The AAA authentication and VRF-Lite

Hello!

I encountered a strange problem, when you use authentication Radius AAA and VRF-Lite.

The setting is as follows. A/31 linknet is configured between PE and THIS (7206/g1 and C1812), where the EP sub-si is part of a MPLS VPN and VRF-Lite CE uses to maintain separate local services (where more than one VPN is used..).

Access to the this, via telnet, console etc, will be authenticated by our RADIUS servers, based on the following configuration:

--> Config start<>

AAA new-model

!

!

Group AA radius RADIUS-auth server

Server x.x.4.23 auth-port 1645 acct-port 1646

Server x.x.7.139 auth-port 1645 acct-port 1646

!

AAA authentication login default group auth radius local

enable AAA, enable authentication by default group RADIUS-auth

...

touch of 1646-Server RADIUS host x.x.4.23 auth-port 1645 acct-port

touch of 1646-Server RADIUS host x.x.7.139 auth-port 1645 acct-port

...

source-interface IP vrf 10 RADIUS

---> Config ends<>

The VRF-Lite instance is configured like this:

---> Config start<>

VRF IP-10

RD 65001:10

---> Config ends<>

Now - if I remove the configuration VRF-Lite and use global routing on the CE (which is OK for a simple vpn installation), AAA/RADIUS authentication works very well. "" When I activate transfer ip vrf "10" on the interface of the outside and inside, AAA/RADIUS service is unable to reach the two defined servers.

I compared the routing table when using VRF-Lite and global routing, and they are identical. All roads are correctly imported via BGP, and the service as a whole operates without problem, in other words, the AAA/RADIUS part is the only service does not.

It may be necessary to include a vrf-transfer command in the config of Group server as follows:

AAA radius RADIUS-auth server group

Server-private x.x.x.x auth-port 1645 acct-port

1646 key ww

IP vrf forwarding 10

See the document below for more details:

http://www.Cisco.com/en/us/partner/docs/iOS/12_4/secure/configuration/guide/hvrfaaa.html

Tags: Cisco Security

Similar Questions

  • The AAA authentication not working method and 'by default' list

    Guys,

    I hope someone can help me here to the problem of the AAA. I copied the configuration and debugging below. The router keeps using username/password local name even if the ACS servers are accessible and functional. To debug, it seems he keeps using the method list 'default' ignoring GANYMEDE config. Any help will be appreciated

    Config

    **********************************

    AAA new-model

    !

    username admin privilege 15 secret 5 xxxxxxxxxx.

    !

    AAA authentication login default group Ganymede + local

    the AAA authentication enable default group Ganymede + activate

    authorization AAA console

    AAA authorization exec default group Ganymede + local

    AAA authorization commands 15 default group Ganymede + local

    AAA authorization default reverse-access group Ganymede + local

    orders accounting AAA 0 arrhythmic default group Ganymede +.

    orders accounting AAA 15 by default start-stop Ganymede group.

    Default connection accounting AAA power Ganymede group.

    !

    AAA - the id of the joint session

    !

    RADIUS-server host x.x.x.x

    RADIUS-server host x.x.x.x

    RADIUS-server host x.x.x.x

    RADIUS-server host x.x.x.x

    RADIUS-server application made

    RADIUS-server key 7 0006140E54xxxxxxxxxx

    !

    Ganymede IP interface-source Vlan200

    ***************************

    Debugs

    002344: 5 Dec 01:36:03.087 ICT: AAA/BIND (00000022): link i / f

    002345: Dec 5 01:36:03.087 ICT: AAA/AUTHENTIC/LOGIN (00000022): choose method list "by default".

    002346: Dec 5 01:36:11.080 ICT: AAA/AUTHENTIC/LOGIN (00000022): choose method list "by default".

    core01 #.

    002347: Dec 5 01:36:59.404 ICT: AAA: analyze name = tty0 BID type =-1 ATS = - 1

    002348: Dec 5 01:36:59.404 ICT: AAA: name = tty0 flags = 0 x 11 type = 4 shelf = 0 = 0 = 0 = 0 = 0 channel port adapter slot

    002349: Dec 5 01:36:59.404 ICT: AAA/MEMORY: create_user (0 x 6526934) user = "admin" ruser = "core01" ds0 = 0 port = "tty0" rem_addr = "async" authen_type = service ASCII = NONE priv = 15 initial_task_id = '0', vrf = (id = 0)

    002350: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): Port = "tty0" list = "service = CMD

    002351: Dec 5 01:36:59.404 ICT: AAA/AUTHOR/CMD: tty0 (2162495688) user = "admin".

