same host for radius and Ganymede

Hello

can I put a host (asa for example) twice in the acs Server? one for Ganymede to grant administrators access exec and the other for radius authenticate remote users.

I don't want remote users to be able to get exec mode.

Or how should I configure this?

Yes, you can do it. Network configuration ON acs

Add

ASA---> 10.1.1.1---> Auth using Ganymede +.

ASA1--> 10.1.1.1---> Auth using RADIUS

Host name cannot be the same.

Kind regards

~ JG

Note the useful messages

Tags: Cisco Security

Similar Questions

  • Can I use an ACS as RADIUS and GANYMEDE to the same ASA Server?

    I want to GANYMEDE to make the accounting of the SAA, meanwhile, the ASA need RADIUS for authentication ssl vpn. Is it possible to reach this object with only a CSA?

    Yes, you can use both. Allows you to add ASA as radius and Ganymede.

    ACS-->---> aaa-client network configuration

    (1) ASA---> 1.1.1.1---> authentic using Ganymede

    (2) ASA1---> 1.1.1.1---> optout by radius

    Don't forget the host name cannot be the same.

    Kind regards

    ~ JG

    Note the useful messages

  • RADIUS and Ganymede + running simultaneously?

    I have a Secure ACS 5.3.40 running GANYMEDE + and I need to also run 802.1 x radius to meet DISA requirements, I've been working on it for a week. I am unable to get the characteristics of work, all AD connections are already there for GANYMEDE + and so I'm not sure how config, Ray can someone help with the procedures.

    Hello

    in the configuration of the aaa you must specify the two authentication 802. 1 x that points to the RADIUS and peripheral administration of Ganymede.

    Configuration of the network device ACS apply both radius and Ganymede keys.

    There will be no conflict for the same as the two have different sets of commands.

    Thank you

    Please rate if useful...

  • authorization for AAA and GANYMEDE unavailable server scenario

    I installed a PIX for users authentication for telnet and enable access. I have permission to install a subset of users can run only display orders. This set works as expected.

    The problem is when I simulate and network failure and try to get access the PIX console. I can't run the enable command because the command shall not be permitted. I have to use means of recovery of password to access the PIX. How to do this? Can I have permission to order processed locally? Can I associated with the command show a lower level of the priveledge? If so, how and how can I limit the user to this level of privilege (via GANYMEDE)? I confiscate doing?

    Thank you

    If the PIX is configured for GANYMEDE authentiaction and RADIUS server is unavailable for authentication, there is no way to rescue or get around this issue at this time.

    You can configure the pix to get back to local authentication if Ganymede is not available.

    Release then (I think 6.3 and above) who will be available.

  • BlackBerry compatible host for leaderboards and achievements

    Everyone will agree that a good game should provide a way to match your performance against others, so Blackberry team should have an answer to that. Scoreloop was strong and had an excellent support, however it is no longer operational, so I guess it should be a replacement for it.

    I tried SwarmConnect, but it is so poorly supported (my bug report remained unanswered, and I could not find any related forum), I had to move rankings Google services to play, even if I'm not really impressed by those. But what to do with my Blackberry port? A Blackberry app is signed with a different key, so it certainly will not be recognized by GMS.

    Most of the BlackBerry games use the Facebook API for leaderboards and achievements.

  • Using the same PIN for input and output

    Hello

    I would use a single PIN for input and output.

    I'm experimenting with writing a driver for the DHT11 that using a single interface

    I have the following code to open the PIN, but it fails

    GPIOPin dhtPin = (GPIOPin) DeviceManager.open (new GPIOPinConfig (0, 17, GPIOPinConfig.DIR_BOTH_INIT_INPUT, GPIOPinConfig.DEFAULT, GPIOPinConfig.TRIGGER_NONE, false));

    VM - iso [DAAPI] =-1: not supported direction was placed for 17 GPIO pin number. Open failed

    jdk.dio.InvalidDeviceConfigException

    -com/oracle/deviceaccess/gpio/impl/GPIOPinImpl.openPinByConfig0 (), bci = 0

    com/oracle/deviceaccess/gpio/impl/GPIOPinImpl. < init > (), bci = 87

    -com/oracle/deviceaccess/gpio/impl/GPIOPinFactory.create (), bci = 6

    -com/oracle/deviceaccess/gpio/impl/GPIOPinFactory.create (), bci = 3

    -jdk/dio/DeviceManager.openWithConfig (), bci = 49

    -jdk/dio/DeviceManager.open (), bci = 6

    -jdk/dio/DeviceManager.open (), bci = 2

    -dht11 / DHT11. < init > (DHT11.java:42)

