ACS 5.0 NFR-version ?

Hi all,
I've seen the ACS 5.0 evaluation version, so I wonder if it is also available in the NFR package ?
If it hasn't already be released there, is there any date when to expect it ?
How often are these NFR packages re-bundled anyway ?
Thanks in advance,
Oliver

Your CAM should be able to answer all your questions. I don't think I've ever seen one on the forum so contacting them will probably be your best bet.

Similar Messages

Does ACS 1120 5.0 version support RSA?

Hi all,
We are using Cisco ACS 1120 with 5.0 base licenced for TACACS , does ACS 5.0 support RSA server as external database for authenticating the users as we do in the previous versions of 4.2,4.0.
If so kindly let me know how we can do it ? or do we have any document?
Regards
Sreekanth

This is supported in ACS 5.1. ACS 5.1 can be downloaded from CCO and can upgrade ACS 5.0 to ACS 5.1
The RSA SecurID Agent is built in to ACS 5.1. Through the ACS GUI you can perform all the required configuration items to activate and configure the agent. This includes setting the:
agent record (sdconf.rec)
load balancing data (sdopts.rec)
node secret (securid)
agent status file (sdstatus.12)
For more details, see http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1134728

Cisco ACS register to primary with different acs versions

Hello, I've updated a backup unit of two acs to version 5.4.0.46.0a first I changed it to standalone, and now I try to register to the main ACS which is running version 5.1.0.44.2
And I get this error
This System Failure occurred: com.cisco.nm.acs.im.certificate.Certificate; local class incompatible: stream classdesc serialVersionUID = 8507982043664257993, local class serialVersionUID = 1927357986028617243. Your changes have not been saved.Click OK to return to the list page.
What can I do to solve it?
Kind regards

The primary and secondary should be running on the same code.
Jatin Katyal
- Do rate helpful posts -

Problem in installing ACS trial version

Hi,
I am having problem in installing ACS 4.1 trial version. On invoking the progem after installation completion, I get the web page "CiscoSecure ACS Trial 127.0.0.1:2002" opened.
Appreciate your advise, why I am getting this web page and how to fix it.
Thanks
Any

You need to add the site 127.0.0.1 (or localhost) to the trusted sites list in IE then when you open the link you will get the ACS welcome page. (Make sure you install the Java runtime as well).

"24427 Access to Active Directory failed" error in ACS 5.1

Hello,
I'm working on implementing a RADIUS authentication for wireless access with the following :
- PCs running Windows 7, protocol used is PEAP (without validating the server certificate to make it simple at first),
- AP 1252 configured to use a RADIUS server to authenticate (it's working good with an ACS server 4.2),
- ACS Server 5.1.0.44.5 running as VM connected to an AD domain and working good with VPN connections,
- AD domain running on Windows 2003 Server.
My ACS VM is working good since a couple of months for VPN (RADIUS) and administration (TACACS) remote access, both using Active Directory. Now, I'd like to use it to authenticate people connecting to a 1252 Cisco access point but I'm getting this error "24427 Access to Active Directory failed". I switched from PEAP to LEAP but this is the same.
All I can get running the expert troubleshoot
Investigating failure code: 24427 Access to Active Directory failed
Checking if Active Directory is configured
Active Directory is configured
Attempting connection to Active Directory
Connection to Active Directory was successful.
Troubleshooting completed.
Click on Show Results Summary to view results.
I followed this guide, at least for the ACS certificate section :
http://www.cisco.com/en/US/products/ps10315/products_configuration_example09186a0080b4cdb9.shtml
Anyone has an idea where the problem may come from?
Thanks in advance,
Vincent

hey there, I ran into the same issue with 5.3 and it turned out being this bug. i came across your post looking for instructions on retrieving the logs. thanks mate.
link
Problem: Error "24495 Active Directory servers are not available"
Authentication starts failing with this error: 24495 Active Directory servers are not available. in the ACS 5.3 logs.
Solution
Check the ACSADAgent.log file through the CLI of the ACS 5.x for messages such as:Mar 11 00:06:06 xlpacs01 adclient[30401]: INFO base.bind.healing Lost connection to xxxxxxxx. Running in disconnected mode: unlatch. If you see the Running in disconnected mode: unlatch error message, this means the ACS 5.3 cannot maintain a stable connection with Active Directory. The workaround is to either switch to LDAP or downgrade the ACS to 5.2 version. Refer to Cisco bug ID CSCtx71254 (registered customers only) for more information.

