802.1x question with ACS

I have ACS 4.2 configured to authenticate Windows clients using PEAP. ACS is setup to check Active Directory to make sure the user and machine are valid.
This process works fine but I want to be able to login as local admin (not part of active directory) but ACS does not have this user account and "authentication fails". I can create the user account as a local user but I have to create the account with machine account name, which means if I have 100 machines, then I have to create 100 machine account local admins.
Is there an easier way to do this? How can I easily authenticate or bypass the local admin account?

Hi,
I am not sure if this is a dot1x question...
It looks you are having some dificulty with the user account creation...
The Administrator account credentials need to be created in a database, either the ACS internal or the AD, or even another one.
Where have you created the Administrator cedentials account?
Why do you say you have to create the account with machine account name?
When you boot your PC, what is exactly happening? Are you able to enter the administrator account credentials on the login prompt for the dot1x authentication?
Thanks,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Similar Messages

802.1x authentication with ACS 4.1 for MAC OSX

Hi,
I simply wanted to know if it's possible to have 802.1x authentication with MAC OSx on ACS Plateform 4.1?
If yes, what pre-required on ACS and MAC OSx? Methods of authentification which are recommended ?
I'm sorry, but i don't find documents which show validated test on 802.1x implementation method on ACS 4.1 with MAC OSx supplicant.
Thanks in advance
Best regards
Thanks

Yes, Refer to the below DOC
http://support.apple.com/kb/HT2717
Port settings and ACS configuration remain the same as you do it for windows based clients

802.1x and Windows Domain Controller with ACS

Wow, I am having a tough time getting my ACS and the Domain controller to work with 802.1x PEAP. Can somebody explane to me how to set up the domain controller (Active directry) to get a PEAP cert? Some other questions. If I am using PEAP and 802.1x how does my computer get a cert. from the CA if the port is disabled by 802.1x? And How do I set up my domain controller to work with ACS to authenticate users. I have been beating my self to death to figure this out. Any help would be ausome. I am really stuck on trying to make this work.
Thanks a ton in advance
Justin

I as a Cisco customer would like to see answers to our questions based on some real world experience or something you've noticed in a lab environment.
By simply posting links is not very helpful. The reason most of us come to this site and post our questions, is because we already went to the Cisco website and found the explanation to be vague. In the future, please post answers to our question, intead of referring us to a link.
Thank you,
John...

Cisco ACS 5.4 + Anyconnect 3.1 NAM with 802.1x, problem with changing ACS Radius user password

Dear all,
Presently, we are testing 802.1x using Cisco ACS 5.4 and Cisco Anyconnect v3.1 as 802.1x supplicant. We have created predefined NAM profiles (with Cisco Profile Editor) and applied as default in on our test machine. We are using PEAP (MsCHAPv2) and ACS local user credentials for authenticating process. We have noticed that, when we try to authenticate the network with predefined profile (network profile has Administrator Network privileges) and Windows user on test machine has no Admin privileges we are not able to change ACS user password (checked "Change password on next login" in the ACS user profile). In the Monitoring and Report View we get Failure Reason "24203 User need to change password" but no popup window apears in Anyconnect. When we change Windows local user privileges to Admin or create Anyconnect network profile localy (privileges User Network) then, we are able to finish the process.
Have you ever been facing the problem described above. Is it Anyconnect bug? How can we fix it?
Best regards,
Piotr

If this happens with all machines then if a microsoft guy can look the app logs/privileges. It seems the app is requesting privilege that it is not authorized to and that's why the propmt window fails to appear. If we know what that privilege is we can probably fix it. If that privilege is not even required for smooth work Cisco need probably to fix this behavior.
I am sorry if I am not able to help but I am not using the anyconnect for production.
Regards,
Amjad
Rating useful replies is more useful than saying "Thank you"

802.1x with ACS and Windows AD

Hi
Im trying to setup 802.1x with ACS 5.2 but am struggling as its very differnet to ACS 4.2.
I have setup the ACS to be the domain and think i have setup up the External Idnetity Store, however when i try to authenticate a pc using authentication Medthod 'PEAP (EAP-MSCHAPv2), i get a failure reason '22056 Subject not found in the applicable identity store'
Marco

Hi Marco,
i guess you've missed a mapping configuration in the Access Policy Section.
Create a Access Service name it AS-802.1x select User Select Service Type and select Network Access. Select the Policy Structure Identity and Authorization. Select PEAP as allowed Protocol. Click Finish
You'll see the new service click Identity.
Select the identity source you've created then save.
Click on authorization
Select a default authorization rule permit access and save.
Create a Service Access Rule name it 802.1x
Select Protocol Radius as Condition and as Compound Condition select RADIUS-IETF:Service-Type match Framed then select the service you created before.
then you can try again.
regards
alex