    002352: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send service AV = shell

    002353: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send cmd = AV set up

    002354: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send AV terminal = cmd - arg

    002355: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): send cmd - arg = AV

    002356: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): found the 'default' list

    002357: Dec 5 01:36:59.404 ICT: tty0 AAA/AUTHOR/CMD (2162495688): method = Ganymede + (Ganymede +)

    002358: Dec 5 01:36:59.404 ICT: AAA/AUTHOR/TAC +: (2162495688): user = admin

    002359: Dec 5 01:36:59.404 ICT: AAA/AUTHOR/TAC +: (2162495688): send service AV = shell

    002360: Dec 5 01:36:59.404 ICT: AAA/AUTHOR/TAC +: (2162495688): send cmd = AV set up

    002361: Dec 5 01:36:59.404 ICT: AAA/AUTHOR/TAC +: (2162495688): send AV terminal = cmd - arg

    002362: Dec 5 01:36:59.404 ICT: AAA/AUTHOR/TAC +: (2162495688): send cmd - arg = AV

    Enter configuration commands, one per line.  End with CNTL/Z.

    core01 (config) #.

    002363: Dec 5 01:37:04.261 ICT: AAA/AUTHOR (2162495688): permission post = ERROR

    002364: Dec 5 01:37:04.261 ICT: tty0 AAA/AUTHOR/CMD (2162495688): method = LOCAL

    002365: Dec 5 01:37:04.261 ICT: AAA/AUTHOR (2162495688): position of authorization = PASS_ADD

    002366: Dec 5 01:37:04.261 ICT: AAA/MEMORY: free_user (0 x 6526934) user = "admin" ruser = "core01" port = "tty0" rem_addr = "async" authen_type = ASCII service = NONE priv = 15

    core01 (config) #.

    Ganymede + accessible servers use source vlan 200. Also in the Ganymede server + can you check if the IP address for this device is configured correctly and also please check the pwd on the server and the game of this device.

    As rick suggested sh Ganymede would be good as well. That would show the failures and the successes

    HTH

    Kishore

  • the AAA authentication enable default group Ganymede + activate

    I implement CSACS 4.0. First of all on the client, I will apply aaa authenticatio / authorization under vty. The issure if I use the followin command

    the AAA authentication enable default group Ganymede + activate

    What happens if I connect via the console? I need to enter a name of user and password?

    Here is my configuration

    AAA new-model

    Group authvty of connection authentication AAA GANYMEDE + local

    the AAA authentication enable default group Ganymede + activate

    authvty orders 15 AAA authorization GANYMEDE + local

    RADIUS-server host IP

    Radius-server key

    Ganymede IP source interface VLAN 3

    AAA accounting send stop-record an authentication failure

    AAA accounting delay start

    AAA accounting exec authvty start-stop group Ganymede +.

    orders accounting AAA 15 authvty power group Ganymede +.

    AAA accounting connection authvty start-stop group Ganymede +.

    line vty 0 15

    connection of authentication authvty

    authorization orders 15 authvty

    authvty connection accounting

    accounting orders 15 authvty

    accunting exec authvty

    Any suggestion will be appreciated!

    It should work because it is a guest message.banner whenever you try to connect (console/vty). I set it up on my router.

    If you have banner motd, it will appear as well (see below). So, I have to remove it to get only the aaa banner & prompt is displayed:

    ************************************************************

    Username: cisco, password: cisco (priv 15f - local) *.

    ************************************************************

    Any unauthorized use is prohibited.

    Enter your name here: User1

    Now enter your password:

    Router #.

    The configuration more or less looks like this:

    AAA new-model

    AAA authentication banner ^ is forbidden to use CUnauthorized. ^ C

    AAA authentication password prompt "enter your password now:

    AAA-guest authentication username "enter your name here:

    Group AAA authentication login default RADIUS

    local authentication AAA CONSOLE connection

    HTH

    AK

  • The AAA authentication configuration

    We have ACS server 3.1 to AAA for authentication for all routers and switches. I want each person to connect the router using its own id, password password and activate. If the ACS server is unavailable, I want to have different id, password and enable password for console and telnet access. What is the right way to do this? I also want to follow all orders entered on the router.

