802.1x - ACS 3.3 with AD Integration

I'm running into an issue using AD integration and 802.1x. A previous thread on this indicated the 802.1x authentication occured prior to the domain login process.
However, when I attempt to login to a machine using a domain account and that account profile is not cached on the machine, the authentication fails indicating it could no contact te specified domain.
Obviously the 802.1x authentication is not occuring to open the port then pass the domain credentials to the AD. The ACS is configuerd to pass unknown users to the AD for authentication at which point the ACS should import the account.
Why is the 802.1x failing for uncached user accounts?

Try this steps:>
1.Check your NTLM version.
NTLMv2 is not supported between ACS and AD. Supported is only NTLM.
2.Check Authentication Method
For the authenticating dot1x users on the external database you need use either PEAP or EAP-TLS as the authentication method. Both of these involve certificates. EAP-MD5 is not supported on External database for authentication.
Try this links:>
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp33/ra/rawi.htm
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user02/o.htm#wp624132
http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_release_note09186a008031479e.html

Similar Messages

Integration problem between Cisco Seure ACS 4.2 with LDAP

Hi expert,
I have a problem with the integration between Cisco Secure ACS 4.2 with SUN Java System Directory (LDAP). During the integration, I noticed that user failed to authenticate against LDAP via Cisco Secure ACS. The error message is "Authentication Type is not supported by external DB". In this case the "external DB" refer to LDAP. Anyone of you having an experience on integration on both product before? Can any of you give me some pointers about this. Attached are both screen capture on my ACS server.
Thanks very much,
Daniel

Hi,
Thanks for the compatibility chart. Oh dear ..., it seems that the LDAP does not supports PEAP (EAP-MS CHAPv2) at all. Am not sure if the latest LDAP (particularly for SUN Java System Directory) able to support this authentication protocol.
Just to clarify with you all just in case if you wonder what I'm trying to do; our company wants to implement 802.1x over the network. So, every staff on the network must authenticated before able to access the network resources. Our Linksys switches supports this standard including Cisco switches of course. Our RADIUS server is Cisco Secure ACS 4.2 but all those users information including username and passwords are stored in our directory server (LDAP) which is SUN Java System Directory.
Since most of our staff machines are running on XP and Vista, the only available authentication method (beside certificate based) is PEAP (EAP-MSCHAPv2). Based on the compatibility chart, the generic LDAP does not supports this authentication protocol as what we noted the "authentication type not supported by external database" error message in the ACS logs.
From what I learned that the latest LDAP (version 3.0?) able to support this authentication protocol, but yet to be confirmed on my further research.
So... Anyone can advice me on this matter? Thanks very much !

ACS 5.4 with DACL over wireless and wired network

Hi my name is Ivan, I have a question
I have a deployment in my network wired at this way:
Profile 1: corporate's users are working with 802.1X to authenticate computers and users with eap peap mschap v2 and Mac Filtering configuring in the Cisco WLC. My ACS 5.4 is integrate to the Active Directory.
Profile 2: Telephonies IP authenticate with MAB. All the Mac Address are registered in to the ACS locally.
Profile 3: user guest authenticate with portal web from Cisco Wireless Lan Controller over the wired network, and the account exist in to the WLC Lobby Ambassador
A my deployment in the wireless network is in this way:
Flex Connect with central authentication and local switching to connect 15 sites over the wan network.
SSID 1: users corporate working with 802.1X to authenticate users with peap mschap v2 and Mac Filtering configuring in the Cisco WLC. My ACS 5.4 is integrate to Active Directory.
SSID 2: users guest working with portal web from Cisco Wireless Lan Controller over the wireless network, and the account exist in to the WLC Lobby Ambassador.
I would like to configure in the Cisco ACS 5.4 Downloadable Access List (DACL) to use in my network wired and wireless.
How can I do it to my scenary?
Please could you help me?
Regards
Ivan.

