ACS 5.4 with 4.x deployment

Hi guys.
Need to solve the further task:
I have a large deployment of independent ACS 4.x servers (every server has his own zone of responsibility). And there is a need to deploy two central ACS servers with the whole database from every independent ACS 4.x ().
I want to deploy two latest ACS 5.4 as central cluster (replicate everything from ACS 4.x to ACS 5.4 using Cisco Migration Tool; secondary unit in a cluster as a backup and a log collector), and all of 4.x severs as secondary servers.
So I have a couple of questions:
1) Will this deployment work like it should with Medium ACS Deployment from Cisco guide for ACS 5.4:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/installation/guide/csacs_deploy.html
The point is: can I manage the whole ACS network from the central 5.4 cluster and will the database be replicated partially to ACS 4.x servers?
2) If the answer to the first question is "no", can I use 4.x as relay servers or it's totally meaningless and I just should point all clients to a central cluster?
Thanks for reading this, I hope you can help me.

Hello Alex:
1-) no. if you use 5.4 the config is not replicated to the 4.x version.
2-) you can use both 5.4 and 4.x as radius server for your clients. the point is you have to configure the policies on both of them independently. for example, internal users - if any - must be created independently on both server. so, you need to maintain the consistency between both versions (i.e. make sure that the auth requests will be processed -almost-the same on both servers. You don't of course need one server to accept an auth while the other server (different versoin) reject it).
3-) The logs of both 5.4 servers are maintained on the log collector. However, if you use the 4.x on the AAA servers list on your clients besides the 5.4 servers then the logs on the 4.x version will not be logged to the log collector of the 5.4 servers. They are stored on the 4.x only (locally or also remotely if you configured remote logging). So, if you need to search for an auth attempt you need to check both versions logs (5.4 and 4.x logs).
I want to mention also that the migration tool does not migrate everything from the 4.x server. there are things that the migration tool can not migrate. The full list of unsupported elements in the migration process are listed here:
http://tiny.cc/61v51w
HTH
Amjad
Rating useful replies is more useful than saying "Thank you"

Similar Messages

ACS any Version with Domain Controller on Windows Server 2008 R2 64bit

Hi All
Is there currently any ACS version working with Windows Server 2008 R2 domain controllers?
Our server stuff has recently upgraded the Domain Controllers to 2008r2 and turned off the 2003 servers. This didn't make our ACS 4.1.4 really happy.
I've read now serveral posts regarding issues with ACS and Server 2008r2 and hope to find a solution (besides switching to LDAP, yukk).
Thanks
pato

Hi AllIs there currently any ACS version working with Windows Server 2008 R2 domain controllers?Our
server stuff has recently upgraded the Domain Controllers to 2008r2 and
turned off the 2003 servers. This didn't make our ACS 4.1.4 really
happy.I've read now serveral posts regarding issues with ACS and
Server 2008r2 and hope to find a solution (besides switching to LDAP,
yukk).Thankspato
Hi Pato,
Just check out the below link hope that help.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/release/notes/ACS42_RN.html
As per the link it says The support for Windows Server 2008 is applicable for ACS 4.2 Patch 4 onwards.
Hope to Help !!
Remember to rate the helpful post
Ganesh.H

ACS 4.2 with patch 4 Services restart

I have installed ACS 4.2 with patch 4
Scertain period after authentication failed. Giving internal error. I need to restart all the services. What could be proble and pl help me in resolving this issue. I am running short of time.

Internal Error is very generic in error. I hope that you had your Logging set to Full, if not then you wont be able to see the exact reason in the debug logs.
You might want to check,
\CSAuth\Logs
And check the debug log when you got the internal error for a particular authentication attempt.
Also, what kind of authentication was failing ? Was it PEAP/EAP-FAST with inner method as MSCHAP machine authentication, then it could be something related to,
CSCsq96755 : ACS needs manual restart to recover machine authentication
Then go for Patch 5 for ACSv4.2
Regards,
Prem
Please rate if it helps!

