Authentication with MS-IAS / AD

I'm trying to control the access of my LAN by authenticate user with EAP / MSIAS + AD.
The IAS denied the access with error 112: The remote RADIUS server did not process the authentication request.
I setup the IAS policy to answer with vendor specific 64:"VLAN", 65:802, 81:10
Is somebody already acheive to use MS-IAS Radius authentication with a Cisco switch 2960
Mon Jun 28 12:22:49 2010: <191>4105: Jun 28 12:22:49.122 UTC+1: RADIUS(00000098): Send Access-Request to 10.221.136.14:1645 id 1645/56, len 211
Mon Jun 28 12:22:49 2010: <191>4106: Jun 28 12:22:49.122 UTC+1: RADIUS:  authenticator 91 EC 87 87 89 0E AF 79 - 76 CE 5A 61 ED 1A D7 AC
Mon Jun 28 12:22:49 2010: <191>4107: Jun 28 12:22:49.122 UTC+1: RADIUS:  User-Name           [1]   17  "EUROPE\ParisAdm"
Mon Jun 28 12:22:49 2010: <191>4108: Jun 28 12:22:49.122 UTC+1: RADIUS:  Service-Type        [6]   6   Framed                    [2]
Mon Jun 28 12:22:49 2010: <191>4109: Jun 28 12:22:49.122 UTC+1: RADIUS:  Framed-MTU          [12]  6   1500                     
Mon Jun 28 12:22:49 2010: <191>4110: Jun 28 12:22:49.122 UTC+1: RADIUS:  Called-Station-Id   [30]  19  "00-24-51-55-47-84"
Mon Jun 28 12:22:49 2010: <191>4111: Jun 28 12:22:49.122 UTC+1: RADIUS:  Calling-Station-Id  [31]  19  "00-14-22-BF-46-40"
Mon Jun 28 12:22:49 2010: <191>4112: Jun 28 12:22:49.122 UTC+1: RADIUS:  EAP-Message         [79]  22 
Mon Jun 28 12:22:49 2010: <191>4113: Jun 28 12:22:49.122 UTC+1: RADIUS:   02 02 00 14 01 45 55 52 4F 50 45 5C 50 61 72 69 73 41 64 6D   [ EUROPE\ParisAdm]
Mon Jun 28 12:22:49 2010: <191>4114: Jun 28 12:22:49.122 UTC+1: RADIUS:  Message-Authenticato[80]  18 
Mon Jun 28 12:22:49 2010: <191>4115: Jun 28 12:22:49.122 UTC+1: RADIUS:   27 E9 35 4C C3 69 99 B0 1B D9 3A 08 84 C0 71 E4            [ '5Li:q]
Mon Jun 28 12:22:49 2010: <191>4116: Jun 28 12:22:49.122 UTC+1: RADIUS:  Vendor, Cisco       [26]  49 
Mon Jun 28 12:22:49 2010: <191>4117: Jun 28 12:22:49.122 UTC+1: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=C0A8FE030000006B13A4833C"
Mon Jun 28 12:22:49 2010: <191>4118: Jun 28 12:22:49.122 UTC+1: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
Mon Jun 28 12:22:49 2010: <191>4119: Jun 28 12:22:49.122 UTC+1: RADIUS:  NAS-Port            [5]   6   50004                    
Mon Jun 28 12:22:49 2010: <191>4120: Jun 28 12:22:49.122 UTC+1: RADIUS:  NAS-Port-Id         [87]  17  "FastEthernet0/4"
Mon Jun 28 12:22:49 2010: <191>4121: Jun 28 12:22:49.122 UTC+1: RADIUS:  NAS-IP-Address      [4]   6   192.168.254.3            
Mon Jun 28 12:22:50 2010: <191>4122: Jun 28 12:22:49.206 UTC+1: RADIUS: Received from id 1645/56 10.221.136.14:1645, Access-Reject, len 20
Mon Jun 28 12:22:50 2010: <191>4123: Jun 28 12:22:49.206 UTC+1: RADIUS:  authenticator CC 28 1A 22 28 32 F2 27 - 79 1F 2B 01 32 C5 AD BC
Mon Jun 28 12:22:50 2010: <191>4124: Jun 28 12:22:49.206 UTC+1: RADIUS(00000098): Received from id 1645/56
Mon Jun 28 12:22:52 2010: <187>4125: Jun 28 12:22:50.842 UTC+1: %LINK-3-UPDOWN: Interface FastEthernet0/4, changed state to up
Thx for your help
Pascal