Hello. To avoid confusion, let's divide the WLC based upon the operating system.
There are WLCs who run AirOS. That includes WLC 4400, but also includes WLC 5500.
There are WLCs who run IOS-XE. That includes the new Catalyst 3850-X and WLC 5700. (also I think can run AirOS too).
IOS-XE fully support DACL. On the other hand AirOS support DACL partially.
From ACS point of view, when you configure DACL for IOS you configure not only the name of the access-list, but also the access-list entries. That way the IOS devices don't need to have the ACLs pre-configured. This is great because you only need to create and update the access-list entries from only one place (which is ACS) and deploy easily to hundreds of switches.
On the other hand, when ACS configures DACL for AirOS it can only specify the name of the access-list. The AirOS device needs to configure the access-list with a name exactly as configured on the ACS. Sadly, each AirOS device also needs to configure all acess-list entries.
It seems you want to configure DACL along with other attributes. If you explain me a little more your requirement I can show you what to configure.
Best regards

ACS any Version with Domain Controller on Windows Server 2008 R2 64bit

Hi All
Is there currently any ACS version working with Windows Server 2008 R2 domain controllers?
Our server stuff has recently upgraded the Domain Controllers to 2008r2 and turned off the 2003 servers. This didn't make our ACS 4.1.4 really happy.
I've read now serveral posts regarding issues with ACS and Server 2008r2 and hope to find a solution (besides switching to LDAP, yukk).
Thanks
pato

Hi AllIs there currently any ACS version working with Windows Server 2008 R2 domain controllers?Our
server stuff has recently upgraded the Domain Controllers to 2008r2 and
turned off the 2003 servers. This didn't make our ACS 4.1.4 really
happy.I've read now serveral posts regarding issues with ACS and
Server 2008r2 and hope to find a solution (besides switching to LDAP,
yukk).Thankspato
Hi Pato,
Just check out the below link hope that help.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/release/notes/ACS42_RN.html
As per the link it says The support for Windows Server 2008 is applicable for ACS 4.2 Patch 4 onwards.
Hope to Help !!
Remember to rate the helpful post
Ganesh.H

MBAM 2.5 with SCCM Integration

Hi
I've installed MBAM 2.5 and now need to roll back the changes as I didn't specify the -SsrsServer value and this is hosted on a different server. When I try to run Disable-MbamCMIntegration I'm getting the following error
Disable-MbamCMIntegration : Could not find System Center role settings for 'Reporting Services Point' role at site
'xxx' on server 'Value removed'
At line:1 char:1
+ Disable-MbamCMIntegration
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Disable-MbamCMIntegration], ReportingServicesNotConfiguredException
+ FullyQualifiedErrorId : Microsoft.Mbam.Setup.Common.CmIntegration.ReportingServicesNotConfiguredException,Micros
oft.Mbam.Server.Commands.DisableMbamCMIntegrationCommand
If I try to install the Web Applications on my MBAM server with SCCM integration it fails with the following
The web application prerequisite check found missing prerequisites
The specified Configuration Manager integration mode does not match the Configuration Manager integration mode currently in use

Sure
If you edit the following key in the registry on your SCCM server
HKLM\SOFTWARE\Microsoft\MBAM Server\Enabled\CMIntegration to 0 and then restart the server it will allow you to re-add the feature with a different config.

Unable to install MBAM 2.5 with SCCM integration on named SQL instance

Hi,
in production i am installing MBAM 2.5 with SCCM integration but during the installation it asks for the SCCM reporting services point and which it is unable to recognize.
whereas in my lab environment i have default SQL instance which has reporting installed, in that case it works fine.
can someone let me know why the issue is coming?
in the event log the issue is : Description = "user domain\username is not able to get the lock at this time.Error:0x40480732"

