ACE with TACACS+ Issue

Trying to get ACE module and IOS devices to work with TACACS+. I have ACS v3.2.
The "optional" syntax does not work. Any idea if the argument is valid for the ACS version ?
service=exec
optional shell:Admin=Admin domain
Tried it with quotations but that didn't work either.

Hi,
Here is a reference doc for configuring ACE for Tacacs+ authentication,
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.0
0_A1/configuration/security/guide/aaa.html#wp1321891
Under custom attribute for Tacacs+ we need to specify attribute as,
shell:Admin*ADMIN MYDOMAIN1
= means mandatory attribute
* means optional
Information on context/role/domain (Virtualization on ACE):
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.0
0_A1/configuration/virtualization/guide/ovrview.html
Default "role" on ACE:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.0
0_A1/configuration/virtualization/guide/ovrview.html#wp1051297
HTH
JK
Plz rate helpful posts-

Similar Messages

Using TACACS+ auth from ACS 5.1.0.44 to ACE. Having Issues with Shell (Exec)

Using TACACS+ auth from ACS 5.1.0.44 to ACE. Having Issues with Shell (Exec)
So I am trying to get TACACS+ auth to work for my ACE.
The command string that I have on the ACE is as follows:
tacacs-server host 172.16.101.4 key 7 XXXYYYZZZ timeout 15
aaa group server tacacs+ tacacs+
server 172.16.101.4
aaa authentication login default group tacacs+ local
aaa authentication login console local
aaa accounting default group tacacs+ local
But to finish getting this enabled I need to create some sort of shell (exec) string in the ACS that tells the ACE what permission level to allocate.
I do not know how to do this on the ACS 5.1.0.44.
Anyone know?
TAC made a good suggestion but the command path doesn't seem to line up with my version of ACS.
Thanks for your reply. About this question:
shell:<Context>*<Role> <Domain>
What I meant is that you need to check the following couple of things on
your ACS server in order to have AAA Tacacs users to login into the
ACE over the context with superuser ritghts.
Group setup ‑> users ‑> TACACS + Settings ‑> enable Shell(exec)
‑> enable Custom attributes ‑> right below this part you need to
use the following sintax to link the ACE context that this user
has access to.
For example:
shell:<Context>*<Role> <Domain>
shell:Admin*Admin default‑domain
Where this user will have access to the Admin context with the role
admin using the 'default‑domain'

Wilfred,
What you will have to do on your version of ACS is modify the shell profile that your admins are hitting for other IOS devices or you can create another shell profile under Policy Elements -> Device Administration ->
Once you get into this shell profile select the Custom Attributes tab and put in the following fields close to the bottom of the screen, from the example you provided type shell:Admin for the attribute field and then default-domain for the value field, and make sure you select this requirement as optional, if you select mandatory and other IOS devices use this same shell profile you will force this av pair to these devices also which will impact the priv levels that then need for authentication.
After you add this attribute, save your changes and then test, also make sure that your Aceess Policy is calling this shell profile under the authorization profile for default device admin.
Thanks,
Tarik Admani

ACE and TACACS+ auth

I'm having to use the free TACACS+ in an environment to configure authentication for all the network devices. I have all the routers and switches working just fine, but am having issue with getting the ACE to use TACACS. I've configured ACE to authenticate to an ACS server by adding the additional shell custom attributes (shell:Admin*Admin default-domain) and this worked fine. I found in some documentation on TACACS+ that described how to add this similar attribute to the tac_plus.conf file, but it doesn't seem to want to work. My aaa config from the ACE as well as the tac_plus.conf file content below. I know the AAA is working with this TACACS server as the accounting functions properly.
ACE AAA
tacacs-server host 10.1.0.202 key 7 <removed>
aaa group server tacacs+ TAC_AUTH
server 10.1.0.202
aaa authentication login default group TAC_AUTH local
aaa authentication login console group TAC_AUTH local
aaa accounting default group TAC_AUTH local
tac_plus.conf
# Accounting Logs
accounting file = /data/tacacs.log
# Server Key
key = <removed>
# ACL
acl = auth_routers {
                      permit = .*
# Groups
group = admin {
    login = file /etc/passwd
    acl = auth_routers
    service = exec {
                     optional shell:Admin = "Admin default-domain"
# Users
user = admin1 {
     default service = permit
     member = admin
user = admin2 {
     default service = permit
     member = admin
user = admin3 {
     default service = permit
     member = admin

Anyone?

