ACS with NAC Server

Can I configure the software  ACS on a server  NAC ??
Thanks for your help
Escuchar
Leer fonéticamente
Diccionario

Hello
How you want to configure ACS on NAC appliance ? What is your requirement ?
If you want NAC appliance to behave as your ACS server, then the answer is NO.
thanks
Devashree

Similar Messages

  • Wireless Guest with NAC Server

    Hi All,
    Anyone knows why Sponsor can't create a guest account with 1 month duration.
    Its a NAC running on 2.1 version in SNS-3415-K9.
    The current setup is WLC connected to NAC Server.
    Is it related to Account type?
    From the Account Type dropdown menu, you can choose one of the predefined options:
    Start End—Allows sponsors to define start and end times for account durations.
    From First Login—Allows sponsors to define a length of time for guest access from their first login.
    From Creation - Allows sponsors to define a length of time for guest access from the moment of account creation.

    When you say, "One MAC user" you mean every other client works except for this one MAC device?  If other MAC devices work, then it must be something on the client device that is having issues.  The only issue that I have ran into, is html code that might not be supported in certain browsers if you are runing a custom webauth page.

  • Configure ADSSO with NAC

    Hi Guys,
    I need to configure my Cisco NAC (ADSSO) with Windows Server 2008 R2 Enterprise (64). For now we only can ADSSO with Windows XP. Windows 7 still using normal authentication. We are using KTPass to authenticate with NAC server. We are using Windows 2008 at 2003 functional level.
    Anyone can help me regarding this?
    Best Regards,
    Azfar

    Azfar,
    There are a few things that you need to check/perform when configuring ADSSO. First you must check that proper version of ktpass is installed on the machine you generate the kerberos ticket for the CAS service account (I recommend using a different account for this just so you can roll back, also you can not run ktpass successfully more than once for the same service account, please delete the account first, recreate the account and try again):
    http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/agntsprt.html#wp228565
    After this you need to follow the steps to generate the kerberos ticket:
    http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1301231
    Here is an example more specific to your environment:
    http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1277452
    Since you are running in a mixed environment you must enable additional algorithms:
    http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1277452
    If it fails, then purchase ISE.
    Thanks,
    Tarik Admani
    *Please rate helpful posts*

  • Wired WebAuth only with NAC Guest Server (No ACS)