    -dht11 / DHT11. < init > (DHT11.java:37)

    -dht11/DHT11Midlet.startApp(DHT11Midlet.java:25)

    -javax/microedition/midlet/MIDletTunnelImpl.callStartApp (), bci = 1

    -com/sun/midp/midlet/MIDletPeer.startApp (), bci = 5

    -com/sun/midp/midlet/MIDletStateHandler.startSuite (), bci = 264

    -com/sun/midp/main/AbstractMIDletSuiteLoader.startSuite (), bci = 38

    -com/sun/midp/main/CldcMIDletSuiteLoader.startSuite (), bci = 5

    -com/sun/midp/main/AbstractMIDletSuiteLoader.runMIDletSuite (), bci = 132

    -com/sun/midp/main/AppIsolateMIDletSuiteLoader.main (), bci = 26

    I have the following permissions value

    jdk.dio.gpio.GPIOPinPermission "*: *" 'open, setdirection '.

    jdk.dio.DeviceMgmtPermission "*: *" 'open '.

    I tried a few other pins too, I don't know if some ankles are entered or only output pins.

    Any help would be appreciated. I could not find documents explaining how to configure more than one action for a permission ( 'open, setdirection'), so I tried just until he stopped to complain about the values...

    What I need is to open a PIN, set it OUT, write a few high and low values... set it to the direction of the ENTRANCE, and reading back high and low values... But right now my GPIOPinConfig seems to be problematic

    (... Configuration of the meaning to DIR_INPUT_ONLY or DIR_OUTPUT_ONLY, works until I try to change the direction of the port - what is expected...)

    Hi Charl-

    As far as I KNOW, he is there no current plan to apply 1 thread in Java ME Embedded.

    I also looked at Pi4Jand they do not also support 1-wire, however, there is an enhancement request to add support for the bit hit Linux driver will have to perform 1-wire work.

    The raspberry pi support it, it's just Java ME holds back me.

    BTW - the article has been referenced in the enhancement request notes that he is not taken in native support for 1 wire on the Raspberry Pi - it requires a Linux kernel driver module.

    Tom

  • WAAS for RADIUS and Windows Server 2012 NPS server configuration

    I have trouble getting our WAAS to authenticate devices and connection via RADIUS.  Running NPS on Windows Server 2012.  Confirmed that my device WAAS can ping the IP address of the RADIUS server.  Using the attribute Type of administrative service under network policies.  Look in the event viewer, I get an error with event ID 15, "a malformed RADIUS message has been received of the xxxx-WAAS-01 customer. The data is the RADIUS message. »

    Right now, I can connect with only the local default user and password name.  Here are a few config for WAAS, running version 6.2.1:

    RADIUS server key *.
    Server RADIUS auth-host 10.194.10.13 port 1645
    !
    connection of local authentication enable secondary
    enable login authentication RADIUS primary
    local authentication configuration enable secondary
    Service radius Authentication configuration Select primary
    failover of authentication server unavailable

    I confirmed that my shared key is entered correctly on the WAAS and the NPS.  I have the switches/routers Cisco works well on the same RADIUS server.

    Someone had a bit of luck plug their WAAS to RADIUS devices using Windows Server 2012 and NPS?  If so, please share additional measures you have taken to get things to work.

    Hi Paul,.

    Based on the RADIUS error you probably experience failure CSCva14731. This was discovered with Cisco ACS, but can affect other RADIUS servers.

    To confirm, you can check the corresponding error in syslog WAAS:

    authenticate: % WAAS-UNKNOWN-3-899999: pam_radius_auth: talk_radius: RADIUS server did not respond (timeout 5 (sec))

    Also, this defect would not affect peripheral on software 5.x WAAS.

    The problem will be solved in 6.2.3 to come free.

  • RADIUS and GANYMEDE + authentication

    We authenticate our systems through dot1x. I also need to be able to authenticate our Cisco admins using the same ACS server. I see how to configure a switch to make the two GANYMEDE + and RADIUS, but I do not see how implement GBA to allow a switch to use GANYMEDE + and RADIUS.