Radius Authentication in ACS 5.2 with AD

Friend,
I have a questión about radius authenticaction with AD, when I log in into the network with user in AD and I make a mistake in password my radius authenticaction event in ACS 5.2 dont show me this logg. only show the authentication succeeded but dont show me the authentication failed. Maybe i must to enable same service to show the authentiaction failed. The Voice authetication works fine..
This is the confg in the port of the switch:
interface FastEthernet0/12
switchport mode access
switchport access vlan 2
switchport voice vlan 10
authentication port-control auto
authentication host-mode multi-domain
authentication violation protect
authentication event fail action authorize vlan 11
authentication event fail retry 2 action authorize vlan 11
authentication event no-response action authorize vlan 11
authentication periodic
authentication timer reauthenticate 60
mab
dot1x pae authenticator
dot1x timeout tx-period 10
dot1x max-reauth-req 3
spanning-tree portfast
end
Vlan 2: DATA
Vlan 10: VOICE
Vlan 11: GUEST
thank...
Marco

Hi Marco,
When you type in the wrong password do you see the login fail on the device you entered it? Depending on how you have configured fallback mechanisms on ACS, an attempt can still be permited eventhough the authentication failed.
It would be best to take a look at the authentication steps under the RADIUS authentication log for an attempt you beleive should have failed to see what ACS is doing with the request.
Steve.

Integration problem between Cisco Seure ACS 4.2 with LDAP

Hi expert,
I have a problem with the integration between Cisco Secure ACS 4.2 with SUN Java System Directory (LDAP). During the integration, I noticed that user failed to authenticate against LDAP via Cisco Secure ACS. The error message is "Authentication Type is not supported by external DB". In this case the "external DB" refer to LDAP. Anyone of you having an experience on integration on both product before? Can any of you give me some pointers about this. Attached are both screen capture on my ACS server.
Thanks very much,
Daniel

Hi,
Thanks for the compatibility chart. Oh dear ..., it seems that the LDAP does not supports PEAP (EAP-MS CHAPv2) at all. Am not sure if the latest LDAP (particularly for SUN Java System Directory) able to support this authentication protocol.
Just to clarify with you all just in case if you wonder what I'm trying to do; our company wants to implement 802.1x over the network. So, every staff on the network must authenticated before able to access the network resources. Our Linksys switches supports this standard including Cisco switches of course. Our RADIUS server is Cisco Secure ACS 4.2 but all those users information including username and passwords are stored in our directory server (LDAP) which is SUN Java System Directory.
Since most of our staff machines are running on XP and Vista, the only available authentication method (beside certificate based) is PEAP (EAP-MSCHAPv2). Based on the compatibility chart, the generic LDAP does not supports this authentication protocol as what we noted the "authentication type not supported by external database" error message in the ACS logs.
From what I learned that the latest LDAP (version 3.0?) able to support this authentication protocol, but yet to be confirmed on my further research.
So... Anyone can advice me on this matter? Thanks very much !

Develope complex WebService with JDeveloper and deploy to tomcat

Hello,
I am thinking of developing a complex WebService with JDeveloper and deploy it to tomcat.
The WebService should retrieve a few "normal" datatypes and a pdf and a few images. I try to store the pdf and the image in an Oracle DB as BLOB.
My idea ist to create a Package which selects the values, pdf and the image and retrieve them as the output paramter.
Then I want to create a WebService with the JDeveloper which calls this Package. This WebService should be published on a Tomcat.
My first question is if that is possible?
I think there are few problems.
I searched the forum about deploying a JDeveloper WebService to Tomcat, but I can not find a whole solution which is going to work. I read something about JAX-RPC, but I am new to this topic. So it would be very nice, if anyone could tell me where I can find the solution or post a quick guide to solve that.
Another question is how I have to decode the images and the pdf to provide those files in a WebService?
I would be very glad if anyone can help me or tell me where I can find information about that, becaus I am new to this topic!
Thank you,
Tim

Hi,
does anybody have an idea about that?
Thanks,
Tim

Is there TopLinkGrid examples with XML descriptor deployment?