For the integration part, You need to install the MBAM SCCM Integration feature on SCCM server. For compliance reporting in integration, MBAM uses the Reporting service point for SCCM.
When installing the SCCM integration feature, you need to provide the name of the reporting Server where Reporting Service point role is installed for SCCM. But it does not provides any option for the instance but for the Server only. We have two instances
for SQL. One for CAS and other for Primary site. We need to run the installer on CAS and hence need to connect to the SQL instance for CAS.
We have also tried with the powershell commands but it is not working either.
Is there any way to install MBAM integration feature on a SQL instance. As far as I know, it automatically picks the instance but not happening for me.
Gaurav Ranjan

Getting started with EP integration

Hi,
A company I work for has a .NET web application that they would like to integrate into the SAP Enterprise Portal. There are a few .aspx pages that should be accessed from the portal. So, we would like to create a tab for our application and have a few links that open the .aspx pages. Eventually, we would like to get the integration certified.
This is the first time I've worked with SAP. From what I've read, doing this type of integration should be fairly easy, but I am not sure how to start. I'm hoping someone will be kind enough to give me some tips or point me to some good source of information.
I've installed the NW04SneakPrevJavaSP11, which I believe contains everything I need for SAP including the NetWeaver Developer Studio. I also installed PDK for .NET and it looks like it has integrated properly with Visual Studio.
When I extracted the content of the PDK for .NET, it contained two files, com.sap.portal.dotnet.framework.sda and com.sap.portal.dotnet.services.systems.sda. I do not see these services in my Control Panel Services. I've read that I must deploy these through the SDM, but I did not figure out how to do that.
Can someone please provide some instructions to get me started with this integration? Do you have a simple example that adds a tab for an application in the portal and contains a link to open a URI? What should I look for to verify that I have everything installed and working correctly to begin the integration?
Thank you very much!

Hi Kenneth,
If you are looking at integrating .Net web application with SAP EP there are two ways of doing it -
1. Uset the PDK for .Net and then develop the .Net applications using the Newweaver controls, finally deploy this .Net application on the Portal itself.
2. If this .Net application is already built and running on a different server other that EP, u can intergate this using a URL reference ans enable SSO form EP to this .Net application. The effort in this case will be very less.
If you choose the 1st approach , then you have to configure SAP EP to deploy .Net applications -
1. Configure the .Net runtime in EP
2. Install the PSK plugin in Visual Studio.
The two SDA files have to be imported in your Portal using the Software deployment manager, the person who has installed EP will be aware of this.
There is also a pdf document on SDN which explains everything in detail about the configurations required for PDK for .Net.
Regards,
Vivek
Please reward points if helpfull.

Not able to deploy VIO 1.0.1 with NSX integration

Hello,
Whenever I try to deploy VIO with NSX integration I stuck on "Configure Neutron networking" step.
Edge Cluster drop-down menu does not contain any options and so I cannot proceed with the deployment. (DVS works fine)
As this a POC deployment, I use the same cluster for Management nodes, NSX Edge nodes and users VMs.
According to the documentation that configuration is supported, even it is not recommended.
Thanks,
Max

Please check if you have the prerequisites met for NSX integration for VIO.
Create a Virtual Distributed Switch(s) and add all hosts from both the management and compute clusters.
On separate VLANs, create three port groups: Management, External, and Public API Network. The fourth port group, VXLAN Transport, is created inline with the NSX installation:
The Management network carries traffic among the management components. This network requires 13 or more static IP addresses.
The Public API network exposes the OpenStack dashboard and provides access for tenants to the OpenStack APIs and services. This network requires 3 or more static IP addresses.
The External network provides external access for the instances. This network requires 8 or more static IP addresses.
The Transport network is used to carry traffic among the instances. This network requires 1 address for each host in the Edge and Compute clusters
Note: Some designs you may collapse both the Public API Network and External network into a single network segment.
-nathan

ACS 4.2 with patch 4 Services restart

I have installed ACS 4.2 with patch 4
Scertain period after authentication failed. Giving internal error. I need to restart all the services. What could be proble and pl help me in resolving this issue. I am running short of time.

