ACS to ISE config issues

Hi,
Im trying to migrate VPNS from ACS to ISE but i cannot quite get used to the ISE.
Below is a picture of my Authentication rule id like replicating on ISE but so far i have had no joy. Any points would be greatly received.
If the network source IP is trusted Rule 1 is hit and ISS is just use AD
If the network source IP is untrusted Rule 2 is hit and ISS is just use OTP Then AD
Im not 100% on the authorisation aspect either.
I think im want something along the lines of Ad:Group/x/x/x/x and TunnelGroup xxx = Permit/Apply ACL else Deny
I can pass authentiation from the ASA to ISE, one thing i have noticed in the aaa report, in the AV pairs the tunnel group name is not listed.
Many thanks in advance
S

Hi
FYI
Cisco Secure ACS and Cisco ISE exist on different hardware platforms and have different operating systems, databases, and information models. Therefore, you cannot perform a standard upgrade from Cisco Secure ACS to Cisco ISE. Instead, the Cisco Secure ACS to Cisco ISE Migration Tool reads data from Cisco Secure ACS and creates corresponding data in Cisco ISE.
For migrating the policies, and all other information, please visit the following link particularly the chapter 3,4,5:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/migration_guide/ise_migration_guide/ise_mig_preface.html

Similar Messages

ACS 5.3 Config

while applying ACS 5.3 Config on Cisco Switches , due to partial config the username and password is not working ....
kindly guide how to recover the password ; even after reboot also we are not able to get access to device and ACS login also not working

I assume you have a username/password setup on the router,if so make the ACS inaccessible then by default you use the username on the router. If no username setup on router then will have to use the console connection

ISE certifiacte issue

Hi,
I have a ISE certifiacte issue when I try to authenticate wireless user with ISE. He show me this:
12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
Please can you help me?
Regards
Aristide

This pretty much means that the authenticating client is not trusting the certificate that is installed in ISE. That certificate is used to build the EAP tunnel that would be used to pass the PEAP credentials. So a couple of questions:
1. What certificate do you have installed in ISE for EAP?
2. What certificate is the supplicant set to trust

REST API ACS vs ISE

Hi all
We are currently using ACS for wireless authentication. Guests register over an external Sharepoint webpage. The REST API is used to create and later delete these temporary users in ACS.
Now we want to migrate to ISE. In contrast to ACS, the ISE REST API seems to have no CRUD (Create, Read, Update and Delete) capabilities for Users. The ISE internal guest portal at the other hand we don't want to use.
Is there any other possibility to create Users in ISE from an external Application ?
Thanks Thomas

Hi Thomas,
Cisco ISE allows you to view, create, modify, duplicate, delete, change the status, import, export, or search for attributes of Cisco ISE users.
ISE also allows you to import user data in the form of a csv file into its internal database. Instead of entering user accounts manually into Cisco ISE, you can import them.
Following are the steps,
Step 1 Choose Administration > Identity Management > Identities > Users.
Step 2 Click Import to import users from a comma-delimited text file.
Tip (Optional) If you do not have a comma-delimited text file, click Generate a Template to create this type of file.
Step 3 In the File text box, enter the filename containing the users to import, or click Browse and navigate to the location where the file resides.
Step 4 Check the Create new user(s) and update existing user(s) with new data check boxes if you want to both create new users and update existing users.
Step 5 Click Save to save your changes to the Cisco ISE internal database.
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_man_id_stores.html#wp1407470

I can sync bookmarks on my Firfox for android, but folders aren't sync, i can only get bookmarks from bookmarks main folder. Is a bug or a config issue?

I can sync bookmarks in firefox for android, but only the ones that are on Bookmarks main folder, the folders create below the main folder are not synchronized. Is this a bug or a config issue?
Thanks

Thanks Barney, I tried that but all that comes up in Spotlight are the log files that show the file paths! I don't know how Steam works. Are all the files held by Steam on their server perhaps?

Can i configure a network with ACS and ISE?

I have both acs and ise, how do i integrate these appliance to work togheter?
Thanks

ISE does not interoperate with Cisco Secure ACS deployments. The Cisco Identity Services Engine can work in tandem with Cisco NAC Manager to provide the same profiling service as the NAC Profiler, which has reached end-of-sale status.
Existing Cisco Secure ACS customers using network access can easily migrate to the Cisco Identity Services Engine platform using migration part numbers and tools. However, existing Cisco Secure ACS customers using TACACS functions will not be able to migrate to the current version of ISE for network device identity management which is often acceptable for customers who prefer to keep user and network identity on separate systems.