How to upgrade the patches in ACS 5.1

I want to upgrade the acs 5.1 in distributed system. We have one hub/ primary ACS and two other spoke / secodary acs. I have following querry.
Will it be possible to upgrad only one Secondary server.>
Will updated secondary ACS will able to sych it configuration with primary acs running on older version?
Will updated secondary acs will retain the current configuration and authenticate the client.?

Current version of ACS system is 5.1.0.44
Primary ACS is also working as log collector.
I have downloaded the patch 5.1.0.44.6.rar.rar, so i belive i should rename it to 5.1.0.44.6.tar.gpg.
so if i want to upgrade my ACS system:
I will have to do following steps:
de-register secondary ACS from primary and take the backup of secondary ACS
update the patch using repository.
finally i will have to upgrade the primary ACS.
I would like to know what is the difference between installing / updating patch and Upgrade the ADE-OS version which is shown as second step in cisco.com site.

ACS 4.2

Hello,
My company bought a product
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
CSACS-1120-K9
And also
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
CSACS-4.2-WIN-K9
why i need a DVD when i have a ACS Engine.??
Can anybody help me to understand, As what i know is that ACSE is a appliance with a preinstalled ACS
AND
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
CSACS-4.2-WIN-K9
is a DVD which is installed on Server according to the prerequisite on cisco website.
Thanks

Thomas,
1120 Secure Access Control System (CSACS 1120) comes with preloaded version 5.x and on the other side you have ACS windows CD for version 4.2.0.124 so they both have different ACSs version. There is no point running two different version running in the same network because that would not allow you to do replication or syncronization. Also both have different architecture and functionality.
I think you would be required a Recovery DVD of ACS version 4.2 so that you can downgrade the 1120 to 4.2 and use one as primary and other as secondary or backup ACS.
Why we have only option to downgrade because ACS windows 4.2 can not be upgraded to 5.x. You always have an option to migrate because 5.x only supports linux OS.
Regds,
JK
Do rate helpful posts-

ACS Windows Agent Issue

Hi,
We just upgraded our 3.3. ACS to the latest version without issue. I created the Remote Agent on the ACS, but we I install the Agent on the Windows 2003 server I get "Unable to initialize variables". Anyone? Thanks.
John

John,
- Logon to the computer as a Local Administrator, preferably "Administrator", and then try and uninstall Remote Agent & try and install it back. Log on locally to the box and install the RA.
- If above doesn't work, you might have to manually uninstall Remote Agent. After uninstalling, you can try to reinstall the current version of the remote agent.
somishra

Need advice about ACS/WLC upgrade ?

We have two ACS 4402 with software version 5.2.193.0 . What version should I upgrade to ?
The ACS is running version 5.2.148.0. What version do you recommend here ?
Regards
Johann F
Volda Universiy College, Norway

Hi Johan,
Are you facing any bug or require any new feature?
Normally recommended in the latest on your code train:
latest on 5.2
latest on 6.0
latest on 7.0
and so on...
Have a good day.
Serge

ISE NFR kit is a preconfigured VM. How to integrate it on existing demo scenario?

Hello,
Just got an ISE NFR kit.
I actually thought that this would just as any other Cisco product where you get a license that will limit your amount of registered devices.
Instead we get a preconfigured VM, tuned and tweaked to work on a corp.rf-demo domain.
The problem that I have that will lead to my question is:
- I have set up a fairly complex scenario using ISE on Evaluation license, using own lab/demo infrastructure, meaning specific DNS, AD, PKI, etc.
- from past tests I have discovered that ISE will NOT accept you changing the FQDN of the machine on the CLI, as internal variable substitution is done based on the initial setup FQDN - for instance for CWA or CPP URL redirection.
- I'd really like to simply license the scenario I already have so that it become part of our somewhat permanent demo showroom.
My questions are:
- is it possible to simply get a NFR license that you can install on a VM, and turn an Eval deployment into an NFR one? Cisco Licensing just told me that the NFR part number is non-licenseable. Does anybody have another idea?
- instead, is it possible to successfully change the FQDN name of the ISE NFR VM into whatever FQDN we need it to be, in case I do find the time to rebuild the entire configuration in this VM?
I have tried adding the NFR VM into my existing deployment as a secondary Admin node, but its license just got overriden by the eval one, as it should.
I'm assuming that if I backup the existing deployment and restore it to the NFR VM, the license will also get overriden. Can anybody confirm?
Thanks for any help/ideas.
Gustavo

Hello Gustavo,
If you resolve this please assist me :
1) Is it possible to customise the NFR version of ISE?
2) would we be able to get an extended evaluation license, both base and advanced, to apply to our lab ISE node.?
ISE NFR 1.2 software - logging not working after changingIP address of ISE. It is not possible to delete the "Remote Logging Targets" which includes itself and the IP address 10.1.100.21. Please advise on how to customize.