    Can someone give me a pointer?

    Thank you

    You need to put in place once the authentication on the switch.

    AAA authentication login default group local Ganymede

    Group AAA dot1x default authentication RADIUS

    AAA authorization exec default group Ganymede + authenticated if

    Group AAA authorization network default RADIUS

    Cisco RADIUS-server host 2.2.2.2 keys

    Cisco GANYMEDE-server host 2.2.2.2 keys

    The GBA, you must add the switch twice.

    ACS---> network configuration---> add aaa-clinet

    Host name switch1

    IP: 3.3.3.3

    With the help of authentic: RADIUS IETF

    Add another switch

    SWITCH2 host name

    IP: 3.3.3.3

    With the help of authentic: Ganymede +.

    Kind regards

    ~ JG

    Note the useful messages

  • Same Folio for iPad and Android?

    Hello

    I created a Folio, (1024 x 768) in InDesign.
    And I created two multi apps like booth for her question.
    > one for iPad
    > one for Android

    Both apps are live in the store.

    But some how only the display of the iPAd shows my Folio.
    Observer of Android remains empty


    Is this a problem of dimension/size?
    Do I really make another file-/-Folio InDesign for the Android Version?

    Unfortunately, you cannot change the format of an existing folio. I think that at this point, your best bet is to create a new custom folio of 1028 x 771. Because this folio has the same 4:3 1024 x 768 dimensions, you can add or import all of your source documents in this new folio without having to change the source folios.

  • Can we use the same package for main and begotten of concurrent programs.

    Hello

    I use a package.procedure1 for a simultaneous program. Can I use the same package.procedure2 of a pondu simultaneous program which was called from package.procedure1? If I say incompatible as the same program of 1, which will create problems by running the 2nd program because the package is same?

    Thank you
    HC

    I use a package.procedure1 for a simultaneous program. Can I use the same package.procedure2 of a pondu simultaneous program which was called from package.procedure1?

    Yes you can.

    If I say incompatible as the same program of 1, which will create problems by running the 2nd program because the package is same?

    When you second the 2nd program it will not work if the 1st program execution, and he has to wait until you have completed the 1st program.

    Don't know what code you use in the first and second procedures or even in the whole, but you can try this in a TEST instance first and check whether or not it works as expected.

    Thank you
    Hussein

  • Is the same IOS for SW and HW script?

    Hello

    I was wondering if I'm doing a script for a working VPN configuration, do I have to change the script, if I add add a VPN Module AIM-VPN/BPII-MORE later?

    How can I test the AIM - VPN module does the work and not just the software?

    Thanks in advance for your help.

    Best regards

    Didier

    Hello

    The configuration is identical, the difference is that the VPN module will unload the burden off the coast of the CPU when it is used.

    To check if the VPN module works can use "sh cry engine Accelerator stat"

    Federico.

  • Same URL for office and phone Layouts

    Hi all

    If you have already created a desktop version and mobile for a Web site, you have seen that Muse creates different URLS to access the desktop versions and mobile. To illustrate, for a site at random, Muse will create these URLs

    Desktop-> www.yoursite.com/index.html version

    Mobile version-> www.yoursite.com/phone/index.html

    It is extremely annoying, because when you go to the website of the office and send link in your browser to a person who then accesses the site from a phone, he or she will see the desktop version, which of course is not suitable for mobile devices. Even if a person accesses the site from a phone and then share the link of its browser with a person who looks at her on a desk that person will see the mobile version, which even once is not suitable.

    The only way I see to solve this problem is to have a URL that is common to both desktop and mobile, but I can't find this feature in Muse.

    Has anyone found a way around this problem?

    Thank you very much.

    lauras18147102 wrote:

    Hi all

    If you have already created a desktop version and mobile for a Web site, you have seen that Muse creates different URLS to access the desktop versions and mobile. To illustrate, for a site at random, Muse will create these URLs

    --> Www.yoursite.com/index.html desktop version

    Mobile version--> www.yoursite.com/phone/index.html

    It is extremely annoying, because when you go to the website of the office and send link in your browser to a person who then accesses the site from a phone, he or she will see the desktop version, which of course is not suitable for mobile devices. Even if a person accesses the site from a phone and then share the link of its browser with a person who looks at her on a desk that person will see the mobile version, which even once is not suitable.