Internal Error is very generic in error. I hope that you had your Logging set to Full, if not then you wont be able to see the exact reason in the debug logs.
You might want to check,
\CSAuth\Logs
And check the debug log when you got the internal error for a particular authentication attempt.
Also, what kind of authentication was failing ? Was it PEAP/EAP-FAST with inner method as MSCHAP machine authentication, then it could be something related to,
CSCsq96755 : ACS needs manual restart to recover machine authentication
Then go for Patch 5 for ACSv4.2
Regards,
Prem
Please rate if it helps!

MBAM 2.0 with SCCM Integration: Recovery Audit Reports errors.

I have installed MBAM 2.0 with SCCM integration according to the following website:
http://myitforum.com/myitforumwp/2013/06/10/how-to-install-mbam-2-0-with-configmgr-integration/
Topology:
SCCM 2012
SCCM SQL Server
MBAM Server
MBAM SQL Server
Components installed:
Integration components on SCCM 2012 server
Compliance and Audit Reports on SCCM SQL Server
Recovery and Audit Databases on MBAM SQL Server
Self-Service and Administration Monitoring on MBAM Server
Everything is running correctly: SCCM sees compliance reports, keys are populating into the Recovery database. Self-service works correctly as tested.
However, the Recovery Audit Report in the /Helpdesk webpage reports an error:
"Cannot create a connection to data source 'DataSource1'. (rsErrorOpeningConnection)
Browsing to the /Reports page on the MBAM SQL server (with reporting) yields an empty page.
If I install the Audit and Compliance reports onto the MBAM SQL server, those populate (but are empty, as SCCM is handling that component), however, the Recovery Audit Report still yields the same error.
Ideas?
Thanks,
-Patrick

You can put the Audit Reports on the SSRS instance on SCCM Server. But it has its own limitations. What if you want to configure the encrypted configuration within the MBAM environment using SSL certificate. In that case you have to take special
care while using the SSL certificate for configuring the reporting Point as it has been also used by the SCCM.
Gaurav Ranjan
So, let me get this clear, I can install the Audit Reports onto the SRSS I am using for SCCM and not have to deploy an SRSS instance elsewhere? The SSL certificate detail is not an issue. I am desperately trying to avoid yet another instance of
SRSS.
Thanks

Radius Authentication in ACS 5.2 with AD

Friend,
I have a questión about radius authenticaction with AD, when I log in into the network with user in AD and I make a mistake in password my radius authenticaction event in ACS 5.2 dont show me this logg. only show the authentication succeeded but dont show me the authentication failed. Maybe i must to enable same service to show the authentiaction failed. The Voice authetication works fine..
This is the confg in the port of the switch:
interface FastEthernet0/12
switchport mode access
switchport access vlan 2
switchport voice vlan 10
authentication port-control auto
authentication host-mode multi-domain
authentication violation protect
authentication event fail action authorize vlan 11
authentication event fail retry 2 action authorize vlan 11
authentication event no-response action authorize vlan 11
authentication periodic
authentication timer reauthenticate 60
mab
dot1x pae authenticator
dot1x timeout tx-period 10
dot1x max-reauth-req 3
spanning-tree portfast
end
Vlan 2: DATA
Vlan 10: VOICE
Vlan 11: GUEST
thank...
Marco

Hi Marco,
When you type in the wrong password do you see the login fail on the device you entered it? Depending on how you have configured fallback mechanisms on ACS, an attempt can still be permited eventhough the authentication failed.
It would be best to take a look at the authentication steps under the RADIUS authentication log for an attempt you beleive should have failed to see what ACS is doing with the request.
Steve.