You need to have 3 policies create in IAS. Each will define the ssid and the AD group the user belongs to. So on the wlc, do you have 3 ssids and each has it own vlan?
Sent from Cisco Technical Support iPad App

Similar Messages

  • Web Authentication with MS IAS Server

    I'm trying to configure my 2106 WLC to authenticate with an MS IAS Radius Server. I had this working, but my boss did not want to do any configuration on the client side and now wants to do all authentication through Web authentication with the Radius server. The wireless client connects and is redirected to the login page like they're supposed to, but when I enter my credentials the login fails. However, if I enter the login of a local user to the controller the authentication works.
    I see in the logs the following error: AAA Authentication Failure for UserName:chevym User Type: WLAN USER. The authentication is reaching the server too, but the logs don't tell you much.
    Here is what is in the server logs: 192.168.0.77,chevym,07/29/2008,05:58:16,IAS,TESTLAB1,25,311 1 192.168.0.221 07/28/2008 17:27:10 48,4127,2,4130,TESTLAB\chevym,4129,TESTLAB\chevym,4154,Use Windows authentication for all users,4155,1,4128,Wireless LAN Controller,4116,9,4108,192.168.0.77,4136,3,4142,19
    I don't really understand any of that and I'm not really sure if I have the server itself configured correctly for what I want to do. Does anyone have instructions on how to do this?

    I had another thread going on this, but since it appears to be an IAS problem, I've been posting on the MS forum instead of here.
    I'm trying to set up wireless laptop-WLC-IAS authentication using PEAP.
    The machine authenticates on boot, but any login by any user results in this message in the Windows Event log on the IAS server:
    Event Type: Warning
    Event Source: IAS
    Event Category: None
    Event ID: 2
    Date: 9/3/2008
    Time: 11:00:55 PM
    User: N/A
    Computer: DC1
    Description:
    User SCOTRNCPQ003.scdl.local was denied access.
    Fully-Qualified-User-Name = SCDL\SCOTRNCPQ003.scdl.local
    NAS-IP-Address = 10.10.10.10
    NAS-Identifier = scohc0ciswlc
    Called-Station-Identifier = 00-21-55-C0-7D-70:Domain Staff
    Calling-Station-Identifier = 00-90-4B-4C-92-B7
    Client-Friendly-Name = WLAN Controller
    Client-IP-Address = 10.10.10.10
    NAS-Port-Type = Wireless - IEEE 802.11
    NAS-Port = 29
    Proxy-Policy-Name = Use Windows authentication for all users
    Authentication-Provider = Windows
    Authentication-Server =
    Policy-Name =
    Authentication-Type = EAP
    EAP-Type =
    Reason-Code = 8
    Reason = The specified user account does not exist.
    The policy is the default connection policy created when installing IAS.
    In ADUC, I've tried setting both the machine and users Dial-In properties to Allow Access or Control through policy, with the same result.
    I've gone through the policy and there isn't anything there, other than the Day-Time rule which is set to allow access for all hours of the whole day, every day.
    In the last few days, I've read about the Ignore User Dial In properties, but can't find where/how you set this.
    It sounded to me as if this had been resolved in this thread, so I wanted to know how this had been accomplished.