    The only way I see to solve this problem is to have a URL that is common to both desktop and mobile, but I can't find this feature in Muse.

    Has anyone found a way around this problem?

    Thank you very much.

    Send them www.yoursite.com and they will receive the version to match their device

    That is to say, Office Gets

    --> Www.yoursite.com/index.html desktop version

    and get phones

    Mobile version--> www.yoursite.com/phone/index.html

    lauras18147102 wrote:

    The only way I see to solve this problem is to have a URL that is common to both desktop and mobile, but I can't find this feature in Muse.

    because it does not... phones are different, they need different code and they display different websites, so unless you are happy to have users of office forced to see a layout of phone?

  • The s/w and h/w on the same host iSCSI initiators.

    Hello

    Can someone tell me if both software and hardware on the same host iSCSI initiators and looking the same LUN is supported in ESX3.5U5, 4.0U2 and 4.1.

    If this isn't the case, please give me the URL of any article of vmware goes in the same.

    Thank you

    P Martin

    The closest would be on page 28 of the 4.1 "iSCSI SAN slot Guide.

    http://www.VMware.com/PDF/vSphere4/R41/vsp_41_iscsi_san_cfg.PDF

    Because the software initiator ESX is definitely a charge adapter, this could be considered to be applicable.

    In spite of being is not clearly established, there is no summer tested enough to be considered as support even if there are no known issues.

    Andy

  • Switches: RADIUS or GANYMEDE?

    Hello

    So far I've managed my switches with GANYMEDE +, but now I have deploy 802. 1 X, requiring RADIUS only.

    For all I know, ACS (I use 4.2) allows you to set a device using only GANYMEDE or RADIUS, but not both.

    Am not mistaken? Or there is a way to define an AAA client to communicate with the ACS even using two protocols?

    Assuming I'm right, I then considered the following options:

    -Configure all switches to use radius for any service (authentication, authorization ec etc.) this makes it easier, but I lose the GANYMEDE services + for switches. What a big loss?

    OR

    -Configure L3 switches to use a second closure, just for the RADIUS services. It would always use the GANYMEDE + but would require a new network for the service RADIUS; In addition, switches L2 does not support both IP addresses and would require anyway a migration to the RADIUS.

    A considerable administrative burden, in other words.

    I'm not ready to deploy a second RAY (ACS, Windows, whatever), right now.

    The key point is this: reading autour I see documentation Cisco recommends always using GANYMEDE + for management, but in this case is not possible. In general, whenever the unit has a role of network entry (switch or access point) RAY seems to be the Protocol of choice. Moving to the RADIUS would have some drawback or a change in the communication protocol? (I know the difference between GANYMEDE + and RADIUS: tcp, udp vs, vs whole package of only the password encryption encryption).

    Thanks anticipately

    C

    Hello Carlo,.

    You can keep using GANYMEDE + for device management and RADIUS to 802. 1 x, with no need for an additional IPN focuses on additional servers or IP on each managed device.

    4.2 ACS allows allows you to set two AAA Clients with the same IP address, one for GANYMEDE + and for RADIUS, however, the host name must be unique.

    Then, on the switch, you can define the same ACS server as a server radius and Ganymede-server host, configure the controls of "aaa" to connect to the console and pointing to the GANYMEDE server authorization + and part dot1x pointing to the RADIUS server.

    What you're looking for is feasible and it is normal to use GANYMEDE + for device management and RADIUS for 802. 1 x.

    I hope that answers your questions.

    Kind regards

    Federico

    --

    If this answers your question please mark the question as "answered" and write it down, so other users can easily find it.

  • Same host Machine

    Hi all

    I have a doubt as to the integration of the APEX with BI Publisher.

    Is the SUMMIT and BI Publisher must be installed in the same machine (i.e. same host) for integration, or it may be in a different host machine.

    Since my APEX is a single machine and BI publisher is in the other machine.

    If it's in another machine, it is possible to integrate between these two.

    Otherwise, it is recommended strictly the inorder to integrate BI publisher by means of the APEX, then both must be in the same machine.

    Kind regards
    Mini

    Hey Mini,

    >
    Host address print server: 4iapps-biserver
    >

    Try the IP address instead!

    Kind regards
    Kiran

Maybe you are looking for