ASA and ACS 5 multiple VPN profiles for one user

Hi there
I have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:
ACS 5.3 group hierarchy:
- VPN users global
-- VPN users A
-- VPN users B
ASA VPN profiles:
- VPN profile A
- VPN profile B
- VPN profile Z
VPN authorizations:
1. VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles)
2. VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A)
3. VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)
Thanks a lot in advance and best regards
Dominic

Hi Dominic,
first of all, let's clarify that on the ASA you have tunnel-groups (named connection profiles in ASDM) and group-policies. These often, but not always, have a one-to-one mapping.
The Tunnel-Group (TG) is either selected by the user (either from a drop down list or by entering a specifiv group-url), or automatically selected by a certificate map (i.e. based on a certain field in the user cert, the user is mapped to one TG or another). The TG mainly specifies what kind of authentication is used.
The Group-Policy (GP) by default is the one specified in the TG, but it can be overridden by e.g. Radius.
So from the ASA's standpoint itself your posibilities are rather limited: the ASA will just apply whatever group-policy you push from Radius (in IETF attribute 25 aka "Class"), and in addition it will deny access to a user if the TG he selected does not match the value of the group-lock attribute. Group-lock can only contain one TG name, so you cannot do something like "allow both B and Z".
In other words you can not achieve your goal if the Radius server has a "static" set of attributes per user.
However, as of ASA 8.4.3 the ASA now sends 2 vendor-specific attributes in the Access-Request:
vendor ID = 3076, attribute 146 is "Tunnel Group Name" (string).
vendor ID = 3076, attribute 150 is "Client Type" (integer)
0 = No Client specified 1 = Cisco VPN Client (IKEv1) 2 = AnyConnect Client SSL VPN 3 = Clientless SSL VPN 4 = Cut-Through-Proxy 5 = L2TP/IPsec SSL VPN 6 = AnyConnect Client IPsec VPN (IKEv2)
So if you can configure the Radius server to "dynamically" permit/deny access based on the TG attribute I suppose you could achieve what you want.
If/how ACS can do this, I personally don't know; I suggest you ask in the AAA forum if you need help with that part.
hth
Herbert

Similar Messages

Multiple database instance for one user in Oracle XE

Hello,
I would like to know if there is a way to create more than one database/schema for the same user in Oracle XE.
Thanks.

And i say...
yes, indeed.. you can find out some info here..
http://www.oracle.com/technology/pub/articles/cunningham-database-xe.html

IE 11 Enhanced Security improperly enabled for one user in domain

I'm running a small network with two domain controllers which use Server 2008 R2 Standard. The clients all run Windows 7 with the latest updates. Today one user suddenly started having their browser always start in Enhanced Security mode on the Windows
7 clients! This happens for any client in the domain, but it does not happen when then user logs into the terminal server for the domain. I use roaming profiles and redirected folders. I have separate profiles for the Terminal server from those used for the
local computers. I have restored the user's profile to last week when the problem was not happening, but it did not help. It does not happen for any other user in the network, even if the user logs in on the same computer. So there is something in the user's
environment that is causing the problem. I have reset IE 11 to default and it still comes up in with Enhanced Security for that user on the Windows 7 clients. I've searched the internet for this problem without success.

So I figured this out. I think that it is a mis-feature in Server 2008. The particular user is a member of the Backup Operators security group on the domain. Recently they did a backup on the server and then this problem started.
It appears that even though they are not a server administrator or a domain administrator, the Enhance Security settings got put into their roaming profile and when they logged into their workstation, the settings got applied to IE on their workstation.
If I turned of Enhance Security on the server for only users, the problem still happened for this user, even though they are only a Backup Operator, not an administrator. If I turned off Enhanced security on the server for administrators, logged in and out
of the server as this user, then the problem went away.
So it seems that Backup Operators are viewed as "administrators" by Enhanced Security and if you use roaming profiles for such users, Enhanced Security will be enabled for such users on their workstations. Yuck.
Easiest solution is probably to have a separate user account for the backup role on the server.

