ACS handing out duplicate addresses

folks
we have an acs server which manages a number of dsl terminations
three of the vpns are having trouble logging on and the when looking at the acs box for the problem vpns it seems to be handing out duplicate IPs and those handed out are only from the higher end of a 24bit mask, i.e. 172.17.10.250 - 254
has anyone seen this before?
thanks to anyone taking the time to reply

Hi,
We must configure the accounting for the users who are fetching IP address from the ACS server, otherwise ACS would never know when that user logged in or logged out and according to that IP address would be freed or assigned to the user.
HTH
Parminder

Similar Messages

Lion Server not handing out DHCP addresses to Snow Leopard client

I have been pulling my hair out over this.
Here is the layout
Lion Server running on the newest Mac Mini and doing mail, DNS, DHCP, Software update and has a valid, not self assigned, certificate
3 clients running Lion Desktop (2 iMACs and a MBP pro (all no more that a year old and all woth the current updates)
1 client running Snow Leopard Desktop (last years 13 inch MBA)
The 3 Lion clients can get dhcp fro mthe Lion server without any issue
The SL client cannot get a DHCP address from the Lion server
A tcpdump shows the DHCP request coming from the MAC address of the SL client but no response from the Lion Server and nothing showing a deny in the logs for the DHCP server or any other system/kernel logs. The Lion clients all show the request and reply for them. All 4 clients currently have a static assignment in DHCP but even if I remove them all and do auto-assign for everything or even each one individually, the SL client will not get an address both on the Wifi and Ethernet (I have the USB ethernet adapter).
I also have an Aiport Extreme and if I use that for the DHCP server then all clients get the addresses. I know the DHCP server in the extreme cannot be shut down but if you give the extreme a static address then assign dhcp on the extreme to only give out one address and that is the same one that is statically assigned then it "thinks" it is out of addresses and no longer tries to assign addresses
At first I thought there was a conflict between the extreme and the Lion server but as I mentioned above, tcpdump clearly shows the requests going right to the Lion server
I'm usually pretty good at this kind of thing but this one has me stumped. I'm thinking bug, anyone else run into this yet?

Ryan jones,
> Having trouble with our dhcp server handing out IP addresses through the
> Wireless Lan Controller.
Has it ever worked? Is the Wireless controller configured to forward DHCP
requests to your DHCP server?
Anders Gustafsson (NKP)
The Aaland Islands (N60 E20)
Have an idea for a product enhancement? Please visit:
http://www.novell.com/rms

New 2008 R2 DHCP server will not hand out IP addresses

We've recently migrated our Domain Controllers to 2008 R2, Virtual Machines. (DC3 & DC4).
DC2 is an older 2003 box, 32 bit, set for retirement. All former roles have been moved to DC3 & DC4, including FMSO roles, and the server (DC2) has been demoted. The only service that remains on DC2 is DHCP.
I've used NETSH to export / import the DHCP info to DC4. All reservations have transferred ( Printers) and the scope shows "active" on DC4 and authorized, and running, but whenever I shut DHCP down on DC2, DC4 doesn't start handing out
IP addresses to clients.
Even after rebooting a client multiple times, running ipconfig /release & /renew, it never finds the new DHCP server, nor does the server show any client information in the address leases. (other than reserves)
We have a Cisco ASDM deployed, but DHCP and DNS are both disabled on this device, so I'm not sure IP Helper would be an issue here.
Since both my new DC's are 2008R2, do I need to elevate active directory up to 2008 function before DHCP will work?

Hi,
Is the issue resolved? As suggested by
Wyatt Miller, you can check if it was caused by IP helper.
In addition, is the new server authorized?
Here is a migration guide for you:
Migration of DHCP Server from Windows Server 2003 to Windows Server 2008
http://blogs.technet.com/b/teamdhcp/archive/2009/02/18/migration-of-dhcp-server-from-windows-server-2003-to-windows-server-2008.aspx
Hope this helps.

AX does not hand out ip addresses in roaming mode

I am trying to set up roaming network in my house using a Airport Extreme as the main router and a ethernet connected (via Powerline HD) Airport Express on the second floor of my house. I followed the usual instructions to set up the Airport Express to create wireless network in bridge mode. The Express allows clients to connect and accepts the password but does not hand out ip addresses. so the roaming device (an ipad and an Air) end up with self-assigned addresses in the 169.*.*.* range.
How do I correct this?
option click on the Air wifi symbol shows that its corrected to the correct wifi base station
Airport Utility sees both the main Extreme base station and the Express second floor base station, and neither reports any problems.
Thanks.