Replacing ACS with ISE

What is required to replace ACS with ISE in simple terms?
I am looking to basically authenticate wired and wireless access against the local/AD) user database via Cisco kit
I am thinking all I need is the BASE (perpetual) license rather than the advanced/wireless licenses
Is there a limit to how many devices or users the base can deal with in its simplest form.
I would also like to be able to push out a splash screen for wireless users during authentication. Can this be done just with the ISE Base License alone for a wireless solution (via WLC with LWAPS or Autonomous APs)
thanks
dave

yes you can authenticate the user using the ISE and but you need a advance license if you want to use both wire and wireless here is small table to help you understand the license requirements also the max. devices support depends on the type of deployment and with advance feature you have the abilitity of profiling and posturing which provide very good control for admins in the network
Software Packages
Options
Base
Capabilities: Basic network access and guest access
Network deployment support: Wired, wireless, and VPN
License prerequisite: None
Perpetual license
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
Advanced
Capabilities: Profiler and feed service, posture, MDM integration, automated endpoint onboarding, and Security Group Access (SGA)
Network deployment support: Wired, wireless, and VPN
License prerequisite: Base license
Term license: 1, 3- and 5-year terms
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
Wireless
Capabilities: Basic network access, guest access, profiler, posture, and SGA
Network deployment support: Wireless
License prerequisite: None
Term license: 1, 3- and 5-year terms
Licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
Wireless Upgrade
Capabilities: Basic network access, guest access, profiler, posture, and SGA
Network deployment support: Wired, wireless, and VPN
License prerequisite: Wireless license
Term license: 1, 3- and 5-year terms
Upgrade licenses are available for 100, 250, 500, 1000, 1500, 2500, 3500, 5000, 10,000, 25,000, 50,000, and 100,000 endpoints
***Do rate Hekofuls posts***

ACS to ISE migration

Has anyone successfully migrated from ACS to ISE especially with WLAN or WiFi users?
If you have, please share any information.

I have done a few of those. I have never tried using the migration tool but instead have always created configurations from scratch. Basically, anything Radius related will migrate just fine. The one major thing that ISE won't support is TACACS+ but that is also coming in a future release. For more info check this doc:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/migration_guide/ise_migration_guide/ise_mig_overview.html\
Thank you for rating helpful posts!

ACS 5.0 having issues with different subnet AAA Clients

Dear All,
I am getting weird issue. My ACS 5.0 is in subnet 10.1.1.0/24. All the AAA clients which are in the same subnet can communicate with the ACS but different subnet cannot.
I have checked the firewall between them, Its allow any any with all services.
One more thing I have faced today is that now from only one switch (10.1.2.10) can access ACS but switches in the same subnet (10.1.2.0/24) cant access ACS as same previous issue.
Following are the logs of one switch(10.1.2.10) in different subnet can access ACS :
Working Switch with Same configuration:
SW-A#test aaa group tacacs+ test cisco legacy
Attempting authentication test to server-group tacacs+ using tacacs+
User was successfully authenticated.
SW-A#
*Nov 17 00:05:52.041: AAA: parse name=<no string> idb type=-1 tty=-1
*Nov 17 00:05:52.041: AAA/MEMORY: create_user (0x1B1FD04) user='test' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
*Nov 17 00:05:52.041: TAC+: send AUTHEN/START packet ver=192 id=3237327729
*Nov 17 00:05:52.041: TAC+: Using default tacacs server-group "tacacs+" list.
*Nov 17 00:05:52.041: TAC+: Opening TCP/IP to 10.1.1.2/49 timeout=5
*Nov 17 00:05:52.041: TAC+: Opened TCP/IP handle 0x1B44D48 to 10.1.1.2/49
*Nov 17 00:05:52.041: TAC+: 10.1.1.2 (3237327729) AUTHEN/START/LOGIN/ASCII queued
SW-A#
*Nov 17 00:05:52.243: TAC+: (3237327729) AUTHEN/START/LOGIN/ASCII processed
*Nov 17 00:05:52.243: TAC+: ver=192 id=3237327729 received AUTHEN status = GETPASS
*Nov 17 00:05:52.243: TAC+: send AUTHEN/CONT packet id=3237327729
*Nov 17 00:05:52.243: TAC+: 10.1.1.2 (3237327729) AUTHEN/CONT queued
*Nov 17 00:05:52.444: TAC+: (3237327729) AUTHEN/CONT processed
*Nov 17 00:05:52.444: TAC+: ver=192 id=3237327729 received AUTHEN status = PASS
*Nov 17 00:05:52.444: AAA/MEMORY: free_user (0x1B1FD04) user='test' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 vrf= (id=0)
Logs from the same subnet switch (10.1.2.20) which cannot access ACS:
SW-B#test aaa group tacacs+ test cisco legacy
Attempting authentication test to server-group tacacs+ using tacacs+
No authoritative response from any server.
SW-B#
*Oct 20 00:54:12.834: AAA: parse name=<no string> idb type=-1 tty=-1
*Oct 20 00:54:12.842: AAA/MEMORY: create_user (0x1A6F3F0) user='test' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
*Oct 20 00:54:12.842: TAC+: send AUTHEN/START packet ver=192 id=3281146755
*Oct 20 00:54:12.842: TAC+: Using default tacacs server-group "tacacs+" list.
*Oct 20 00:54:12.842: TAC+: Opening TCP/IP to 10.1.1.2/49 timeout=5
*Oct 20 00:54:12.842: TAC+: Opened TCP/IP handle 0x1B1E888 to 10.1.1.2/49
*Oct 20 00:54:12.842: TAC+: 10.1.1.2 (3281146755) AUTHEN/START/LOGIN/ASCII queued
SW-B#
*Oct 20 00:54:12.943: TAC+: (3281146755) AUTHEN/START/LOGIN/ASCII processed
*Oct 20 00:54:12.943: TAC+: received bad AUTHEN packet: type = 0, expected 1
*Oct 20 00:54:12.943: TAC+: Invalid AUTHEN/START/LOGIN/ASCII packet (check keys).
*Oct 20 00:54:12.943: TAC+: Closing TCP/IP 0x1B1E888 connection to 10.1.1.2/49
*Oct 20 00:54:12.943: TAC+: Using default tacacs server-group "tacacs+" list.
*Oct 20 00:54:12.943: AAA/MEMORY: free_user (0x1A6F3F0) user='test' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 vrf= (id=0)
Waiting for your responses.
Regards,
Anser

