AAA failures on 3750G running ADVIPServ 12.2(53) SE

I am just banging my head on the wall and I can seem to figure it out. I am trying to configure my 3750G stack to authenticate to my ACS 4.2 server. The configuration is fine and when I look at the debugs I am getting from the switch that it selected the default profile and that is the extent of the log. On the server I am getting a failed authentication of invalid secret key. I have a multiple times changed the secret key to match and still getting the same issue. I thought that it was because the source interface being a L3 port-channel and changed it to a vlan interface with the same issue.
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login noauth local
aaa authorization exec default group tacacs+ local
aaa authorization exec noauth local
aaa authorization console
ip tacacs source interface port-channel 1
tacacs-server timeout 5
tacacs-server host 10.224.1.181
tacacs-server key itsasecret
tacacs-server directed-request **must be a default command**
line con 0
login authentication noauth
line vty 0 15
login authentication default
Any help would be appreciated as I don't know if I am hitting a bug or not and searches have turned up nothing.
Regards,
Karim

I looked into that and deleted whatever key was in there and made sure teh client had a proper key. This gave me the same error so I deleted client to try again with the same results. I also deleted the NDG and recreated a new one with no success. Still getting the invalid key error within ACS's failed logs.

Similar Messages

Following hard drive failure on iMac running Maverick I have recovered from TimeMachine backup but now app store does not connect. All other internet connections normal. Does anyone know of a fix?

following hard drive failure on iMac running Maverick I have recovered from TimeMachine backup but now app store does not connect. All other internet connections normal. Does anyone know of a fix?
Also mail not loading. The error report suggests that I look for updates from the app store?

http://www.apple.com/support/mac/app-store/contact/

IMac drive failure? Consider running off a Firewire 800 external

This is an informational post, but worth sharing I believe.
My 2009 iMac 1TB Seagate (ST31000528ASQ) has failed.
For the SECOND time. When the first one failed at 1.5 y Apple charged me $200+ ($40 service, which is a bargain, and $160+ for the drive which was excessive) to put this one in. I was later reimbursed when Apple extended its recall range.
Now, at age 1.5 y, the second one of this wretched line has failed. I could pay another $200+ to Apple, assuming they'd still service my 4 yo iMac. Or I could bit the bullet, pay $650 for an SSD, and then pay $240 for an independent to work on the disgustingly unserviceable iMac. With the SSD I'd probably extend the machines useable lifespan another 2 years, and I'd get far higher reliability. The latter is very important to me.
Except, there's another option. One that is much cheaper.
My drive wasn't quite dead, so I was able to use Carbon Copy Cloner to create a bootable external drive. It sits in a Firewire 800 cradle, I used a 7200 rpm 1TB Samsung - one of my offsite backup rotation drives. I booted off this drive and use Disk Utility to unmount my internal. I figured I'd do this while I decided which option to pursue.
Weird thing is, the iMac 2009 works rather well this way. If anything, it's FASTER than it was running off the internal drive. Aperture is MUCH smoother.
If your internal drive fails in this old machine, I think switching to a fast, big external drive is a good option to consider.

Since the Mac is set to boot off the external, i was suprised a complete failure of the internal would make a difference. How does that happen? (I unmount using Disk Utility, it presumably remounts when I restart. But I supposed if it died it couldn't remount :-).

MDT 2012 OSD Failure (5627):1450 Run DISM.exe

Litetouch deployment failed, return code=-214746729 0x80004005
Failed to save environment to 80070057
Failed to run the action:Install Operating System
Unknown error(Error:000015FB;Source:Unknown)
The execution of the group(install) has failed and the execution has been aborted. An action failed
Operating system aborted(Error:8004004:Source:Windows)
Failed to run last action:Install Operating system.Execution of task sequence failed
Unknown error:Error:000015FB:Source:unknown)
Can some one help me with this? I am trying to run standard client TS for windows 7
Thanks,
Rajith.
Thanks, Rajith P

Hi, I had slightly different error code (no 1450 in the beginning), and my error message was as follows:
FAILURE ( 5627 ): -2147467259 0x800F082E: Run DISM.exe
Litetouch deployment failed, Return Code = -2147467259 0x80004005
Failed to run the action: Install Operating System.
Unknown error (Error:000015FB; Source: Unknown)
and it also said I had 8 errors because of this.
What solved this for me was to enter Properties of the Task Sequence and choose the tab Task Sequence and in the group "Install" in the "Install Operating System" I clicked the tab Options and chose to "Continue on error". This
worked for me. I don't know why it stopped for me since the installation always concluded with 100% and then gave the error message, so I don't know what was going wrong, so if anyone knows what the Lite Touch Installation is complaining about, please let
us know! =)
(A strange thing to have 8 errors and then just ignore them and the installation continues just fine, with an up and running Windows install at the end!)

