ACS RDBMS Synchronization
I have been reviewing the ACS 4.0 documentation and want to know if there are any options available for synchronizing the DB using ODBC on the Solution Engine. Looking for something other than FTP, if available.
Like Jeff said - not supported.
The reason is because ODBC can require a 3rd party driver and the appliance is "hard".
Although common ones could be loaded, there tends to be regular security vulnerabilities (esp in jet) that would require constant patching/updating.
Of course you can still manage DBSync in your own DB, you just need to export to csv to get it actioned.
Similar Messages
-
RDBMS Synchronization problem in ACS Appliance 3.3
Hi,
I was adding multiple AAA Clients on ACS Appliance using RDBMS Synchronization option I followed the complete steps but failed to synchronize accountActions.csv file on ACS my ftp server is working fine and returned the logs saying "accountActions.csv file read recieved file successfully size 0 bytes 0.00 kbps" and RDBMS synchronization logs ACS reported as "No import CSV file on ftp server - nothing to process" I have attached related screen shots. Any help on this issue will be highly appreciated.
Thanks in advance
Best Regards,
AhmedThe format of the accountsaction.csv file is incorrect as a result of which the RDBMS Synchronization is not executed correctly.
I have attached a sample accountsAction.csv file for you.
(i) The AAA Client C7609-X with the ip address 10.10.10.10 has been added with the shared secret key as mikey and is is registered with TACACS+
(ii) The NDG michasisX has been added.
(iii) The device C7609-X has been added to the NDG michasisX
Place the file in the FTP and try performing an RDBMS synchronization. Restart the ACS services.
Then you can add the devices as per the sample file attached.
Also check if the file name is exactly the same in the RDBMS Synchronization page in the ACS
Hope this helps,
Soumya -
I use Cisco ACS 3.3 version. When i want to configure RDBMS Synchronization i can't see the table "FTP Setup Options". I needed this table to configure FTP with the purpose of adding some user options.
Somebody knows the solution for this problem ?Although not strictly supported you can make the software image run like the appliance
csutil -setPlatform appliance
This will then enable the appliance features -
The user guide for ACS for Windows ver4.0 states that Cisco ACS can use RDBMS to synchronize its database with a third party RDBMS system and only one primary ACS server needs to interact with the third party system and the other ACSs in the network can be updated by this primary ACS using RDBMS synchronization.
However, like many other features that suppose to work (e.g. domain stripping for MS AD) this too does not seem to work and there is no detailed documentation on how it actually does it.
The procedure stated in user guide fails and there are gaps in the documentation.
Can someone refer to any documentation other than the User Guide for instructions/details of this functionality?
Thanks in advance.I think the easiest solution is to have a single ACS that is populated via RDBMS Sync. This ACS becomes the replication "master" that then pushes its config down to a set of "slaves".
That is the easiest method but replication is a destructive write onto the slave - so you may choose not to do this.
An alternative is to use the Sync Partners config (part of RDBMS Sync) which attemtps to process actions in the sync table on multiple ACSs. For this to work you need the "other" ACSs to have the RDBMS Sync'ing ACS server in their network config db.
You need to make sure that ACS can write to the transaction table too (note CSV datasources no good) in case one of the other ACSs is down.
If you're having problems check the rdbms sync CSV & service log on the "master" ACS and the csauth service log on the "slave" for errors. -
RDBMS Synchronization with a .CSV file
Good morning. I am trying to create a testable .csv file that I can import into our ACS on a prescheduled basis.
Here are my questions about this process:
1. Do I need to use the PASS_Expire action or is there a STOP_DATE? I have looked at the codes and didn't really see one.
2. Is there a way that I can extract a copy of the dump.txt or get my actual database exported to a different system?
3. What are the group's recommendations on synchronization? Are there some lesson's learned I should look out for?
Thanks
Dwanecan you help me add vendor UDV and attributs to ACS.