802.1x peap mschap v2 with MAC Filter + IP Address Permanent

Hi my name is Ivan, i have an issue
I have one cisco wlc 5508 with ios 7.4.100 with a ssid is working with 802.1x peap mschap v2 with mac filter, and I need configure in the web page of the WLC Security > Mac Filter, a MAC and one IP Address permanent to the users.
I have a service dhcp into the wlc to this profile.
This configuration works fine for 3 or 4 days. At the fifth day , my users renew the ip address, and they can not surfing to internet, because in my firewall i have a policy to the users with exactly ip address, for example.
MAC Filter - IP Address A - UserA
My policy say:
PolicyUserA - Internet
Please, i can establish an filter mac associate to one ip address permanent to one user, when service dhcp in the cisco wlc is active?
I possible to do it?.
How can i do it?

Hi Ivan,
You can not map the mac-ip address pairs on the WLC DHCP.
The WLC has a limited DHCP server functionalities. You better to use an external DHCP server with full functionalities and then you can configure the DHCP server to provide the same IP address everytime to each client in your network.
HTH
Amjad
Rating useful replies is more useful than saying "Thank you"

ANN: Spring 1.2 with TopLink Integration Released

Version 1.2 of the Spring Framework has been released. New in the 1.2 final release is support for TopLink "out of the box". Prior to 1.2, TopLink support was an "add on" that was available on OTN. Now Spring ships with the integration code required to use TopLink as a persistence provider. TopLink 10.1.2 (9.0.4) and 10.1.3 (preview) are supported.
To get started, try out the Pet Clinic sample app configured to use TopLink.
NB: Spring doesn't include TopLink; it provides the necessary integration classes. You still need to download both Spring and TopLink.
- Shaun
Spring Home page: http://www.springframework.org
Spring 1.2 Announcement: http://www.springframework.org/node/86

Version 1.2 of the Spring Framework has been released. New in the 1.2 final release is support for TopLink "out of the box". Prior to 1.2, TopLink support was an "add on" that was available on OTN. Now Spring ships with the integration code required to use TopLink as a persistence provider. TopLink 10.1.2 (9.0.4) and 10.1.3 (preview) are supported.
To get started, try out the Pet Clinic sample app configured to use TopLink.
NB: Spring doesn't include TopLink; it provides the necessary integration classes. You still need to download both Spring and TopLink.
- Shaun
Spring Home page: http://www.springframework.org
Spring 1.2 Announcement: http://www.springframework.org/node/86

802.1x EAP-PEAPv0 (MSCHAPV2) with computer authentication

I am a network administrator at seven schools, and a few of these schools are now using 802.1x EAP-PEAPv0 (MSCHAPV2) with computer authentication only, for wireless security.
We are a mixture of 2008 and 2003 (Windows Domain) servers running IAS or NPS for RADIUS.
I push out the wireless client’s setting via group policy, and the clients are using WZC.
Every now and then, a client will be unable to authenticate/validate during the authentication phase.
Some clients this will never happen to and a few it will happen repeatedly.
To fix this I have to hard wire the computer and do a gpupdate, even though the computer already had the updates applied previously, and is still part of the domain.
Many of our classrooms lack network drops, so wireless is the best for us.
Except for this one downfall, it is working great. Any help is appreciated.

