ACS 4.2 access que

Hi,
how to take out full access to the device on perticular date and give read only access from that date...
sorry...im new to acs
Thanks...

Hi,
You can play with the time "Default Time-of-Day Access Settings" options you have on the group setup.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Similar Messages

ACS 5.4 Access Policies Problem

Hi Gents,
I've been trying to troubleshoot this for a long time but I'm out of ideas now. here is the topo. I've got a Cisco ACS 5.4 VM used for Radius Network Authentication with a Cisco WLC 7.0, I've done the initial setup and all the rules, everything was working perfectly so far. now i'm trying to add more Access Rules (Identity/Authorization), it seem ok in the GUI interface and it is saving the configuration even if I reboot the Appliance, however when I check the Monitoring and Report log the new rules are not matching. I will attach some print screen for that.
in the identity part there is a rule matching users that attribute Radius_IETF Username start with "g_" without quotes to identify them with local database. "JV1\" to identify them using Active Directory (this is the old rule that was working) the Default is Deny Access
in the authorisations, for the users that attribute Username start with "g_" they got a service policy X and for the "JV1\" they get a service policy Y.
the new users added in the local database (starting with "g_") are matching in the identity store but in the authorisation they hit the default rule which is deny access. the only condition in the authorisation is to be part of the identity group "Wireless Users".
I've had this issue with ACS 5.2 in the past and I used to delete the rule than create it back again but it doesn't seem to be working for the version 5.4
thanks & regards,
Habib

I ran into this issue as well on my ACS 5.4 and never found a bug that matched. I ended up installing the latest patch and I havent had any issues since.
Thanks,

Add user in ACS with limited access

Dear
I have low experiance with cisco ACS
So kindly i need help to add user to The ACS which has limited access to my network Switches ( As Show only not to change configuration )
Also how to take backup for the ACS Database
Thanks,

Hi,
Search about command authorization in the AAA section, you'll get ample information about it, i.e., on how to configure network devices so that you can allow certain users on ACS to have limited and certain user to have full access.
About taking a backup, that is pretty simple.
System Configuration > ACS Backup > Backup Now.
And you have a latest backup from ACS.
Regards,
Prem

ACS can not access ADS-LDAP starting from "DC=..."

Hi
I have an ACS v4.2 from which I try to access an ADS LDAP directory. When I use "CN=Users,DC=Domain,DC=com" as the baseDN for the users and the groups everything works as it should. When I change the base DN to "DC=Domain,DC=com" only, then the ACS is not able to find any users or groups. Even when trying to configure the group mappings he claims: "LDAP Server NOT reachable. Please check the configuration.". Using an LDAP browser I don't have any issues accessing the directory from the shorter baseDN.
Is this a v4.2 related problem or a general ACS problem?
The point is that I need to find users in different OU's, which are based directly under the domain name, so that I need to search for them starting from "DC=Domain,DC=com". I know that with "Generic LDAP" I can make severeal "Databsae Configurations" to resolve the issue with the OU's. But not with a "RSA SecurID Token and LDAP Group Mapping" setup. There is only possible to have one LDAP group mapping configuration.
Any input would be greatly appreciated.

Hi
We invested a lot of time together with TAC and development. Short answer: No it's not solved. It was an ACS bug. But development didn't realy understand the problem. We went ahead and restructured the ADS.
The problem we had, is that a LDAP directory of a Windows is not fully accessible. Even if you connect as a Domain Administrator or to the Global Catalog. :-) And that's where the ACS fails. LDAP browsers just read over the unaccessible parts of a LDAP directory and show you all the accessible part. ACS doesn't. He stops and reports the failure. You can see that clearly when sniffing the access of the ACS and the LDAP browser to the directory. Unfortunately the unaccessible part is at the beginning of the ADS LDAP directory. :-(
Maybe they resolved the problem nowadays. Or if you have a Windows Guru who can help you in making the directory fully accessible I would be interessted in the How-To.
I wish you best luck with your issue.
Kind regards
Roberto