    Ok, I have been fighting this for two days now.  I want to use the webauth function on some of our Cisco 3750Gs ver
    12.2(55)SE5 for guest access.  I'm trying to use our NAC Guest Server ver: 2.0.3 as the backend portal and Radius server.  We do not have ACS or any of the other components of ISE or NAC.  I think the issue is the NGS server is not sending the d(ACL) back to switch.  Guest work work fine from our WLCs. 
    switch debug:   No Attributes in swtich debug
    Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Config NAS IP: 199.46.201.26
    Mar 22 12:56:00.448 CDT: RADIUS/ENCODE(0000030C): acct_session_id: 1012
    Mar 22 12:56:00.448 CDT: RADIUS(0000030C): sending
    Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Send Access-Request to 10.199.33.20:1812 id 1645/19, len 177
    Mar 22 12:56:00.448 CDT: RADIUS:  authenticator 99 95 59 55 09 A9 D9 E1 - 2B 01 90 36 1B 8A 41 92
    Mar 22 12:56:00.448 CDT: RADIUS:  User-Name           [1]   20  "[email protected]"
    Mar 22 12:56:00.448 CDT: RADIUS:  User-Password       [2]   18  *
    Mar 22 12:56:00.448 CDT: RADIUS:  Framed-IP-Address   [8]   6   199.46.201.231
    Mar 22 12:56:00.448 CDT: RADIUS:  Service-Type        [6]   6   Outbound                  [5]
    Mar 22 12:56:00.448 CDT: RADIUS:  Message-Authenticato[80]  18
    Mar 22 12:56:00.448 CDT: RADIUS:   A2 57 B5 F2 A6 FB 46 71 D0 EA 26 54 95 90 F4 D0             [ WFq&T]
    Mar 22 12:56:00.448 CDT: RADIUS:  Vendor, Cisco       [26]  49
    Mar 22 12:56:00.448 CDT: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=C72EC91A000002FC0A6CD698"
    Mar 22 12:56:00.448 CDT: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    Mar 22 12:56:00.448 CDT: RADIUS:  NAS-Port            [5]   6   50106
    Mar 22 12:56:00.448 CDT: RADIUS:  NAS-Port-Id         [87]  22  "GigabitEthernet1/0/6"
    Mar 22 12:56:00.448 CDT: RADIUS:  NAS-IP-Address      [4]   6   199.46.201.26
    Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Started 5 sec timeout
    Mar 22 12:56:01.454 CDT: RADIUS: Received from id 1645/19 10.199.33.20:1812, Access-Reject, len 20
    Mar 22 12:56:01.454 CDT: RADIUS:  authenticator 92 98 05 84 6E 4B CF DD - B5 D7 90 25 10 59 7B E7
    Mar 22 12:56:01.454 CDT: RADIUS(0000030C): Received from id 1645/19
    NGS log:
    rad_recv: Access-Request packet from host 199.46.201.26 port 1645, id=19, length=177
        User-Name = "[email protected]"
        User-Password = "5rRmpPt9"
        Framed-IP-Address = 199.46.201.231
        Service-Type = Outbound-User
        Message-Authenticator = 0xa257b5f2a6fb4671d0ea26549590f4d0
        Cisco-AVPair = "audit-session-id=C72EC91A000002FC0A6CD698"
        NAS-Port-Type = Ethernet
        NAS-Port = 50106
        NAS-Port-Id = "GigabitEthernet1/0/6"
        NAS-IP-Address = 199.46.201.26
    +- entering group authorize {...}
    [radius-user-auth]     expand: %{User-Name} -> [email protected]
    [radius-user-auth]     expand: %{User-Password} -> 5rRmpPt9
    [radius-user-auth]     expand: %{NAS-IP-Address} -> 199.46.201.26
    [radius-user-auth]     expand: %{Calling-Station-Id} ->
    Exec-Program output:                          Note:  no attributes here
    Exec-Program: returned: 1
    ++[radius-user-auth] returns reject
    Delaying reject of request 12 for 1 seconds
    Going to the next request
    Waking up in 0.6 seconds.
    Similar debug from NGS but auth request from WLC: See attributes are sent to wlc although not needed
    rad_recv: Access-Request packet from host 10.100.16.100 port 32770, id=22, length=152
        User-Name = "[email protected]"
        User-Password = "5rRmpPt9"
        Service-Type = Login-User
        NAS-IP-Address = 10.100.16.100
        NAS-Port = 13
        NAS-Identifier = "ICTWLC01"
        NAS-Port-Type = Ethernet
        Airespace-Wlan-Id = 514
        Calling-Station-Id = "10.198.12.211"
        Called-Station-Id = "10.100.16.100"
        Message-Authenticator = 0xc9383e767f0c228a2b8a0ece7069f366
    +- entering group authorize {...}
    [radius-user-auth]     expand: %{User-Name} -> [email protected]
    [radius-user-auth]     expand: %{User-Password} -> 5rRmpPt9