Dynamic Vlan Assigment on 2950 with acs 4.2

Hello to everyone
We have a problem with Cisco 2950G 48 EI and ACS (version 4.2) providing dynamic Vlan assignment based on groups
On the ACS we configured the following attributes for the specific group
64 = VLAN
65 = 802
81 = VLAN Name
We tried for the 81 attribute both Vlan name and Vlan ID but we get the same results
In detail, we need the machine to be placed on Vlan ID 6 named vlan_sio so we inserted these value in the attribute field
Before we configured the switch to speak with ACS:
aaa new-model
aaa group server radius Switch
                               server 172.16.0.93 auth-port 1812 acct-port 1813
dot1x system-auth-control
                radius-server host 172.16.0.93 auth-port 1812 acct-port 1813 key xxxxxx
radius-server retransmit 3
Configured the ports for the use of dot1.x.
switchport mode access
               dot1x port-control auto
               dot1x guest-vlan 7
               spanning-tree portfast
The users are correctly authenticated but the ports are always connected to the default Vlan of the ports
We tried to debug with the debug dot1.x events command and we get the following errors:
Feb 16 12:00:04.017:         Attribute 64 6 0100000D
Feb 16 12:00:04.017:         Attribute 65 6 01000006
Feb 16 12:00:04.017:         Attribute 81 4 01360806
Feb 16 12:00:04.025: dot1x-ev:Received VLAN is No Vlan
Feb 16 12:00:04.037: dot1x-ev:Received VLAN Id -1
Feb 16 12:00:04.041: dot1x-ev:dot1x_port_authorized: clearing HA table from vlan 1
Feb 16 12:00:04.049: dot1x-ev:dot1x_port_authorized: Added 0006.1bdb.6a09 to HA table on vlan 1
Does anyone know what we could have missed?
Thank’s

solved
It was just missing the command
aaa authorization network default group XXXX

EAP-TLS authentication with ACS 5.2

Hi all,
I have question on EAP-TLS with ACS 5.2.
If I would like to implement the EAP-TLS with Microsoft CA, how will the machine and user authentication take place?
Understand that the cert are required on both client and server end, but is this certificate ties to the machine or ties to individual user?
If ties to user, and I have a shared PC which login by few users, is that mean every user account will have their own certificates?
And every individual user will have to manually get the cert from CA? is there any other method as my environment has more than 3000 PCs.
And also if it ties to user, all user can get their cert from CA with their AD login name and password, if they bring in their own device and try to get the cert from CA, they will be able to successfully install the cert into their device right?
Hope you guys can help on this. THanks.

Yes, you can configure:
machine authentication only
user authentication only
Machine and user authentication.
Machine or user authentication
So machine authentication only is quite common scenarion. Correct, as long as machine is a part of a domain, you will be authenticated via machine authentication.
PEAP-based machine authentication uses PEAP (EAP-MS-CHAPv2) and the password for the computer established automatically when it was added to the Microsoft Windows domain. The computer sends its name as the username and the format is:
host/computer.domain
If the machine is a valid machine in the domain then during the boot process, once the HAL is loaded, the system begins loading device drivers to support the various hardware devices configured on the client in question. After loading the device drivers, the network interface is initialized. At this point, machine start getting ip address and once it done, the user may have access to most of the network.
Regards,
Jatin

Srw2048 802.1x, authentication with certificates

Hi,
Is it possible to use 802.1 x port authentication on SRW2048 based on EAP and certificates?
Br,
Lukasz

Hello!
We've just launched an Ask the Expert event on 802.1x
https://supportforums.cisco.com/discussion/12463991/ask-expert-8021x-configuring-and-troubleshooting-javier-henderson
Perhaps post your question with Javier as well!
Thank you!

802.1X Authentication with InTouch

Dear Community,
does anybody know if/when it's possible to use 802.1X authentication with the TelePresence InTouch 10?
It perfectly works on the C/SX codecs and as long as the Panels are connected directly to the Codec, there is no issue. But on some codecs, direct pairing is not possible and therefore I would need 802.1X authentication from the panels itself.
Thanks in advance!
Best regards
Alex

Hello!
We've just launched an Ask the Expert event on 802.1x
https://supportforums.cisco.com/discussion/12463991/ask-expert-8021x-configuring-and-troubleshooting-javier-henderson
Perhaps post your question with Javier as well!
Thank you!