I am trying to set up roaming network in my house using a Airport Extreme as the main router and a ethernet connected (via Powerline HD) Airport Express on the second floor of my house. I followed the usual instructions to set up the Airport Express to create wireless network in bridge mode. The Express allows clients to connect and accepts the password but does not hand out ip addresses.
Actually, with the AirPort Express in bridge mode, the AirPort Extreme would be the router "handing out" the IP addresses as they would just be "passing through" the Express in this configuration.
Let's double-check your roaming network configuration, just to be sure nothing was missed.
Roaming Network Setup
Ref: See page 42 of the Apple AirPort Networks guide.
Setup the AirPort connected to the Internet to "Share a public IP address." Internet > Internet Connection > Connection Sharing: Share a public IP address
Setup the remaining AirPorts, as bridges. Internet > Internet Connection > Connection Sharing: Off (Bridge Mode) For each AEBSn in the roaming network:
For each base station:
Connect to the same subnet of the Ethernet network.
Provide a unique Base Station Name.
The Network Name (SSID) should be identical.
If using security, use the same security type (WEP, WPA, etc.) and password. Note: It is highly recommended that you use WPA2 Personal for best bandwidth performance.
Make sure that the channel is set at least three channels apart from the next base station to prevent Wi-Fi interference.

New Subnet not handing out IP Addresses

I have created a new subnet (10.168.64.x) on a Netware 6.5 server using DNS/DHCP Admin Tool.
The old subnet (10.168.60.x) is running out of IP addresses but still functioning properly. The new subnet (10.168.64.0) is showing in DNS/DHCP but not handing out addresses.
I have done all of the following-
-Bound an IP address to the Server in the range of the new subnet (10.168.64.1)
-Unloaded and Loaded DHCPSRVR
Still no luck - What are some other steps I can take to get this new Subnet to hand out IP's?
I loaded DHCPSRVR -d2 and got the following message - https://docs.google.com/document/d/1...it?usp=sharing
Any help is appreciated!

If you don't get any replies here, try the DNS/DHCP specialist forum
https://forums.novell.com/novell-pro...dent/dns-dhcp/

Time capsule takes forever to hand out IP address

I have a time capsule and I have an airport express. The time capsule is downstairs and the the airport extreme is upstairs.
I have them both named the same thing. I don't know if that's right.
Here's the setup.
On the main page of the Airport Utility
FROOTY - time capsule Firmware = 7.6.4
Internet page - DHCP and 2 DNS servers listed
Wireless page
mode = create a wireless network
Network name = Frooty
Security = WPA2 Personal
Wireless Options
5ghz network name = FROOTY 5GHz
Radio mode = 802.11a/n - 802.11b/b/n (Automatic)
2.4GHz Channel = automatic
5GHz Channel = automatic
Network = Off (Bridge Mode)
no DHCP Reservations
no Port settings
Enable Access Control = unchecked
FROOTYU - airport express (U = upstairs) Firmware = 7.6.4
Base Station name = FROOTYU
Internet page - DHCP and 2 DNS servers listed
Wireless Options
Network Mode = extend a wireless network
Wireless name = FROOTY
Security = WPA2 Personal
Wireless options = FROOTY 5GHz
Network tab everything greyed out
Enable access control unchecked.
My setup is as follows
The airport express is recently configured, but I think this was happening before I hooked it up upstairs.
I have a Nvidia Shield and the wireless *****. You have to be like 10' from the WIFI device so I put the airport express
upstairs so when I'm up there I don't have issues with the Shield Tablet.
My Modem is a Charter cable modem, downstairs, wireless off. Plugged into a switch. Plugged into the switch as well
is all the CAT5 jacks I'm using around the house. The Airport Express and the Time capsule are both plugged into CAT5 jacks. I don't know if the airport express needs to be plugged into a CAT5 jack as well? That part I don't get.
Anyhow, any new device that is connected to the network, it takes about 1- 1.5 minutes to get an ip address. This is becoming increasingly annoying, to the point where I'm considering getting rid of the apple wifi devices.
Any help is appreciated.

This is what I did, posted below, but devices like my PS3 and my wifes Nook still take forever getting an IP it seems.
Temporarily, move the AirPort Extreme to the same room or general area of the Time Capsule, power it up, and wait a full minute.
Then, hold in the reset button on the back of the AirPort Extreme for 9-10 seconds, then release. Allow a full minute for the AirPort Extreme to restart to a slow, blinking amber light.
Close AirPort Utility if it is open.
Click the fan shaped AirPort icon at the top of your Mac's screen. Wait a few seconds for the listing of New AirPort Base Station to appear.
Click on AirPort Extreme just below that and AirPort Utility will open automatically open and analyze your network settings. In the example above, this is shown as an AirPort Express. In another minute, you will see that it will configure the AirPort Extreme to "Extend" the network.
Enter a device name that you want to use and click Next
Wait another minute for AirPort Utility to configure the AirPort Extreme. When you see the message of Setup Complete, click Done.
Move the AirPort Extreme to a location that is approximtely half the distance from the Time Capsule to the area that needs more wireless coverage and power it up.
You are all set.