CSM 4.1\ACS5.1 non-ACS AAA failure

Greetings,
I know that CW Common Services 3.3 does not work with pre-defined roles on ACS AAA. So I followed these forums and enabled non-ACS AAA and selected TACACS+. I have a single rule that is matching in my ACS (after looking at the audit trail):
Authentication Details
Status:
Passed
Failure Reason:
Logged At:
Jan 10, 2012 11:56 PM
ACS Time:
Jan 10, 2012 11:56 PM
ACS Instance:
Hou-ACS
Authentication Method:
PAP_ASCII
Authentication Type:
ASCII
Privilege Level:
1
User
Username:
xxxxx.xxxxx
Remote Address:
10.250.xxx.xxx
Network Device
Network Device:
fw1.outside.hq.hou.tx.us
Network Device IP Address:
10.250.xxx.xxx
Network Device Groups:
Device Type:All Device Types, Location:All Locations
Access Policy
Access Service:
ad.security.sgITnetworkM
Identity Store:
AD1
Selected Shell Profile:
Priv15
Active Directory Domain:
corp.org
Identity Group:
All Groups
Access Service Selection Matched Rule :
networkEngineer
Identity Policy Matched Rule:
Default
Selected Identity Stores:
AD1
Query Identity Stores:
Selected Query Identity Stores:
Group Mapping Policy Matched Rule:
Default
Authorization Policy Matched Rule:
Rule-1
Authorization Exception Policy Matched Rule:
As you may have noticed even though it is matching an access service that allows Priv15. That doesn't seem to be passing through as you can see on top I am only receiving Priv 1. What can I do to properly pass through the access service profile?

To anyone who may be searching for this:
CSM can do authentication from a non-Cisco TACACS server and you can register ACS 5.x as such. However, authorization in these cases will have to come from the CSM's internal database.
In short: you can use the ACS for authentication (so the users wouldn't need to remember yet another password) then replicate those users, who you want to access CSM within CSM (it's not important what password you set for them) and set up the access rights you wish to give them from within CSM.

Will rollback failure cause long-running transaction?

We are getting the following error for one transaction
[TimesTen][TimesTen 5.1.35 CLIENT]Communication link failure. System call select() failed with OS error 110. This operation has Timed Out. Try increasing your ODBC timeout attribute or check to make sure the target TimesTen Server is running
After that application tries to do a rollback, but rollback failed.
Will this transaction become a long-running transaction in server?

Have you filed a metalink SR to get help on this issue?
-scheung

Cisco ACS (TACACS+) - AAA failure on WLC

Setting up TACACS+ between Cisco ACS and 4402 WLC using the below configuration guide.
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a0080851f7c.shtml#add-authorizserv
Authenication is failing on the WLC. Currently getting the below error message on the Cisco ACS server (Reports and activity > failed attempts)
Message Type: Author Failed
Author-Failure-Code: Service denied
Author-Data: service=ciscowlc protocol=common
Anybody have any idea to resolve this problem.
Thanks,
Colm

Hi,
The document you referred is correct.
What version of WLC are you running?
Check this one:
CSCsk21007 WLC requires tacacs authentication when configuration change ccess Control
HTH
Regards,
JK
Plz rate helpful posts-

How to read success/failure message while running sqlldr through php?

Hi All,
currently i am running sqlldr through PHP . i want to read both success and failure message from sqlldr.
sometimes it fails to load data, but it shows record inserted
is there ant way to figure it out succ or failure?

With SQL Loader you can get errors at several levels.
At the command line level by reading $? after it runs since it sets $ERROR_LEVEL correctly.
It also creates many types of log files which can then be parsed that include but are not limited to:
The [control file name].log and the [control file name].bad file which are created wherever you would like them to be created and named any way you would like them. The [control file name].bad file contains all records that were considered unacceptable by SQLLDR and therefor simply testing for that files existence will start you down the road to programatically dealing with errors.
Yes I know the documentation for SQLLDR is worse then stereo instructions that started out in Japanese, then were translated to Greek then to Korean then finally into English but there are some pretty good examples out there.