Multiple apple dropboxes for one account

Can you have multiple apple dropbox accounts in the public folder for one user account? EX: instructor account and 3 different public dropboxes for 3 different users on the same instructor account? Using mountain lion and the users are not mac (computer) experts they are just "users"

You don't need to create two separate libraries.
If you want to sync different content onto each device, select the device in iTunes, select the tabs across the top and sync what you want.
To make it easier, create different playlists for each device and sync only those playlists.

How do I use the same profile for two users on the same computer

I use my laptop both at home and at work. And in each venue I use a different user log on. But I wish to have firefox use the same profile for each user log on. How can I get firefox to point to the same profile for each user?

Note that only one user (Firefox instance) can use a profile folder at the time, so if you would switch the Windows user to another account then you would first have to close Firefox.
* http://kb.mozillazine.org/Creating_a_new_Firefox_profile_on_Windows
* http://kb.mozillazine.org/Shortcut_to_a_specific_profile
* http://kb.mozillazine.org/Using_multiple_profiles_-_Firefox
* http://kb.mozillazine.org/Bypassing_the_Profile_Manager

How to FaceTime and iMessage on multiple apple devices with one iTunes account

We recently received iPad 2's for Christmas and was looking for some advice on how to FaceTime and iMessage on multiple apple devices with One iTunes Account (Apple Id). I have created or attached other e-mail addresses to our apple id but do not know how to use them on the new devices. Our home MacBook Pro uses our main apple id for FaceTime. The iPads have been setup with the main apple id w/o being able to use FaceTime and iMessage.
Please Help...
I appreciate the help and support.

P and V-
If you are trying to connect to someone with a different Apple ID, I think all the devices should work, but one at a time.
The problem is when you try to connect between two with the same Apple ID. Once the calling device tries to make the connection, it finds the second device to be "busy". That is where each needs to use a different E-Mail address when setting it up.
On iOS devices, when you press the Home button to exit an App, the App may still be active in the background, even when the device is sleeping. If FaceTime or iMessage is merely being active that way, it may be enough to "tie up" the E-Mail address.
From the Home screen, double click your Home button. You will see a list of recent Apps along the bottom of the screen. Press and hold on one of them until they start to wiggle. You will then see a red minus sign on each. Pressing the minus sign will remove an App from the list, and stop it from working in the background. (Click the Home button to stop the wiggling, and again to hide the recent Apps.)
Fred

Multiple free goods for one item in standalone CRM

Hi Gurus,
We are trying to implement multiple free goods for one item in standalone CRM.
As per SAP.help.com, it says that we can configure multiple free goods scenario in standalone CRM system.
We tried to set up this in our system. Basically we want to implement the scenario, where a user wants to purchase item A, he should get a prompt for choosing between two free goods B and C.
We did the relevant IMG settings required for Free goods at IMG ->CRM -> Basic Functions -> Free Goods.-> Set up Free Goods
We also did the relevant item category determination where we have made an entry with
Item Usage = " Free Goods" , Main item cat. = "TAN' , Item Category = "TANN".
Now we went to create condition records in the path "SAP Menu -> Master Data -> Prices and Conditions -> SAPCND/GCM - Maintain condition"
We chose Application ="PRT", MaintenanceGrp="PRT_FGOODS", Maintenance context ="GCM"
Then while creating conditon records , when I try to create two condition records where the Main Product is same but free good product is different, the system is not allowing to save these two condition records.
it is giving error "Overlapping validity periods for two condition records".
Please advice, if i am missing something. Thanks in advance for your help.
thanks,
Randhir
Edited by: Randhir Soni on Feb 8, 2010 8:12 AM

Constraints in free goods in R3 taken from SAP library
Free goods can only be supported on a 1:1 ratio. This means that an order item can lead to a free goods item. Agreements in the following form are not supported: u2018With material 1, material 2 and material 3 are free of chargeu2018 or u2018If material 1 and material 2 are ordered at the same time, then material 3 is free of chargeu2018.
Free goods are not supported in combinations with material structures (for example, product selection, BOM, variants with BOM explosion).
Free goods are only supported for sales orders with document category C (for example, not quotations).
Free goods are not supported for deliveries without reference to a sales order.
Free goods cannot be used in make-to-order production, third-party order processing and scheduling agreements.
If you defined a free goods for variants in a generic article (only SAP Retail), you can only process the variants in the purchase order and goods receipt individually (as single articles). In other words, you cannot process them using the generic article matrix.
This answers your qn Not possible in R3
If you are on Retail scenario this is possible thro bonus buy schemes
But a lot of customizations needs to be done and you need a retail server to do that
Regards
Raja