Ok, cool,
So this usually means that the switch is sourcing the requests from a difernet interface that is configured on the ACS.
I would guess that the ACS is reporting unknown NAS...
Can you please use the "ip tacacs source-interface" command to make sure the switch will source the Tacacs+ packets from the interface with the IP address for which you have the ACS configured to?
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

851 Router Config Issue

Hi all,
Hopefully this will be a nice easy one for you all.
I have recently configured and installed an 851 router successfully :) I now only have one issue, the damn thing switches itself off after a period of inactivity!
If I want to use it again I have to issue a reset command then a boot command.
This takes me to the:
router>
prompt. I then have to issue a copy start run command. And then a no shut on each of my interfaces.
Obviously I would just like the router to stay up and running. But I cant work out how to do it. Im sure that this is just a simple config issue and I would dearly love for you all to solve it!
If any of you know the answer can you please provide clear an accurate commands as I will copy it parrott fashion into the router.
Thank you all in advance.
Stuart

Hello,
as spremkumar already pointed out the config register usually is set to 0x2102. You can reconfigure the register by:
Router#configute terminal
Router(config)#config-register 0x2102
Router(config)#end
Then perform a reload and check whether the config is present after the router finished booting.
Hope this helps! Please rate all posts.
Regards, Martin

Difference between ACS and ISE

What is the big difference between the ACS and the ISE? We just purchased an ACS server to start locking down ports on our switches and use the Radius functions to better secure our wireless environment. It has been ordered but not yet arrived. I had a discussion with management today about preventing the IPads / IPhones / Smartphones / etc. of the world from accessing the network. If the user knows the credentials for getting their laptop onto the network then they can use these same credentials to get their IPad on the network. How do we detect and prevent is the current question.
In discussing with others the ISE comes up. The questions now become what is the big difference between this and the ACS. Do they work together or independently since they both seem to have "radius on steroids". Can I configure the ACS to do the same functions? I figure this will have to be something on a MAC address level anyway. Oh and one other thing. My wireless infrastructure is not Cisco.
Off to continue the research path ....
Brent

To put it simply I usually say ACS = RADIUS, ISE = NAC.
ISE will do RADIUS functions as well as NAC functions. Eventually you'll probably see ACS go away and be simply replaced by ISE.
ISE will do posturizing and profiling of a device to see if it truly meets requirements to be on a certain VLAN. For your example if you were to my credentials on my own smart device I would have access. ISE could profile this device to see if it truly is a corporate owned device or not. If it wasn't ISE can switch the network that the device connects to, say a guest network.
ISE can also do captive web portals for wired/wireless guest access.
I wouldn't rely on any type of MAC address authentication as I can easily spoof that.