    That's what I have:

    AAA new-model

    AAA authentication login default group Ganymede + local

    enable AAA authentication login no_tacacs

    the AAA authentication enable default group Ganymede + line

    AAA authorization exec default group Ganymede + local

    AAA authorization commands 15 default group Ganymede + local

    AAA accounting exec default start-stop Ganymede group.

    orders accounting AAA 15 by default start-stop Ganymede group.

    !

    username admin password 7 xxxxxxxxxxxxxxxx

    !

    !

    Line con 0

    connection of authentication no_tacacs

    line to 0

    line vty 0 4

    password 7 xxxxxxxxxxxxxxxxxxxxxxxx

    !

    Yes, it's Joy on the right. Thank you, Renault

  • Excluding the lines of Terminal Server in the AAA authentication

    Hi all

    Hope you can help, I'm trying to find a solution to exclude only the following line port by using the AAA authentication (ACS GANYMEDE +) on a map of Terminal Server on a Cisco 2600 router.  Does anyone know how to do this, or point me in the right direction to solve?

    I've included the output below:

    AAA authentication login default group Ganymede + local
    AAA authorization exec default group Ganymede + local
    AAA accounting exec default start-stop Ganymede group.
    AAA accounting network default start-stop Ganymede group.
    AAA accounting default connection group power Ganymede
    AAA accounting system default start-stop Ganymede group.
    AAA - the id of the joint session

    line 41
    session-timeout 20
    decoder location - XXXXXX XXXXXX BT
    No banner motd
    No exec-banner
    absolute-timeout 240
    Modem InOut
    No exec
    transport of entry all
    StopBits 1
    Speed 38400

    Is it a question of disabling the command line or using a defined group?

    Thanks a lot for your help.

    Jim.

    Hi Jim

    You may need to create another group for authentication to the and send your AAA configuration

    line to 0

    connection of authentication aux_auth

    AAA authentication login aux_auth line

    You can also configure a username local/pw and map it on the group to here...

    Console and telnet would still use the configured default group, or you can specify specific groups:

    Line con 0

    console login authentication

    line 4 vty0

    vty authentication login

    and specify the aaa authentication settings individually...

    I hope this helps... all the best

    REDA

  • The AAA authentication: not configured

    I have cisco 851 using ccp to configure EASY VPN

    I click on TEST VPN SERVER, and then click Start the State shows successful

    When I tried to connect a client I mm_no_state

    When I considered the report of the test I found

    The AAA authentication: not configured

    My AAA

    AAA new-model

    !

    !

    AAA authentication login tgcsusers local

    AAA authorization tgcsvpn LAN

    !

    AAA - the id of the joint session

    I have also attached my config

    Ideas or thoughts?

    You will need to get my client work...

    I logged by user name password you provided.

    Please check the pictures I downloaded to you.

    Good night, sleep tight.

    Thank you

    Rizwan James

  • DMVPN and VRF Lite

    Someone at - it an example of use of several networks DMVPN and VRF (no MPLS) interfaces

    I have a requirment to use a common link to transmit three talking about networks isolated to the Hub as encrypted data. It could be VTI doesn't bother me, but I can't use MPLS.

    Thank you

    Hello

    "back in the day", I made this config:

    of http://isamology.blogspot.com/2010/01/IPSec-and-vrfs-so-who-faire-vrf.html

    But normally, I guess you've seen this:
    http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6660/prod_white_paper0900aecd8034be03_ps6658_Products_White_Paper.html

    Same principles apply to the VRF lite little matter DMVPN/VTI/GREoIPsec configuration.

    tunnel vrf VRF door =

    IP vrf forwarding = inside the VRF

    Now, if you add the cheat of Nico (for isakmp profiles) sheet especially if necessary, you should be all set.

    https://supportforums.Cisco.com/docs/doc-13524

    Marcin

  • the AAA authentication

    Hello

    Just 2 8164 unpacket new switches. This is my first network hardware dell that I use. I have a little trouble understanding authentication methods. I'm used to using a database of the local user. I managed to create a list of login authentication which checks the local user database. But I stil have to Pentecost autheticate an enable password when I enter enable promt.

    Is it possible to login and go straight through the mode exec user without password enable?