I tried it it showing me UDV, but getting a error RDBMS report for one attribut.
when v3 is integer
Error: ACS 'ACS_A1' Action failed [SI=6 A=352 UN="" GN="" AI="" VN="Login-Service" V1="2011" V2="10" V3="integer"] Reason: UDV VSA error - User Defined Vendor/VSA operation failed (VSA name not unique)
when v3 is string
Error: ACS 'rdevid-4eafe3cf' Action failed [SI=6 A=352 UN="" GN="" AI="" VN="Login-Service" V1="2011" V2="7" V3="string"] Reason: UDV VSA error - User Defined Vendor/VSA operation failed (VSA name not unique)
actually i am doing it for H3c.dct it is for 3com.
Below is the file which i used.
SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,350,3COM-H3C,AUTO_ASSIGN_SLOT,2011,,,,,,0
2,0,,,352,h3c-User-Access-Level,2011,26,integer,,,,,0
3,0,,,352,Administrator,2011,3,string,,,,,0
4,0,,,352,Manager-(write),2011,2,string,,,,,0
5,0,,,352,Monitor-(read),2011,1,string,,,,,0
6,0,,,352,Login-Service,2011,5,string,,,,,0
7,0,,,352,SSH,2011,50,string,,,,,0
8,0,,,352,Terminal,2011,52,string,,,,,0
9,0,,,353,,2011,221,IN OUT,,,,,0
10,0,,,355,,,,,,,,,0
Also please let me know how can delete the UDV if i want to. i tried procedure mentioned in user guide but failed. -
RDBMS Synchronization Import Definitions
Hi,
we want to automatically sychronize our ACS server with an external database including user, groups, network devices and command authorization sets.
As read in the RDBMS sychronization import definitions there is no possibility to import "command authorization sets".
Is this correct or does anybody knows if there is a way to do this with ".csv-files"?
thanks for your answers.
Torsten WaibelIf the guide has the actions to import command authorization sets then it is possible otherwise then not possible:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/A_RDBMS.html -
Cisco secure ACS - RDBMS Rename a Group-
Hi,
I'm currently working with Cisco secure ACS 3.1 and I'm trying to use RDBMS synchronisation with a csv file. I create a accountactions.csv file where I create a new user.
1,0,TESTuser,,100,,,,,,0,,,0
2,0,TESTuser,,102,,test,,,,0,,,0
Until here, all is working fine. But now, I would like to put this user into a Group. This should be done with :
3,0,TESTuser,Group 30,106,,,,,,0,,,0
But I would like to know if it's possible to rename or create one Group (e.g rename Group 30 with Group TEST) directly in my csv file ?
Thank you
Regards
Pascal TOURNIERHere is what i found works for renaming a default group, as you cannot create more groups beyond what is there.
SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,1,,Group 100,210,,BPM,,,,0,,,0
2,2,,Group 101,210,,CHANNEL SECURE OPS,,,,0,,,0
3,3,,Group 102,210,,CISCO CNC,,,,0,,,0
4,4,,Group 103,210,,CISCO NOS,,,,0,,,0
5,5,,Group 104,210,,CTS,,,,0,,,0
6,6,,Group 105,210,,DCI,,,,0,,,0
line 1
Rename "Group 100" to named group "BPM" using code 210 to perform the Action
Gerald -
ACS RDBMS adding NDG with Shared Secret
I have an ACS 4.2 on a SE 1113 and I am using RDBMS to add Network Device Groups. I am able to create the group, but I would like to set the Shared Secret for the group. I am using the action code 250 to add the group but I can not see a way to set the Secret. I can modify the Secret after creating the group using the GUI but it would be better to do it all with RDBMS. Are there any other action codes that can be used on NDGs?
Thank you.Per NDG shared secrets came after NDG addition via dbsync. It looks like this has not been retro-fitted to dbsync.
This is quite typical as dbsync is the poor unloved child of ACS. -
Hello guys,
actually I was happy founding the RDBMS function in AAA to get my hundred of aaa clients into the database, but now I am stuck with the a problem.
I would like to summarize some aaa devices in one AAA entry, which means it will have several ip adresses inside.
According to the RDBMS function I can only add 1 ip adress per csv-line. Is there no work around to push more in the aaa entry without adding them manually?