LMS 3.2 and RME 4.3.1 telnet with tacacs+ fails

Hi everyone,
I'm having issue with credentials verification for telnet with TACACS+ enabled. Verification job fails with "Telnet: Incorrect" and an exception to daemons.log:
om.cisco.nm.lib.cmdsvc.CmdSvcException: com.cisco.nm.lib.cmdsvc.telnet.TelnetException: Unable to read from socket
        at com.cisco.nm.lib.cmdsvc.TelnetSession.connect(TelnetSession.java:89)
        at com.cisco.nm.lib.cmdsvc.Session.connect(Session.java:152)
        at com.cisco.nm.lib.cmdsvc.AuthHandler.connect(AuthHandler.java:254)
        at com.cisco.nm.lib.cmdsvc.OpConnect.invoke(OpConnect.java:56)
        at com.cisco.nm.lib.cmdsvc.SessionContext.invoke(SessionContext.java:299)
        at com.cisco.nm.lib.cmdsvc.Engine.process(Engine.java:57)
        at com.cisco.nm.lib.cmdsvc.LocalProxy.process(LocalProxy.java:22)
        at com.cisco.nm.lib.cmdsvc.CmdSvc.connect(CmdSvc.java:190)
        at com.cisco.nm.lib.cmdsvc.CmdSvc.connect(CmdSvc.java:166)
        at com.cisco.nm.xms.xdi.pkgs.LibDcma.persistor.CliOperator.<init>(CliOperator.java:214)
        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.IOSCliOperator.<init>(IOSCliOperator.java:116)
        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.CatIOSSwitchCliOperator.<init>(CatIOSSwitchCliOperator.java:56)
        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.Cat6kIOSCliOperator.<init>(Cat6kIOSCliOperator.java:32)
        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.Cat6kIOSConfigOperator.getOperator(Cat6kIOSConfigOperator.java:35)
        at com.cisco.nm.xms.xdi.pkgs.LibDcma.persistor.OperatorCacheManager.getOperatorForDevice(OperatorCacheManager.java:50)
        at com.cisco.nm.xms.xdi.pkgs.LibDcma.persistor.ConfigOperation.doConfigOperation(ConfigOperation.java:99)
        at com.cisco.nm.xms.xdi.pkgs.SharedDcmaIOS.transport.IOSConfigOperator.fetchConfig(IOSConfigOperator.java:73)
        at com.cisco.nm.rmeng.dcma.configmanager.ConfigManager.updateArchiveForDevice(ConfigManager.java:658)
        at com.cisco.nm.rmeng.dcma.configmanager.ConfigManager.performCollection(ConfigManager.java:1646)
        at com.cisco.nm.rmeng.dcma.configmanager.CfgUpdateThread.run(CfgUpdateThread.java:27)
I've tried to edit TacacsPrompts.ini also with suggestion to enter "," after last space character
I'm using only TACACS so all prompts are the same. I'm using MOTD also.
TACACS prompt looks like this example : "TEST username: ,TEST password: " so this looks obvious.
The issue started to appear after some patching done to RME and CiscoView, but I'm not sure that this is connected anyhow.
Thanks for all the help

Hi!
They gave me the solution like this:
line vty
timeout login response 90
Ofcourse it helped but this it still inproper behavior from LMS side. It sends the username char by char for more than a minute! Guess the scenario with thousands of devices.... It will take ages to telnet to them. And network performance has nothing to do with that - i'm running the LMS on a powerful Sun and the network is mostly gigabit connected.
Setting timeout login response is a workaround but does not fix the problem.
Still waiting fot some fix to LMS not for fairly acceptable workarounds.
This is NOT case with TACACS enabled on a router. The box responds within moment when telneted using commandline or other NMS software. This is a problem with LMS telnet login mechanism and prompt parsing (TacacsPrompts.ini doesn't seem to work at all, I could type there anything and it has no effect on the login proces).
Besides this SSH to the same box wit TACACS works flawlessly. But then it parses only password prompt not the username - this is sent by ssh.

