RADIUS across servers

Similar Questions

• My outlook express will not send any e-mails to btinternet, across servers are OK

  Recently, I find I'm unable to send emails to any address btinternet, all other servers, for example, hotmail, sky, talktalk.net seem to be OK.  I am able to receive emails from btinternet.

  "When you try to send e-mail to btinternet I get a message - Mail Delivery System - Delivery Status Notification (failure) the reason for the problem 5.1.0 address unknown 554" error message unauthorized (320) "

  If I go directly to the server of talktalk, I can then send emails to btinternet.

  Any ideas?

  Make sure that the date and time of the clock are correct. Which can cause this error.

• 5.2 ACS with different RADIUS authentication servers

  Hello

  I want to migrate from ACS ACS 5.2 4.1. I have already configured authentication GANYMEDE +, but now I've stuck to the RADIUS authentication for remote access WebVPN configuration. Please see the following diagram:

  

  I want to configure ACS to use Server Token WBS first. If authentication fails or the user is not found, ACS must use IAS in Windows Server. If this server fails also ACS must use internal DB. Additional attributes as belonging to a group or ACL downloadable should be taken from internal ACS DB.

  Is it possible to configure ACS like that? ACS 4.1 it is very easy to configure by selecting the per user authentication method.

  Thanks for your help!

  There is an option in the Advanced tab of definition 'RADIUS Identity server' th:

  This storage of identity differentiates between 'authentication failed' and 'user not found' when an authentication attempt is rejected. Among the options below, select how a rejection of authentication of the identity store must be interpreted by FAC for the politics of identity of treatment and reports.
  Releases to treat as 'authentication failed' treat dismisses them as "user not found".

  In order to continue in the sequence, I think you have to select the option "user not found".

• WLC with RADIUS authentication servers

  I WLC user authentication with Cisco ISE which is linked with LDAP, now ISE is not accessible. Will be wireless users could always connect and use the Services of WLC?

  Hello Irshad-

  All customers who have already been authenticated will continue to work and to be allowed on the network until they leave the network and/or re-auth, idle, etc type timers expire. At that point, customers will not be able to join the SSID and won't have access to the network.

  To avoid that from happening, you can:

  1. create a redundancy by having more than one node of ISE

  2. create a secondary authentication via another RADIUS or LDAP server

  I hope this helps!

  Thank you for evaluating useful messages!

• In Active/Passive Mode Radius server configuration

  We set up (active/active) the two ASA load balancing.  We also configure two Radius servers with load balancing.  At present, the Radius servers are configured with active/active.  Is it possible to configure a Radius Server with (active/passive)?

  RADIUS protocol Radius AAA server
  AAA-server Radius (inside) host XXX.XXX.XXX.XXX
  Timeout 300
  key *.
  RADIUS-common-pw *.

  AAA-server Radius (inside) host XXX.XXX.XXX.XXX
  Timeout 300
  key *.
  RADIUS-common-pw *.

  AAA accounting enable console RADIUS

  Thank you.

  Diane

  Diane,

  Well I'm still not 100% sure that you understand exactly what is happening. Normally, on a single ASA, authentication is always performed on the same radius server until it fails (i.e. active/passive as you call it).

  Now, you mention that you have 2 ASAs in load balancing, so I don't know if you mean that:

  (1) 2 users that connect to the same ASA get authenticated by radius 2 servers different (should never happen)

  or

  (2) when 2 users connect to the cluster, user1 gets redirected to ASA1 and authenticated on Radius1, while User2 will be redirected to ASA2 using Radius2 to auth. This could be normal if both ASAs are set up differently (defined in a different order radius servers) or an ASA had a problem connecting to Radius1, at some point and so it considered out of service.

  In any case, 'sh aaa-server protocol radius' and 'debug RADIUS' can help determine why an asa individual does not use (initially configured) primary radius server.