  • Wirelss AP1140 Radius authentication with Microsoft IAS

    Hi,
    I have a Cisco C1140 Ap. I have cnfigured the device. Initially for testing i used WPA and authenticated locally. I have now setup a radius server and added my AP in as a client etc. I have changed my SSID's to authenticate with the radius server and i am having issues authenticating.
    I can connect via a PC and an iphone. They say that i am connected but i get no ip address and the debugs state that the authentication fails:
    000466: Sep 5 14:33:07.074 AEST: %DOT11-7-AUTH_FAILED: Station 40a6.d967.8b13 Authentication failed
    000467: Sep 5 14:33:28.368 AEST: %DOT11-7-AUTH_FAILED: Station bc77.3771.b15f Authentication failed
    000468: Sep 5 14:33:39.837 AEST: %DOT11-7-AUTH_FAILED: Station 40a6.d967.8b13 Authentication failed
    I can see the Radius server as connected
    imc-syd-ap1#show aaa servers
    RADIUS: id 4, priority 1, host 10.10.0.2, auth-port 1645, acct-port 1646
    State: current UP, duration 4337s, previous duration 0s
    Dead: total time 0s, count 0
    Authen: request 0, timeouts 0
    Response: unexpected 0, server error 0, incorrect 0, time 0ms
    Transaction: success 0, failure 0
    Author: request 0, timeouts 0
    Response: unexpected 0, server error 0, incorrect 0, time 0ms
    Transaction: success 0, failure 0
    Account: request 0, timeouts 0
    Response: unexpected 0, server error 0, incorrect 0, time 0ms
    Transaction: success 0, failure 0
    Elapsed time since counters last cleared: 1h12m
    The debugs show:
    000474: Sep 5 14:36:00.969 AEST: %DOT11-7-AUTH_FAILED: Station bc77.3771.b15f Authentication failed
    000475: Sep 5 14:36:01.485 AEST: AAA/BIND(00000109
    show dot11 associations:
    imc-syd-ap1#show dot11 associations
    802.11 Client Stations on Dot11Radio0:
    SSID [IMC-Wireless-Data] :
    MAC Address IP address Device Name Parent State
    bc77.3771.b15f 0.0.0.0 ccx-client DAVID self AAA_Auth
    Any ideas or recomendations would be greatly appreciated
    Thanks
    Below is a copy of my wireless config:
    version 12.4
    no service pad
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname xxxxxxxxxxxxxx
    logging buffered 40960 debugging
    enable secret 5 xxxxxxxxxxxxx
    aaa new-model
    aaa group server tacacs+ IMC
    server 172.16.100.3
    aaa group server radius AUTHVPN
    server 10.10.0.2 auth-port 1645 acct-port 1646
    server 10.11.0.24 auth-port 1645 acct-port 1646
    aaa authentication login default group IMC local enable
    aaa authorization exec default group IMC local if-authenticated
    aaa session-id common
    clock timezone AEST 10
    clock summer-time AEDT recurring 1 Sun Oct 2:00 1 Sun Apr 3:00
    no ip domain lookup
    ip domain name imc.net.au
    dot11 syslog
    dot11 ssid IMC-Wireless-Data
    vlan 10
    authentication open eap AUTHVPN
    authentication network-eap AUTHVPN
    guest-mode
    mbssid guest-mode
    infrastructure-ssid optional
    information-element ssidl
    dot11 ssid IMC-Wireless-Voice
    vlan 14
    authentication open eap AUTHVPN
    authentication network-eap AUTHVPN
    mbssid guest-mode
    information-element ssidl
    dot11 aaa authentication attributes service login-only
    bridge irb
    interface Dot11Radio0
    no ip address
    no ip route-cache
    encryption mode wep mandatory
    ssid IMC-Wireless-Data
    ssid IMC-Wireless-Voice
    antenna gain 0
    mbssid
    station-role root
    interface Dot11Radio0.10
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface Dot11Radio0.14
    encapsulation dot1Q 14
    no ip route-cache
    bridge-group 14
    bridge-group 14 subscriber-loop-control
    bridge-group 14 block-unknown-source
    no bridge-group 14 source-learning
    no bridge-group 14 unicast-flooding
    bridge-group 14 spanning-disabled
    interface Dot11Radio1
    no ip address
    no ip route-cache
    encryption mode wep mandatory
    ssid IMC-Wireless-Data
    ssid IMC-Wireless-Voice
    antenna gain 0
    no dfs band block
    mbssid
    channel dfs
    station-role root
    interface Dot11Radio1.10
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface Dot11Radio1.14
    encapsulation dot1Q 14
    no ip route-cache
    bridge-group 14
    bridge-group 14 subscriber-loop-control
    bridge-group 14 block-unknown-source
    no bridge-group 14 source-learning
    no bridge-group 14 unicast-flooding
    bridge-group 14 spanning-disabled
    interface GigabitEthernet0
    description IMC-Wireless-Data
    no ip address
    no ip route-cache
    duplex auto
    speed auto
    no keepalive
    interface GigabitEthernet0.10
    description IMC-Wireless-Data
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    no bridge-group 1 source-learning
    bridge-group 1 spanning-disabled
    interface GigabitEthernet0.14
    description IMC-Wireless-Voice
    encapsulation dot1Q 14
    no ip route-cache
    bridge-group 14
    no bridge-group 14 source-learning
    bridge-group 14 spanning-disabled
    interface BVI1
    description IMC-Wireless-Data
    ip address 10.10.0.245 255.255.255.0
    no ip route-cache
    ip default-gateway 10.10.0.254
    ip http server
    ip http authentication local
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    access-list 111 permit tcp any any eq telnet
    access-list 111 permit tcp any any eq www
    access-list 111 permit tcp any any eq 22
    snmp-server community public RO
    snmp-server enable traps tty
    tacacs-server host 172.16.100.3 key 7 xxxxxxxxxxxxxxxxxxx
    tacacs-server directed-request
    radius-server host 10.10.0.2 auth-port 1645 acct-port 1646 key 7 xxxxxxxxxxxxxxxxxxx
    bridge 1 route ip
    wlccp wds aaa authentication attributes service login-only
    line con 0
    line vty 0 4
    access-class 111 in
    exec-timeout 5 0
    line vty 5 15
    access-class 111 in
    exec-timeout 5 0
    sntp server 10.10.0.254
    end