WRE54g not handing out IP address to client systems

This is probably a silly question, but I'll ask it anyways.
We have a Linksys WRT54G ver6 running latest firmware revision 1.02.0 along with a WRE54G ver3 running firmware 3.01.01.
Both devices are configured to use WPA-PSK security, and I have reconfirmed that the key is the same on both devices.
The wireless router is connected to our existing wired network, and so the DHCP functionality of the router is disabled as we want wireless clients to get their IP address from our existing DHCP server on the wired network. This part works fine, wireless systems can connect to the wireless router and they are given an IP address from the range configured on our wired DHCP server.
The range expander has been configured with the same SSID, and security settings as the wireless router. Wireless clients can see the SSID being broadcast by the range expander and they are able to connect to it, but they are not given an IP address.
Is this because the range expander is expecting to receive the IP's from the DHCP server on the wireless router ( which is disabled ) and does not know anything about our existing wired DHCP server?
Thanks.

ok I knew this was going to be something silly.
I tried disabling the wireless security on both devices and this allowed wireless clients to receive an IP address from the Range expander ( verified by the MAC address of the Access point the wireless clients were connected to ).
So I rechecked the security settings again, the key was fine but the issue turned out to be that the wireless router was configured to use WPA2 while the range expander only seems to have support for WPA. Once I enabled WPA on the wireless router, the wireless clients were able to connect and receive their IP address via the Range expander.

CISCO ACS has stopped handing out IPs from IP Pool

I've setup ACS to assign a user an IP address from the IP Pool assigned to the group. Gave the pool a 10.1.16.150 - 10.1.16.250 range. 20 clients worked fine, and now it won't hand out any addresses. I rebooted the ACS and one of the clients that did not get an IP address now gets one, but now others don't.
Any ideas?

All addresses in an IP pool must be on the same Class C network, so the first three octets of the start and end addresses must be the same. For example, if the start address is 192.168.1.1, the end address must be between 192.168.1.2 and 192.168.1.254.
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user/sad.htm#wp36881

Why is my blackberry sending out duplicate emails?

My blackberry is sending out duplicate emails - one for each of my email addresses, regardless of the originating email address. How can I stop this?

You may have diagnostics and usage set to automatically send this may periodically use some data.
" Tapping Settings > General > About > Diagnostics & Usage will allow you to choose between Automatically Send and Don't Send. "
Sources: http://support.apple.com/kb/HT4305

%IP-4-DUPADDR: Duplicate address

Hi, I've been getting the follwoing message on my c2600 (version 13.3) router since last december (according to the log file).
005179: .Dec 28 04:35:08.652 AUS: %IP-4-DUPADDR: Duplicate address xxx.xxx.xxx.xx on
FastEthernet0/0, sourced by 0015.f987.941a
The symptom of the problem is that occassionally the network looses connactivity.
The mac addresses are both for Cisco devices. One is the router and i'm not sure what the other is possibly a firewall.
The Cisco site says that we can change the mac address of one of the offending items ?
Which would be the best one to change?
How can i find out what the other device is?
What if any issue arise with changing the mac address ?
Proably other questions that i should be asking as well, but i'll get to those later.
thanks in advance for any reponses.

changing the mac-address will not help.
You have to change the ip address.
You first have to find out what/where is the other device.
For that you can follow the L2 path.
Go the switch to which the router is connected on fast0/0. If you don't know the switch, try 'sho cdp nei'.
Once on the switch, check the mac-address with the command 'show mac-address address x.x.x'. It should give the port.
Check what device is attached to this port.
If another switch, repeat the operation above until you find the end device.
Gilles.

Server 2008 DHCP is handing out the wrong DNS server.

We have two new 2008 DC that handles, DNS, DHCP and WINS. Our DHCP scopes have been migrated to these servers. We are seeing some random issues where clients are using the new dhcp server but the old dns server information is listed for the some systems. We discover this by using network monitor on the old DC, DNS, DHCP server. Once the client performs a ipconfig /renew, the problem is corrected. Any ideas?

Hi BrianAuH20,
Thank you for posting here.
Based on your description, I understand that your Windows 2008 DHCP server hands out the wrong DNS server address.
To troubleshoot this issue, please perform the follow steps to see whether the clients retrieve the right DNS server address.
1.     Temporarily make the old DC, DNS, DHCP server offline.
2.     Check the new 2008 DHCP server setting.
                      i.        In the DHCP console tree, under Scope [172.16.0.0] SS Scope, right-click Scope Options, and then click Configure Options.
                     ii.        On the Advanced tab, verify that Default User Class is selected next to User class.
                    iii.        Select the 006 DNS Servers check box, in IP Address, under Data entry, type DNS Server IP address, and then click Add.
                    iv.        Select the 015 DNS Domain Name check box, in String value, under Data entry, type your domain's FQDN name, and then click OK.
3.     Restart the DHCP service.
For more information, you may refer to:
http://technet.microsoft.com/en-us/library/ee404786(WS.10).aspx
Hope this helps.
Sincerely,
Wilson Jia
This posting is provided "AS IS" with no warranties, and confers no rights.