    [radius-user-auth]     expand: %{NAS-IP-Address} -> 10.100.16.100
    [radius-user-auth]     expand: %{Calling-Station-Id} -> 10.198.12.211
    Exec-Program output: Session-Timeout := 20002004, cisco-AVPair += priv-lvl=15, cisco-AVPair += auth-proxy:proxyacl#1=permit ip any any
    Exec-Program-Wait: plaintext: Session-Timeout := 20002004, cisco-AVPair += priv-lvl=15, cisco-AVPair += auth-proxy:proxyacl#1=permit ip any any
    Exec-Program: returned: 0
    ++[radius-user-auth] returns ok
    [files] users: Matched entry DEFAULT at line 1
    ++[files] returns ok
    Found Auth-Type = Accept
    Auth-Type = Accept, accepting the user
    +- entering group post-auth {...}
    [sql]     expand: %{User-Name} -> [email protected]
    [sql] sql_set_user escaped user --> '[email protected]'
    [sql]     expand: %{User-Password} -> 5rRmpPt9
    [sql]     expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('[email protected]', '5rRmpPt9', 'Access-Accept', NOW())
    rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('[email protected]', '5rRmpPt9', 'Access-Accept', NOW())
    rlm_sql (sql): Reserving sql socket id: 12
    rlm_sql_postgresql: Status: PGRES_COMMAND_OK
    rlm_sql_postgresql: query affected rows = 1
    rlm_sql (sql): Released sql socket id: 12
    ++[sql] returns ok
    Sending Access-Accept of id 22 to 10.100.16.100 port 32770
    Finished request 4.
    Going to the next request
    Waking up in 4.9 seconds.
    rad_recv: Accounting-Request packet from host 10.100.16.100 port 32770, id=30, length=170
    config:
    aaa new-model
    aaa authentication login default group radius
    aaa authentication login console group tacacs+ line
    aaa authentication enable default group tacacs+ enable
    aaa authorization console
    aaa authorization exec default group tacacs+ none
    aaa authorization auth-proxy default group radius
    aaa accounting auth-proxy default start-stop group radius
    aaa accounting exec default stop-only group tacacs+
    aaa accounting commands 15 default stop-only group tacacs+
    ip device tracking
    ip auth-proxy auth-proxy-banner http ^C HawkerBeechcraft Guest Network ^C
    ip auth-proxy proxy http login expired page file flash:expired.html
    ip auth-proxy proxy http login page file flash:login.html
    ip auth-proxy proxy http success page file flash:success.html
    ip auth-proxy proxy http failure page file flash:failed.html
    ip admission auth-proxy-banner http ^C HawkerBeechcraft Guest Network ^C
    ip admission proxy http login expired page file flash:expired.html
    ip admission proxy http login page file flash:login.html
    ip admission proxy http success page file flash:success.html
    ip admission proxy http failure page file flash:failed.html
    ip admission name web-auth-guest proxy http inactivity-time 60
    dot1x system-auth-control
    identity policy FAILOPEN
    access-group PERMIT
    interface GigabitEthernet1/0/6
    switchport access vlan 301
    switchport mode access
    ip access-group pre-webauth-guest in
    no logging event link-status
    srr-queue bandwidth share 10 10 60 20
    queue-set 2
    priority-queue out
    mls qos trust device cisco-phone
    mls qos trust dscp
    no snmp trap link-status
    auto qos voip cisco-phone
    spanning-tree portfast
    spanning-tree bpduguard enable
    service-policy input AutoQoS-Police-CiscoPhone
    ip admission web-auth-guest
    ip http server
    ip http secure-server
    ip access-list extended PERMIT
    permit ip any any
    ip access-list extended pre-webauth-guest
    permit udp any any eq bootps
    permit udp any any eq domain
    permit tcp any host 10.199.33.20 eq 8443
    permit tcp any host 10.199.33.21 eq 8443
    permit tcp any host 10.100.255.90 eq 8443
    deny   ip any any log
    ip radius source-interface Vlan301
    radius-server attribute 8 include-in-access-req
    radius-server dead-criteria tries 2
    radius-server host 10.199.33.20 auth-port 1812 acct-port 1813 key 7 022E5C782C130A74586F1C0D0D
    radius-server vsa send authentication
    I get the login and AUP page then the failed page... I never see the priv-lvl 15 or the proxyacl?  How do I do this with Guest server only?
    Help!