ACS 5.1 - Access Services Issues

Folks,
I have an issue with an implementation, I had a ACS R5.1 that I'm using to authenticate the wireless users with 802.1x, that's OK and working fine. Now I want to use the same ACS to authenticate wired users using MAB (for IP phones, printers, servers, and other devices) and 802.1x (for corporate users). I already configured the authentication services (MAB and 802.1x) on ACS, but when I'm doing tests I can see that for example the phones are trying to authenticate using the 802.1x rules of wireless connection, not using the MAB rules.
Below you could see my switch configuration related to authentication.
switchport access vlan 2011
switchport mode access
switchport voice vlan 2111
ip access-group PRE-AUTH in
authentication event fail action authorize vlan 2211
authentication event no-response action authorize vlan 2211
authentication host-mode multi-domain
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 5
dot1x max-reauth-req 1
You could also see an screen from the ACS in the attached file. On the picture remark you could see a IP Phone trying to authenticate using the wireless Access Services insted of using MAB.
Any help would be apreciated.
Regards,
Luis F. Martinez

Can you share the service selection rules you have defined
Also the RADIUS attributes in the wireless and MAB requests.
select: Monitoring and reports -> Launch Monitoring & Report Viewer
and then select Authentications -> RADIUS today
You should see a list of the requests including the ones you had tried. In the details column click on the icon and you will see the details of your RADIUS request. This includes the list of RADIUS attributes received.

ACS RADIUS Certificate Access Workflow

Hello Friends, I've been trying to deploy a ACS solution that includes Radius, connection with an AD database and Certificate-Based Access to the network but the documentation that I have found is very very vague and is getting a little bit complex for me to deploy it. I wonder if there's a guide or a better organize documentation about the diferent scenarios of configuration for the ACS solution. At least a workflow configuration document that has secuenced steps. Thanks in advance for your help.
PD: If any of you is involved with Cisco documentation I hope it serves as a suggestion and recommendation.
Atte. Jonás.

Hi Jonas,
Please take a look into this doc:
https://supportforums.cisco.com/docs/DOC-13545.
It is a step-by-step guide to configure ACS for dot1x, installing certs on the ACs and integration with AD.
Regarding the Certificate based authnetication, there you need to be more specific on what EAP type you intend to use.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

ACS/ASA authentication for vpn access vs. console management access

I have an ACS 4.2 Server and an ASA 5540. I have setup AnyConnect SSL VPN on the ASA and want to authenticate users using AAA tacacs+ authentication with the ACS and an external Windows AD database. I have done this successfully. I also want to use the ACS for authenticating SSH management sessions into the ASA. I have setup a group in AD and on the ACS called VPNUSERS and NETADMINS. The problem is, I want the VPN users to ONLY be able to authenticate for VPN but not have access to logging into the ASA CLI or ASDM. The NETADMINS should be able to do both. The question I have is how do I setup the VPNUSER group in ACS to have access to connect to the ASA for VPN but not for the management console? It seems that if they can authenticate for vpn, they can also ssh the firewall which is what I want to prevent.

Try using Network Access Restrictions (NAR)where you can restrict the administrative access on per device or on NDG basis.
By default user accounts from external database such as AD in ACS will get authenticated through telnet on network device or a AAA client which can be restricted by enabling NAR in ACS.
In your case it should be VPNUSERS group in ACS.
HTH
Ahmed

Console access Cisco 1113 ACS

We have a new ACS and cannot access the device thru the console. I am using TeraTerm and I can see the characters but it is a bunch of garble almost like the terminal settings are incorrect. I have 8 1 and no parity for the Serial port settings. Has anyone run into this? If so, how did you get it solved? Thanks.

I got it to the login screen now but do not know what the Admin password is?? Is there a default login initially for this device? I found documentation on how to change it but you need to be in the device first. Thanks

ACS - Cannot get Time-of-Day Access Settings to work

I have set up ACS to control access to my local LAN users who connect to the network via c2950 switches.
I have configured the default Time-of-day setting to stop local LAN users logging in before 7am, I have followed the instructions in Cisco documentation but it still fails to deny access before this time. Can this be achieved or am I doing something wrong?
Thanks

Ive tried to reproduce this on 3.3 and I can't.
Try disabling all hours, ( Clear All button ), If that does manage to stop access then it certainly looks like a timezone issue.
If the previous test does cause users to be denied accsss?
Reset the Time restriction to what you want and
Enable Passed Authentication log via System Configuration Logging
Then to an authentication prior to 07:00 and check the time stamp in the passed authentication log.

How to prevent/allow admin access from certain ip address.