If I try by using several csv-lines with the same name, but different ips, I just get an error.
Thanks for your help!You can not use several IP in one AAA client entry. But you have the following options,
1. You can define a NDG "network device group" and put the same type of AAA client into the group.
Or.
2. You can use "Wildcard asterisk" or IP range to include multiple IP address with one AAA client, like 10.1.1.* or 10.1.1.1-10.1.1.100. -
Deleting or Renaming the AccountAction.csv in RDBMS synchronization
Good morning all,
I am trying to finalize a process using the RBDMS Sync on Cisco ACS 4.1 SE. The process will get my AccountActions.csv file, but does not seem to want to rename it. I have the synch occuring every morning at 0300. I guess one question would be, if the file does not change, what will occur? I get an error like this;
Could not delete CSV file on FTP Server - may process same actions again. (The file may be in use).
I have set up the FTP server to allow deletion and renaming from this login.
Any help or direction would be appreciated.
Thanks
DwaneI would schedule something to rename the account actions csv on the ftp server.. have it run at 04:00
That way you know it done. Otherwise ACS will simply process all the same actions again.
This is because RRBMS sync was designed to work with proper databases. There is a field to indicate a row has been processed, but csv files are read only thanks to the retarded Microsoft csv driver. -
I'm trying to create an import script for RDBMS to import users, but cannot figure out how to set the "PASS_TYPE_RADIUS_TOKEN" to something other than the default of "RADIUS Token Server". We have multiple RADIUS Token Server definitions.
I can create a user with what I need, except external db password is set to "RADIUS Token Server". How do I set it to (for example) something like "RADIUS Token Server - xxxx"
We have more than 1 RADIUS Token Server definition called "RADIUS Token Server - xxxx", "RADIUS Token Server - yyyy".
Thanks!As per my knowledge you have to update 4.2 ACS to
5.1, because when you go for RDBMS synchronization it wont allow you, I have faced problem in past while primary ACS was 4.1 and secondary I have 4.2, I have updated primary ACS to 4.2 and everything is working fine. -
We are unable to manage our ACS
Accidentally the power to the ACS server was switched off and then on again. But after the power on though the device came up successfully; we are not able to manage it.
We are unable to manage our ACS. We have a configuration back-up.
1) by HTTPS. The cert can not be added manually on the browser in any way. Looks like an application error. Tried several different browsers.
ACS details:
CSACSE-1113-K9 Cisco secure ACS 4.x solution engine 1113 Appliance CSACSE-1113-K9v01
when i try https:abc001:2002/
I get he following pop up error message:
Secure connection failed.
an error occurred during connection to abc001:2002. certificate type not approved for application.(Error code:sec_error_inadequate_cert_type)
.the page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
.please contact the web site owners to inform this problem. Alternatively, use the command found in the help menu to report this broken site.
2) by SSH. xxxxx is the administrator account.
We can login but there are no commands available
abc001>help
command Description
? List commands
exit Log off
help List commands
csdbsync -syncnow RDBMS synchronization
abc001>?
command Description
? List commands
exit Log off
help List commands
csdbsync -syncnow RDBMS synchronization
2)Tried with a serial cable, but we only get some rubbish on the screen. We tried different serial cables. These cables work on other appliances (WLC controller and Cisco switches) but not on the ACSHi,
The issue which you are facing comes when you the certificate installed on the ACS is either not correct or has gone corrupt. You would not be able to install a fresh certificate on the ACS Appliance through console or SSH.
You can open a TAC case and send a backup of the ACS database, they might be able to correct the database. Otherwise the only other option is to reimage the ACS Appliance.
To access an ACS Appliance from the console, you can go to http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/solution_engine/instalap.html#wp1065399
To administer the ACS Appliance, take a backup etc., you can go to http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/solution_engine/admap.html
Regards,
Kush -
Adding RADIUS VSAs on ACS 3.2 SE
I have tried to add a VSA to enable a Packeteer to authenticate using RADIUS on the ACS.
Using RDBMS synchronization to import the csv file below.