Cisco ACS 5.4 problem

Hello
Did anyone experience problem with Service Selection Rules in Cisco ACS. When I click this tab ( it only works for me in google Chrome), configuration is normally opened. But when I want to edit one of two default rules (rules that match radius and tacacs) nothing happens. If I want to add new rule, popup window in normally opened but I am not able to add any conditions or results. It is just nothing to choose from. I have some attributtues under "customize window". It looks like some gui problems.
I am using
acs/admin# sh application version acs
Cisco ACS VERSION INFORMATION
Version : 5.4.0.46.0a
Internal Build ID : B.221
with trial license. I am running ACS on vmware player (1 GB of RAM and 1 proc).
Thanks in advance
General
Name:
Status:
Enabled Disabled Monitor Only
The Customize button in the lower right area of the policy rules screen controls which policy conditions and results are available here for use in policy rules.
Conditions
Results

When dealing with Cisco ACS and Cisco ISE you have to be very careful with your web browsers. For example there's a major bug when using Cisco ISE 1.1.x and Chrome.
Back to ACS, please refer to the release notes to see the validated web browsers.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/release/notes/acs_54_rn.html#wp222016
I have used ACS and ISE a lot, and we had many problems when using Internet Explorer and Chrome. That's why I prefer Firefox, but even with firefox we had little problems once in a while.
Please rate if this helps

ACS 4.2.1: adding new AAA clients through odbc import

Hello,
we have added the user defined vendor RADIUS_HUAWEI to our Cisco ACS 4.2.1 Windows Server.
Unfortunately there is a problem with importing network devices through odbc connection using the accountactions table with the action code 220.
The documentation tells us :
220
ADD_NAS
VN, V1, V2, V3
Adds a new AAA client (named in VN) with an IP address (V1), shared secret key (V2), and vendor (V3). Valid vendors are:
•VENDOR_ID_IETF_RADIUS—For IETF RADIUS.
•VENDOR_ID_CISCO_RADIUS—For Cisco IOS/PIX RADIUS.
•VENDOR_ID_CISCO_TACACS—For Cisco TACACS+.
•VENDOR_ID_AIRESPACE_RADIUS—For Cisco Airespace RADIUS.
•VENDOR_ID_ASCEND_RADIUS—For Ascend RADIUS.
•VENDOR_ID_ALTIGA_RADIUS—For Cisco 3000/ASA/PIX 7.x+ RADIUS.
•VENDOR_ID_AIRONET_RADIUS—For Cisco Aironet RADIUS.
•VENDOR_ID_NORTEL_RADIUS—For Nortel RADIUS.
•VENDOR_ID_JUNIPER_RADIUS—For Juniper RADIUS.
•VENDOR_ID_CBBMS_RADIUS—For Cisco BBMS RADIUS.
•VENDOR_ID_3COM_RADIUS—For Cisco 3COMUSR RADIUS.
The new user defined vendor is:
C:\Program Files\CiscoSecure ACS v4.2\bin>CSUtil.exe -listUDV
CSUtil v4.2(1.15), Copyright 1997-2009, Cisco Systems Inc
UDV 0 - RADIUS (RADIUS_HUAWEI)
Our action code and variables look like:
A=220
VN="xxx"
V1="10.10.10.10"
V2="blabla"
V3="VENDOR_ID_RADIUS_HUAWEI"
Error Code is as following:
06/22/2010,10:21:12,W03P-3413,ERROR,Parse Error: Reason - Host vendor is unknown [A=220 UN="" GN="" AI="" VN="xxx" V1="10.10.10.10" V2="blabla" V3="VENDOR_ID_RADIUS_HUAWEI"]
Does anybody knows the correct name for the V3-variable to import the network device in a correct way?
Best regards
Torsten Waibel

Hello,we
have a new acs appliance (1113) with version 4.2.1.15 and we want to
authenticate user through ssh from routers with ios xr software.
unfortunately this doesn't work.Here ist our configuration of the router:##################################################line template VTY
access-class ingress abcd!tacacs-server host x.x.x.x port 49 single-connectiontacacc-server key 7 test!tacacs source-interface Loopback13!ssh server v2
ssh timeout 60! AAA config
aaa accounting exec default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting commands default start-stop group tacacs+
aaa authorization exec default group tacacs+ none
aaa authorization commands default group tacacs+ none
aaa authentication login default group tacacs+ local##################################################does anybody has a solution for this problem?thnx and best regardsTorsten Waibel
Hi Torsten Waibel,
For ssh to support you should have a cryptography ios image in router and check the following command in line vty that transpot input ssh under line vty cofiguration.
If helpful do rate the post
Ganesh.H