    Inside the ssid, when you put "authentication open" it's an eap_method that follows. You put your AUTHVPN aaa server group name. that's wrong.
    aaa authentication login  group AUTHVPN
    and adjust your "authentication open eap " to match with that method name.
    Also your group authvpn contains a 2nd server that is undefined in yoru global config ...
    Nicolas

  • WLC 4402 RADIUS Authentication with IAS

    Hello
    I configured a WLAN with PEAP (CHAP v2)and Radius authentication to a Win 2003 IAS Radius Server.
    On the controller 4402 the layer 2 security is set to WPA1+WPA2 with 802.1x authentication.
    The IAS server don't use the configured policy when a authentication reguest arrive.
    I there an issue with special RADIUS attributes or configuration items on the IAS Server?
    The following event appear in the windows logs:
    User STANS\kaesmr was denied access.
    Fully-Qualified-User-Name = STANS\kaesmr
    NAS-IP-Address = 172.17.25.6
    NAS-Identifier = keynet-01
    Called-Station-Identifier = 00-18-74-FB-CA-20:keynet
    Calling-Station-Identifier = 00-16-CE-52-C8-EB
    Client-Friendly-Name = Wireless-Controller
    Client-IP-Address = 172.17.25.6
    NAS-Port-Type = Wireless - IEEE 802.11
    NAS-Port = 1
    Proxy-Policy-Name = Windows-Authentifizierung f?r alle Benutzer verwenden
    Authentication-Provider = Windows
    Authentication-Server = <undetermined>
    Policy-Name = <undetermined>
    Authentication-Type = Extension
    EAP-Type = <undetermined>
    Reason-Code = 21
    Reason = The request was rejected by a third-party extension DLL file.

    What I understand from your post is that the authentication is not handled by your IAS server. IF I am correct, the problem might be with the "Allow AA override" option disabled in your WLAN. If it is enabled, then the AAA server or your IAS server will override the security parameters set locally on the controller.
    So, first ensure whether "Allow AAA override" is enabled under Controller--->WLAN field.
    Also, chek out the logs of the IAS server for obtaining more info on this.

  • WPA2 on 1220-B with MS IAS (2003 server)

    All -
    I have a Win2003 server running IAS. I have a 1220-B AP running 12.3(8)JA2.
    I am trying to create two VLANs/SSIDs; one for guest mode - fully open without encryption, and one for secure mode WPA2.
    The two segments will be firewalled using an ASA-5510.
    I have followed the guidelines provided in the WPA2 sample configuration (though AES is not available to me in the encryption Cipher settings - only TKIP), and the using VLANs on wireless access points.
    However - the clients (Intel Pro Set 3945 ABG running 10.1.0.3 client) are not able to associate to the secured segment as expected - even when using the AP's local radius server (to eliminate IAS as a source of problems).
    Anyone have any suggestions - or known working configs they would care to share?

    Scott -
    The radio units for use in production include the G radio module. The test environment does not (my bad!). I'll have to see about taking one of the upgraded units out of production to further test WPA2. This concerns me though because we have a cache of 350 PCMCIA adapters - and this suggests that they will never be able to do WPA2 because they cannot associate as G devices. I've got to come up with a workable solution for basic B devices (both Cisco and non) and our newer A/B/G devices.
    I've used both the ProSet Utilities and WZC to attempt this on the test environment laptop.
    Authentication will be testing/proven in two sequences.
    The first sequence for authentication will be against the AP's local user database using LEAP.
    The second sequence (and ultimately final) will require authentication against the Win2003 IAS AD domain due to multiple APs in the production environment, likely using PEAP.
    If I can successfully go directly to the second sequence, that would be nice, but I'm concerned about the simplicity of troubleshooting - in the event something is wrong with the IAS configuration.
    For the record, I'm a router/switch head - with only moderate skills with wireless, and virtually no experience with Win 2003 Server. I may need some hand-holding .