    Without the ACS, only with the NAC guest is possible?
    They can send me sample configuration?

  • Wired WebAuth with NAC Guest Server

    Hi,
    I am trying to get wired WebAuth working with NAC Guest Server. In the switch_login.html file example, what should be changed for this line:
    ngsOptions.actionUrl = https://1.1.1.1/;
    Should this be an IP address on the switch? Shoul I have this pointing to the success.html page like this:
    ngsOptions.actionUrl = "https://1.1.1.1/success.html";
    When I log on, and accept the AUP, my browser just sits there trying to access Https://1.1.1.1/?redirect-url=blah blah blah
    Thanks,
    Peter

    FYI,
    In my case I WAS getting the switch_login.html web page being displayed, but after entering credentials and submitting the Acceptable Use Policy page, I did NOT 'see' any radius traffic between the switch (C2960S 12.2(55)SE3) and the ACS 5.3 radius server?!.
    I used the sample .html docs that you can find on the NAC Guest Server in the 'samples' folder on that server. I used WCP app to copy them to my PC/laptop before modifying where relevant and copying to flash on switch and to the wireless 'hotspot' folders on the NGS.
    I went through the following document in url below line by line, paragraph by paragraph and found that I had left out the following command in the configuration:
    aaa authentication login default group radius
    see doc at:
    http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_1.99/WebAuth/WebAuth_Dep_Guide.html#wp392553
    So I added it in and I am now seeing the radius debug traffic being redirected to the ACS by the switch when a user submits the credentials.
    aaa new-model
    aaa authentication login default group radius
    aaa authentication login VTY-USER-LOGIN local
    aaa authentication dot1x default group radius
    aaa authorization console
    aaa authorization exec EXEC-LOCAL local
    aaa authorization network default group radius
    aaa authorization auth-proxy default group radius
    aaa accounting auth-proxy default start-stop group radius
    aaa accounting dot1x default start-stop group radius
    with debug radius enabled:
    Feb  1 13:36:09 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/4, changed state to down
    TEST-802.1X#
    Feb  1 13:36:10 PST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/4, changed state to down
    TEST-802.1X#
    Feb  1 13:36:18 PST: %AUTHMGR-5-START: Starting 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    TEST-802.1X#
    Feb  1 13:36:20 PST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/4, changed state to up
    Feb  1 13:36:21 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/4, changed state to up
    TEST-802.1X#
    Feb  1 13:36:27 PST: %DOT1X-5-FAIL: Authentication failed for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID
    Feb  1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-5-START: Starting 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27.367 PST: RADIUS/ENCODE(0000058E):Orig. component type = DOT1X
    Feb  1 13:36:27.367 PST: RADIUS(0000058E): Config NAS IP: 10.167.64.74
    Feb  1 13:36:27.367 PST: RADIUS/ENCODE(0000058E): acct_session_id: 1421
    Feb  1 13:36:27.367 PST: RADIUS(0000058E): sending
    Feb  1 13:36:27.367 PST: RADIUS(0000058E): Send Access-Request to 10.167.77.70:1645 id 1645/14, len 211
    Feb  1 13:36:27.372 PST: RADIUS:  authenticator 2E F0 62 2D 43 D9 7D 2A - 7C 88 0A 52 B9 6E 78 A8
    Feb  1 13:36:27.372 PST: RADIUS:  User-Name           [1]   14  "848f69f0fcc7"
    Feb  1 13:36:27.372 PST: RADIUS:  User-Password       [2]   18  *
    Feb  1 13:36:27.372 PST: RADIUS:  Service-Type        [6]   6   Call Check                [10]
    Feb  1 13:36:27.372 PST: RADIUS:  Framed-MTU          [12]  6   1500                     
    Feb  1 13:36:27.372 PST: RADIUS:  Called-Station-Id   [30]  19  "20-37-06-C8-68-84"
    Feb  1 13:36:27.372 PST: RADIUS:  Calling-Station-Id  [31]  19  "84-8F-69-F0-FC-C7"
    Feb  1 13:36:27.372 PST: RADIUS:  Message-Authenticato[80]  18 
    Feb  1 13:36:27.372 PST: RADIUS:   11 20 B4 9A B6 E2 56 30 AC EC 43 CD 17 13 3E 14             [  V0C>]
    Feb  1 13:36:27.372 PST: RADIUS:  EAP-Key-Name        [102] 2   *
    Feb  1 13:36:27.372 PST: RADIUS:  Vendor, Cisco       [26]  49 
    Feb  1 13:36:27.372 PST: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0AA7404A0000054E16335518"
    Feb  1 13:36:27.372 PST: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    Feb  1 13:36:27.372 PST: RADIUS:  NAS-Port            [5]   6   50104                    
    Feb  1 13:36:27.372 PST: RADIUS:  NAS-Port-Id         [87]  22  "GigabitEthernet1/0/4"
    Feb  1 13:36:27.372 PST: RADIUS:  NAS-IP-Address      [4]   6   10.167.64.74             
    Feb  1 13:36:27.372 PST: RADIUS(0000058E): Started 5 sec timeout
    Feb  1 13:36:27.377 PST: RADIUS: Received from id 1645/14 10.167.77.70:1645, Access-Reject, len 38
    Feb  1 13:36:27.377 PST: RADIUS:  authenticator 68 CE 3D C8 C3 BC B2 69 - DB 33 F5 C0 FF 30 D6 33
    Feb  1 13:36:27.377 PST: RADIUS:  Message-Authenticato[80]  18 
    Feb  1 13:36:27.377 PST: RADIUS:   82 3D 31 0A C7 A2 E0 62 D5 B7 6B 26 B8 A0 0B 46            [ =1bk&F]
    Feb  1 13:36:27.377 PST: RADIUS(0000058E): Received from id 1645/14
    Feb  1 13:36:27 PST: %MAB-5-FAIL: Authentication failed for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-7-FAILOVER: Failing over from 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-5-START: Starting 'webauth' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'success' from 'webauth' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27 PST: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