Duplicate address recieved

Hello,
We had an incident recently where a router expectantly reloaded - while it restarted the logs on all adjacent routers received the following message in their log:
%TAGCON-3-DUP_ADDR_RCVD: Duplicate Address 10.1.1.254 advertised by peer 192.168.63.252:0 is already bound to 192.168.60.251:0
I understand why this error occurred - it's because I have the same loopback IP addresses on multiple routers and the reason for this is we have DSL customers who have BGP sessions with us and can authenticate to any of 6 routers. The loopback IP is the IP address that their BGP session is set to peer with, and since they could 'land' on any one of six routers I need to have that same loopback on all six routers.
Is there a better way to implement what I have and still achieve the same goal or filter out the prefixes that LDP advertises? - I know there is a command like the below, but this doesn't appear to do the filtering.
mpls ldp advertise-labels for 10 (where 10 is an access list)
Another issue is that while the router was rebooting, it caused a significant interruption to other routers on the network. I know I haven't supplied much detail about this as there isn't much to supply, however, it seems to relate to the error message I received above - or perhaps it's a result of the mpls network under significant load while learning the prefixes from the router that just reloaded. Would MPLS Graceful restart assist here?
Many thanks,
Jonathan.

Hi Renan,
I don't think the crashed was caused by the dup addr - in fact I'd be very surprised if did.
The problem came when the router was restarting - that's when I saw the dup addr in the router's log and the rest of the network paused while this was going on.
Thanks,
Jonathan

Duplicate address x.x.x.x on Port-channel10.101, sourced by 0080.7733.b2f

HI,
I am getting the following log message on my L3 device and the L3 switch hangs. I have restricted telnet session on the L3 device. What is causing this ?
32w1d: %AUTOSTATE-6-SHUT_DOWN: Putting interface Port-channel10.131 into Autostate mode
32w1d: %SYS-5-CONFIG_I: Configured from console by vty0 (127.0.0.2)
32w1d: %AUTOSTATE-6-BRING_UP: Taking interface Port-channel10.131 out of Autostate mode
32w1d: %AUTOSTATE-6-SHUT_DOWN: Putting interface Port-channel10.131 into Autostate mode
32w1d: %AUTOSTATE-6-BRING_UP: Taking interface Port-channel10.131 out of Autostate mode
39w3d: %IP-4-DUPADDR: Duplicate address x.x.85.254 on Port-channel10.101, sourced by 0080.7733.b2f9
48w2d: %STANDBY-3-DUPADDR: Duplicate address x.x.83.251 on Port-channel10.102, sourced by 0000.0c07.ac66
I tried to track these two mac addresses 0080.7733.b2f9 and 0000.0c07.ac66
These mac addresses belong to IP phones which are connected to a L2 device which in turn cascaded to the L3 switch.
Whats the meaning of "Duplicate address x.x.85.254 on Port-channel10.101, sourced by 0080.7733.b2f9 "
x.x.85.254 is the L3 IP(Virtual L3 interface) on the L3 switch.
Is the IP phones MAC address conflicting with the mac address of the L3 switch?
How can I find the L3 switch's system mac addresses.
Appreciate some detailed explanation.

Hi,
Just an idea : look at the STP instance of the concerned VLAN (Virtual L3 interface). it can be caused by a loop.
symptoms ("show proc cpu hist" and "sh spann vlan x detail") and try to look at "Number of topology changes ".
it was just an idea, hope it helps

How to find out the address of a servlet without a Request

Hi all,
in a servlet, I need to find out its address before the first client request (the best would be in the init method).
So I have no access to a HttpServletRequest object that normally offers this information.
Is this possible?
Thanks,
RayBen

If you need to know the host name, then something says me that your code is already not portable :)
No, it is not possible. Not without nasty stuff or lookups. Why do you need to know about it then? It sounds like if you want to set some host-specific settings. You can better use the init-param in web.xml or configuration files for this than hardwiring it in Java source code.

How to get rid of duplicate addresses all over the place?

Duplicate addresses appears all over the places: on my mac (in the mail program) and in my ios devices.
I suspect that it occurs during some synchronisation activities but how to get rid of this once and for all?
Thanks for your help. It helps also if some tell me that I am not alone in that kind of trouble

iCloud- Resolving duplicate Contacts after setting up iCloud Contacts

ACS handing out duplicate addresses

Similar Messages

Maybe you are looking for