    Hello

    If you have a radius or Ganymede server you won't have to use the enable password if you define methods like the default method and user account appropriate to record level in sound. FTP://FTP.Dell.com/manuals/all-products/esuprt_ser_stor_net/esuprt_powerconnect/PowerConnect-8100_Reference%20Guide_en-us.PDF page 242

  • AAA authentication and privilege-mode

    I want to configure authentication aaa with accounts of local user on the switch. The idea is to come directly into the "privilege" without the enable command mode.

    I have configured the following commands:

    AAA new-model

    AAA authentication login default local

    What other commands (permission) are necessary to obtain the command of privilege?

    Thank you

    Pascal

    Dear Sir

    For the console you must issue to order more.

    There is a hidden within IOS command you will need to apply: "authorization aaa console.

    Who should fix it

    Kind regards

    ~ JG

    Note the useful messages

  • The AAA authentication &amp; accounting using the command of Ganymede-orders

    In the page of the cisco Remote Access Companion guide 394 book we got these configuration lines:

    RTA (config) #tacacs - server host 192.168.0.11

    RTA (config) #tacacs - host 192.168.0.12 server

    RTA (config) #tacacs - server key topsecret

    RTA (config) #aaa new-model

    Ganymede + RTA (config) #aaa authentication login default group

    If I want to add to the configuration above, the following command:

    RTA (config) #aaa accounting connection defult stop / start Ganymede +.

    Is it necessary that the above lines be in a specific order when I configure the RTA?

    No, the order in which you enter commands doesn't matter.

  • The AAA authentication failure

    I have a 2500 with configured radius server controller with safety as the WPA system. Few users authenticate not since yesterday (they were connected before) with the same user credentails in another laptop sound work. All a both few customers is not authenticate.

    Here are the logs of problem with the command show debugging client client mac address

    (Cisco Controller) > * Dot1x_NW_MsgTask_3: 18:30:37.487 Mar 20: 98:03:d8:7 d: d0:83 received EAPOL START of mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.487 Mar 20: 98:03:d8:7 d: d0:83 dot1x - moving d mobile 98:03:d8:7: d0:83 in the State of connection

    * Dot1x_NW_MsgTask_3: 18:30:37.487 Mar 20: 98:03:d8:7 d: d0:83 send request/identity EAP to d 98:03:d8:7 mobile: d0:83 (EAP Id 2)

    * Dot1x_NW_MsgTask_3: 18:30:37.493 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.493 Mar 20: 98:03:d8:7 d: d0:83 response received identity (count = 2) d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.493 Mar 20: 98:03:d8:7 d: d0:83 EAP State update of login authentication for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.493 Mar 20: 98:03:d8:7 d: d0:83 dot1x - moving d mobile 98:03:d8:7: d0:83 by authenticating the State

    * Dot1x_NW_MsgTask_3: 18:30:37.493 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.551 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.551 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 220) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.551 Mar 20: 98:03:d8:7 d: d0:83 WARNING: Update 2 EAP-identifier ===> 220 for STA 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.551 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 220)

    * Dot1x_NW_MsgTask_3: 18:30:37.566 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.566 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (220 Id EAP, EAP Type 3)

    * Dot1x_NW_MsgTask_3: 18:30:37.566 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.627 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.627 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 221) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.627 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 221)

    * Dot1x_NW_MsgTask_3: 18:30:37.643 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.643 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (221 Id EAP, EAP Type 25)

    * Dot1x_NW_MsgTask_3: 18:30:37.643 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.701 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.701 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 222) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.701 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 222)

    * Dot1x_NW_MsgTask_3: 18:30:37.723 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.723 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (222 Id EAP, EAP Type 25)

    * Dot1x_NW_MsgTask_3: 18:30:37.723 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.782 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.782 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 223) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.782 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 223)

    * Dot1x_NW_MsgTask_3: 18:30:37.809 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.809 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (223 Id EAP, EAP Type 25)

    * Dot1x_NW_MsgTask_3: 18:30:37.809 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.892 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.892 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 224) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.892 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 224)

    * Dot1x_NW_MsgTask_3: 18:30:37.903 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.903 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (224 Id EAP, EAP Type 25)

    * Dot1x_NW_MsgTask_3: 18:30:37.903 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.959 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.959 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 225) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.959 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 225)

    * Dot1x_NW_MsgTask_3: 18:30:37.976 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:37.976 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (225 Id EAP, EAP Type 25)