    Feb  1 13:36:27.933 PST: RADIUS/ENCODE(0000058E):Orig. component type = DOT1X
    Feb  1 13:36:27.933 PST: RADIUS(0000058E): Config NAS IP: 10.167.64.74
    Feb  1 13:36:27.933 PST: RADIUS(0000058E): sending
    Feb  1 13:36:27.933 PST: RADIUS(0000058E): Send Accounting-Request to 10.167.77.70:1646 id 1646/151, len 100
    Feb  1 13:36:27.933 PST: RADIUS:  authenticator D0 F0 04 F3 A5 08 90 BE - A9 07 8D 32 1B 0E 93 AC
    Feb  1 13:36:27.933 PST: RADIUS:  Acct-Session-Id     [44]  10  "0000058D"
    Feb  1 13:36:27.933 PST: RADIUS:  Framed-IP-Address   [8]   6   10.167.72.52             
    Feb  1 13:36:27.933 PST: RADIUS:  Acct-Authentic      [45]  6   RADIUS                    [1]
    Feb  1 13:36:27.933 PST: RADIUS:  Acct-Status-Type    [40]  6   Start                     [1]
    Feb  1 13:36:27.933 PST: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    Feb  1 13:36:27.933 PST: RADIUS:  NAS-Port            [5]   6   50104                    
    Feb  1 13:36:27.933 PST: RADIUS:  NAS-Port-Id         [87]  22  "GigabitEthernet1/0/4"
    Feb  1 13:36:27.933 PST: RADIUS:  Service-Type        [6]   6   Framed                    [2]
    Feb  1 13:36:27.933 PST: RADIUS:  NAS-IP-Address      [4]   6   10.167.64.74             
    Feb  1 13:36:27.933 PST: RADIUS:  Acct-Delay-Time     [41]  6   0                        
    TEST-802.1X#
    Feb  1 13:36:27.938 PST: RADIUS(0000058E): Started 5 sec timeout
    Feb  1 13:36:27.938 PST: RADIUS: Received from id 1646/151 10.167.77.70:1646, Accounting-response, len 20
    Feb  1 13:36:27.938 PST: RADIUS:  authenticator C2 DC 8D C7 B1 35 67 D9 - 28 2B 56 E4 4A 1E AD 65
    At this point the user enters the credentials on the switch_login.html page and the clicks Submit on the Acceptable Use Policy splash page.
    TEST-802.1X#
    Feb  1 13:36:41.413 PST: RADIUS/ENCODE(0000058F):Orig. component type = AUTH_PROXY
    Feb  1 13:36:41.413 PST: RADIUS(0000058F): Config NAS IP: 10.167.64.74
    Feb  1 13:36:41.413 PST: RADIUS/ENCODE(0000058F): acct_session_id: 1422
    Feb  1 13:36:41.413 PST: RADIUS(0000058F): sending
    Feb  1 13:36:41.413 PST: RADIUS(0000058F): Send Access-Request to 10.167.77.70:1645 id 1645/15, len 176
    Feb  1 13:36:41.413 PST: RADIUS:  authenticator 6D 34 7E D6 34 B5 CB AC - 09 1F AC 5A 34 97 7D 6B
    Feb  1 13:36:41.413 PST: RADIUS:  User-Name           [1]   11  "testuser1"
    Feb  1 13:36:41.413 PST: RADIUS:  User-Password       [2]   18  *
    Feb  1 13:36:41.413 PST: RADIUS:  Calling-Station-Id  [31]  14  "ip|G
    Feb  1 13:36:41.413 PST: RADIUS:  Service-Type        [6]   6   Outbound                  [5]
    Feb  1 13:36:41.413 PST: RADIUS:  Message-Authenticato[80]  18 
    Feb  1 13:36:41.413 PST: RADIUS:   F8 4D 85 64 05 5E C9 1D D8 11 B2 A3 1A 3A 76 E0             [ Md^:v]
    Feb  1 13:36:41.413 PST: RADIUS:  Vendor, Cisco       [26]  49 
    Feb  1 13:36:41.418 PST: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0AA7404A0000054E16335518"
    Feb  1 13:36:41.418 PST: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    Feb  1 13:36:41.418 PST: RADIUS:  NAS-Port            [5]   6   50104                    
    Feb  1 13:36:41.418 PST: RADIUS:  NAS-Port-Id         [87]  22  "GigabitEthernet1/0/4"
    Feb  1 13:36:41.418 PST: RADIUS:  NAS-IP-Address      [4]   6   10.167.64.74             
    Feb  1 13:36:41.418 PST: RADIUS(0000058F): Started 5 sec timeout
    Feb  1 13:36:41.424 PST: RADIUS: Received from id 1645/15 10.167.77.70:1645, Access-Accept, len 173
    Feb  1 13:36:41.424 PST: RADIUS:  authenticator 28 48 DE B5 1A 0A 71 5A - 3B 8B 7A 12 FB EA 01 58
    Feb  1 13:36:41.424 PST: RADIUS:  User-Name           [1]   11  "testuser1"
    Feb  1 13:36:41.424 PST: RADIUS:  Class               [25]  28 
    Feb  1 13:36:41.424 PST: RADIUS:   43 41 43 53 3A 78 62 63 2D 61 63 73 2F 31 31 36  [CACS:xbc-acs/116]
    Feb  1 13:36:41.424 PST: RADIUS:   34 37 33 32 33 39 2F 31 36 36        [ 473239/166]
    Feb  1 13:36:41.424 PST: RADIUS:  Session-Timeout     [27]  6   3600                     
    Feb  1 13:36:41.424 PST: RADIUS:  Termination-Action  [29]  6   1                        
    Feb  1 13:36:41.424 PST: RADIUS:  Message-Authenticato[80]  18 
    Feb  1 13:36:41.424 PST: RADIUS:   10 80 26 5D 02 C5 15 0C A8 16 AA 35 14 C9 4F 14              [ &]5O]
    Feb  1 13:36:41.424 PST: RADIUS:  Vendor, Cisco       [26]  19 
    Feb  1 13:36:41.429 PST: RADIUS:   Cisco AVpair       [1]   13  "priv-lvl=15"
    Feb  1 13:36:41.429 PST: RADIUS:  Vendor, Cisco       [26]  65 
    Feb  1 13:36:41.429 PST: RADIUS:   Cisco AVpair       [1]   59  "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-GuestACL-4eefc9a0"
    Feb  1 13:36:41.429 PST: RADIUS(0000058F): Received from id 1645/15
    Feb  1 13:36:41.439 PST: RADIUS/ENCODE(0000058F):Orig. component type = AUTH_PROXY
    Feb  1 13:36:41.439 PST: RADIUS(0000058F): Config NAS IP: 10.167.64.74
    Feb  1 13:36:41.439 PST: RADIUS(0000058F): sending
    Feb  1 13:36:41.439 PST: RADIUS/ENCODE(00000000):Orig. component type = INVALID
    Feb  1 13:36:41.444 PST: RADIUS(00000000): Config NAS IP: 10.167.64.74
    Feb  1 13:36:41.444 PST: RADIUS(00000000): sending
    Feb  1 13:36:41.450 PST: RADIUS(0000058F): Send Accounting-Request to 10.167.77.70:1646 id 1646/152, len 119
    Feb  1 13:36:41.450 PST: RADIUS:  authenticator 23 E3 DA C3 06 5B 37 20 - 67 E2 96 C5 90 1C 71 33
