ACS v4.2 for Windows multiple NICs?

Hi, I would like separate ACS traffics on 2 two separate NICs, one for front end AAA service related traffics, and another one for web, backup administrative traffic, is it possible?
Leo

Hi Leo,
Teaming is not supported at this
time.
When ACS server has dual NIC, there might be problem with interoperability between ACS servers for functions like replication, RDBMS-sync, RADIUS proxy, remote logging, remote agent.
Already filed as enhancement.
CSCsr76897: ACS interoperability with dual NICs
HTH
Regrads,
JK

Similar Messages

  • CA and Certificate Issue in ACS 4.0 For Windows 2003 Enterprise Server

    Hi,
    I have configured Microsoft CA server on the same ACS 4.0 for Windows 2003 enterprise server which was configured earlier using the self generated certificates for EAP and PEAP authentications.
    After I change the certificate from self generated to the new CA certificate that can be viewed under install ACS certificate option on ACS server but having the following problems
    1. SSL is not functioning while internet browser access to the ACS server and going through http instead of https.
    2. Wireless clients are authenticated successfully even after the certificate is uninstalled.
    Any help on these problems will be appreciated.
    Thanks
    Best Regards,
    Ahmed

    Hi Rohit,
    Thanks for reminding the HTTPS option under Administration Control on ACS.
    I have some doubts pertaining to installation of certificates on Wireless clients though it is optional for Self Generated Certificates but what in case of Mirosoft CA as I tested wireless client authentications even after removing the certificate from microsoft supplicant WindowsXP SP2 having installed the patch KB885453 for PEAP. How the certificate on wireless client works.
    Is it mandatory or optional to keep certificate on Wireless Clients as they could able to get authenticated through ACS after removing the certificate.
    Thanks
    Best Regards,
    Ahmed

  • ACS 3.2 for Windows and MS Windows AD Directory Integration Problem

    Dear all,
    We have some issues while integrating Windows AD with ACS 3.2 for Windows.Currently we have done the following:
    1. Installed ACS 3.2 for Windows on Windows 2003 Enterprise with SP1
    2. ACS and Domain Controller are configured on the same server
    Checked and verified the following configurations
    1. created a domain user "csacs" selected Act as a part of operating system and log on as a service enabled for this user.
    2. Enabled all the CS services to log on as a user csacs.
    But I noticed CS services are not respdonding and gives the error as "Could not able to start the service with service specific error ..." while trying to start services manually on ACS.
    Kindly help me through this integration part
    An easy and handy Step wise procedure on configuring integration of AD with ACS 3.2 on both Domain Controller and on Member server will be of great help.
    Thanks
    Kind Regards,
    Ahmed

    I have no issues running Cisco ACS version 3.2 on Windows
    Server 2003 with SP2:
    1) create user test1 in MS Active Directory and put test1
    in users group with dial-in access granted,
    3) Create a group called "LDAP". Actually I renamed
    group name "group 1" to "LDAP".
    3) in ACS external user database configuration, I specified
    domain "CCIE" as for this. unknow user policy is to use
    Windows Database configuration,
    4) Configure the database configuration in ACS to point
    to "CCIE" windows domain,
    5) setup the ACS to authenticate one of your Cisco devices
    and log in using the MS windows account,
    By the way, mgurwara, you are wrong. I run Cisco
    ACS 3.2 on windows 2003 Enterprise Edition with Service
    Pack 2. I am running it on a Dell Optiplex Gx240
    (1.7 GHz with 512MB of RAM) and it is running fine.
    I use it to manage about 20 cisco devices and
    about 200 Wireless LEAP user(s). Furthermore, I am also
    running ACS 4.1 on another identical hardware. It has
    nothing to do with the hardware. I don't know where
    you get that information from.

  • CiscoSecure ACS v2.4 for Windows NT Upgrade

    We still have two ancient instances of CiscoSecure ACS v2.4 for Windows NT running on our network. ACS1 (primary) and ACS2 (secondary). I would like to upgrade these, not only because of how old they are but because of an issue trying to replicate the user and group database from ACS1 to ACS2. When trying to replicate the user and group database the logs say it's successful but the databases don't match. ACS2 is missing some of the users that are in ACS1. I have successfully replicated the interface database. But for whatever reason, the user and group database will not replicate.
    First, is there any other way I can get the user and group database copied from ACS1 to ACS2? Other than using the built in database replication tool?
    Second, is there any way I can get these upgraded? I read that the recommended upgrade path is 2.4->2.6->3.0->3.2. But Cisco no longer has version 2.6 available for download. I really would like to upgrade rather than starting from scratch.
    Thanks!