  HTH

  Herbert

• SSID anchored

  Hello

  We have a couple of corporate Wireless LAN Controller (WLC 5508). They are used for corporate purposes. Now, we have added an anchor (WLC 2504) controller located in the demilitarized zone to offer access as a guest. We threw the anchor two SSID. The first is completely free with only internet access. It works very well. But we have a problem with the second SSID.

  The other requires authentication. This authentication must be made through RADIUS. We don't have work and finally, we understood why. The authentication process is done by the controller from abroad. We have confirmed that this network as a point of capture. Foreign controllers do not know how to get to the Radius server. And we want to anchor the controller to be one who makes authentication. His IP address is the IP address that is accepted on the Radius server.

  In all of literature, we read that it is said that authentication is always via the controller to default anchor. For example:

  • http://www.Cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-...

  In an anchor - WLC foreign scenario, which WLC sends RADIUS account management?

  In this scenario, authentication is always made by the WLC anchor. Therefore, RADIUS account management is sent by the WLC anchor.

  • http://wirelessccie.blogspot.com.es/2009/12/WLC-layer-2-and-layer-3-SECU...

  -RADIUS server: in the WLAN security > AAA Servers tab, you controller anchor can set specific RADIUS servers to use, that your foreign controller does not care. Authentication is performed on the anchor, not on Foreign Affairs, you can call the RADIUS servers on the anchor and not on Foreign Affairs, no problem. It can also be a difference.

  This is not the case in this way on our scenario. We have:

  • Layer Security 2 management of 'WPA + WPA2' keys and authentication set to the value "802.1 x."
  • 3-layer security the value 'None '.
  • • We read--> http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-0/configurati...
    • • "Authenticationfor Layer 3 RADIUS, RADIUS for authentication requests are sent by the controller of the anchor."
      • We need to define an authentication type of layer 3?
  • Set us the RADIUS AAA Servers tab.
  • We took the version of the 8.0.132.0 software.

  So we would like to know if any other configuration is needed to get the anchor being the source of the authentication process.

  I thank very you much in advance!

  Josu,

  This is where your needs must be defined?  Encryption of the client to the access point is done only when you use the layer 2 encryption.  So that being said, the RADIUS is also done on the foreign controller to layer 2.  Therefore, decide what is the best solution for you. When I hear about erase the text when you anchor, I ask if encryption is required.  Generally, you anchor a SSID to a controller of the DMZ to access internet only so do you really care?

  -Scott

  Please rare useful messages *.

• Right way to restart the ISE PSN node in a distributed deployment

  Hi all

  Two of my ISE nodes (in a 1.2 8 node deployment) have expired admin CLI past (I know I'm stupid!)

  One is the secondary node MnT and one is a PSN node (1 of 4).

  I have some information on what I need to do to get a new password, but I have to unregister the nodes first or can I restart them.

  Will be my other three nodes PSN automatically re - authenticate users on PSN restart node or should I ask the downtime?

  Thanks for any help in advance

  Mark

  Right, shouldn't be a problem.  You certainly wouldn't want to remove it - you'd only if you need to reimage or something like that.

  Just as a tip, if you speak only use wireless cases, you could always disable this particular NHP since authentication Radius and Radius Accounting servers in the world (not over the WLAN).  If you make a change to the WLAN, it will "bounce" the WLAN.  But, if globally disable you "admin" that particular NHP, it will keep just the WLC as NHPS by up to that turn you it on again.

  Tim

• Active Directory users are authenticated web-auth (web-auth has only LOCAL users)

  Hello

  I have a model WLC 4404 with software version 4.2.205.0.
  I have 2 SSID: Wireless and invited
  -Wireless: using [WPA + WPA2] [Auth (802. 1 X)]
  -Guests: use Web-Auth

  In the guests of SSID (WLAN-> Edit > AAA security servers I have not all enable server - option there is NOT and not activated-).

  I do not understand that the request for authentication is attempted ONLY locally to the WLC but not in the ACS (ACS has been configured in security-> RADIUS-> authentication).

  When a user authentication Web Page inserts user and password of SSID wireless (users who need to be authenticated in Active Directory via ACS) it is authenticated.