SequenceId,Priority,GroupName,Action,ValueName ,Value1,Value2,Value3
1,1,External,163,26,access=look,2334,1
The group name is 'External', Action is 163 which corresponds to ADD_RADIUS_ATTR.
From RDBMS Sychronization Import Definitions (http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user/ag.htm#wp35130)
To add a vendor-specific attribute (VSA), set VN = "26" and use V2 and V3 as follows:
V2 = IETF vendor ID (which in this case is 2334)
V3 = VSA attribute ID (1)
V1 = In this case 'access=look'
After a couple of attempts I got the format correct but when I try and import the file I don't get an "INFO" message in the "Reports" section of the ACS indicating that the process was successful. I don't get any message at all, WARNING, ERROR or INFO.
From the FTP server I can confirm that the file was transferred.
What I should get is an INFO message similar to:
08/30/2004 16:27:50 INFO Sync complete: 1 transaction(s) 0 parse error(s) 0 process error(s)
Any ideas as to what is wrong would be much appreciated.
Cheers,
Aylmer.HI you need to import the RADIUS VSA for PAcketeer from their site.
The link to the steps as shown below is ( might require u to subscribe & login)
https://packeteer.custhelp.com/cgi-bin/packeteer.cfg/php/enduser/std_adp.php?p_faqid=399&p_created=1046793530&p_sid=gszcDFBh&p_lva=&p_sp=cF9zcmNoPTEmcF9zb3J0X2J5PWRmbHQmcF9ncmlkc29ydD0mcF9yb3dfY250PTImcF9wcm9kcz0wJnBfY2F0cz0wJnBfcHY9JnBfY3Y9JnBfc2VhcmNoX3R5cGU9YW5zd2Vycy5zZWFyY2hfZm5sJnBfcGFnZT0xJnBfc2VhcmNoX3RleHQ9YWNz&p_li=&p_topview=1
IN any case the same content is copied below:-
Also the stpes on how to do them is listed here
Create a User Defined Vendor
First, you need to create a User Defined Vendor.
1. Create a text file (packet.ini) and enter the following:
[User Defined Vendor]
Name=Packeteer
IETF Code=2334
VSA 1=Packeteer-AVPair
[Packeteer-AVPair]
Type=STRING
Profile=OUT
2. Name the file packet.ini.
Add the Vendor to the Database
Next, you need to add the above vendor to the database.
1. Go to the command prompt, and change the directory to the Cisco Secure utils directory (typically C:\Program Files\CiscoSecure ACS v3.0\Utils).
2. The instructions below install the vendor into User Defined slot 0. If you have other vendors, you need to change this number to a free slot. To see a list of slots and their assignments, use the csutil -listudv command. For example:
C:\Program Files\CiscoSecure ACS v3.0\Utils>csutil -listudv
CSUtil v3.0(2.5), Copyright 1997-2002, Cisco Systems Inc
UDV 0 - Unassigned
UDV 1 - Unassigned
UDV 2 - Unassigned
UDV 3 - Unassigned
UDV 4 - Unassigned
UDV 5 - Unassigned
UDV 6 - Unassigned
UDV 7 - Unassigned
UDV 8 - Unassigned
UDV 9 - Unassigned
3. Run csutil -addudv to and add Packeteer to UDV (User Defined Vendor) slot 0 or the next
open slot.
C:\Program Files\CiscoSecure ACS v3.0\Utils>csutil -addudv 0 c:\temp\packet.ini
CSUtil v3.0(2.5), Copyright 1997-2002, Cisco Systems Inc
Adding or removing vendors requires ACS services to be re-started.
Please make sure regedit is not running as it can prevent registry
backup/restore operations
Are you sure you want to proceed? (y/n)y
Parsing [c:\temp\packet.ini] for addition at UDV slot [0]
Stopping any running services
Creating backup of current config
Adding Vendor [Packeteer] added as [RADIUS (Packeteer)]
Adding VSA [Packeteer-AVPair]
Done
Checking new configuration...
New configuration OK
Re-starting stopped services
Verify that Packeteer was added.