Hi,
Oracle docs include examples of using Oracle Coherence (as shared cache) with TopLinkGrid, but with annotations.
Is there somewhere examples/docs about using TopLinkGrid, but with XML descriptor deployment ?
Thanks.
Regards,
Dominique

With TopLink Grid usage configured per Entity using EclipseLink customizers, you can either use annotations or specify in in the eclipselink-orm.xml file.
For example, the following ecilpselink-orm.xml could be used in the OTN GridCache example with all the Java annotations removed. Note the specification of:
<customizer class="oracle.eclipselink.coherence.integrated.config.GridCacheCustomizer"/>--Shaun
<?xml version="1.0" encoding="UTF-8"?>
<entity-mappings version="1.1" xmlns="http://www.eclipse.org/eclipselink/xsds/persistence/orm" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.eclipse.org/eclipselink/xsds/persistence/orm http://www.eclipse.org/eclipselink/xsds/eclipselink_orm_1_1.xsd">
     <persistence-unit-metadata>
          <persistence-unit-defaults>
               <access>FIELD</access>
          </persistence-unit-defaults>
     </persistence-unit-metadata>
     <entity class="gridcache.model.Address">
          <customizer class="oracle.eclipselink.coherence.integrated.config.GridCacheCustomizer"/>
          <table name="GRIDCACHE_ADDRESS">
          </table>
          <attributes>
               <id name="id">
                    <generated-value />
               </id>
               <version name="version">
               </version>
          </attributes>
     </entity>
     <entity class="gridcache.model.Employee">
          <customizer class="oracle.eclipselink.coherence.integrated.config.GridCacheCustomizer"/>
          <table name="GRIDCACHE_EMPLOYEE">
          </table>
          <named-query name="Employee.findByLastNameLike">
               <query>SELECT e FROM Employee e WHERE e.lastName LIKE :lastName</query>
          </named-query>
          <attributes>
               <id name="id">
                    <generated-value />
               </id>
               <version name="version">
               </version>
               <one-to-many name="phoneNumbers" mapped-by="owner">
                    <cascade>
                         <cascade-all />
                    </cascade>
               </one-to-many>
               <one-to-one name="address" fetch="LAZY">
                    <cascade>
                         <cascade-all />
                    </cascade>
               </one-to-one>
          </attributes>
     </entity>
     <entity class="gridcache.model.PhoneNumber">
          <customizer class="oracle.eclipselink.coherence.integrated.config.GridCacheCustomizer"/>
          <table name="GRIDCACHE_PHONE">
          </table>
          <attributes>
               <id name="id">
                    <generated-value />
               </id>
               <basic name="number">
                    <column name="NUM"/>
               </basic>
               <version name="version">
               </version>
               <many-to-one name="owner" fetch="LAZY">
               </many-to-one>
          </attributes>
     </entity>
</entity-mappings>

TelePresence Conductor with Cisco TMS Deployment - the missing part

Hello,
I am looking at the deployment guides for Telepresence Conductor XC3.0:
Cisco TelePresence Conductor with Cisco Unified CM Deployment Guide (XC3.0)
Cisco TelePresence Conductor with Cisco TMS Deployment Guide (XC3.0 with TMS 14.6)
To setup the TMS, the Conductor and CUCM for scheduled meetings.
The Doc #2, explains how to add the Telepresence Conductor to the TMS, create the scheduled conference alias and configure the conductor on the TMS
The Doc #1, explains how to setup the CUCM and the Conductor for ad-hoc and meet-me conference.
So it looks that there's a part missing. How do we setup the CUCM for the scheduled conferences managed by the Conductor?
With the Doc#2, I can create my scheduled meetings and get a conference SIP address, but how do my endpoints registered on my CUCM route to them. I guess I have to create a SIP trunk on my CUCM but to where? the main conductor IP ? A new location with a new VIP pointing to the same template as the conference alias ?
Another strange thing in the Doc #1, on page 87 of the documentation for Conductor XC3.0 it says:
"Scheduled conferences
Scheduled conferences are not supported in TelePresence Conductor version XC2.4. It will be supported for Personal Multiparty Advanced in a future version of TelePresence Conductor software."