    ACS 2.4 - wow! That hasn't been sold for over 11 years. (reference)
    Think about it - would you want to try to upgrade Windows 98 to Windows 7? That's about an equivalent span of software product timeline.
    The current product is so different that even if you could upgrade it would not be advisable to do so. While painful, it would be much better option to make a clean break with the old and move onto a current platform (e.g ACS 5.3).

  • Advice for Buying Cisco Secure ACS 3.3 for Windows

    Just need advice on what other things I NEED to order apart from the Windows server when I want to iplement ACS and I want to use CISCO SECURE ACS 3.3 FOR WINDOWS
    Hope someone will help

    Hi,
    This is all what you require:
    Supported Operating System
    Cisco Secure ACS for Windows Servers 3.3 supports the Windows operating systems listed below. Both the operating system and the service pack must be English-language versions.
    •Windows 2000 Server, with Service Pack 4 installed
    •Windows 2000 Advanced Server, with the following conditions:
    –with Service Pack 4 installed
    –without features specific to Windows 2000 Advanced Server enabled
    •Windows Server 2003, Enterprise Edition
    •Windows Server 2003, Standard Edition
    Note The following restrictions apply to support for Microsoft Windows operating systems:
    •We have not tested and cannot support the multi-processor feature of any supported operating system.
    •We cannot support Microsoft clustering service on any supported operating system.
    •Windows 2000 Datacenter Server is not a supported operating system.
    Please refer to the following link for more information:
    http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/win33sdt.htm
    Thanx & Regards

  • SAPGui for Windows Multiple Logon with Portal

    Hi,
    We are using SAPGUI for Windows in Portal in the external window, we are also using it the SAPConsole form the desktop. While using from desktop, the multiple logon (within same client) complains / comes with the pop-up with two standard options.
    We would like achieve the same functionality of popup (Restricting multiple logons for the same client) within the portal, any ideas?
    I came across certain threads and also notes but none seem to provide a solution....
    [Restrict multi logon to R/3 system from portal using single sign on.    |Restrict multi logon to  R/3 system from portal using sigle sign on.;
    [SAP GUI 7.10 and SSO - multiple logons issue. How to restrict it?    |/thread/1623980 [original link is broken];
    Note 142724 - Prevention of multiple SAPGUI logons
    Thank you in advance.
    Best regards,
    Dharmi
    Edited by: Dharmi Tanna on Jun 25, 2010 2:09 PM

    Lonny,
    The best way to authenticate users when they logon using SAP GUI for Windows, is to use SNC authentication in SAP GUi. Then, the browser iview will launch the GUI and the GUI will authenticate the user using their AD credentials issued during the Windows logon. You will need to setup an SNC library on both the ABAP system which the user is logged onto, and the workstation where SAP GUI is installed.
    If you don't use SNC, and you just launch SAP GUI for Windows from browser, then an SSO2 ticket is used to authenticate the user to the ABAP stack, and this is not secure due to the fact that the SAP GUI session which is used to pass the SSO2 ticket is not protected - anybody can intercept the SAP GUI session, take the SSO2 ticket from this traffic and logon as that user - clearly this is bad security and needs SNC to make it secure.
    Thanks,
    Tim

  • Delete proxy config on Cisco Secure ACS 4.1 for Windows ?