  • Database authentication with 9iAS

    Hi,
    I was wondering if anyone nows when it will be possible to use database authentication with 9iAS. I don't mean just removing the password from the DAD configuration and authentication that way. I want to be able to have basic Oracle authentication like in OAS.

    In the next release of iAS (towards end of year) single signon will be integrated with apache. At that time, it will be possible to do this.

  • Long time wait for authentication with Windows 2003 AD

    Hello,
    We have a problem with authentication with 2003 AD. If it was no requests from VDI to Windows 2003 AD during some time (10-15 minutes), first request take a lot of time - 3-5 minutes and user need to wait after entering his username/password. Searching users in VDI GUI also take a lot of time in this situation.
    How to resolve this? Size of directory is very small.
    And with 2008 AD and Open LDAP there is no such problem.

    Same thing for 2003, it is called IAS (Internet Authentication Service).
    http://www.microsoft.com/technet/network/ias/default.mspx
    Basically you will set up IAS with a RADIUS Client which would be your wireless access point(s). Then you will set up a remote access policy which will define how connections are authorized or rejected (windows groups, protocols etc.). Don't forget to register IAS with active directory.

  • I get error message: "An error occurred with the  publication of album...Authentication with server failed...whenever I open a facebook file in my iPhoto. In each file, most of my photos have disappeared. What do I need to do?

    I get error message: "An error occurred with the  publication of album...Authentication with server failed. Please check your login and password information" whenever I open a facebook file in my iPhoto. In each file, most of my photos have disappeared. I am hoping I can retrieve these "lost" files. What do I need to do?

    Message was edited by: leroydouglas
    better yet, try this solution:
    https://discussions.apple.com/message/12351186#12351186

  • Error in authentication with ldap server with certificate

    Hi,
    i have a problem in authentication with ldap server with certificate.
    here i am using java API to authenticate.
    Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed.
    I issued the new certificate which is having the up to 5 years valid time.
    is java will authenticate up to one year only?
    Can any body help on this issue...
    Regards
    Ranga

    sorry i am gettting ythe same error
    javax.naming.CommunicationException: simple bind failed: servername:636 exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed]
    here when i am using the old certificate and changing the system date means i can get the authentication.
    can you tell where we can concentrate and solve the issue..
    where is the issue
    1. need to check with the ldap server only
    2. problem in java code only.
    thanks in advance

  • Ricoh Aficio MP C2051 Scan to Folder - Windows 7 64 bit Error: Authentication with the destination has failed check settings

    I got an issue with OS of widows 7.
    unable to scan  documents to user's PC.am getting error message "Authentication with the destination has failed. Check settings. To check the current status, press [Scanned Files Status
    Other Windows xp  PC can do this.
    How can I fix this problem?
    Printer Model :C2051 /mp2001sp

    Hi,
    I searched for the error and it is mentioned in Ricoh's website:
    Messages Displayed on the Control Panel When Using the Scanner Function
    http://support.ricoh.com/bb_v1oi/pub_e/oi_view/0001045/0001045718/view/trouble/int/0036.htm
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
    Message
    Cause
    Solution
    “Authentication with the destination has failed. Check settings. To check the current status, press [Comm. Status/Print].”
    The entered login user name or login password is not correct.
    Check that the user name and password are correct.
    Check that the ID and password for the destination folder are correct.
    A password of 128 or more characters may not be recognized.
    From the solution, it mentioned that the issue could relate to user account or its password.
    Please let me know if it is in domain environment. If so, please test to log the same user account currently on Windows 7 to Windows XP and see if issue persists.
    Also please test to directly access the scanning folder on printer server to see if there is any issue in accessing the destination folder. 

  • Not Working-central web-authentication with a switch and Identity Service Engine