Hi Matthieu,
I guess I have to create a SIP trunk on my CUCM but to where?
You would use a rendezvous location and build a SIP trunk to that location from CUCM to Conductor.
Another strange thing in the Doc #1
this is specific to the Personal Multiparty Advanced feature, looks like the version wasn't updated in the doc to XC3.0 for this line.
-Jonathan

ACS Appliance 1113 with v4.2

I have ACS appliance 1113 with v4.2 software. How do I tight this into Active directory? Do I have to run some software on the DC server?
Thanks,

You need to install remote agent on member server. The software will facilitate communication between acs and AD.
Here is the link,
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.1/installation/guide/remote_agent/rawi.html
Regards,
~JG
Do rate helpful posts

Configuring Cisco ACS 5.1 with Juniper Netscreen Firewall wit Radius & Tacacs+

Hello,
Can anybody tell me the step-by-step configuration of Cisco ACS 5.1, to configured it with Juniper Netscreen Firewall for radius & tacacs+ authentication and authorization?
I am able to configure this with Cisco ACS 4.2 with customise VSA file but can't understand how to configure it on ACS 5.1.
Thanks in Advance.

Hi Eduardo,
Can you tell me how to map ACS 4.2?
service=junos-exec
local-user-name=Engineering
Into the new "shell profiles" on ACS 5.2? How do I verify these attributes are passed onto ACS 5.2? I don't have access to a sniffer or tap nor do I have writes on this box. I have to instruct our systems folks to investigate. It has been a back and forth battle.
Also, I'd like to see where I'd map this on ACS 5.2. Keep in mind in both cases I have a JUNOS config mapping to a login user Engineer and operations respectively.
local-user-name=opertions
allow-commands=((^ping *)|(^mtrace *)|(^traceroute *)|(^monitor *))
deny-commands= ((^start *)|(^file delete *)|(^file rename *)|(^request *)|(^set cli restart-on-upgrade *)|(^set cli prompt *)|(^set chassis *)|(^set date *)|(^test *)|(^clear *)|(^op *))

Access to ACS 4.2 with Domain Credentials

Hello,
We have ACS 4.2 for windows on an enterprise network. User authentication to network devices are passing through the acs via tacacs+ with domain credentials.
Please, i need to know if is possible to also have access to the acs GUI with domain (windows) credentials. If possible, send documentations.
Awaits your response.
Regards,
Ethelbert

I think you mean that radius is working through ACS for domain users. TACACS is used for device access. Here is a link to guide you through the setup.
Scott
**Please rate helpful post**

Fiori CRM apps with central hub deployment

Hello Experts,
We are looking to configure Fiori CRM apps in our landscape with central hub deployment option. Our CRM backend and frontend server (Gateway) are 2 separate systems.
The CRM backend system (CRM 7.0 EHP3) is running NW 7.4 whereas the frontend server where we have installed the Gateway component is running NW 7.31. Can we go ahead and install the CRM UI components on our frontend server or is it mandatory that the frontend server also runs NW 7.4?
Regards,
Saurabh
Tags edited by: Michael Appleby

Hi Masa,
The link you mentioned gives details about the required SAP Gateway Components for NetWeaver 7.3 & 7.4, but does not mention anywhere whether the NetWeaver version of the backend business suite system should necessarily be NW7.4 if we have front-end system on NW7.4.
I am looking to clarify the doubt regarding whether both front-end and back-end systems should be on the same NetWeaver release or it is fine to have front-end on 7.31 and back-end on 7.4
Regards,
Saurabh