    We have a pair of ACS 4.1 servers (Windows Server 2003 R2). Let's call them ACS1 and ACS2.
    We don't want either one of them to proxy to any AAA server, including each other. We're using mostly TACACS authentication.
    While troubleshooting a general problem, I'm guessing that one of us did this on ACS1:
    pressed the Network Configuration button,
    saw the Proxy Distribution Table
    clicked (Default)
    moved ACS1 from the AAA Servers column to the Forward To column.
    So, essentially, we're telling ACS1 to proxy all requests to itself, which doesn't seem to make sense. I don't know for sure whether it should work when configured to "self proxy," but in that state, it does not authenticate anyone and gives merely "Internal error" as the reason.
    If I change the configuration so that "ACS2" appears in the Forward To column, and I move "ACS1" back to AAA Servers and restart, ACS1 starts responding correctly to TACACS requests. Of course, ACS1 is just proxying all requests to ACS2, so having two servers isn't doing much good.
    I cannot simply remove ACS1 from the Forward To column and leave it empty. The interface complains that it can't forward to zero servers. Of course, on ACS2, there are no servers in the Forward To column, since we never touched the Proxy Distribution Table there.
    Is there any way to return the Proxy Distribution Table to its default setup, that is, no servers appear in the "Forward To" column?
    We're planning to upgrade to version 4.2 very soon, so this question is mostly academic, unless the same problem exists in 4.2.
    For full disclosure, I should mention that the problem we were troubleshooting was loss of connectivity to our Windows Domain Controllers from our ACS servers. We had missed adding some exceptions in our firewalls to allow for four new DCs. As far as we can tell from testing, connectivity to the DCs is now fine. The firewall rules group ACS1 and ACS2 together, so connectivity should be the same, and ACS2 authenticates users correctly.

    Hello Jeffrey,
    By default the ACS 4.x Proxy Distribution Settings should have the ACS entry for itself on the Forward To box. Your ACS1 entry should be on the Forward To box.
    The Internal Error message on the ACS should be highligthing a different issue on your ACS1. Also, the message stating that we cannot have zero servers on the "Forward To" box is expected.
    Set your ACS1 for Full Logging Detail (System Configuration > Service Control) and configure the ACS1 entry under the Forward To box. Recreate the authentication issue and collect a package.cab file. If you have an ACS for Windows, under the ACS Installation folder look for the CSAuth folder > Logs and share the auth.log file with a failure timestamp for us to review the ACS logs when failing with Internal Error.
    If this was helpful please rate.
    Regards.

  • ACS 4.2 For Windows DB Replication

    Hi Folks.
    I have a pair of ACS for windows 4,2 and we also have a few mappings (ACS Group --> AD Group)
    The replication process was configured and it replicates all the seetings, but the Group Mappings.
    Is this the way it's supposed to be or it should replicate the group mappings as well?
    Best regards,
    AL

    The following items cannot be replicated:
    •IP pool definitions (for more information, see About IP Pools Server).
    •ACS certificate and private key files.
    •Unknown user group mapping configuration.
    •Dynamically-mapped users.
    •Settings on the ACS Service Management page in the System Configuration section.
    •RDBMS Synchronization settings.
    User guide
    http://www.ciscosystems.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/SCAdv.html#wp756078
    Regards,
    Jatin
    Do rate helpful posts-

  • ACS SE setup for windows authentication

    Dear All,
    I'm trying to install an ACS Solution Engine in My network for access control (AAA). I succeed in setting up authentication using the internal database and that works fine. Now My boss want users to be authenticated through an external database (windows AD). I tried achieving this but kept getting different errors.(like EAP-TLS or PEAP authentication failed during SSL handshake) or (Authen session timed out: Challenge not provided by client).
    Please I need someone who has done this setup successfully before to give Me a step by step procedure on how I can setup ACS SE for windows authentication using My domain windows authentication.
    Thanks

    Dear All,I'm
    trying to install an ACS Solution Engine in My network for access
    control (AAA). I succeed in setting up authentication using the
    internal database and that works fine. Now My boss want users to be
    authenticated through an external database (windows AD). I tried
    achieving this but kept getting different errors.(like EAP-TLS or PEAP
    authentication failed during SSL handshake) or (Authen session timed
    out: Challenge not provided by client).Please
    I need someone who has done this setup successfully before to give Me a
    step by step procedure on how I can setup ACS SE for windows
    authentication using My domain windows authentication.Thanks
    Hi,
    Check out the belwo link on your query,Hope that help !!
    https://supportforums.cisco.com/docs/DOC-5542
    If helpful do rate
    Ganesh.H

  • ACS 5.1 for Windows VM Ware

    Hello,
    Please help me...
    I want to know can we install ACS 5.1 in Windows VM Ware machine. I have downloaded it but it is giving me the option of installation in Linux.
    Please suggest.

