ACS IP Pools

Hello, I have a question about the handling of the IP Address Pools on the ACS which can be used by dial in users. If I define an IP Address Pool and take one of these addresses and assign it permanently to a user (for dial in) in the ACS configuration, does the ACS recognize this and excludes this address from the address pool ?
Regards Stefan

Sorry, but no. ACS handling IP addresses is not that sophisticated.

Similar Messages

ACS, IP Pools and subnet.

I'm using ACS 3.2 to distribute IP address with pool.
Now I want to use a different subnet mask for my vpn's users.
How can define a sunbet with ACS?
Example.
Pool-A 172.31.31.1-172.31.31.254 subnet 255.255.255.0
Thanks.
Andrea

I believe that the netmask is not pushed to the client from the ACS server and there is actually a bug, CSCee45254
However there is a feature enhancement described in CSCeb83746 : Add the ability to assign a subnet mask to the address pool

Where does the ACS server get the DNS info for IP pools?

I am trying to change the DNS servers that my VPN users are assigned from the IP pools on the ACS server. Where does the IP pools get the DNS server information. I have changed the DNS Ips on the windows server and rebooted. But the VPN clients are still being assigned the old DNS servers.

ACS ip pools do not push DNS server information
It is either being forwarded from VPN concentrator group setup or
it is being send from ACS user/group setup > Radius(VPN 3000) attributes > [026/3076/005] Primary-DNS.
Hope this helps.
Regards
Rohit

Can ISE 1.2 Virtual Appliance assign VPN address pool like ACS does?

Dear friends,
I have observed that Cisco ISE Virtual Appliance (VMware) can act as a RADIUS server in the same manner as ACS does, but I cannot find the way of assigning an IP address to a remote VPN client (only assigning a VLAN).
At this point I don't know if it is strictly necessary to have the IP address assignment for the remote VPN clients done in the external firewall (i. e. Cisco ASA) in this case.
Is there any way of defining an IP address pool in the ISE itself for VPN clients authenticated against that ISE?
If the answer is not, which ones could be the options for that assignment other than the ASA pool assignment? Could it be possible defining the corresponding address pool in an internal DHCP server that could provide the IP address to the VPN client after successful authentication through ISE?
Any help would be really appreciated to clarifying these questions.
Thank you and best regards.

Please find the link below for the may help you to get the answer related to comparision and even for deployment.
http://pmbuwiki.cisco.com/Products/ISE/Technical/Design-Config/Guest_and_Web_Portal_Services

IP address Pool in ACS 5.1

Hi,
Does anyone knows if it is possible to configure IP Pools on ACS 5.1 so that we can assign those addresses to VPN users using the Policy Elements/Access Policies?
I managed to configure static addresses for single users, but not a pool of addresses to a group of them
Thanks

Hi,
Unfortunately, In ACS 5.1, IP pool feature is not supported, please refer to the release notes, under the section 'Features Not Supported':
Relaese Notes
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/release/notes/acs_51_rn.html#wp122068
HTH
JK
Plz rate helpful posts-

Assign ip pool per nas on ACS 3.2 with radius

Hello
is it possible to assign different ip pools defined on the ACS to different NAS? For eg. I like to assign the IP pool x to the NAS X and the IP pool y to the nas Y. So if a user logins in to X he gets the pool x and on Y the pool y.
thanks for any answers.
Andre

Its not possible to assign end users an ip address based on the NAS equipment that they currently are connected too.

CISCO ACS has stopped handing out IPs from IP Pool

I've setup ACS to assign a user an IP address from the IP Pool assigned to the group. Gave the pool a 10.1.16.150 - 10.1.16.250 range. 20 clients worked fine, and now it won't hand out any addresses. I rebooted the ACS and one of the clients that did not get an IP address now gets one, but now others don't.
Any ideas?