    on the followup the document "Configuration example : central web-authentication with a switch and Identity Service Engine" by Nicolas Darchis, since the redirection on the switch is not working, i'm asking for your help...
    I'm using ISE Version : 1.0.4.573 and WS-C2960-24PC-L w/software 12.2(55)SE1 and image C2960-LANBASEK9-M for the access.
    The interface configuration looks like this:
    interface FastEthernet0/24
    switchport access vlan 6
    switchport mode access
    switchport voice vlan 20
    ip access-group webauth in
    authentication event fail action next-method
    authentication event server dead action authorize
    authentication event server alive action reinitialize
    authentication order mab
    authentication priority mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    authentication violation restrict
    mab
    spanning-tree portfast
    end
    The ACL's
    Extended IP access list webauth
        10 permit ip any any
    Extended IP access list redirect
        10 deny ip any host 172.22.2.38
        20 permit tcp any any eq www
        30 permit tcp any any eq 443
    The ISE side configuration I follow it step by step...
    When I conect the XP client, e see the following Autenthication session...
    swlx0x0x#show authentication sessions interface fastEthernet 0/24
               Interface:  FastEthernet0/24
              MAC Address:  0015.c549.5c99
               IP Address:  172.22.3.184
                User-Name:  00-15-C5-49-5C-99
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  single-host
         Oper control dir:  both
            Authorized By:  Authentication Server
               Vlan Group:  N/A
         URL Redirect ACL:  redirect
             URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC16011F000000490AC1A9E2
          Acct Session ID:  0x00000077
                   Handle:  0xB7000049
    Runnable methods list:
           Method   State
           mab      Authc Success
    But there is no redirection, and I get the the following message on switch console:
    756005: Mar 28 11:40:30: epm-redirect:IP=172.22.3.184: No redirection policy for this host
    756006: Mar 28 11:40:30: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
    I have to mention I'm using an http proxy on port 8080...
    Any Ideas on what is going wrong?
    Regards
    Nuno

    OK, so I upgraded the IOS to version
    SW Version: 12.2(55)SE5, SW Image: C2960-LANBASEK9-M
    I tweak with ACL's to the following:
    Extended IP access list redirect
        10 permit ip any any (13 matches)
    and created a DACL that is downloaded along with the authentication
    Extended IP access list xACSACLx-IP-redirect-4f743d58 (per-user)
        10 permit ip any any
    I can see the epm session
    swlx0x0x#show epm session ip 172.22.3.74
         Admission feature:  DOT1X
         ACS ACL:  xACSACLx-IP-redirect-4f743d58
         URL Redirect ACL:  redirect
         URL Redirect:  https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
    And authentication
    swlx0x0x#show authentication sessions interface fastEthernet 0/24
         Interface:  FastEthernet0/24
         MAC Address:  0015.c549.5c99
         IP Address:  172.22.3.74
         User-Name:  00-15-C5-49-5C-99
         Status:  Authz Success
         Domain:  DATA
         Oper host mode:  multi-auth
         Oper control dir:  both
         Authorized By:  Authentication Server
         Vlan Group:  N/A
         ACS ACL:  xACSACLx-IP-redirect-4f743d58
         URL Redirect ACL:  redirect
         URL Redirect:  https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
         Session timeout:  N/A
         Idle timeout:  N/A
         Common Session ID:  AC16011F000000160042BD98
         Acct Session ID:  0x0000001B
         Handle:  0x90000016
         Runnable methods list:
         Method   State
         mab      Authc Success
    on the logging, I get the following messages...
    017857: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
    017858: Mar 29 11:27:04: epm-redirect:epm_redirect_cache_gen_hash: IP=172.22.3.74 Hash=271
    017859: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: CacheEntryGet Success
    017860: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: Ingress packet on [idb= FastEthernet0/24] matched with [acl=redirect]
    017861: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Enqueue the packet with if_input=FastEthernet0/24
    017862: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_process ...
    017863: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Not an HTTP(s) packet
    What I'm I missing?

  • Ricoh Aficio MP C2051 Scan to Folder - Windows Server 2012 Error: Authentication with the destination has failed check settings

    I have recently upgraded a clients servers to Windows Server 2012 & since doing so have lost the ability to scan to folder.
    Both servers are domain controllers and previously on a 2008 domain controller I would have had to make the following change to allow scan to folder:
     Administrative Tools
     Server Manager
     Features
     Group Policy Manager
     Forest: ...
     Default Domain Policy
    Computer configuration
     Policies
     Windows Settings
     Security Settings
     Local Policies
     Security Options
     Microsoft Network Server: Digitally Sign Communications (Always)
     - Define This Policy
     - Disabled
    However I have applied this to the Windows 2012 server but am still unable to scan, possibly due to added layers of security in server 2012. The error on the scanner is Authentication with the destination has failed check settings.
    I have also tried the following at the server:
    Policies -> Security Policies
    Change Network Security: LAN Manager authentication level to: Send LM & NTLM - Use NTLMv2 session security if negotiated.
    Network security: Minimum session security for NTLM SSP based (including secure RPC) clients and uncheck the require 128 bit.
    Network security: Minimum session security for NTLM SSP based (including secure RPC) servers and uncheck the require 128 bit
    I have created a user account on the server for the ricoh and set this in the settiings of the Ricoh and verified everything is correct.
    Are there any other things I have missed?