ACS 5.4 with DACL over wireless and wired network

Hi my name is Ivan, I have a question
I have a deployment in my network wired at this way:
Profile 1: corporate's users are working with 802.1X to authenticate computers and users with eap peap mschap v2 and Mac Filtering configuring in the Cisco WLC. My ACS 5.4 is integrate to the Active Directory.
Profile 2: Telephonies IP authenticate with MAB. All the Mac Address are registered in to the ACS locally.
Profile 3: user guest authenticate with portal web from Cisco Wireless Lan Controller over the wired network, and the account exist in to the WLC Lobby Ambassador
A my deployment in the wireless network is in this way:
Flex Connect with central authentication and local switching to connect 15 sites over the wan network.
SSID 1: users corporate working with 802.1X to authenticate users with peap mschap v2 and Mac Filtering configuring in the Cisco WLC. My ACS 5.4 is integrate to Active Directory.
SSID 2: users guest working with portal web from Cisco Wireless Lan Controller over the wireless network, and the account exist in to the WLC Lobby Ambassador.
I would like to configure in the Cisco ACS 5.4 Downloadable Access List (DACL) to use in my network wired and wireless.
How can I do it to my scenary?
Please could you help me?
Regards
Ivan.

Hello. To avoid confusion, let's divide the WLC based upon the operating system.
There are WLCs who run AirOS. That includes WLC 4400, but also includes WLC 5500.
There are WLCs who run IOS-XE. That includes the new Catalyst 3850-X and WLC 5700. (also I think can run AirOS too).
IOS-XE fully support DACL. On the other hand AirOS support DACL partially.
From ACS point of view, when you configure DACL for IOS you configure not only the name of the access-list, but also the access-list entries. That way the IOS devices don't need to have the ACLs pre-configured. This is great because you only need to create and update the access-list entries from only one place (which is ACS) and deploy easily to hundreds of switches.
On the other hand, when ACS configures DACL for AirOS it can only specify the name of the access-list. The AirOS device needs to configure the access-list with a name exactly as configured on the ACS. Sadly, each AirOS device also needs to configure all acess-list entries.
It seems you want to configure DACL along with other attributes. If you explain me a little more your requirement I can show you what to configure.
Best regards

Acs in ha with certificate eap expired

Hi my name is Ivan, I have a question:
I have two cisco acs version 5.4 servers in HA primary and replica 802.1x providing services for users and computers, integrated corporate Active Directory. servers have a certificate to authenticate users and comptadoras by PEAP MSCHPv2. This certificate installed on the acs server has expired. The certificate is obtained by performing the request from the acs server and download it with a CA microsoft server.
As I can do to re-install the certificate, since the units are in HA, 802.1x and provide the services again?
Thanks for your answers.
Regards.
Ivan.

Hi Ivan,
Here are the steps:
To replace the certificate in both server it is better to make each server a stand alone
unit. In other words breaking the cluster.
To break the cluster you can go under distributed deployment and select from primary
server your secondary unit and first you need to deregister and then you need to delete
it.
This will restart services in the secondary server and this may take around 5 minutes.
Once the server is back you can start the process in each server of requesting a new
certificate from VeriSign.
To do so:
Create a new certificate signing request in each server.
Export the CSR to your CA.
Install the new certificate receive from your CA under local certificates (here select
that you want to use this certificate for EAP authentication)
Delete the old certificate use for EAP once you are sure that EAP is working fine for
your clients with the new certificate.
Join both servers as primary/secondary unit under the distributed deployment section
for your secondary unit.
Regards,
Kanwal
Note: Please mark answers if they are helpful.