I have an older iMAC that once burned CD's with no issues. Now I get an error message saying "The attempt to burn a disc failed. The device is not accessible, probably because it was removed". I have never had it touched so the device was not removed.Help

I have an olde iMac that once I have an older iMAC that once burned CD's with no issues. Now I get an error message saying "The attempt to burn a disc failed. The device is not accessible, probably because it was removed". I have never had it touched so the device was not removed. Please advise as to what could be the problem. How to fix. Thanks

Try resetting the SMC and PRAM first, if that doesn't help try a cleaning disc.....and then buy an inexpensive external burner. Slimline super drive failures are all too common.
To reset the SMC
Shut down the computer.
Unplug the computer's power cord.
Wait fifteen seconds.
Attach the computer's power cord.
Wait five seconds, then press the power button to turn on the computer.
Resetting NVRAM / PRAM
Shut down your Mac.
Locate the following keys on the keyboard: Command (⌘), Option, P, and R. You will need to hold these keys down simultaneously in step 4.
Turn on the computer.
Press and hold the Command-Option-P-R keys before the gray screen appears.
Hold the keys down until the computer restarts and you hear the startup sound for the second time.
Release the keys.

Question for those with memory issues on k8n neo plat

I have been having issues with my memory on the k8n neo platinum board since i built the system last month and i just recently discovered a fact I had overlooked.
I Have discovered that if i test the system while it is cool (having sat turned off overnight for example), then memtest will pass the ram just fine and the system will be stable for a short period of time, generally longer if no intensive applications are used, ie. doom3 vs. websurfing).
This system, once it heats up ( seems mostly to be the nvidia 3 nb that needs to be "hot"- that is, a probe placed in contact with the module reaches about 58+ degrees c) then the system becomes unstable and memtest, if used, fails.
Prime95, if used on it when its cool, will usually take about an hour or so to fail, but if its used on the system when its been running a bit ( temps from nb at 58c+ and memory module hot to the touch) then it fails after about 20-30 seconds.
I have placed an active hs on the nb in an attempt to correct this, but temps still remain high with failures occuring.
I have spent the better part of three days testing the sytem this way and the above facts have held true in all these tests.
I have tested at stock ratings ( not using "auto" in bios, but using "approved ratings" of 10 x 200 for fsb and timings of 2-3-3-7 for my ram at 1:1 (which is recommended as well) since i am testing for base stability at this point;Voltages have been left at auto settings, however.
I was wondering if anyone else with memory issues could try this out and post if this seems to be the case for you as well.
Perhaps the memory issues on these boards are directly related to a problem with the nvidia 3 chipset running too hot?
Does anyone have a memory issue with these boards who is using water cooling on the NB ?
Lack of issues from people using 'problem" memory, but having no failures with water cooled nb's would support my assumption.

Yes i did mean chipset.
I am using a stock hs/fan from amd, which seems to run a tad hot but, considering that I wont overclock until I can get board stable, its not an issue. (runs 35-40 idle and up to 72 intensive). I need the warranty more then the extra mhz at present.
I removed the stock heatsink from the nvidia chipset and bought a generic chipset cooler (green, very little in the way of fins and seems to be aluminum) with a small fan.
I used a generic silver paste from Compusa to adhere both the cpu hs and the chipset.
I didnt lap either hs, just installed each as per instructions on artic silvers website (figured it had to go on the same way even generic).
I also bought a kingwin thermal center which i ran probes from to the cpu, case, and nb chipset.
I am not using it to adjust fans so those arent connected - its just a reference temp I can see at a glance, esp considering the funky bios reading this boards been known to give.
I assume from these responces that even a nvidia 3 250 chipset shouldnt get as hot as mine?
I asked about that from the retailer i bought this from but he seemed to think it was "ok" at 50ish celcius, but then again he didnt look too confident when he said it, lol.
Idle right now reads on Corecenter at 28 celcius for cpu and 33 celcius for the chipset, although, I have readings of 37 c and 43 c from the kingwin thermal center, which i believe to be more accurate.
My voltage reads at 11.67 for the 12v line at idle right now.
The psu i got is stick from the xblade case i bought in store. (http://www.xoxide.com/xblade2.html)
I have a dvd burner, cd drive, and two maxtor ide hd's attached to the system;The only card is the agp.
Is there a way to check and see if the cpu ispower starved? software monitor or even an external probe perhaps?
I havent put a probe on it, but the ram came in its own heatspreader, which gets very hot to the touch as well.
What temps should I be looking for on these items?