    Ravi,
    This release of ACS 5.1 provides new architecture and functionality on a standard Cisco Linux-based. We would be requiring a new box all together for 5.0.
    Installing ACS on VMware virtual machine
    http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/installation/guide/csacs_vmware.pdf
    ACS 5.1 doesn't support windows OS.
    HTH
    JK
    -Do rate helpful posts-

  • Cisco Secure ACS 4.2 for Windows web-based Admin Console log in problems

    To Whomever Can Assist,
          I am running two deployments of Cisco Secure ACS for Windows 4.2 and I can login into the admin web-console just fine.  However, when I create a new or test user that mirror my configuration that user cannot login to the admin web-console.  The user can login it to devices with the appropriate privileges, but can't administer his/her account within ACS.  This has proven very problematic and needs a remedy.  Thanks for the assistance.

    Bradbryant.dhs,
    Where are you creating the new admin user who should have access to ACS web gui under internal users or administration.
    Internal user and ACS administrator accounts are completely different. 
    Adding administrator account
    http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4-2/user/guide/ACS4_2UG/Admin.html
    Regards,
    Jatin Katyal
    ** Do rate helpful posts **

  • ACS SE & CSACS for windows

    Hello Friends,
    If i order Access Control Server Solution Engine (ACS SE) CSACS-1120-K9, i should'nt order a CSACS for windows CD,????? Is it ACS server is built-in in ACS SE no need of installing windows OS and on top of that ACS server ,i m confuse regarding the product.
    Can anybody help me for this,i have been through the cisco web site but not pretty sure regarding these two product.
    Thanks

    CSACS-1120-K9 is an ACS appliance, and it supports both ACS version 5.0 and 5.1.
    Here is the release notes for both versions:
    5.0: http://cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.0/release/notes/ACS-50-releasenotes.html
    5.1: http://cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/release/notes/acs_51_rn.html
    FYI, ACS version 5.x onwards is completely different to the previous version of ACS 3.x and 4.x.

  • ACS 3.3 for windows - Win AD and eap-tls problem

    Hi,
    I have a problem with an ACS to authenticate users with certificate on MS AD.
    Working things:
    PEAP authentication with the MS AD;
    EAP-TLS authentication with the local DB.
    Not working things:
    EAP-TLS authentication with MS AD.
    Because I'm able to auth users with PEAP on MS AD, I guess my config on MS AD is correct.
    Because I'm able to auth users with certif in EAP-TLS, I guess my certif config is correct.
    So, why it's not working with the combination EAP-TLS and MS AD.
    I receive the error 'External DB Account Restriction'
    Thanks for your help.

    Hi,
    This is what is interesting,
    AuthenProcessResponse: process response for 'phd' against Windows Database
    Unknown User 'phd' was not authenticated
    Done RQ1027, client 50, status -2125
    The field that is being picked from certificate has the value 'phd', check you check which field is it.
    And was the logging at full?, I think something is missing in the logs.
    Lets do a sanity check, and go through following link again,
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a008068d45a.shtml
    Regards,
    Prem

  • Self Generated certificate validity issue in ACS 4.0 for Windows

    Hi,
    Is there any solution to extend the validity time of self generated certificate on ACS, by default the validity is set for one year.
    As the server certificate on one of the ACS which is CA has expired and need to renew it.
    Is it possible only one certificate from third party can be used both as a server certificate and certificate from CA for other ACS servers.
    Thanks in Advance
    Regards,
    Ahmed

    Other solution would be to create an in house(Microsoft probably) CA, and get a certificate for your ACS server. Go through the installation steps of Microsoft CA before, as the validity date for Server Certificate(i guess) is configured during initial install of CA.
    Regards,
    Prem

  • CA certificate issue in ACS 4.0 for Windows

    Hi,
    How to generate lost private key .pvk file on ACS which is also configured as CA Server, As I would like to register all the available ACS's Servers to CA Server using the same certificate from CA Server. Need a step wise procedure on obtaining certificate from ACS CA server.
    your kind response will be of great help.
    Thanks in advance
    Best Regards,
    Ahmed

    Windows Server 2003 with SP1, Enterprise Edition, is used so that auto-enrollment of user and workstation certificates for EAP-TLS authentication can be configured. This is described in the EAP-TLS Authentication section of this document. Certificate auto-enrollment and auto-renewal make it easier to deploy certificates and improve security by automatically expiring and renewing certificates.

Maybe you are looking for