Hello
trying to setup the following scenario:
have a user BOB created in Cisco ACS 4.2
have several network devices with different management IP addresses all added in Cisco ACS 4.2
want to be able to allow BOB to access network devices only if BOB's access request is coming from one ip address 1.1.1.1
If BOB is trying to access network devices from any other ip addresses, the request should be denied regardless of the fact that BOB has full access to all network devices.
Is there a way to acomplish this using Cisco ACS 4.2
Appreciate your input.
Regards,

It is actually possible, thanks for your doc reference:
in ACS setup AAA client user will be allowed to call from
in ACS setup NAR (devices you want to allow access to);
create user in ACS
configure user access in ACS:
     allow access to required NARs
     define IP - based access restrictions
          Permitted calling / point of access locations
               enter AAA client from which user will call (* for ports and * for ip address)
Save and test
In failed attempts you should see Authentication failure code "Users access filtered" when trying to login to NAR devices with new username and from non-permitted calling client/ip address.
Thanks for you help.

ACS 4.2 authentication using multiple external databases

Hi there.
We currently use ACS 4.2 for authentication of corporate users who are accessing the network in 2 different ways:
1) VPN client (via ASA5510)
2) Wireless (EAP-PEAP)
For all users who currently access the network via either of the above 2 methods, the Password Authentication under User Account settings in ACS is set to query an RSA SecurID Token Server.
We would like to try achieve the following in ACS:
IF an access request comes from the ASA (VPN clients), THEN we would like the user's password authentication to be handled by the RSA SecurID Token Server as it currently is.
IF an access request comes from the Wireless LAN controllers THEN we would like to use EAP-TLS authentication. (We are aware that we would obviously need to configure the WLC, clients, PKI infrastructure etc accordingly for eap-tls).
Does anyone have any best practice guidance, configuration guides or previous experience in differentiating the request sources and how they are handled by ACS?
Many thanks

Hello Malcom,
If you have ACS 4.2 you might want to implement Network Access Profiles:
http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/NAPs.html#wp1128143
or
http://tools.cisco.com/squish/5F591
This should be the best approach for you if using ACS 4.x.
If this was helpful please rate.
Regards.

ACS 5.5 RADIUS OUTBOUND Attributes Injection feature

Hello
I'm having a look at the RADIUS OUTBOUND Attributes Injection feature for the External Proxy service in ACS version 5.5.0.46.
The use case is:
ACS uses the External Proxy service to authenticate wireless users with certain domain suffixes
Sometimes the username Access-Accept comes back with the domain suffix stripped.
The result of this is:
ACS logs a successful authentication with the sent username (with suffix)
ACS sends the Access-Accept to the WLC and the user is listed on the WLC (without suffix)
Subsequent accounting packets for the user appear in ACS (without suffix)
In the past I've used a freeradius proxy server between ACS and the external proxy to 'rewrite' the username in the Access-Accept so that it matches the username origianlly sent in the Access-Request. The code for this looked something like the following.
Post-proxy {
update outer.reply {
User-Name := "%{request:User-Name}"
I'm looking to do the above solely with ACS but I can't see the Radius-ietf username attribute listed under the RADIUS OUTBOUND Attributes Injection feature. Is it possible to rewrite the username attribute in ACS 5.5?
Thanks
Andy

Don't think this can be done in ACS 5.5 when using an External Proxy Service Type.
Interestingly, it appears to be possible with a Network Access Service Type. Under Allowed Protocols there is a tick box for Send as User-Name in RADIUS Access-Accept - one of the options is RADIUS Access-Request User-Name. Hopefully this will be implemented in a future release for External Proxy.
Cheers
Andy

Anyconnect VPN-Authentication multiple profiles via ACS

Hi,
I'm currently facing the issue, that I need to migrate a customer VPN-structure from VPN-client to the new Anyconnect.
There is an ASA5515 and they have ACS with local users and AD-Integration.
The problem: The old system used different profiles with PSK, so every external partner who had a VPN connection got it's own profile, which was secured by the IKEv1 PSK. The credentials for externals are saved locally on ACS. Also there is a profile for the normal employees, which authenticate via AD or RSA. The guys who implemented this did it the easy way, means when a user connects, the whole user-table is checked (AD, local, RSA). So if an external would have the .pcf from an internal user, it would be possible for him to connect to internal resources. There was no profile-to-usergroup binding.
I should now implement a new ASA with Anyconnect and also keep up the different profiles. But in this case the problem is - there is no PSK any more. So if a smart guy changes the group in his XML-profile to e.g. "Internal", it would authenticate and grant access to all resources, since the internal pool isn't restricted by ACL's, but the externals are.
I'm looking for a guide, how to set up different policies on the ACS, which look up the user only in the one group, depending on the profile he connected. As far as I understand, I must somehow define already on the FW which group or policy it should look up. How can I achieve this?
What do I need e.g. for 10 different profiles?
- 10 groups on ACS?
- 1 Access-Policy? (Network Access) -> with 10 different Authorization Policy rules?
- Anything else?
Where do I define the policy to use in Anyconnect?
Thanks in advance!
BR