Continuing update failure problems, "Not running real Windows"

Hello,
About 2 weeks ago I started getting a message on my computer screen "Not running Genuine Windows". I am most definitely running genuine windows. I checked the archives here and tried a fix that popped up, no joy.
It gave a fix option, which failed...generating error code 800706F7 again. I called tech support, a lady spent two hours working on the computer and could not fix it. She sent me to level two tech support, he called on New Years Day and worked on it for
a couple of hours and thought it was fixed.
The error message is back, the computer will not accept updates from windows updates.com, tells me to install update fix it, did so, still fails to install updates. This is becoming a nightmare, please help.

Hello NorCal Jeff,
Please use system restore to restore the system back to a store point before two weeks ago and check if the issue still exists.
System Restore:
http://windows.microsoft.com/en-hk/windows7/products/features/system-restore
1.Open System Restore by clicking the Start button. In the search box, type System Restore, and then, in the list of results, click System Restore. Administrator permission required If you're prompted for an administrator password or confirmation, type the
password or provide confirmation.
2.Follow the steps in the wizard to choose a restore point and restore your computer.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

Urgent Skype update failure - Unable to run Skype

Windows 7 - Skype update 5.10.0.115
Starting Skype
Automatic Skype update starts.
Error message "You don't have appropriate privilegde to access C:\Program File\Skype\Phone ... "
No more access to skype
Downloaded latest version lauch install as Administrator
Same error message
Tryed to change C:\Program File\Skype\Phone properties ... don't have owner's privileges
Tryed to get ownership as administrator .. not allowed to
Unable to go back to previous version
Plz help

No response to this yet?

AAA/Radius failures

Have a couple of switches setup for AAA/Radius (Microsoft IAS running Radius). All authentication fails when I configure it with a radius key (matching on switch and server).
When I remove the key, I still cant authenticate with my domain credentials, and can only authenticate using the local admin password configured on the switch on a few occasions.
To get back into the switch I have to stop the IAS service on the Microsoft Radius server, log into the switch with the local admin password, before restarting the IAS service.
How can I make AAA/Radius work effectively.

Mark
There are several things that you might do:
- reconfigure a switch and reconfigure the Radius server for that switch to eliminate the possibility of configuration mismatch. I would be sure to key in clear text keys rather than cut and paste some encrypted value which you assume will be the same on both ends.
- look on the server to see if there are any log entries that indicate that it saw authentication requests and why they failed.
- run debugs on the switches to see what they are reporting.
HTH
Rick

ACE30 is running but not allowing management access

We've got pairs of ACE30s in our data centers set up with active/standby FT. Some time yesterday the active ACE in one data center started refusing management traffic - it accepts SSH connections but fails authentication (local password, no RADIUS/TACACS is configured); and ANM reports it as down (no XML connectivity):
Desktop > ssh -a admin@ace-macc-1
Password: ********
Password: ********
Password: ********
admin@ace-macc-1's password: ********
Received disconnect from 192.168.255.100: 2: Too many authentication failures for admin
r-MACC-A#show module 8
Mod Ports Card Type                              Model              Serial No.
8    1 Application Control Engine Module      ACE30-MOD-K9       SAL1549XG39
Mod MAC addresses                       Hw    Fw           Sw           Status
8 e05f.b9a1.fb4c to e05f.b9a1.fb53   1.0   ace2t_main_d A5(1.2)      Ok
Mod Sub-Module                  Model              Serial       Hw     Status
8/0 ACE Expansion Card 1       ACEMOD-EXPN-DC     SAL1549XAA9 1.1    Ok
8/1 ACE Expansion Card 2       ACEMOD-EXPN-DC     SAL1549XA9G 1.1    Ok
Mod Online Diag Status
8 Pass
8/0 Pass
8/1 Pass
r-MACC-A#session slot 8 processor 0
The default escape character is Ctrl-^, then x.
You can also type 'exit' at the remote prompt to end the session
Trying 127.0.0.80 ... Open
ACE-MACC-1 login: admin
Password: ********
Login incorrect
ACE-MACC-1 login:
Login timed out after 60 seconds.
[Connection to 127.0.0.80 closed by foreign host]
However it's still load-balancing traffic properly, and log messages (mostly health probe failures) are still showing up in the Sup720 syslog; and the standby ACE seems to be perfectly happy:
ACE-MACC-2/Admin# show ft gr br
FT Group ID: 1 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: Admin     Context Id: 0
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 2 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: UM-AAA    Context Id: 5
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 3 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: AIGWEB    Context Id: 1
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 4 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: UMCE-MAILSVCS     Context Id: 7
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 5 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: UMCE-DNSTEST      Context Id: 6
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 6 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: IAM-NONPROD       Context Id: 2
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 7 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: TL-PROD-MACC      Context Id: 4
                Running Cfg Sync Status:Running configuration sync has completed
FT Group ID: 8 My State:FSM_FT_STATE_STANDBY_HOT       Peer State:FSM_FT_STATE_ACTIVE
                Context Name: TL-NONPROD-MACC   Context Id: 3
                Running Cfg Sync Status:Running configuration sync has completed
We haven't opened a TAC case yet - someone's on his way over to see whether we can get in through the serial port first - but I'm wondering whether there are any other diagnostics we can gather (will resetting the module form the Sup force a coredump?) before we do.