Hi Ryan,
Thanks for posting here.
Could you discuss the situation that you mentioned “a client will be unable to authenticate/validate during the authentication phase.
Some clients this will never happen to and a few it will happen repeatedly. ”
in detail ? Can you verify if there is any error or warring that relate with this authentication issue recorded in event log on client and radius server ?
Only certain computers are facing this issue or all?
What’s OS running on these client computers?
According the situation right now , I’d like to share some suggections with you:
1. An 802.1x client may fail to connect to an Radius server if the Trusted Root CA certificate that issued the Radius server certificate is not installed on
the client computer. Either verify that the trusted root authority is installed on the client computer or disable certificate validation on the client. To disable certificate validation, access the properties of the connection, and on the Authentication tab,
click Properties. Click to clear the Validate server certificate check box. EAP-TLS requires the installation of a computer certificate on each RADIUS server and a computer or user certificate, or smart card on all clients. PEAP-MS-CHAPv2 requires the installation
of a computer certificate on each RADIUS server and the root CA certificates of the issuing CAs of the RADIUS server certificate on each of the client computers.
2. Verify that Radius is configured for the logging of rejected authentication attempts to the event log. Try the connection again, and then check the system
event log for an IAS event for the failed connection attempt. Use the information in the log to determine the reason the connection attempt was either rejected or discarded. Logging options are configured on the General tab of the Radius server Properties
dialog.
3. Any rejected or discarded connection attempt recorded should identify the Connection Request Policy used. A RADIUS request message is processed only if the
settings of the incoming RADIUS request message match at least one of the connection request policies. Examine the conditions of the policy identified to see where the request fails.
4. Determine from the IAS system event log entries whether the authentication failure is for computer auth, user auth, or both. By default, Windows performs
an 802.1x authentication with computer credentials before displaying the Windows logon screen. Another authentication with user credentials is performed after the user has logged on, and if this fails the machine will be disconnected from the network. Similarly,
if computer authentication fails but user auth is successful, symptoms will include failure to process login scripts or apply group policies and machine password expiration will not be updated since the user will only be able to logon with cached credentials.
If you use a smart card for authentication, you can only perform user authentication because smart card usage requires manual entry of a personal identification number (PIN). There is no way to provide the PIN to unlock the smart card certificate during computer
authentication.
5. Examine the wireless trace logs captured and search for keywords error, failed, failure, or rejected. This should give an indication as to what point in the
authentication process the failure occurs.
Meanwhile, I ‘d like suggest you may start troubleshooting with following the guides below and see if it will help:
Windows Server 2003 Wireless Troubleshooting
http://technet.microsoft.com/en-us/library/cc773359(WS.10).aspx
Troubleshooting Windows Vista 802.11 Wireless Connections
http://technet.microsoft.com/en-us/library/cc766215(WS.10).aspx
Thanks.
Tiger Li
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact
[email protected]
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Random computers running Windows XP have this problem. It does not happen to all of them at once.
It is very random. A computer that has been connecting to the secure network for weeks will all of a sudden not be able to connect. The message is “attempting to authenticate” and it never makes the connection.
I checked if logging is turned on and I can see successful events from computers that are working.
I can also see failed events from computers that are not ours that tried to connect to our wireless.
However for the computers that are having this problem there are no logged events.
It is as if they don’t even communicate with the server.
Other clients on the same AP are working fine. I rebooted the IAS service, and RADIUS clients, but this did not help.
I also checked all the settings and they are correct, using PEAP, and validating the server certificate is disabled.
I did notice that the firewall is also turned on through group policy when the domain is not available.
Do you think the firewall is blocking the communication?
I added an exception to port 1812 UDP and this did not make a difference.

Connect one Business system with two Integration Server

Hello,
Can we able to connect one Business System with two Integration Server?
I have one Business system (ECC 6.0 with the client 900) and it is already connected with PI 7.0 system.Can I able to connect the same sytem (with same client) with PI7.1?
I want to do the HTTP Connection for ABAP Proxy for this two XI system with one business Sytem ?
Is this possible ?Is there any work around solution there?
Thanks.

Hello ,
This document describes about connecting with Two PI7.1 system using Application Server 7.1 and Application Server 7.0 SP14 .
I want to connect same ECC system via abap proxy with two different PI system .One is PI7.0 and another one is PI7.1 system.
Is this possible if i use Application Server 7.1 or Application Server 7.0 SP14 ?
Thanks.
Lakshmi
Edited by: Muthulakshmi Pandi on Apr 16, 2009 11:48 PM
Edited by: Muthulakshmi Pandi on Apr 17, 2009 12:21 AM

802.1x - ACS 3.3 with AD Integration

Similar Messages

Maybe you are looking for