All addresses in an IP pool must be on the same Class C network, so the first three octets of the start and end addresses must be the same. For example, if the start address is 192.168.1.1, the end address must be between 192.168.1.2 and 192.168.1.254.
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user/sad.htm#wp36881

IP Pool with ACS 4.1

Hello,
Description:
- I have an ACSv4.1
- I have 2xNAS configured on ACS as RADIUS IETF
- I have definet IP Poll under System conf -> IP pool Server (start Address & End adress)
- On the Group setup I defined IP-assignement -> Assigned from AAA Server pool -> MyPool1
Problem:
The client get an IP address from the ip poll defined but doing ipconfig on the WINClient the subnet mask is randomly assigned (sometime 255.255.255.240 sometime 255.255.255.255.0)
The client get a DNS that is not specified in the IP Pool ! :-() ..
Quetions
Since in the IP Poll is only defined start address and end address (i.e:10.47.110.32-10.47.110.40)
Why client get random subnet mask, it should be 255.255.255.255 isn't ?
Why there is no definition for Gateway ? Which value gets ?
Clinets get also DNS, Where does this value get from ?
I wuold like also to have the possibility to assign IP from IP poll based on the NAs that relay the AAA request, is that possible ?

You may try the bug ID CSCse33323

VPDN - L2TP Tunneling with IP pool on ACS 4.2

Hi all,
We have below scenario :
Scenario 1 :
I have implemented L2TP tunneling with authentication using radius and ip address assignment using local pool on AAA client devices.
"2 client initiates L2tp tunneling using the same username , and both of the clients succesfully logged in and the router (AAA client) gave them 2 different ip address assignment."
Scenario 2
I have implemented L2TP tunneling with authentication using radius and ip address assignment using IP Pool on ACS 4.2.
"2 client initiates L2tp tunneling using the same username , and both of the clients succesfully logged in and the ACS gave them 2 same ip address assignment."
Question : Can we got the different ip address assignment with scenario 2 ? Please advice,,
Best Regards,
Rian

can we see your config please?

ACS replication and IP pools server

Hi, I have 2 ACS 3.3.2 with replication active and IP pools server function active.
I know that the IP pools definitions are not replicated but the group associations with pools are.
What's the best way to manage the IP pools on the 2 ACSs ?
60% of the pool on the first and 40% on the second ?
Or is there a way to infor the second ACS of the single IP assigned by the first ACS to avoid overlapping, in case of failure of the first ACS ?
Thank you in advance
greatings
Renato

IP pools are purposely not replicated automatically, no way around it. This is to avoid the situation where users authenticating to two different ACS servers get allocated the same IP address.
Basically there's nothing in ACS where the primary and backups talk to each other about what IP addresses they've allocated (this woul be huge task and require some new sort of communication mechanism between servers). If the same IP pool is configured on all 3 servers, they'll just blindly allocate the next available IP address to users, and you'll run into scenario's where two (or more) users get given the same address.
The pool is therefore purposely not replicated, which means you have to go in manually and configure it, making sure you configure a UNIQUE pool across the 3 servers. This only has to be done once and is then there forever.

ACS v5 IP pool feature

Hi friends ,
i have problem with Acs v5 that it dosen't support IP pool feature . , i was using ACs v4 which was assigning IP's to VPN users - now i need to upgrade to v5 ?
can you please help to solve this ?

You may try the bug ID CSCse33323

IP Pool assigned by the ACS

Hi,
We are implementing the VPN 3015 Concentrator and using ACS to assign IPs to the VPN clients. Want to use 10.200.200.0/24 subnet as a pool, but I can not find the way to assign the right mask. I guess, the ACS detects that this is a class A network and assigns 255.0.0.0 mask to the clients. Is there any way to hardcode it to 255.255.255.0?
Thank you,
Evgueni

It is recommended to reconfigure the settings in the VPN concentrator and the ip pools on the ACS:
On the VPN Concentrator, choose Configuration > System > Address Management > Assignment > Use Address from Authentication Server > Apply in order to choose the authentication server option for IP address assignment.
On the Cisco VPN 3000 Concentrator, choose Configuration > System > Servers > Accounting Servers.
Add the details for the ACS in order to specify the ACS as an Accounting Server. This allows the ACS to see what IP addresses are in use and assign free IP addresses.
In the ACS, go into either the User Setup or the Group Setup in order to provide the IP address.
Choose VPN Client IP Address Assignment.
Choose Assigned from AAA server pool. An IP address pool on the Authentication Authorization Accounting (AAA) server assigns the IP address.