    Feb  1 13:36:41.450 PST: RADIUS:  Acct-Session-Id     [44]  10  "0000058E"
    Feb  1 13:36:41.450 PST: RADIUS:  Calling-Station-Id  [31]  14  "10.167.72.52"
    Feb  1 13:36:41.450 PST: RADIUS:  User-Name           [1]   11  "testuser1"
    Feb  1 13:36:41.450 PST: RADIUS:  Acct-Authentic      [45]  6   RADIUS                    [1]
    Feb  1 13:36:41.455 PST: RADIUS:  Acct-Status-Type    [40]  6   Start                     [1]
    Feb  1 13:36:41.455 PST: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    Feb  1 13:36:41.455 PST: RADIUS:  NAS-Port            [5]   6   50104                    
    Feb  1 13:36:41.455 PST: RADIUS:  NAS-Port-Id         [87]  22  "GigabitEthernet1/0/4"
    Feb  1 13:36:41.455 PST: RADIUS:  Service-Type        [6]   6   Outbound                  [5]
    Feb  1 13:36:41.455 PST: RADIUS:  NAS-IP-Address      [4]   6   10.167.64.74             
    Feb  1 13:36:41.455 PST: RADIUS:  Acct-Delay-Time     [41]  6   0                        
    Feb  1 13:36:41.455 PST: RADIUS(0000058F): Started 5 sec timeout
    Feb  1 13:36:41.455 PST: RADIUS(00000000): Send Access-Request to 10.167.77.70:1645 id 1645/16, len 137
    Feb  1 13:36:41.455 PST: RADIUS:  authenticator 02 B0 50 47 EE CC FB 54 - 2A B6 14 23 63 86 DE 18
    Feb  1 13:36:41.455 PST: RADIUS:  NAS-IP-Address      [4]   6   10.167.64.74             
    Feb  1 13:36:41.455 PST: RADIUS:  User-Name           [1]   31  "#ACSACL#-IP-GuestACL-4eefc9a0"
    Feb  1 13:36:41.455 PST: RADIUS:  Vendor, Cisco       [26]  32 
    Feb  1 13:36:41.455 PST: RADIUS:   Cisco AVpair       [1]   26  "aaa:service=ip_admission"
    Feb  1 13:36:41.455 PST: RADIUS:  Vendor, Cisco       [26]  30 
    Feb  1 13:36:41.455 PST: RADIUS:   Cisco AVpair       [1]   24  "aaa:event=acl-download"
    Feb  1 13:36:41.455 PST: RADIUS:  Message-Authenticato[80]  18 
    Feb  1 13:36:41.455 PST: RADIUS:   15 EC 10 E7 2F 67 33 DD BC B5 AE 11 E3 C3 19 E1               [ /g3]
    Feb  1 13:36:41.455 PST: RADIUS(00000000): Started 5 sec timeout
    Feb  1 13:36:41.455 PST: RADIUS: Received from id 1646/152 10.167.77.70:1646, Accounting-response, len 20
    Feb  1 13:36:41.455 PST: RADIUS:  authenticator AB 0F 81 95 71 A9 61 E0 - 5B B5 D3 2E 8D A2 68 98
    Feb  1 13:36:41.460 PST: RADIUS: Received from id 1645/16 10.167.77.70:1645, Access-Accept, len 560
    Feb  1 13:36:41.460 PST: RADIUS:  authenticator 64 53 94 79 CF CD 05 B0 - ED 12 5C 5B A0 AB 4F FA
    Feb  1 13:36:41.460 PST: RADIUS:  User-Name           [1]   31  "#ACSACL#-IP-GuestACL-4eefc9a0"
    Feb  1 13:36:41.460 PST: RADIUS:  Class               [25]  28 
    Feb  1 13:36:41.460 PST: RADIUS:   43 41 43 53 3A 78 62 63 2D 61 63 73 2F 31 31 36  [CACS:xbc-acs/116]
    Feb  1 13:36:41.460 PST: RADIUS:   34 37 33 32 33 39 2F 31 36 38        [ 473239/168]
    Feb  1 13:36:41.460 PST: RADIUS:  Message-Authenticato[80]  18 
    Feb  1 13:36:41.460 PST: RADIUS:   A1 E6 37 EB 60 3A 28 35 92 56 C5 A9 27 7D 2C E9         [ 7`:(5V'},]
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  38 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   32  "ip:inacl#1=remark **Allow DHCP"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  57 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   51  "ip:inacl#2=permit udp any eq bootpc any eq bootps"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  37 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   31  "ip:inacl#3=remark **Allow DNS"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  47 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   41  "ip:inacl#4=permit udp any any eq domain"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  61 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   55  "ip:inacl#5=remark **Deny access to Corporate Networks"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  53 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   47  "ip:inacl#6=deny ip any 10.0.0.0 0.255.255.255"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  45 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   39  "ip:inacl#7=remark **Permit icmp pings"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  38 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   32  "ip:inacl#8=permit icmp any any"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  50 
    TEST-802.1X#
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   44  "ip:inacl#9=remark **Permit everything else"
    Feb  1 13:36:41.460 PST: RADIUS:  Vendor, Cisco       [26]  37 
    Feb  1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   31  "ip:inacl#10=permit ip any any"
    Feb  1 13:36:41.465 PST: RADIUS(00000000): Received from id 1645/16
    TEST-802.1X#
    TEST-802.1X#
    TEST-802.1X# 
    interface config looks like:
    interface GigabitEthernet1/0/4
    description **User/IPphone/Guest
    switchport access vlan 702
    switchport mode access
    switchport voice vlan 704
    ip access-group PRE-AUTH in
    srr-queue bandwidth share 1 30 35 5
    queue-set 2
    priority-queue out
    authentication event fail action next-method
    authentication event server dead action authorize
    authentication host-mode multi-auth
    authentication open
    authentication order dot1x mab webauth
    authentication priority dot1x mab webauth
    authentication port-control auto
    authentication fallback WEB_AUTH_PROFILE
    mab
    mls qos trust device cisco-phone
    mls qos trust cos
    dot1x pae authenticator
    dot1x timeout tx-period 3
    auto qos voip cisco-phone
    spanning-tree portfast
    service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY

  • NAC Integrated with Guest Server

    Hi all,
    I encountered a problem which happened when I integrated NAC with Guest Server.
    Hope I can find solution here!
    When I create an account in Guest Server, the account will also be created in NAC as local user.
    If I chose "Time Profile - Start-End", the account will be created in NAC.
    But if I chose "Time Profile - from First Login", the account will not be created in NAC.
    So the guest can't login with this account using "Time Profile - from First Login".
    All the configuration in the document including "Radius Client and Accounting" was correctly configured.
    But I still can't find the solution.
    Please answer me if you know the answer. Thanks a lot!!!!
    Jet Li
    Taiwan SI

    Hi Jet Li,
    This should be expected since only time profiles with start-end are supported when integrating NGS with the NAC Appliance solution:
    http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/g_guestpol.html#wp1063409
    "Cisco NAC Guest Server Version 2.0 supports only start/end and from creation profiles when used with Cisco NAC Appliances"
    Regards,
    Fede
    If  this helps you and/or answers your question please mark the question as  "answered" and/or rate it, so other users can easily find it.

  • ACS 4.1 support with Windows Server 2012 Domain controller

    I am upgrading my Domain Controller / Active Directory from Windows Server 2003 to Windows Server 2012.
    In my environment, I am using Cisco ACS 4.1 which is integrated with Windows Server 2003 Active Directory.
    Will ACS4.1 will work fine with my new domain controller (Windows server 2012) or I need to upgrade my ACS too?
    Regards,
    Junaid

    Junaid,
    ACS 4.x code doesn't even support Windows 2008 R2. Your best bet is to migrate the ACS from 4.x to ACS 5.4 Patch 2 or stay with windows 2003 or 2008 (Non-R2).
    ACS 5.4 patch 2 supports Windows 2012 AD.
    http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-4/release/notes/acs_54_rn.html
    Regards,
    Jatin
    **Do rate helpful posts**

  • Scenario related to NAC server with hight availabily

    Hello
    am looking for good scenario related to NAC server with hight availabily, mentioned the how it works,how the phisical coonection could be to each Core?what is the P-service..
    Thanks for ur time

    Hi,
    Here's the documentation regarding the HA setup:
    http://www.cisco.com/en/US/customer/docs/security/nac/appliance/installation_guide/hardware/47/hi_ha.html
    http://www.cisco.com/en/US/customer/products/ps6128/products_configuration_example09186a00808fbc0f.shtml
    HTH,
    Faisal

  • Three NAC server deployment

    Hello guys,
    Could you suggest a workaround to bypass the HA limitation of only two NAC servers. 
    The problem is we already had two NAC guest servers in active/active mode but now we have a third one at a new branch, which would need to share the same user DB.
    Is there a way to replicate the data from the cluster to this remote NAC server?
    The idea is achieving a scenario like working with multiple ACS servers distribuited worldwide and sharing the same user data.
    Thanks,
    Lucas

    Hi,
    Assuming the CAM has failed, the CAS would allow all traffic from the AUTH VLAN to the ACCESS VLAN. Since the CAM has failed, the switchports which are not in the AUTH VLAN would behave per the rules/ACLs on the VLAN they're in and won't get flipped over.
    HTH,
    Faisal

  • Cisco NAC server hang issue

    Hi All Cisco NAC Experts,  I am currently experiencing a Cisco NAC NAC3315-SVR hang issue.
    The issue was already happened for few time on the same server and the symptom when NAC server hung includes no response to ICMP ping, no response to SSH request, no response for access request to CAS management page via https, HA pair was detected down from its HA neighbor and triggered failover to secondary CAS.
    The CAS server was recovered after manually power cycle the hardware. 
    After went through the attachment CAS logs, I found all the services and logging service were stopped when the issue happening but unfortunately there is no any suspicious activity was logged down before or during the issue happening.
    I have also tried to search on Cisco Bug Toolkit but no similar case was found, I believe it was not caused by software bug due to the software version 4.8.1 is running in my company for years and only one CAS server having the issue.
    That will be great if any one can help me out for the same.
    Thanks,
    Eric

    Hi Bro
    This could be a problem with the certificate in that Cisco NAC appliance itself. My suggestion is to redo the certificate generation between the CAS CAM and CA Server. If this still doesn’t work, it could also be due to overload/broadcast storm on the LAN portion. This can be verified via Wireshark.
    If all else fail, then a hardware swap would seem like the next best thing.

  • SYMANTEC 10 with NAC

    Hi,
    I have a problem with a Windows XP station with SP2 in the NAC DOT1X environment. I've already installed the SYMANTEC ADF file in ACS with success.
    After I've installed the SYMANTEC client v. 10.1.0.394 in the XP station, it don't put any file and directory \Program Files\Common Files\PostureAgent\Plugins\Install.
    So, CTA client can't read the files into the directory to indentify the attributes of SYMANTEC to send to ACS 4.0.
    The Posture Validation of OS, service packs and hotfixes works fine in the NAC solution. I'm just have problem with the SYMANTEC.
    Does anyone can help me?
    Tks

    Hi!
    If I did undersand well, you need to install Symantec Client Security Posture Plugin, which can be found on Symantec Corporate AV installation media.
    Can you share what ADF file have you used? On CD can be found only AVPs for Symantec FW and one more thing I can't remember, but AFAIK it's not AV, and both unsupported.
    So second problem is you have possibly wrong AVPs installed.
    However, I am not Symantec guru, maybe I am wrong. Mybe someone else could clarify, or tell us where to find Symantec docs for Cisco NAC, because I didn't find anything.
    Enjoy!
    Astib

  • NAC server is not available on the network

    I am doing a rollout of ISE 1.1.1. I am using NAC agent 4.9.0.47 for posture checking win7 x86 machines. Occassionly users are getting 'NAC server is not availble.... try disconecting and connecting to the network to start a new connection' When I  try to reproduce the issue it is not happening. It happens randomly here and there. What are the possible reasons fro this issue. Since ISE is not getting posture result, and the machine remain in in posture check 'unknown' stage. I am in half way of rollout and it is stoping me to further rollout. IIf anybody knows, please advise.........

    Hi,
    I had the same issue and upgrading to 1.1.2 made the issue quiet down a bit. I have a few reported issues but havent seen any in the past 2 weeks. Also which supplicant is the client running and do they see these on the laptops or machines that have both wired and wireless connections?
    The reason I ask is that the native windows supplicant tends to connect to both networks (wired and wireless), this can can cause some problems with the NAC agent if the link for the wired or "the lower metric route" flaps.
    the bug cisco provided me is related to "CSCuc70607".
    Hope this helps,
    Tarik Admani
    *Please rate helpful posts*

