate CA by using the MMC on windows in ACS and then reinstall it.

  You, too, need to install the certificate authority root in ACS. You can install the certificate authority root in System Configuration-> ACS certificate of installation-> ACS certificate authority installation.

  Also incase you use Verisign cert, you install VeriSign intermediate CA certificates.

  https://www.VeriSign.com/support/VeriSign-intermediate-CA/index.html

  Kind regards

  ~ JG

• How to remove the 5.2 ACS Local certificate

  Summer tinker around in our ACS 5.2 devices today to PEAP configuration. I generated a self-signed certificate under local certificates that I want to delete now. But when I try to remove it I get the following message is displayed:

  This failure has occurred: certificate is associated with a protocol. Therefore, it can be removed... Your changes have not been save. Click OK to return to the list page.

  I guess that's because it is associated with the EAP protocol, but I can not uncheck the box when I change the local certificate. How can I get rid of this test certificate?

  You must change the other server certificate and mark it as being used for Protocol EAP

  This removes the parameter of your test certificate and can then be removed

  Not the most intuitive but works

• 5.2 ACS access policy

  Hello

  could you recommend me how I accomplish the following task, I need to configure ACS 5.2 to authenticate WIRELESS users.

  There are two types of users: users in domain and not domain users.  I want to authenticate users in domain with PEAP-MSCHAPv2.

  And no domain users, I want to authenticate the host lookup (MAC).

  The question is how to properly organize access policy? I need to access several services or access service will be sufficient.

  Thanks in advance.

  Hello

  Your understanding is very close but MAB to work to work with wireless users, you need to activate the option for mac filtering to the SSID. This setting is global and will always trigger unlike port based authentication where you can define a sequence of authentication.

  You can create a service and strategy with which you can leave several policies. For the parameters of the identity of this policy, you will need to create an identity store sequence so that either AD is used first, then the internal hosts serves as a second, or vice versa. For the identity parameter, you need to set the indicator not found user to continue.

  Let me know if it works.

  Thank you

  Tarik Admani

  Please rate if useful!

• Ploblem with 2950 and ACS

  Hi all

  I have configured the 2950 as below and properly configured ACS and I can connect to the 2950 using this configuration, the problem lies after that I go to enable and try any command, I get approval to next error command failed.

  What I missed out the config that will allow me to execute commands?

  AAA new-model

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local authenticated by FIS

  AAA authorization commands 15 default group Ganymede + authenticated if

  AAA authorization network default group Ganymede + local authenticated by FIS

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  AAA accounting network default start-stop Ganymede group.

  GANYMEDE server host ***. ***

  radius-server key 7 *.

  Thanks in advance.

  Bruno

  Hi friend

  AAA of the switch seems ok, maybe you need to take a look at your ACS.

  Check the following information, where you have to apply it in your ACS config:

  http://www.Cisco.com/en/us/products/sw/secursw/ps5338/products_configuration_guide_chapter09186a00801fd6fc.html#wp676529

  If it helps, please note or ask another question.

  Kind regards

  Rafael Lanna

• Problem with GANYMEDE + (ACS) and cat 2950

  I have configured the 2950 as below and properly configured ACS and I can connect to the 2950 using this configuration, the problem lies after that I go to enable and try any command, I get approval to next error command failed.

  What I missed out the config that will allow me to execute commands?

  AAA new-model

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local authenticated by FIS

  AAA authorization commands 15 default group Ganymede + authenticated if

  AAA authorization network default group Ganymede + local authenticated by FIS

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  AAA accounting network default start-stop Ganymede group.

  GANYMEDE server host ***. ***

  radius-server key 7 *.

  Thanks in advance.

  Jon

  Hi Jon,

  AAA of the switch seems ok, maybe you need to take a look at your ACS.

  Check the following information, where you have to apply it in your ACS config:

  http://www.Cisco.com/en/us/products/sw/secursw/ps5338/products_configuration_guide_chapter09186a00801fd6fc.html#wp676529

  Rgds,

  AK