ISE Config Backup Failure - Data filesystem full above threshold

Hi,
Both the config and operational backups were working until earlier last month. Now the config backup is failing with the following error. No configuration or repository settings were changed.
ISE 1.2.0.899 Patch 8 - Clustered with persona Node 1 = PAN, SMN, PSN .... Node 2 = SAN, PMN, PSN
CLI history says the same:
The local repository (disk:/) is looking good. The "/" filesystem is taking 77% space.
Although it may not be relevant. Data Purging is set to 30 days in the GUI and Operations -> Reports -> Data Purging Audit indicates its running daily with success i.e. threshold_space = 80GB, used_space = 3GB.
Is there a way to clean "/" filesystem ? It is filling up by roughly 1% every 5 days ? Note: the same on Node 2 is only 24% full.
Any ideas on how to get the config backup issue resolved ?
P.S. If images don't appear inline, please see the attachment
Thanks,
Rick.

922963 wrote:
Hi JK,
Thanks for response. Yes, I am worried that it may not be enough. How about if I increase memory to 32GB, ie. I have two servers, both with 32GB? Will it be sufficient in case of one physical server fail for 8GB data?
What is the point in having the 3rd physical box if two boxes have enough memory/capacity? You know, we need to pay licence according to no of CPU.
thanks,
HenryHi Henry,
actually the recommended minimum number of physical boxes is 4 so that the witness protocol participants can all be on separate machines.
But a minimum of 3 is highly recommended for a number of reasons related to partitioning:
1. If you have only 2, then you are much more vulnerable to split brain scenarios (should for some reason the two servers not be able to communicate with each other, it is harder to decide which half should be the winner). In short how do you decide which box is unable to communicate with the rest of the cluster if there are only 2 boxes?
2. You can't ensure a balanced and also machine safe partition distribution if you have a mismatching number of nodes on only 2 boxes. It would either be balanced or machine safe, but you can't get both at the same time. And you will either have mismatching number of nodes at startup or have mismatching number of nodes after one node failure.
Best regards,
Robert

ISE, MAB issue

I'm working with the following lab:
ISE 1.1.3.124
3560 running c3560-ipservicesk9-mz.122-55.SE
Cisco AP (1131, 1231).
I'm attempting MAB. The AP is being profiled correctly and I'm seeing successful authen and authz. But the device (AP/whatever) cannot pickup a DHCP address. If I manually assign an IP, then no traffic flows through the switchport. DHCP works fine for ports with no security. The DACL is being applied and should permit the traffic - I've even tried a permit ip any any.
I've attached the switch config and some ISE screenshots / logs.
Some further details below.
Thanks to anyone if you can nudge me in the right direction.
## switch dot1x debug
%MAB-5-SUCCESS: Authentication successful for client (001b.2abc.5de0) on Interface Fa0/2 AuditSessionID C0A863FE000001392E8FE236
3560-1#
%EPM-6-POLICY_REQ: IP 0.0.0.0| MAC 001b.2abc.5de0| AuditSessionID C0A863FE000001392E8FE236| AUTHTYPE DOT1X| EVENT APPLY
%EPM-6-AAA: POLICY xACSACLx-IP-LAB2-WLC-ONLY-5160b7f6| EVENT DOWNLOAD-REQUEST
%EPM-6-AAA: POLICY xACSACLx-IP-LAB2-WLC-ONLY-5160b7f6| EVENT DOWNLOAD-SUCCESS
%EPM-6-IPEVENT: IP 0.0.0.0| MAC 001b.2abc.5de0| AuditSessionID C0A863FE000001392E8FE236| AUTHTYPE DOT1X| EVENT IP-WAIT
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up
3560-1#
%AUTHMGR-5-SUCCESS: Authorization succeeded for client (001b.2abc.5de0) on Interface Fa0/2 AuditSessionID C0A863FE000001392E8FE236
3560-1#sh authentication sessions int fa0/2
            Interface: FastEthernet0/2
          MAC Address: 001b.2abc.5de0
           IP Address: Unknown
            User-Name: 00-1B-2A-BC-5D-E0
               Status: Authz Success
               Domain: DATA
      Security Policy: Should Secure
      Security Status: Unsecure
       Oper host mode: single-host
     Oper control dir: both
        Authorized By: Authentication Server
           Vlan Group: N/A
              ACS ACL: xACSACLx-IP-LAB2-WLC-ONLY-5160b7f6
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: C0A863FE000001392E8FE236
      Acct Session ID: 0x00000180
               Handle: 0xFC000139
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
3560-1#sh authentication method mab
Interface MAC Address     Method   Domain   Status         Session ID
Fa0/2      001b.2abc.5de0 mab      DATA     Authz Success C0A863FE000001392E8FE236
3560-1#sh ip access-lists
Standard IP access list 10
    10 permit 192.168.99.10 (9814 matches)
    20 deny   any log
Extended IP access list ACL_DEFAULT
    10 permit udp any eq bootpc any eq bootps (71 matches)
    20 permit udp any any eq domain
    30 permit icmp any any
    40 permit udp any any eq tftp
    50 permit ip any host 192.168.99.10
    60 deny ip any any log
Extended IP access list ACL_REDIRECT
    10 deny udp any eq bootpc any eq bootps
    20 deny udp any any eq domain
    30 deny ip any host 192.168.99.10
    40 permit tcp any any eq www
    50 deny ip any any
Extended IP access list xACSACLx-IP-LAB2-WLC-ONLY-5160b7f6 (per-user)
    10 permit udp any eq bootpc any eq bootps
    20 permit udp any any eq domain
    30 permit ip any host 192.168.99.224
    40 deny ip any any log