  I need to change this behavior.

  There are a few options depending on what you are using the code.

  6.0 and higher, there is an option in the WLAN directly, select only LOCAL.

  5.2 below, under Radius authentication servers, uncheck the box for the user of the network.  This check box allows the WLC to use the servers in the world, which means that if it is not precisely defined under the WLAN, it can / will still be used

• AAA authorization commands

  Hi all

  Probably, I'll ask a stupid question but I am really confused about the purpose of the "x by default local aaa authorization commands" command. I understand that if this command is configured, it allows each order of this level, but in my experience, this command does nothing. The result is the same whether or not it is configured.

  Here is my config part aaa

  cisco cisco username privilege 15 secret

  AAA new-model

  AAA authentication login default local activate

  AAA authorization exec default local authenticated by FIS

  AAA authorization commands 15 local default authenticated by FIS

  Now if I keep the last command or remove, user name "cisco" is able to use each command level 15 so my question is, why would I bother to configure this command?

  Would really appreciate your quick response

  Concerning

  Hi Charlotte,.

  According to my understanding of the database of the local user you don't need to have permission from aaa in the network device... If you use any Ganymede + / Radius authentication servers, then it will be more efficient, you can set an attributes to the user profile and through which you can play the config access level users at certain level...

  When it is with a local database, to approval based on the level of privileage we set locally on the device and he never looks for aaa... reference local authorization is limited and more that it is limited to sets of levels of privileage on the specific profile...

  You can go through the below document mentioned for your apprenticeship on aaa...

  http://www.Cisco.com/c/en/us/TD/docs/iOS/12_2/Security/command/reference...

  Concerning

  Knockaert

• "Distribution of the Proxy table" featured ACS 5.2?

  Hello!

  Is it possible to have something similar to the table of distribution of proxy 4.2 ACS ACS 5.2?

  I need to authenticate my users with ACS against AD and let guests to authenticate to external radius proxy.

  4.2 I manage it with the table of distribution of proxy: the suffix @ourdomain to my ACS and the rest points goes to 2 radius proxy servers.

  5.2 can I define a strategy of selection of the Service with the Service Type 'Proxy RADIUS' but I can not set a rule to test against a domain or a user name and based on this result authenticate locally or send with radius proxy servers.

  No idea how this can be done in 5.2?

  Thank you

  Wolfgang

  I think that can be done so driven off the username in the RADIUS request

  (1) create definition of RADIUS proxy servers:

  Network resources > external RADIUS servers

  (2) create the proxy service:

  Access policies > access > create:

  Type of Service selected user should be "Proxy RADIUS" and select RADIUS server in option 1)

  (3) create conditions for the custom user name attribute:

  Elements of strategy > Session Conditions > Custom

  Dictionary should be "RADIUS-IETF."

  Attribute should be "user name".

  (4) change the selection of the service policy.

  Reach:

  Access policies > Access Services > Service selection rules

  Press 'Customize' and select 'User name' condition that was created in step 3). Press OK

  Now to add a rule to check the username and pass them on to the proxy server required

  For example the condition: "" If the username ends - with @ourdomain ".

  result: the service Proxy created in step 2)

• RAY of relief with multiple Radius servers

  Wism2 version 7.6.130

  I have multiple Radius servers for different wireless LANs that are used for authentication. For example:

  WLAN1 - Radius1, Radius2

  Wlan2 - Radius3, Radius4

  WLAN3 - Radius5, Radius6

  Radius servers have different types of user to the authentication databases.

  My question is, when you configure RADIUS of relief in Active mode on the WLC he must receive a successful authentication response in order to stay active or simple an answer?

  Thank you

  Waqas

  "My question is, when you configure RADIUS of relief in Active mode on the WLC he must receive a successful authentication response in order to stay active or simple an answer?