    I can email anybody the firmware module if interested and how to...
    Tell me your model and email
    If your offer still stands we have an Aficio MP C3300
    Firmwareversion
    Modulnavn Version Delnummer 
    System/Copy  1.13  D0255562H  
    Network Support  8.16.1  D0255563D  
    Font EXP  1.03  D0255588  
    OptionPCLFont  1.02  D0255589  
    animation  1.3.1  D0255568A  
    Fax  01.10.00  D0255569B  
    RemoteFax  01.10.00  D0255564B  
    Printer  1.11  D0255572A  
    RPCS  3.7.5.4.1  D0255574A  
    Option PCL  1.00  D0255580A  
    Scanner  01.17  D0255570C  
    Network DocBox  1.00  D0255567B  
    Web Support  1.06  D0255565B  
    Web Uapl  1.07  D0255566C  
    libcvm(v4)  4.13  D4135765B  
    GWFCU3-13(WW)  03.00.00  D3935570C  
    PowerSaving Sys  1.10  D0255560C  
    Engine 1.51:09 D0255117E 
    OpePanel 1.03 D0251492A 
    LANG0 1.03 D0251496 
    LANG1 1.03 D0251496 
    ADF 03.420:02 D3665604 
    Finisher 01.090:03 D3725112
    Best Regards/
    Henrik Plougstad
    henrik(a)pieroth.dk

  • Policy agent 2.2 amfilter local authentication with session binding failed

    Hi All,
    I have policy agent 2.2 for weblogic 8.1 sp4 installed on redhat linux. All are working fine in my development box. But I was running all the process under user root, so today I decided to change it to a regular user, joe. I changed all the files' owner for weblogic server and policy agent from root to joe, and restart server as user Joe. After the change, I can not access the application on Weblogic server. I changed file ownership back to root and restart weblogic server as root, still same error.
    Here is the error I got:
    10.4.4 403 Forbidden
    The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable.
    Here is the error I found from agent log file, amFilter:
    AmFilter: now processing: SSO Task Handler
    05/24/2006 06:27:08:127 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    SSOTaskHandler: caching SSO Token for user uid=amAdmin,ou=People,dc=etouch,dc=net
    05/24/2006 06:27:08:127 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    AmBaseSSOCache: cached the sso token for user principal : uid=amadmin,ou=people,dc=etouch,dc=net sso token: AQIC5wM2LY4Sfcx4XY/x/M7G1Y3ScVjFj8E3oT0BV45mh0Q=@AAJTSQACMDE=#, cache size = 1
    05/24/2006 06:27:08:127 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    SSOTaskHandler: SSO Validation successful for uid=amAdmin,ou=People,dc=etouch,dc=net
    05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    AmFilter: now processing: J2EE Local Logout Task Handler
    05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    AmFilter: local logout skipped SSO User => amAdmin, principal =>null
    05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    AmFilter: now processing: J2EE Local Auth Task Handler
    05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    LocalAuthTaskHandler: No principal found. Initiating local authentication for amAdmin
    05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    LocalAuthTaskHandler: doing local authentication with session binding
    05/24/2006 06:27:08:129 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    LocalAuthTaskHandler: Local authentication failed, invalidating session.05/24/2006 06:27:08:129 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    WARNING: LocalAuthTaskHandler: Local authentication failed for : /portal/index.jsp, SSO Token: AQIC5wM2LY4Sfcx4XY/x/M7G1Y3ScVjFj8E3oT0BV45mh0Q=@AAJTSQACMDE=#
    05/24/2006 06:27:08:129 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
    AmFilter: result =>
    FilterResult:
         Status      : FORBIDDEN
         RedirectURL     : null
         RequestHelper:
              null
         Data:
              null
    -----------------------------------------------------------