It is nice to see that you find the resolution the command “ip dncp snooping trust”   Validates DHCP messages received from untrusted sources and filters out invalid messages.

ACS 5.2 Authentication Issue with Local & Global ADs

Hi I am facing authentication issue with ACS 5.2. Below is AAA flow (EAP-TLS),
- Wireless Users >> Cisco WLC >> ADs <-- everything OK
- Wireless Users >> Cisco WLC >> ACS 5.2 >> ADs <-- problem
Last time I tested with ACS, it worked but didn't do migration as there'll be changes from ADs.
Now my customer wants ACS migration by creating new Group in AD, I also update ACS config.
For the user from the old group, authentication is ok.
For the user from the new group, authentication fails. With subject not found error, showing the user is from the old group.
Seems like ACS is querying from old records (own cache or database). Already restared the ACS but still the same error.
Can anyone advice to troubleshoot the issue?
Note: My customer can only access their local ADs (trusted by Global ADs). Local ADs & ACS are in the same network, ACS should go to local AD first.
How can we check or make sure it?
Thanks ahead,
Ye

Hello,
There is an enhacement request open already:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCte92062
ACS should be able to query only desired DCs
Symptom:
Currently on 5.0 and 5.1, the ACS queries the DNS with the domain, in order to get a list of all the DCs in the domain and then tries to communicate with all of them.If the connection to even one DC fails, then the ACS connection to the domain is declared as failed.A lot of customers are asking for a change on this behavior.
It should be possible to define which DCs to contact and/or make ACS to interpret DNS Resource Records Registered by the Active Directory Domain Controller to facilitate the location of domain controllers. Active Directory uses service locator, or SRV, records. An SRV record is a new type of DNS record described in RFC 2782, and is used to identify services located on a Transmission Control Protocol/Internet Protocol (TCP/IP) network.
Conditions:
Domain with multiple DCs were some are not accessible from the ACS due to security/geographic constraints.
Workaround:
Make sure ALL DCs are UP and reachable from the ACS.
At the moment, we cannot determine which Domain Controller on the AD the ACS will contact. The enhacement request will include a feature on which we can specify the appropriate the Domain Controllers the ACS should contact on a AD Domain.
Hope this clarifies it.
Regards.

MAB Config Issue

with acs 4.2 installed in my network,   PEAP, EAP-TLS, md5... authentications work normally. But Mac-Based-Authentication   doesnt work at all. i tested every thing but no luck .
This is what i have setup on Swith for MAB:
aaa new-model
aaa authentication login default none
aaa authentication dot1x default group radius
radius-server host 192.168.2.16 auth-port 1645 acct-port 1646 key cisco
dot1x system-auth-control
interface FastEthernet0/1
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x mac-auth-bypass
On ACS server, i created Netword-Profile for MAB, i added those Agentless hosts mac-adds,   Even i created User-Name&password by those Agentless hosts mac-adds on acs,   ..... still nothing seems to be working.   i have selected ACS_Internal-Database for mac authentication.
On ACS while i check the   Failed-attempt log, nothing is logged there. i dont know where is the issue.
Please tell me where im wrong on my config?

Under your interface type: mab
Sent from Cisco Technical Support iPad App

ACS to ISE config issues

Similar Messages

Maybe you are looking for