  Hi Waqas,

  It doesn't have to be a successful authentication, could be access accept or decline. You may have noticed with mode active there is a section to specify the user name (default: cisco-probe) what it does is when the radius known as death wlc server use that specific account to query the server radius on the specified time intervals.all these responses would also be responses to refuse access. Just a response if accept or reject to keep active.

  Look here to see little more on the functionality of relief

  See you soon

  Micheline

  WLC actively interrogate the radius server

• How many radius servers?

  What is the maximum number of RADIUS servers that can be configured on a controller 4404?

  Hello

  You can configure up to 17 on 4404 controllers.17 radius servers is the maximum limit for radius authentication, accountants, and LDAP servers.

  Hope this will answer your query.

• Is it possible to send Radius accounting packets with two different servers?

  Hello experts!

  I have dilemma I send info Radius accounting on two different servers for authentication of the dot1x. Here are the relevent config. However the switch just to send a copy on the first server in the server group...

  RADIUS AAA server Acct group
  ACCT-port of the server 172.17.1.1 auth-port 1812 1813
  ACCT-port of the server 172.17.1.2 auth-port 1812 1813

  accounting dot1x default start-stop broadcast group AAA Acct

  RADIUS-server host 172.17.1.1 auth-port 1812 acct-port 1813 key xxxxxx
  RADIUS-server host 172.17.1.2 auth-port 1812 acct-port 1813 key xxxxxx

  Is it possible to send two copies of two different servers? I tried the key word 'issue' in the aaa accounting command, but it does make a difference. What is doing? I can't find it in the manual...

  Thank you!

  Difan

  Difan,

  You must create two aaa server groups to operate. Allows the sending of accounting records to multiple AAA servers.  At the same time returns accounting records the first server in each group. If the first server is unavailable, the failover occurs using servers defined within this group.

  Accounting AAA broadcast configuration
  The following example shows the turn on broadcast accounting using the aaa accounting global command:

  RADIUS AAA server group isp
  Server 1.0.0.1
  Server 1.0.0.2

  AAA isp_customer radius server group
  Server 3.0.0.1

  AAA accounting network default start-stop broadcast group isp group isp_customer

  host server RADIUS 1.0.0.1
  host server RADIUS 1.0.0.2
  Server RADIUS key key1
  RADIUS-server host 3.0.0.1 key2 keys

  The broadcast keyword causes the start and stop accounting for dot1x connections to be sent simultaneously to the 1.0.0.1 group isp server and Server 3.0.0.1 in the isp_customer group. If 1.0.0.1 is unavailable, Server failover 1.0.0.2 occurs. If the 3.0.0.1 server is unavailable, no failover occurs because backup servers are not configured for the isp_customer group.

  Kind regards

  ~ JG

  Note the useful messages

• 3005 to multiple RADIUS servers?

  Is it possible to install groups in the 3005 to authenticate on the specific RADIUS servers?

  I wish:

  VPNGroup1 authenticate on RADIUS1 then

  VPNGroup2 authenticate on RADIUS2.

  I can tell the group to authenticate to a RADIUS server, but I have not found a way to tell the group what server to use.

  Hello

  Go in configure > user mgmt-> groups

  highlite group, click Server Auth button and then configure the RADIUS server, and it would only be used for this group.

  THX

  AFAQ

• With the help of several radius for authentication servers

  Hello.

  I want to install a PPTP to my router and I wonder if it is possible to use windows multiple IAS servers on a Cisco router?

  The scenario is that I have more than one business using this PPTP connection and they all have their own advertising on their own VLAN, I would like the router to forward the authentication request containing the username and password for all IAS of Windows servers that I specify or go through them one at a time until it receives an awnser.

  Is this possible?

  Best regards Tommy Svensson

  Tommy,

  This is not possible because if a radius server receives a user name, it will be simple rejection the user and send this response to the Cisco router. The radius Protocol is not throw or send any message to warn the router that the user is not present in its database.

  I know that with ACS that if a username has been sent with a special domain can proxy communication on the acs server and the Cisco router based on the user name.

  I hope this helps.

  Tarik