I've done a similar deployment where all authentication/authorization and accounting was pointed from ASA to ACS.
There are multiple layers to your question.
First of all, you have ACS, hopefully 5.x which gives you a nice policy driven authentication and authorization schema.
1st layer - setup group-alias and group-urls for specific users on ASA.
2nd layer - on ACS decides where those connection should be authenticated/authorized against (go to AD, RSA, local DB). ASA passess tunnel group name in authentication calls to ACS.
3rd layer - group-lock feature ensures that user can only have access to resources if they are in a specific group.

802.1x(ACS) with avaya phones

Hi All ,
We are implementing wired dot1x for our wired users with EAP-TLS. When I am connecting laptop it is getting authenticated and it is working fine. For Voip(Avaya) we are using MAB .When we connect VOIP , after 30 seconds ACS is giving Access-accept(auth success) . But Voip is stuck up in Bad router state and VOIP is not working. If I connect the laptop behind the voip it is getting authenticated and it is working fine eventhough voip is stuck up.
Is there a way we can reduce 802.1x auth timings , so that VOIP can register succesfully?
The switch interface config is ,
authentication event fail action next-method
authentication host-mode multi-auth
authentication order dot1x mab
authetication priority dot1x mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 10
Thanks,
Vijay

Hi,
i am using AVAYA as well in production. They support 802.1X.
Configure Voice VLAN on each Port.
Let ACS send the radius attribute device-traffic-class=voice under
Policy Elements/Authorization and Permissions/Network Access/Authorization Profiles VOICE VLAN
and select Permission to join static.
A good guide: IP Telephony for 802.1X Design Guide
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/IP_Tele/IP_Telephony_DIG.html
Regards Horst

Using Active Directory and ACS for Concentrator 3000 VPN

Has anyone gone down the path of using Cisco ACS for network access control AND authenticating it with their W2K Active Directory for VPN 3000 concentrators? I did some research on Google, Cisco web, and this group, I did not find a definite answer on the best practice for the architecture and design, can anyone share your experience how you approached this?
Below is my understanding, I appeciate any help to piece some or all the below together
(1) The end state is once a VPN user is successfully authenticated, it is assigned to certain network access privilege based on its group's policy. How to accomplish this?
(2) AD stores a central user database for user authentication. Each user may belong to one or more groups on the AD; ACS is reponsible for network access control for the specific groups and enforces these controls to the users via the concentrators.
(3) Concentrator is the NAS, and ACS is the RADIUS server
http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800949b4.shtml
(4) Concentrator can link to the AD as an external database: http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/4_1/gs/gs3mgr.htm
(5) A single "Tunnel Group" is created on the concentrator
(6) Mulpile Groups, per corporate infosec policies are created on the AD
(7) Mulpile Groups, per corporate infosec policies are also created on ACS, need to match with what're in the AD
TIA.

In order to restrict access for a specific AD group to specific SSID this is what you need to perform.
When the WLC sends an authentication request to the ACS, it will include the SSID that the user is connecting to, in the attribute Calling-Station-Id(31). We can use this information to create multiple rules in ACS 5.x in order to take actions based on the information contained in the attribute.
Under the Users and Indetity Stores > click on Directory Groups > select > check the group name you want to add and hit ok. Save the changes.
We just need to create a DNIS rule that includes the name of the SSID and use it as a condition in any rule that we create for authentication. The * is required because the attribute not only contains the SSID but also a MAC address so the * is use as a regular expression.
Now go to access-policies > default-network access > identity should be AD1.
Go to authorization > click on customize > move the AD1:ExternalGroups and end-station filter attribute on the right side and hit ok.
After that slect the appropriate ad group for teachers and end-station filter.
Save changes.
Jatin Katyal
- Do rate helpful posts -

ACS 4.2 access que

Similar Messages

Maybe you are looking for