WLC 4402 + ACS 5.4 + AD: is it possible to use separate ip dhcp pools according to AD user group?

Hello, we are using WLC with ACS and it is working well.
We have AD group WiFi_access, and all users from these group are able to athunticate during connecting to corporate wifi network.
How we could make, for example, two AD groups: WiFi_access and WiFi_VIP and users from first group get 10.7.0.0/24 adressess and 10.8.0.0/24 from the second? or it could be 10.7.0.0-100 and 10.7.0.100-200 it doesn't matter.
the main goal is: different AD groups of users must have different privileges and these is controling via ACL on their default gateway switch.

You can use "aaa-override" feature to do that. In that case once user get connected & if he is belong to "WIFI_VIP" group ACS can override the user vlan to a different one (10.8.0.0/24) what they initially associate to.
You can get an idea about the concept from the below post
http://mrncciew.com/2013/05/21/aaa-override-in-acs5-2/
HTH
Rasika
*** Pls rate all useful responses ***

ACS 5.3 Radius authentication with ASA and DACL

Hi,
I am trying to do Radius authentication on the ACS 5.3 for VPN access (cisco client) using a downloadable ACL with AD identity
Clients are connecting to an ASA 5510 with image asa843-K8.bin
I followed the configuration example on the Cisco site, but I am having some problems
First : AD identity is not triggered, I put a profile :
Status
Name
Conditions
Results
Hit Count
NDG:Location
Time And Date
AD1:memberOf
Authorization Profiles
1
TestVPNDACL
-ANY-
-ANY-
equals Network Admin
TEST DACL
0
But if I am getting no hits on it, Default Access is being used (Permit Access)
So I tried putting the DACL in the default profile, but when connecting I am immediately disconnected.
I can see the DACL/ASA being authenticated in the ACS log but no success
I am using my user which is member of the Network Admin Group.
Am I missing something?
Any help greatly appreciated!
Wim

Hello Stephen,
As per the IP Pools feature, the ACS 5.x does not include such functionality. It is not on the ACS 5.x roadmap either as the recommended scenario would be to use a dedicated DHCP server.
ACS 4.x included that functionality, however, it was not the best solution as the ACS returned the IP Address value as a RADIUS Attribute instead of acting as a real DCHP server.
As per the IMEI and MISDN I am assuming you are referring to International Mobile Equipment Identity and Mobile Subscriber ISDN. Correct me if I am wrong.
In that case it seems that the ACS 5.x should be able to Allow or Deny access based on Radius Attribute 30 (Called-Station-Id) and 31 (Calling-Station-Id).
In that case you might want to use the End-Station Filters feature and use it as the condition for the Rule. The End-Station Filter feature uses CLI/DNIS where CLI is Radius Attribute 31 and DNIS is Attribute 30.
I am assuming a Generic Username will be embedded on the devices request. In that case you will define which end-user devices will be granted access based on the above attributes.
Here is a snapshot of the section:

ACS and same username for multiple users (max sessions)

Hello,
I have created four user groups and four users. Each user is in its own user group and each usergroup have its own ip pool. The problem is that multiple sessions is not always (works random) possible even if the max session is set for group to unlimited and users use group settings. does anyone have any idea what might cause the problem?
thanks for your answers,
Lasse

Hi,
Here is some more information about problem. Connection fails even if the authentication is passed. I use ACS (3.3) for authenticating users from mobile network.
Lasse

ACS IP Pools

Similar Messages

Maybe you are looking for