C:\Program Files\CiscoSecure ACS v3.0\Utils>
C:\Program Files\CiscoSecure ACS v3.0\Utils>csutil -listudv
CSUtil v3.0(2.5), Copyright 1997-2002, Cisco Systems Inc
UDV 0 - RADIUS (Packeteer)
UDV 1 - Unassigned
UDV 2 - Unassigned
UDV 3 - Unassigned
UDV 4 - Unassigned
UDV 5 - Unassigned
UDV 6 - Unassigned
UDV 7 - Unassigned
UDV 8 - Unassigned
UDV 9 - Unassigned
4. Return to ACS Admin and select Network Configuration.
From the main screen select Network Configurtion and add the PacketShaper by supplying the AAA client Hostname, IP address: , Key. Scroll through the Authenticate Using choices and select RADIUS (Packeteer).
5. From the main screen select User Setup and enter a user name for a Touch or Look access user to the Packet Shaper. Supply the PAP/CHAP password. Leave other fields at defaults and scroll to the bottom
of the form. Be sure the Packeteer-AVPair box is selected and supply either
"access=touch" or "access=look" in the available entry space. -
Add new OPNET VSA in ACS 4.2
I need to add OPNET Radius attributes in ACS 4.2. How should I add a new VSA in ACS? The google search is pointing me to CSUtil.exe, and I cannot find this utility in the ACS install files.
These are the values that I need added for OPNET.
When configuring the RADIUS server to support the ACE Live Appliance, use the following Vendor Code and Vendor Specific Attribute (VSA):
Vendor Code: 7119
VSA: 33
Thanks for your help.
FasihWell Well Well, you can use the RDBMS synchronization feature to add the new custom vendor to acs with its custom attributes that complement the standard list of IETF.
What you need to do is to define the accountactions.csv file with the actions needed to add the new custom vendor as well as its attributes.
As a reference to the way how to implement the accountactions.csv file please check the following link:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/A_RDBMS.html#wp148322
Walk throught the whole chapter described above.
One more thing you need to find the dictionary file for OPNET with their custom attributes.
If You need the fish , just provide the dictionary file and i will make the file to you.
Pleae make sure to rate correct answers -
Hi
I have the following issue, user exists on both the ACS and token server authenication is set to external database with no unknown user policy as the user is known to the ACS! this fails authenication error message is CS user unknown... Now if the unknown user policy is set to the external database the authenication works fine this is on 3.3. I have checked for bugs to no avail.
Any assistance would be good...
Thanks MJHi JG
Many thanks for your response, it is configured this way due the documentation below:
Known Users -Users explicitly added, either manually or automatically, into the CiscoSecureACS database.
These are users added through User Setup in the HTML interface, by the RDBMS Synchronization feature, by the Database Replication feature, or by the CSUtil.exe utility. For more information about CSUtil.exe, see "CSUtil Database Utility".
CiscoSecureACS attempts to authenticate a known user with the single database that the user is associated with. If the user database is the CiscoSecure user database and the user does not represent a Voice-over-IP (VoIP) user account, a password is required for the user. If the user database is an external user database or if the user represents a VoIP user account, CiscoSecureACS does not have to store a user password in the CiscoSecure user database.
This is from the following link....
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user/qu.htm
Many thanks MJ
Maybe you are looking for
-
How can I adjust fonts in one window only without affecting other open windows
I like to use a chat program and adjust font size without affecting other open windows
-
Why is there such an issue about removing my debit card from my account? This is an issue that needs to be resolved without me having to create a new account..
-
Drag and Drop no longer working in Windows 8
Running ID6 on new computer running Windows 8. I'm running as Administrator mode, but I can no longer drag images into designs. I was able to in Windows 7.
-
I'm working with a large InDesign file, full of links and content. As a result of to and fro with client we're sending the Masters to them, as and Idml file (they're on CS4 and us on CS6) The file was sent back to us as an idml file but for some reas
-
Hi! I've just bought a fake app, by Bocker Applications. It doesn't work (it would have to find phone positions by gps, it's a phone tracker) and in addition, I paid fo it 1 € instead 0,79 € as it said it costs. What can I do??