Multiple free goods for one main material

Hello SAP Gurus,
we have a business requirement that to issue multiple free products for one main product, if the upliftment is beyond the specified quantity.
Using free goods functionality, is it possible to achive the above requirement.
e.g                                                     Quantity
main product        123456                         10
free goods             xxxxx                           2
free goods             yyyyy                           1
is it possible to maintain such data thru free goods or any development needs to be done.
regards
Casimer

Constraints in free goods in R3 taken from SAP library
Free goods can only be supported on a 1:1 ratio. This means that an order item can lead to a free goods item. Agreements in the following form are not supported: u2018With material 1, material 2 and material 3 are free of chargeu2018 or u2018If material 1 and material 2 are ordered at the same time, then material 3 is free of chargeu2018.
Free goods are not supported in combinations with material structures (for example, product selection, BOM, variants with BOM explosion).
Free goods are only supported for sales orders with document category C (for example, not quotations).
Free goods are not supported for deliveries without reference to a sales order.
Free goods cannot be used in make-to-order production, third-party order processing and scheduling agreements.
If you defined a free goods for variants in a generic article (only SAP Retail), you can only process the variants in the purchase order and goods receipt individually (as single articles). In other words, you cannot process them using the generic article matrix.
This answers your qn Not possible in R3
If you are on Retail scenario this is possible thro bonus buy schemes
But a lot of customizations needs to be done and you need a retail server to do that
Regards
Raja

How to open multiple sessions for one user?

Sorry for the silly question but I couldn't find it googling or searching through this forum, so I started wondering whether it's possible in SQL Developer to open multiple sessions for one user. I'm fairly new to SQL Developer and databases in general.
When I open SQL Developer and connect to a schema, a worksheet opens named MYSCHEMA. If I disconnect then connect, another worksheet opens, named MYSCHEMA~1. I assumed these were different sessions, but if I enter into one worksheet:
select col1 from my_table where row_id = 1
-- shows result is 1
update my_table set col1 = 0 where row_id = 1
select col1 from my_table where row_id = 1
-- shows result is 0and then enter into the second worksheet:
select col1 from my_table where row_id = 1
-- shows result is 0I would have expected the second worksheet to report 1 because the first worksheet did not issue a COMMIT. Thus, I'd guess both worksheets are the same session? Is that right? If so, how do I have two sessions open simultaneously (opened by same user)?
I'm trying to implement the code at the bottom of this post, for which testing requires at least two sessions:
Re: Help with Procedure
Edited by: tem on Apr 18, 2012 6:44 AM

Thanks Jim,
Ctrl-Shift-N doesn't do anything for me. I'm on a mac -- by experimenting it looks like command-N does what you're looking for. This appears to be the same as left-clicking on the "New" icon in the top left corner of SQL Developer, or selecting from the pull-down menu, File > New.
This opens "Create a New" window that appears to be a wizard. What would I select at this point? Options are: Database Connection, Table, View, Package, ...
I don't see an option for "Worksheet".
UPDATE:
OK, I found that if I select "SQL File", a worksheet becomes available. Perhaps this is what you intended. However, when I issue the command
select col1 from my_table where row_id = 1;it still returns 0 instead of 1. Hmm, maybe my initial assumption was wrong -- if this is a second (e.g. different) session, should I expect the changes made in the first session in SQL Developer (the UPDATE command) WITHOUT a commit, to be observed in this second session? I thought that changes made in one session were not viewable in a different session until these changes are committed in the first session? If so, how to show this in SQL Developer? I must be missing something basic here.
Or, is SQL Developer issuing some sort of "auto-commit" without my knowledge?
Edited by: tem on Apr 18, 2012 8:00 AM

How can i found out parner profile for one of my purchase order number

I am having 4500000000 purchase order in our client.From this purchase order how can I find out the partner profile.I am using F4 in messages-partner field it is showing no records found for this.input.So how can I find out partner profile for one of our client.