Is there an issue with the hitachi hard drives in the MacBook Pro's ? Got a 15 inch and a 13 inch at the same time and both drives have failed in under two years. I have heard from a few other people with same issue.

Is there an issue with the hitachi hard drives in the MacBook Pro's ? Got a 15 inch and a 13 inch at the same time and both drives have failed in under two years. I have heard from a few other people with same issue. Other drive I have had have lasted at least 5 or more years.

there is a dylib you can put in the springboard if jailbroken but if not you have to find an apple store

Sales orders with credit issues taking availability stock

Hi,
I am doing confirmation using Global ATP in APO. The confirmation is well done, but the confirmed quantity for sales orders with clients that have credit issues is taken the available sotck for other sales orders with ok clients that I want to confirm the quantity they ordered.
For example:
Stock: 10 PC
Client A order 15 PC and 10 are confirmed, but the ordered is retained becuse of credit issues with client A.
Then client B order 3 PC, but nothing is confirmed because the ordered for client A is reserving the stock (note: this would be ok if client A had not credit issues).
So, I want that the 3 PC for client B are confirmed and the 10 PC not reserved for the cient A while client A has credit issues.
How could I configured, so that the orders with credit issues do not reserve stock for the incoming orders?
Thanks a lot.

Hi DB49,
thanks for the quick answer.
I checked the configuration in the R3 and seems to be fine. To prove it, I disconnect APO and did the availability check in the R3 system and it is working fine; the orders quantities that are blocked because of credit issues, do not reserve stock for incoming orders.........son new incoming orders are well confirmed.
But after connecting APO the problem continues. I checked the next points.
In R3 transaction CO09: takes to the APO screen and you see the ATP available quantity OK (do not consider the quantities of the credit issues orders). But at the moment that you make the order (VA01) it does not confirm any stock and if you select the line and go to the ATP screen (the same you get from the CO09) the quantities of credit issues orders are taken into account..the ATP availability quantity changes from the first going directly from the CO09.
What could it be?
Note: it was working fine with APO, I started to have the issue after implementing note 1262475 in APO. This note was becuase the BAPI_APOATP_CHECK was not brigning any value for the ATPQTY_***.
Thanks a lot!!!

Report with grouping issue

I have a report which have year(2008), Category(0-1,2-3, ALL), product(0,1,2,3,4..), % sales. I group by all the category elements and called it as All, I am not getting the right percentage sales for the Category ALL other wise for 0-1,2-3 i am getting it right. Please advise where i am doing it wrong. please find the blog for a screen shot of my issue.
http://ravibiblog.blogspot.com/2012/04/report-with-grouping-issue.html
Thanks,
RC

Pl post details of OS, database and EBS versions. Pl see if these MOS Docs can help
FARXPBSH Failing With "Program was terminated by signal 11" or "Program was terminated by signal 10"          (Doc ID 742729.1)
Publishing RXAPPYAC: The FARXPBSH Ends With 'Signal 11' Error          (Doc ID 432797.1)
RXi RX Reports Failing With Program Was Terminated By Signal 10 or 11 Errors After FA Rollup Patch 6          (Doc ID 737963.1)
Program was Terminated by Signal 11 when Running Rxi Reports          (Doc ID 559425.1)
HTH
Srini

I am using Windows 7 Home Premium 64-bit OS. I've never had this problem before... today I opened iTunes and it prompted me to download the newest version. I use iTunes all the time and have updated it multiple times with no issues. During the installa