Hyperion planning installation(Problem with application server deployment)

Hi There:
I am new to hyperion planning.I am trying to install planning.I got problem with Hyperion Configuration utility while configuring application server deployment.Its show message failed.Please guide me how to fix this.If it is possible can you please send me any personal documentation on installation.I am trying this for past 4 day's.Below is the error its showing in configtool
     ... 10 more
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.ProductTaskSelectionPanel, INFO, Validating dependencies...
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.ProductTaskSelectionPanel$5, DEBUG, Product: Planning; Dependencies: []
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.ProductTaskSelectionPanel, DEBUG, task to execute: HspDBPropertyLocation
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.ProductTaskSelectionPanel, DEBUG, task to execute: applicationServerDeployment
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.PanelEventDispatcher, DEBUG, constructor
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.AppServerSelectionPanel, INFO, AppServerSelectionPanel in queryEnter
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.AppServerSelectionPanel, INFO, Server: WebLogic 8.1; deployment type = both
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.AppServerSelectionPanel, INFO, Server: WebSphere 5.1; deployment type = both
(Mar 09, 2008, 08:26:04 PM), com.hyperion.cis.config.wizard.AppServerSelectionPanel, INFO, Server: Tomcat 5.0.28; deployment type = both
(Mar 09, 2008, 08:26:08 PM), com.hyperion.cis.config.wizard.AppServerSelectionPanel, INFO, AppServerSelectionPanel in queryExit
(Mar 09, 2008, 08:26:08 PM), com.hyperion.cis.config.wizard.AppServerSelectionPanel, DEBUG, AppServer selected: WebLogic 8.1
(Mar 09, 2008, 08:26:08 PM), com.hyperion.cis.config.wizard.ProductCustomInputPanel, ERROR, Error:
java.lang.NullPointerException
     at com.hyperion.cis.config.wizard.ProductCustomInputPanel.queryEnter(ProductCustomInputPanel.java:88)
     at com.installshield.wizard.awt.AWTWizardUI.currentBeanChanged(Unknown Source)
     at com.installshield.wizard.swing.SwingWizardUI.currentBeanChanged(Unknown Source)
     at com.installshield.wizard.StandardWizardListener.currentBeanChanged(Unknown Source)
     at com.installshield.wizard.Wizard$RunThread.run(Unknown Source)
(Mar 09, 2008, 08:26:09 PM), com.hyperion.cis.config.AppServerDeployer, DEBUG, Starting WebLogic 8.1 deployment...
(Mar 09, 2008, 08:26:09 PM), com.hyperion.cis.config.AppServerDeployer, DEBUG, pre-Deploy: Planning
(Mar 09, 2008, 08:26:09 PM), com.hyperion.cis.config.AppServerDeployer, DEBUG, Deploy: Planning
(Mar 09, 2008, 08:26:09 PM), com.hyperion.cis.config.wizard.RunAllTasksWizardAction, ERROR, Error:
java.lang.NullPointerException
     at com.hyperion.cis.config.AppServerDeployer.initContexts(AppServerDeployer.java:628)
     at com.hyperion.cis.config.AppServerDeployer.deploy(AppServerDeployer.java:548)
     at com.hyperion.cis.config.AppServerDeployer.deploy(AppServerDeployer.java:526)
     at com.hyperion.cis.config.wizard.RunAllTasksWizardAction.executeDeployerTask(RunAllTasksWizardAction.java:251)
     at com.hyperion.cis.config.wizard.RunAllTasksWizardAction.execute(RunAllTasksWizardAction.java:156)
     at com.installshield.wizard.RunnableWizardBeanContext.run(Unknown Source)
(Mar 09, 2008, 08:26:13 PM), com.hyperion.cis.config.wizard.CustomSummaryPanel, DEBUG, CustomSummaryPanel in queryExit
Please help me.Email id:[email protected]
Thanks
Harsha.
Message was edited by:
user603943

I think the installation of planning on Vista is difficult. As some of the files doesn't support even i am tired of doing that.
But tell me one thing have you installed all other products , I mean Essbase, (server, client) , AAS and Shared services.
Are they working good .
I have formatted my system to XP and installed everything , but the problem is when i install planning it prompts me that IIS 5 should be greater other wise EPM will not install...
there are lot of things with planning 1) i can't datasource as it is not highlighting when we configure with Shared services
2) It does not create product instance .
If any one can fix this thing by giving me a suggestions.
Advance Thanks

ACS 5.4 with 4.x deployment

Similar Messages

Maybe you are looking for