Ciscoworks 3.2 login issue with ACS

Hi All,
I am facing an issue with login into Ciscoworks portal from the LMS server, which is integrated with ACS tool.
Now I am unable to login to the portal with the username and password, which is already configured in the ACS server.
I have ended up with reinstalling the ciscoworks software and restored the backup, still problem persists. Please let me know how to fix it.
If I again reinstall it, how would I restore the backup - since back restoration again gives the login issue.
If Im using only the dcrcli exported devices list after the reinstallation, all the devices gets stuck in DFM question status, hence I restored the proper backup. Now I am stuckup. please help.

You need to sort out your DNS get the lookup and reverse lookup working.
Say your device is a box with
Fa 0/0 10.10.1.1
Lo 0 172.32.1.1
If you get you dns to resolve the address of port Fa 0/0 (10.10.1.1) to the DNS "name adevice.yournetwork.com".
Next you get your DNS to resolve the name "adevice.yournetwork.com" to 172.32.1.1 with happens to be to Lo0 interface of the device
Then you can get LMS to use the address you want as it is configured in DNS
Cheers,
Michel

How do I reset my apple id security question with out a rescue email

How do I reset my apple id security question with out a rescue email?

You need to ask Apple to reset your security questions; ways of contacting them include clicking here and picking a method for your country, phoning AppleCare and asking for the Account Security team, and filling out and submitting this form.
They wouldn't be security questions if they could be bypassed without Apple verifying your identity.
(101013)

Using Multiple AD domains with ACS

Hi,
Is it possible to use multiple domains for authentication with ACS? I need to use AAA to authenticate remote users into a centralised location but the users will be from different domains and I was hoping to use a single applicance to cater for all domains. Can this be achieved using LDAP? I understand that ACS can only be part of one AD domain.....
In essence I am hoping that I will be able to authenticate the user based on their domain\credentials.
Thanks in advance
Jason

Hi Javier,
I understand that ACS can only join a single AD domain - but can it use LDAP to authenticate users from different AD domains - I don't want to have to established trusts between different domains.
Kind regards
Jason

Basic questions with respect to ABAP WebDynpro Application

Hi All,
I have two basic questions with respect to an ABAP WebDynpro application :
a) If an ABAP WebDynpro application has been developed, how could it be made available to the end user?
b) Can an ABAP WebDynpro application be developed in ECC or is it only applicable for version 4.6c?
Thanks & Regards,
Sushanth Hulkod

Sushanth Hulkod wrote:
> a) If an ABAP WebDynpro application has been developed, how could it be made available to the end user?
>
> b) Can an ABAP WebDynpro application be developed in ECC or is it only applicable for version 4.6c?
a) If an ABAP WebDynpro application has been developed, how could it be made available to the end user?
Answer - By providing direct link of the WD application created in SE80, creating iView for webdynpro abap application in the portal environment and NWBC environment
b) Can an ABAP WebDynpro application be developed in ECC or is it only applicable for version 4.6c?
Answer - Yes it can be developed in ECC. Webdynpro ABAP is introduced in NW 2004s (SAP NetWeaver 7.0 or ECC 6.0)
Thanks,
Chandra

LMS 3.2 integration with ACS 5.1

Hi
Is it
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;
mso-fareast-language:EN-US;}
possible to integrate LMS 3.2 with ACS 5.1? I know it works with ACS 4.X, but I can't get it to work with ACS 5.1.
Here is a link to how to do it with ACS 4.X:
http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps2425/prod_white_paper0900aecd80613f62.html
Regards
Reidar

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Thanks Reidar.... hmm very strange. I really wish an expert would respond to this thread as it will help a lot of people who might be planning to deploy these versions and they can help put this matter to rest once and for all. Not sure why LMS 3.2 will not support ACS 5.1 and it might help to know when it will (updates etc). Kindly let me know if you get any further information. My deployment is so large that setting a local username and password on all the devices is not an option unfortunately .......

I cannot purchase anything at the itunes store because I am being ask for my security questions, but I don't remember them. How do you change you security questions with out knowing them?

I cannot purchase anything at the itunes store because I am being ask for my security questions, but I don't remember the answers. I tried going to appleied.apple.com but I won't allow me to change my security answerswithout answering the original questions. How do you change you security questions with out knowing them? I need help.

Welcome to the Apple Community.
Start here, and reset your security questions, you will receive an email to your rescue address, use the link in the email and reset your security questions.
If that doesn't help or you don't have a rescue address, you might try contacting Apple through iTunes Store Support

802.1x question with ACS

Similar Messages

Maybe you are looking for