Hi Kurt,
It looks like the ACE control plane has hung and that's why you are not getting any management access. But everything is working since there is no problem with data plane.
Reloading ACE should fix this. It can due to low memory conditions. Please do check logs before the issue happened. You may have had some low memeory condition warnings.
Regards,
Kanwal

Imminent Hard Drive Failure? Satellite C655D-S5130

Recently performed a system recovery after boot failure on Satellite C655D-S5130. Recovery went fine, but now we're getting a windows error message after startup saying that we should run file backup because the hard drive reported errors and warning us of an imminent failure. Otherwise running fine. Please advise.
R&S

Everybody should already have a file backup for all of their PCs. So if you haven't already backed up your files then do it now. I strongly suggest creating a Hard Drive Image of your C drive using a reliable imaging/ghost program. If the hard drive is able to provide a reliable image this will save you a lot of heartache and countless hours of rebuilding your NEW Hard Drive.
FYI I can't count the number of Hitachi HDDs that have come across my desk from both Toshiba and the other company that sounds like bell. All with bad sectors or making clicking sounds. On the other hand...I have not seen any bad WD drives since 1999, and I have only seen a few bad Seagate drives. (1 3.5" and 1 2.5").
My guess is that you are experiencing Premature HDD Death Syndrome or PHDDDS.
If you are still within warrenty you may be able to get it replaced....when it dies...but I would spend the $$ now to get a new WD Scorpio Blue or Black and make preperations to restore your reliable image to the new HDD.
Good Luck.
"My comments are my own reality" Consider these in addition to other sources. I only know what I know.
Dan

VPN Client and AAA services on a Cisco ISR Router

Hi, my name is Jim, and I was just promoted as a trainer for the company I work for. Part of my new challenge is understanding how the configuration files in both my Terminal Services/VPN Router and Core Router work, so for many of you, these questions are going to seem very fundamental, but please help, I am an instructor in training. I hold a CCNA, CCNA-Wireless, and a CCSI cert, but I have little working experience in building and maintaining a lab....hence the need for this inquiry.
So to my questions. In our lab environment, we have a router that acts as our terminal services router and VPN router. Each laptop that connects to the lab has the Cisco VPN client loaded onto it, as well as my laptop that I teach from. My questions are these:
1. What parts of the AAA output of the running configuration tell me how to configure the VPN clients on my laptops?
2. I am using crypto key generate RSA at 1024 bits on the VPN/TS router, so does that tell me how to configure some part of the client?
3. In our lab, we are going to use a direct connection to an AP to get connected to the network, and how will the absence of an Internet connection affect the settings on the VPN client, or will they?
4. Are there helpful articles I can read that will answer some or all of these questions?
Thanks in advance,
Jim

Hi Jim,
congratulations
Assuming a basic setup, your router will have something like this:
crypto isakmp client configuration group MyGroup
key cisco123
So on the client, you configure it to use MyGroup as the group name, and cisco123 as the (group) password.
I'm not sure I understand your question #3 and what you mean by "AP" (Access Point? So WiFi?). In any case you don't need Internet access per se, as long as you have network (IP) connectivity between the host running the vpnclient and the VPN router.
Does this help?
Herbert

Install of Flash 10 failing - "run preflight script" - Mac OS X 10.5.6

I tried to install Flash 10 - and it asks me to close the "Dashboard Client" of Mac OS X and after I click close on the flash install window, the installation fails. A message says that the failure occurs during "run preflight script" and to contact the software developer.
Has anyone else had this problem? Any fixes or way around it?!

Got the problem as well, a little bit frustrating, i have the problem with BOTH flash 10 and photoshop elements 3 why isn't adobe willing to help us? I think this is quite dissapointing when you take into account the software costs ±$100 I also have Mac OSX 10.5.7
HELP?

AAA failures on 3750G running ADVIPServ 12.2(53) SE

Similar Messages

Maybe you are looking for