Acs 4.2.1.15 appliance with vendor Huawei

Hello,
we have a new acs appliance (1113) with version 4.2.1.15 and we have successfully imported the codes for the new vendor Huawei.
In the webgui of the appliance you can choose the different administration levels for users and groups.
unfortunately we have the problem that RADIUS requests from any Huawei device will not arrive at the acs appliance. we do not see any entry in the logfiles.
has anybody experiencies with the vendor Huawei and RADIUS request ?
best regards
Torsten Waibel
P.S.: funnily enough we have no problem with our old acs server (1112) and version 4.0

Hello,we have a new acs appliance (1113) with version 4.2.1.15 and we have successfully imported the codes for the new vendor Huawei.In the webgui of the appliance you can choose the different administration levels for users and groups.unfortunately
we have the problem that RADIUS requests from any Huawei device will
not arrive at the acs appliance. we do not see any entry in the
logfiles.has anybody experiencies with the vendor Huawei and RADIUS request ?best regardsTorsten WaibelP.S.: funnily enough we have no problem with our old acs server (1112) and version 4.0
Hi,
If you have sucessfully imported the VSA in ACS and there is no log coming in ACS log file then need to do some troubleshooting you need to span the port of huawei port and acs port check that when ever you login into huawei devices at that any request goes to ACS or not and any log messages in huawei devices regarding the aaa packets that will give some view to troubleshoot the problem.
Hope to Help !!
Ganesh.H

Acs 4.2.1.15 and ssh authentication with ios xr

Hello,
we have a new acs appliance (1113) with version 4.2.1.15 and we want to authenticate user through ssh from routers with ios xr software. unfortunately this doesn't work.
Here ist our configuration of the router:
line template VTY
access-class ingress abcd
tacacs-server host x.x.x.x port 49 single-connection
tacacc-server key 7 test
tacacs source-interface Loopback13
ssh server v2
ssh timeout 60
! AAA config
aaa accounting exec default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting commands default start-stop group tacacs+
aaa authorization exec default group tacacs+ none
aaa authorization commands default group tacacs+ none
aaa authentication login default group tacacs+ local
does anybody has a solution for this problem?
thnx and best regards
Torsten Waibel

Hello,we
have a new acs appliance (1113) with version 4.2.1.15 and we want to
authenticate user through ssh from routers with ios xr software.
unfortunately this doesn't work.Here ist our configuration of the router:##################################################line template VTY
access-class ingress abcd!tacacs-server host x.x.x.x port 49 single-connectiontacacc-server key 7 test!tacacs source-interface Loopback13!ssh server v2
ssh timeout 60! AAA config
aaa accounting exec default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting commands default start-stop group tacacs+
aaa authorization exec default group tacacs+ none
aaa authorization commands default group tacacs+ none
aaa authentication login default group tacacs+ local##################################################does anybody has a solution for this problem?thnx and best regardsTorsten Waibel
Hi Torsten Waibel,
For ssh to support you should have a cryptography ios image in router and check the following command in line vty that transpot input ssh under line vty cofiguration.
If helpful do rate the post
Ganesh.H

Upgrade path for Cisco Secure ACS 4.X Solution Engine 1113 Appliance.

Hello,
I am having Cisco Secure ACS 4.X Solution Engine 1113 Appliance, and is running on version Cisco Secure ACS Release 4.1(1) Build 23 and now want to upgarde it to the latest version. Need to know the upgrade path for the same. As per my information ACS 4.1(1) runs on windows server and releases post to 5.X uses Linux. Please guide how can i upgrade Appliance 1113 from 4.1 to 5.x

Hi,
Cisco ACS 1113 appliance doesn't support ACS 5.x version. 1113 appliance supports till ACS 4.2.1 version.
Cisco ACS SE 1120/1121 appliance models are required for ACS 5.x
The upgrade path for ACS 4.1 to 4.2.1 version can be found in the following link :
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2.1/Installation_Guide/solution_engine/upgap.html#wp1237189
Regards,
Karthik Chandran
*kindly rate helpful post*

ACS 5.0 NFR-version ?

Similar Messages

Maybe you are looking for