    * Dot1x_NW_MsgTask_3: 18:30:37.976 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.051 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.051 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 226) d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.051 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 226)

    * Dot1x_NW_MsgTask_3: 18:30:38.059 Mar 20: 98:03:d8:7 d: d0:83 EAPPKT EAPOL received from mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.059 Mar 20: 98:03:d8:7 d: d0:83 response EAP received from mobile 98:03:d8:7 d: d0:83 (226 Id EAP, EAP Type 25)

    * Dot1x_NW_MsgTask_3: 18:30:38.059 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth response for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.116 Mar 20: 98:03:d8:7 d: d0:83 treatment Access-Challenge for mobile 98:03:d8:7 d: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.116 Mar 20: 98:03:d8:7 d: d0:83 State entering Backend Auth Req (id = 227) for d 98:03:d8:7 mobile: d0:83

    * Dot1x_NW_MsgTask_3: 18:30:38.116 Mar 20: 98:03:d8:7 d: d0:83 send EAP request of AAA to d mobile 98:03:d8:7: d0:83 (EAP Id 227)

    Please help me solve this problem

    Make sure that policies of login GBA allowing a user for several sessions as well.

    Rating of useful answers is more useful to say "thank you".

  • How to access the AAA columns and later using ExcelRowColToRange.vi

    Hello

    I have a huge database that I need to write on Excel in the first row, so I need to access the columns AAA, AAB...

    But using ExcelRowColToRange.vi I'm able to go up to column ZZ. Can someone please suggest a way to modify this VI to meet my need.

    Thank you

    Hi panka.

    try this one...

  • Urgent - Custom authentication and authorization for the application of the ADF

    Hi friends,

    Custom implementation for authentication and authorization for the application of the ADF

    My project to use the OID , authentication and authorization, we will need to support both OAM and DB tables ( according to the preferences of the client during the installation ).

    I am new to this and do not have a clue about the same.

    Please guide me how to set up both in JDeveloper 11 g + ADF

    Thanks in advance.

    The answers you got up to present every point in the right direction. ADF security see the authentication of WLS, even for business authorization with respect to user roles defined on the WLS server. During the deployment, ADF security defined application roles are mapped to the user enterprise groups

    Application developed using Jdeveloper ADF +.

    This would use WLS for authentication

    Users of authentication - LDAP (OID) - are stored in LDAP

    Use the OID authentication provider in WLS

    Authorization - OAM or database (authorization details are stored in the DB or OAM tables)

    You can't allow users without authentication. If you need create authentication providers additional if they exist for OAM and RDBMS (there is a supplier of existing RDBMA, that you can use to identify users and to assign membership user groups). Then, you set the optional flag so that when authentication fails for additional providers you can always start the application.

    When running Admin users - create users from roles to create and assign permission privileges to the role (for pages and workflows)
    assign (or remove) the roles to/to leave users.

    ADF security uses JAAS to permissions that you can change using Enterprise Manager when running. Permissions are granted to the application roles and application roles are granted to business roles that which then has users become members of the. If you want to change the status of user account, then you don't do this the ADF or EM, but use a direct access to the provider of the user (for example, access OID, RDBMS access etc.) There is no unified administration API available that would allow you to do this via WLS (which uses OPSS).

    If your question is in the context of the ADF, the documentation, with that you should follow is OPSS and WLS authentication providers.

    Frank

  • issue certificates of 802. 1 x authentication and X 509

    Hello

    Can someone please help me with the following question:

    First off I am a guy from Windows Server/PKI/AD etc. rather than CISCO, even if I have a CCNA :)

    I take care of PKI to my company and will work with the team CISCO that are the introduction of CISCO's ISE, we will use X 509 CERT on the suppliants (desktop/laptops Windows computers mainly)

    What I want to know is something pretty basic, but I saw not written anywhere

    Question 1:

    First stop, I guess it's the AAA (ISE) server is the entity that verifies the pleading certificate X 509, rather than the AP (access wireless router for example point)? is that correct

    Question 2:

    As supplicants X 509 certificate is public (for example, it is not secure and anyone can ask what it is normal) I guess the AAA server must encrypt a (random number for example) value with the public key of supplicants (of the X 509 cert) then send this value to the supplicant by which the supplicant decrypts with its private key (that no one else has as usual). Then the supplicant figure the value even with servers AAA public key (which is held in servers announced AAA X 509 cert) cela send on the AAA server and once that deciphers AAA server (with its private key) if the value matches the value originally sent to the supplicant then the AAA server can continue with authentication etc.