Try the other methods of:
- iOS: How to find the serial number, IMEI, MEID, CDN, and ICCID number

An internal error occurred on the report server. See the error log for more details. (rsInternalError) Get Online Help The profile for the user is a temporary profile. (Exception from HRESULT: 0x80090024)

An internal error occurred on the report server. See the error log for more details. (rsInternalError) Get Online Help The profile for the user is a temporary profile. (Exception from HRESULT: 0x80090024)
while proview the report i will get this error am using sql server 2008R2,
can u plesae hlep me out for this

<Header>
<Product>Microsoft SQL Server Reporting Services Version 2009.0100.1600.01 ((KJ_RTM).100402-1539 )</Product>
<Locale>English (United States)</Locale>
<TimeZone>W. Europe Standard Time</TimeZone>
<Path>C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVEREPORT\Reporting Services\Logfiles\ReportServerService__01_30_2015_03_09_32.log</Path>
<SystemName>WEGDACM1</SystemName>
<OSName>Microsoft Windows NT 6.1.7601 Service Pack 1</OSName>
<OSVersion>6.1.7601</OSVersion>
<ProcessID>4880</ProcessID>
<Virtualization>Hypervisor</Virtualization>
</Header>
rshost!rshost!5e4!01/30/2015-03:09:32:: i INFO: Currently registered url http://+:80/ReportServer_MSSQLSERVEREPORT/ on endpoint 2
rshost!rshost!5e4!01/30/2015-03:09:32:: e ERROR: Failed to register url=http://+:80/Reports/ for endpoint 3, error=b7.
rshost!rshost!5e4!01/30/2015-03:09:32:: w WARN: Endpoint 3 is enabled but no url is registered for vdir=/Reports, pdir=C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVEREPORT\Reporting Services\ReportManager.
servicecontroller!DefaultDomain!1e30!01/30/2015-03:09:32:: e ERROR: Error creating HTTP endpoint. System.Runtime.InteropServices.COMException (0x800700B7): Cannot create a file when that file already exists. (Exception from HRESULT: 0x800700B7)
at Microsoft.ReportingServices.HostingInterfaces.IRsUnmanagedCallback.CreateHttpEndpoint(RsAppDomainType application, String[] urlPrefixes, Int32 cPrefixes, String[] hosts, Int32 cHosts, Boolean wildCardPresent, String virtualDirectory, String
filePath, Int32 authType, Int32 logonMethod, String authDomain, String authRealm, Boolean authPersist, Int32 extendedProtectionLevel, Int32 extendedProtectionScenario, Boolean enabled)
at Microsoft.ReportingServices.Library.ServiceAppDomainController.SetWebConfiguration(RunningApplication rsApplication, Boolean enabled, String folder)
rshost!rshost!65c!01/30/2015-03:09:32:: i INFO: Endpoint 4 is disabled and no url is registered vdir=/ReportServer_MSSQLSERVEREPORT/ReportBuilder, pdir=C:\Program Files\Microsoft SQL Server\MSRS10_50.MSSQLSERVEREPORT\Reporting Services\ReportServer\ReportBuilder.
rshost!rshost!1e30!01/30/2015-03:09:32:: i INFO: Derived memory configuration based on physical memory as 16776696 KB
servicecontroller!DefaultDomain!1e30!01/30/2015-03:09:32:: i INFO: Recycling the service from the default domain
rshost!rshost!1e30!01/30/2015-03:09:46:: i INFO: Application domain type WindowsService statistics: created: 7, unloaded: 7, failed: 0, timed out: 0.
appdomainmanager!DefaultDomain!1e30!01/30/2015-03:09:46:: i INFO: Appdomain:11 WindowsService_7 started.
library!WindowsService_7!1e30!01/30/2015-03:09:46:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: No DSN present in configuration file, Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException:
The report server has encountered a configuration error. ;
servicecontroller!WindowsService_7!1e30!01/30/2015-03:09:46:: e ERROR: Error initializing configuration from the database: Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: The report server has encountered a configuration
error.
resourceutilities!WindowsService_7!1e30!01/30/2015-03:09:47:: i INFO: Reporting Services starting SKU: Enterprise
servicecontroller!WindowsService_6!1e30!01/30/2015-03:09:47:: i INFO: Service controller exiting.
appdomainmanager!DefaultDomain!1e30!01/30/2015-03:09:47:: i INFO: Appdomain:10 unregistered.
appdomainmanager!DefaultDomain!1e30!01/30/2015-03:09:47:: i INFO: Appdomain:10 WindowsService_6 unloading.
appdomainmanager!DefaultDomain!1f40!01/30/2015-03:09:47:: i INFO: AppDomain:10 0 pending unload(s)
library!WindowsService_7!2410!01/30/2015-03:09:47:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: No DSN present in configuration file, Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException:
The report server has encountered a configuration error. ;
library!WindowsService_7!2410!01/30/2015-03:09:47:: e ERROR: ServiceStartThread: Exception caught while starting service. Error: Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: The report server has encountered a configuration
error.
library!WindowsService_7!2410!01/30/2015-03:09:47:: e ERROR: ServiceStartThread: Attempting to start service again...
library!DefaultDomain!202c!01/30/2015-08:04:43:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: No DSN present in configuration file, Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException:
The report server has encountered a configuration error. ;
library!DefaultDomain!202c!01/30/2015-08:25:26:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: No DSN present in configuration file, Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException:
The report server has encountered a configuration error. ;
library!DefaultDomain!202c!01/30/2015-08:26:16:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: No DSN present in configuration file, Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException:
The report server has encountered a configuration error. ;
The above is my log file pls find it resolve my problem,am trying to add the encryption key to my configuration seetings it will through the error like The profile you were used is temporary profile.