I am using Windows 7 Home Premium 64-bit OS.I've never had this problem before... today I opened iTunes and it prompted me to download the newest version. I use iTunes all the time and have updated it multiple times with no issues. During the installation process it gave me an error message that said:
Runtime error!
Program C:\Program Files\iTunes.exe
R0634
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
I quit the installation, uninstalled iTunes and rebooted my computer. I now receive a similar message with a slight difference:
Runtime error!
Program C:\Program Files (x86)...
R0634
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
I did not leave anything out from the error message. It doesn't point to a specific file, it just ends with "(x86)..." Every time I boot up my computer, this error message pops up on my desktop.
How do I repair this issue? I have found multiple suggested solutions but am unsure which one is the best, and I don't want to try a bunch of different things for fear I may make the problem worse. I would like to try and fix this myself if possible but I need to know if that is really possible or if I need to take my computer to someone for repairs. Any suggestions will be greatly appreciated!!

Hi lustyln,
I'm having a little trouble understanding all of what you are trying to explain. From what I can tell, it sounds like your PC has a lot of software problems and you want to know what is supposed to be there and what isn't.
For reference, here are your product specifications:
http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&dlc=en&docname=c01893242&lc=en&product=4043282
To get your PC software back to how it was when it was first purchased, run a system recovery:
http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&dlc=en&docname=c01867418&lc=en&product=4043282
I hope this helps.
...an HP employee just trying to help where I can, but not speaking on behalf of HP.

After upgrading to mountain lion i keep getting an error message saying my startup disc is full. it shouldnt be full because there is barely anything on there and i was running windows with bootcamp prior to this with no issues

after upgrading to mountain lion i keep getting an error message saying my startup disc is full. it shouldnt be full because there is barely anything on there and i was running windows with bootcamp prior to this with no issues. my computer now freezes and programs close randomly. The usual command for opening windows with bootcamp doesnt work. once in restarted my computer after it froze and it rebooted in windows automatically. i really just want to know if there is a way to take the upgrade off my laptop because it is very annoying.

Hi Memalyn
Essentially, the bare issue is that you have a 500GB hard drive with only 10GB free. That is not sufficient to run the system properly. The two options you have are to move/remove files to another location, or to install a larger hard drive (eg 2TB). Drive space has nothing to do with SMC firmware, and usually large media files are to blame.
My first recommendation is this: download and run the free OmniDiskSweeper. This will identify the exact size of all your folders - you can drill down into the subfolders and figure out where your largest culprits are. For example, you might find that your Pictures folder contains both an iPhoto Library and copies that you've brought in from a camera but are outside the iPhoto Library structure. Or perhaps you have a lot of purchased video content in iTunes.
If you find files that you KNOW you do not need, you can delete them. Don't delete them just because you have a backup, since if the backup fails, you will lose all your copies.
Don't worry about "cleaners" for now - they don't save much space and can actually cause problems. Deal with the large file situation first and see how you get on.
Let us know what you find out, and if you manage to get your space back.
Matt

My mac air will not connect to the internet. There is an exclamation point in the wifi icon and when i go into preferences i see that it is setting its own IP address. I have a macbook that is able to connect with no issue. HELP

My macbook air will not connect to the internet. There is an exclamation point in the wifi icon and when i go into preferences i see that it is setting its own IP address. I have a macbookpro that is able to connect with no issue. HELP

Reset the TC to factory and start again.
Use all SMB type names for wireless and base station.. Not apple type names.. this is more important since Mavericks.
I also recommend different names for the different bands.
So for example.
TC name.. TCgenx (I use whatever the generation number is for the x.. eg TCgen4 or latest one TCgen5)
WIreless name.. TC24ghz for 2.4ghz
TC5ghz for 5ghz
You can also set the channel manually.
If you still have issues.. start with no security and then if it fails to connect there is something seriously wrong with the laptop. Did you upgrade install Mavericks?? That can lead to driver issues.. I would recommend a clean install.

HT1365 Hi can anyone help with this issue regarding my wireless magic mouse? When im on google chrome and scrolling down the page i always have youtube running in the background but the audio cuts/spits/pops can anyone help me with this?