  • Cisco ACS 4.2 - Server Busy

    Hi!
    We're authenticating our Desktops and IP-Phones via 802.1x using two Radius-servers running Cisco ACS v4.2 on Win2k8.
    From time to time we run into the problem, that one of the servers 'get's too busy' and stops answering authentication requests. That results in many failed authentications with our VoIP-phones (Siemens OpenStage).
    What I don't understand is why the ACS acts that way...
    TAC says that all 42 or so threads are in use when the server says it's too busy.
    While the server is 'busy' the CPU runs at 1 - 2 % !! And there's loads of RAM left...
    This is an extract from the CSRadius-Log-File:
    RDS 06/09/2011 07:51:13 E 1495 2072 0x0 Server too busy - request from 10.104.204.249 ignoredRDS 06/09/2011 07:51:13 E 1495 5124 0x0 Server too busy - request from 10.104.204.249 ignoredRDS 06/09/2011 07:51:13 E 1495 5124 0x0 Server too busy - request from 10.100.204.22 ignoredRDS 06/09/2011 07:51:13 E 0958 3712 0x0 Error processing accounting request - no response sent to NASRDS 06/09/2011 07:51:13 E 5947 4916 0x0 Failed to update logged on list for IPPhone (UDB_SERVER_BUSY)RDS 06/09/2011 07:51:13 E 1495 5124 0x0 Server too busy - request from 10.100.204.22 ignoredRDS 06/09/2011 07:51:13 E 0958 1880 0x0 Error processing accounting request - no response sent to NASRDS 06/09/2011 07:51:13 E 6025 3560 0x0 Matching class attribute failed for user IPPhone, no further processing will be done assuming this is out-of-order packet due to UDPRDS 06/09/2011 07:51:13 E 1825 1532 0x0 Error UDB_SERVER_BUSY authenticating host/hostname.xxx.yyy - no response sent to NAS...RDS 06/09/2011 07:51:20 E 3089 2704 0x0 Error AS_NO_FREE_CONNECTIONS authenticating IPPhone - no response sent to NAS
    Did any of you encounter the same problem? Did you find a workaround or fix? Maybe there's a way to increase the number of authentication threads?
    Thanks alot!

    The key is to get all of the information needed. Normally when they say it takes too long for the client to answer that is not always the exact fault.
    You may seem to get that answer if the ACS is taking a long time to process the request and the switch or client has basically timed out its requests.
    The information needed is the following
    all of these items really need to be gathered at the same time
    switch debugs including
    debug radius
    debug aaa authen
    debug aaa accounting
    sniffer capture between the switch and the ACS
    logs from ACS with debugs enabled.
    If you are going to AD on the backend you may also want a sniffer capture between the ACS and the AD
    all of these together should tell you where the delay of failure lays and then at that time some changes can be suggested

  • Antivirus issue with NAC

    hello,
    i am currently using Microworld Escan antivirus corporate edition 8.0 antivirus server integrated with NAC in the network. I am planning to upgrade the antivirus server from Corporate edition 8.0 to Corporate edition 11.0. As per cisco document, Currently cisco NAC support only Escan Corporate for windows version 8.x only. which means version 11.x is not supported. I want to know,whether cisco will include support for escan corporate edition 11.x with NAC,even in future.
    waiting for reply!!!!!!!!!!!!!!!
    regards !!!!!!!!!

    Hello,
    Here are the links to the Windows and MacOS supported AV/AS on NAC 4.8.2:
    http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/48/WinAV-AS-vers86.pdf
    http://www.cisco.com/en/US/docs/security/nac/appliance/release_notes/48/MacOSXAV-AS-ver9.pdf
    Regards.

  • ACS with dot1x

    Hi all, i am trying to collect infos for a future ACS network management and i have some questions that i can´t find answers.
    It is possible to authenticate users in the wired interfaces and redirect them to diferent VLANs based on their attributes?
    If any Cisco member have any type of usefull document with configs for ACS plus NAC Apliances (Profiler/Collector) to manage authentications on a switched LAN, i would apreciate sharing.
    (I´ve searched alot, but all info are a litle dispersed and i can´t mount the puzzle)
    Best Regards,

    Hi.
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_configuration_examples_list.html
    Read specially the topic 'Wired Dot1x Version 1.05 Configuration Guide'
    Complication arises mostly on installing certificate to enable PEAP or TLS which are the authentication method you need for dot1x to authenticate using external database i.e. AD

Maybe you are looking for

  • Easy example not so easy!

    on the grails+flex plugin site: http://grails.org/Flex+Plugin it says that integrating flex and grails is SO easy, but i can't get the simple example to work! (i'm using MAC OS X) here is EXACTLY what i've tried: 1-in my workspace, from the terminal

  • AOL: deleted mail on laptop is not reflected in iTouch mail

    My wife will read HER AOL e-mail on her iTouch when she is out at the office. Then later when she is home she will read her AOL e-mail via her MacBook and THEN delete messages from AOL via her main account. Yet, when she updates the mail on her iTouc

  • Where to best allocate my Mac Pro funds...?

    I'm about to upgrade to the new tower and to Logic X. I need some advice on the macpro configuration. Where should I spend more if I'm focusing completely on Logic X? memory, PCIe flash storage or core count? Everything seems to be different with the

  • Help .. save my php forum

    I have a G4 running OS X.4 and managed to set up php and then install phorum to act as a forum for a bike club web site. I followed a group of instructiions religiously and all has worked well for a year until i upgraded the machine to 10.4.4 the fol

  • Is any expert here?Please help!

    Hi, I want to retrieve data from vector to Jlist and TextFileds. Here is the situation: The vector likes this: {[string1,string2,string3], [string11,string12,string13],...}.So,how can I put string1 to Jlist, string2 to JTextField1, and string3 to JTe