    The above assumption is correct?

    If the above is correct, not ISE always act like that or can you lower the security and get just the ISE server to check whether he trusts the issuer of the certificate (CRL does OK) the pleading X 509 Cert and not bother to send the encrypted packet as described above (this of course would ensure not begging-1 is actually "supplicant" - 1).

    Thank you very much in advance

    Ernie

    Answers:

    1 - Yes, ISE verifies the certificate presented by the device of end-user (begging) against his PB of authority certificate TRUSTED internal to import in ISE root and intermediary certificates where you use CA non-public servers (this is my case for EAP - TLS) such as Verisign, Entrust, etc. UNFORTUNATELY, ISE allows you only to have 1 cert for the use of EAP in the list (PEAP, EAP - TLS, etc.), which means that you CAN not EAP - TLS and PEAP running on different SSID. The problem is now that Entrust for example use an intermediary called L1K Entrust which is not included in trust for the devices Apple and Win 7 CA. This causes a certificate not approved for IPADs warning then you need to trust this certificate but for Win 7 features the PEAP TLS Tunnel, Setup will fail if the connection cannot be established if you uncheck "VALIDATE SERVER" on Win 7 for this SSID profile.

    2 - you can create a condition that validates the issuer cert but the authorized Protocol is EAP - TLS or PEAP so that the actual process for one of these protocols, based on my understanding is actually. For example, Protocol PEAP, the configuration of the TLS Tunnel is the 1st step, so once the configured secure tunnel then the inside MSChapv2 + EAPOL is performed and finally the data passes through the tunnel

  • The AAA for PIX515E 6.3 rules (5)

    Hello. If I wanted to configure the PIX for the authentication of an ACS server (for the purpose of management of PIX), what else would need apart from what follows:

    AAA-server Admin-FW Protocol Ganymede +.

    AAA-Server Admin-FW max-failed-attempts 3

    AAA-Server Admin-FW deadtime 10

    !

    AAA-Server Admin-FW (inside) host 192.168.2.9 access timeout 10

    !

    console series FW-Admin-AAA authentication

    Console telnet authentication AAA Admin-FW

    authentication AAA ssh console Admin-FW

    As far as I KNOW, I did not specify which IP addresses can someone telnet from to connect on the PIX. I tried the following, but I do not know I did not provide the correct instructions:

    the AAA authentication include telnet inside 192.168.0.0 255.255.0.0 Admin-FW

    ... and I have a username / password to invite him on the PIX but it keeps asking for a user name and password. I know my account GANYMEDE is good because I can connect on the routers with the same details as what I use to authenticate on the PIX.

    I also ran a debugging on the PIX when I was trying to authenticate. The output is attached.

    Thank you

    Timothy

    Hi Tim,.

    There is no need to order,

    the AAA authentication include telnet inside 192.168.0.0 255.255.0.0 Admin-FW

    Try it now and see if you get hits on ACS. Incase it is not working, pls get again him debugs.

    Thank you

    Jagdeep

Maybe you are looking for

  • Search Enhancement Pack popup

    Search Enhancement Pack appears that I tried to remove it. Run msiexec /x {A853BEB2-B270-4645-AAAA-9D83C2233BD3} but nothing seems to work he told me he is not installed so nothing to delete.

  • Get error "Microsoft Visual C++ Runtime Library Runtime error R6034 C:/P program

    Get error "Microsoft Visual C++ Runtime Library Runtime error R6034 C:/P program

  • NEX5

    I want to improve the lens and I have the following questions: should I buy lens adapter or sony? What is the best? If I bought adapter I see different type don't know which I buy Thank you Moataz

  • BlackBerry Bond IMEI / SIM CARD / unlock problem - HELP

    Hello all, greetings. I have a recurring problem to unlock my classic Blackberry.  I have received the handset as a replacement under warranty from 02 and have had it for about 2 weeks, my first handset microphone developed problems. The first phone

  • Slow response from the DPM Touch Interactive applications

    Hello In our premises of the Subscriber, we deployed a solution we have developed as a tactile interactive application using a 3rd party Content Management System. The content of the application is pushed to the DPM and stored locally. This app is mo