    Hi,
    I'm having the exact same problem in the Prod environment, but on a Sun App Server. In development all is fine, in prod we now have:
    ERROR: AmFilter: Error while delegating to inbound handler: J2EE Local Auth Task Handler, access will be denied
    java.lang.IllegalStateException: invalidate: Session already invalidated
    at org.apache.catalina.session.StandardSession.invalidate(StandardSession.java:1258)
    at org.apache.catalina.session.StandardSessionFacade.invalidate(StandardSessionFacade.java:164)
    at com.sun.identity.agents.filter.LocalAuthTaskHandler.doLocalAuthWithSessionBinding(LocalAuthTaskHandler.java:289)
    at com.sun.identity.agents.filter.LocalAuthTaskHandler.authenticate(LocalAuthTaskHandler.java:159)
    at com.sun.identity.agents.filter.LocalAuthTaskHandler.process(LocalAuthTaskHandler.java:106)
    at com.sun.identity.agents.filter.AmFilter.processTaskHandlers(AmFilter.java:185)
    at com.sun.identity.agents.filter.AmFilter.isAccessAllowed(AmFilter.java:152)
    at com.sun.identity.agents.filter.AmAgentBaseFilter.doFilter(AmAgentBaseFilter.java:38)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:210)
    at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55)
    at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:161)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:263)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:551)
    at org.apache.catalina.core.StandardContextValve.invokeInternal(StandardContextValve.java:225)
    FilterResult:
    Status : FORBIDDEN
    RedirectURL : null
    RequestHelper:
    null
    Data:
    null
    Also, we I debug I see:
    LocalAuthTaskHandler: No principal found. Initiating local authentication for ...
    Did you receive any solution for this?
    Many, many thanks,
    Philip

  • Certificate based authentication with sender SOAP adapter. Please help!

    Hi Experts,
       I have a scenario where first a .Net application makes a webservice call to XI via SOAP Adapter. Then the input from the .Net application is sent to the R/3 system via RFC adapter.
    .Net --->SOAP -
    >XI -
    >RFC -
    R/3 System
    Now as per client requirement I have to implement certificate based authentication in the sender side for the webservice call. In this case the .Net application is the "client" and XI is the "server". In other words the client has to be authenticated by XI server. In order to accomplish this I have setup the security level in the SOAP sender channel as "HTTPS  with client authentication". Additionally I have assigned a .Net userid in the sender agreement under "Assigned users" tab.
    I have also installed the SSL certificate in the client side. Then generated the public key and loaded it into the XI server's keystore.
    When I test the webservice via SOAPUI tool I am always getting the "401 Unauthorized" error. However if I give the userid/password for XI login in the properties option in the SOAPUI tool then it works fine. But my understanding is that in certificate based authentication, the authentication should happen based on the certificate and hence there is no need for the user to enter userid/password. Is my understanding correct? How to exactly test  certificate based authentication?
    Am I missing any steps for certificate based authentication?
    Please help
    Thanks
    Gopal
    Edited by: gopalkrishna baliga on Feb 5, 2008 10:51 AM

    Hi!
    Although soapUI is a very goot SOAP testing tool, you can't test certificate based authentication with it. There is no way (since I know) how to import certificat into soapUI.
    So, try to find other tool, which can use certificates or tey it directly with the sender system.
    Peter

  • LDAP authentication with MD5 passwords

    Hi,
    in one of our Linux servers we have MD5 passwords stored in /etc/shadow. We want to implement pam_ldap on that machine, and move passwords to an LDAP database.
    I know it is to be done with {crypt} storage scheme.
    This works with DS 5.2 running on a Linux box, but under Solaris 8 I couldn't get it working. I know that Solaris 8 doesn't support MD5 passwords in its crypt(3) function, and I suppose Directory Server uses that. Somewhere I read that, however crypt() in Solaris 9 does support MD5.
    Can you confirm that after upgrading to Solaris 9, authentication with MD5-hashed passwords will be possible? Has anyone tried it?
    Thanks in advance,
    Kristof

    Thanks you for your reply.
    Our openldap version is openldap-2.3.39
    And all passwords are encrypted with : Base 64 encoded md5
    Below is a sample password:
    {md5}2FeO34RYzgb7xbt2pYxcpA==Thanks again for any help..

Maybe you are looking for

  • Value field in which table?

    Does anybody know value field was put in which table?

  • Owb process flow error handling

    Hi, I am using OWB 10gR2. I have 2 process flows that each call a series of mappings. Then I have one "master" process flow that calls the two aforementioned proecess flows. When a mapping errors, I want my whole master process flow to abort. I put e

  • How to create the Frame object with API in 6i?

    do i create an item using d2fitmcr_Create, and then set the type or style to frame? or is it a graphics item that i have to create using a different function? ive tried various combinations with no luck. ive looked at the frame object in the GUI, and

  • How do you open a DVD/file in another search engine

    how do you open a DVD/file in another search engine?

  • Control Inspection Lot Generation

    Hi Experts, I have a requirement where I need to use Inspection Type 04 in 2 ways. 1) For FERT material types inspection lot should be generated automatically. 2) For HALB material types inspection lot should not be generated. The client will generat