Hi can anyone help with this issue regarding my wireless magic mouse? When im on google chrome and scrolling down the page i always have youtube running in the background but the audio cuts/spits/pops can anyone help me with this?

The figures you mention only make sense on your intranet. Are you still using the same wireless router. The verizon one is somewhat limited as far as max wireless-n performace. For one thing it only has a 2.4 radio. I like many people who wanted wireless-n performance before they even added a wireless-n gigabit router, have my own handling my wireless-n network.

A suggestion for those with battery issues:

When I first got my iPhone, I had the same battery issues many people here are talking about, in fact I posted about it myself. Its fixed. Very fixed, and Im very happy with my battery life. Here is what I did.
First, do not charge it using your USB connection. At least not always. Why? I dont know. I did the first few days, and couldnt get a full charge even tho system wasnt going to sleep. I started using the wall charger, and got longer battery life, but still not great. One night, I forwarded the phone to my home phone in case I got a call, and shut the phone down completely, and put it on charge. In the morning, I woke up to a 100% charged, fully glowing battery icon. The battery lasted all day with no issues. Every night after that, I just charged it on the wall charger, but did NOT shut it down to see what happened. I am still waking up every morning to a 100% fully charged battery. The battery life seems to get better daily now.
Today, I ran wifi for about 5 hours because I forgot to shut it off. This was after going to the pool and listening to the iPod on the phone for about 2 hours. And using the phone normally throughout the day, checking mail, sms, etc. Really a full day of work, and my battery is still over 50% full. I purposely didnt connect it to anything during the day for a recharge, not the USB or wall charger.
Good luck, hope this helps. Id be interested to know if it does.

Here's my non-scientific experiment.
After surprising battery drain for the first 10 days or so with not much usage, I completely drained the battery yesterday until the phone shut off.
I plugged into AC charge and was worried when it didn't seem to even begin charging.
I plugged into USB, assuming it needed to charge enough to at least complete a sync.
I left it on USB until about 5-10% charge, then switched it to AC. At about 50% I needed to use it, so I did but sparingly, and put it back on charge, all the while keeping Mail on manual and WiFi off.
I took it off once more to get it home from the office, then plugged into AC.
I left that charging overnight.
I never actually got the "glow", but did get the plug icon showing full charge in the status bar.
After about 2 1/2 hours this morning, the status has not moved off of 100% (but with little usage as before).
This is definitely an improvement already though. Hope this helps.

I can't be the only one with this issue. MacBook Pro Retina Late-2013 WiFi disconnects after waking up from sleep.

Did anyone buy a MacBook Pro Retina 13" from Best Buy this Black Friday?
I'm having an issue where the WiFi disconnects after the MacBook wakes from sleep but only after a couple of minutes.
Once the WiFi disconnects, I can't reconnect to the same network and sometimes it won't find nearby networks.
I have to turn off the WiFi and wait for at least 5 seconds before turning it back on for it to auto-reconnect to my home network.
If I wait less than 5 seconds, it will continue to attempt connection to the home network but won't connect.
I've tried reformatting and deleting my network configurations as well as resetting my modem, power cycling it, etc.
I am using 2Wire Gateway modem/router from AT&T on b/g network.
I've tried connecting to a friend's network under Time Warner Cable and the same issue occurs.
I exchanged the MacBook at a Best Buy for a brand unopened one (I hope) and the same exact thing happens with this new one.
Really, I can't be the only one with this issue. Unless in a 0.00001% chance I received two defective units in a row?
Please.. does anyone have a clue why this is happening?

You're definitely not the only one. I have the same issue. I spent 6 hours over multiple days on the phone with Apple support trying a variety of things (some of which are mentioned above), and none of them worked. They finally sent me a replacement laptop. I made sure to try it periodicaly as I was moving files and installing applications to see if I ran into it again and things seemed okay at first but now I am running into the same issue and it is terribly annoying. I've got 5 other devices that connect to the same router and I've never had this issue with any of them.
My router is a Linksys E2000. I haven't tried changing the router channel but I have tried to cnnecting to other networks in the building I live in and I have run into the same issue there.

ACE with TACACS+ Issue

Similar Messages

Maybe you are looking for