My MacBook Air is in a support profile for one of my Apple IDs while all my other devices are in a support profile for a different one of my Apple IDs; how can I combine under one?

My MacBook Air is in a support profile for one of my Apple IDs while all my other devices are in a support profile for a different one of my Apple IDs; how can I combine under one?

Actually, this can be done without merging Apple IDs, as I found just by trying this out: I went into the support profile for the Apple ID that had only my Mac listed. I then chose to disassociate the Mac from that Apple ID. I signed out and signed in using my other Apple ID (the one with all my other Apple devices). I chose to add/register a new device, entered my Mac's serial number, and now it is associated with all my other Apple devices under a single Apple ID. No merger of Apple IDs required.

'BBPSC11' error in Monitor SC for one User having multiple positions but on

Hello,
'BBPSC11' error in Monitor SC for one User - having multiple positions in org structure - but having one BP code associated to all positions.
We have one BP ID associated to multiple positions of the same user - in multiple org structure.
The org unit is refered as one Project and like wise we have multiple projects people worked on.
Once the Proj is over we move the Users from one Proj (Org unit) to another Proj, with new Position created copying the old and associate old BP code to it.
With this when we go for Monitor SC option - enter User ID in Created By field - old SC are listed but we are getting error if we click on the Detail icon.
Error:The Internet Transaction Server could not start the transaction "BBPSC11" because of the following error: Attribute for user contains errors. Inform systemadmin. .
AD

Hi,
Pl. verify the user with txn-bbp_attr_check. It could be that the org. relationship of the user changed with what was captured on shopping cart. Also use txn-users_gen to repair the user.
Regards,
Sanjeev

When a new user is created on the Server Computer,Why profile for the user is created as computername.username?

When a new user is created on the Server Computer,Why profile for the user is created as computername.username?

This is done if there are domain users with the same name. For example, if there is a domain user named 'test' who has logged in on the server, he will get the profile 'test'. If you then create a local user named 'test', the profile 'test' already exists
and the computer will create the profile 'computername.test'

HT5312 I have never set up any security questions and now it is asking me for one.... how do you answer a question you never set up?????

I have never set up a security quesiton and now it is asking me for one... i have set up 40 ipads so far without personal security info... how am i to respond to a security question i never set up????!

Contact iTunes Customer Service and request assistance
Use this Link > Apple Support iTunes Store Contact

ASA and ACS 5 multiple VPN profiles for one user

Similar Messages

Maybe you are looking for