Can I intergrate TACACS+ authentication with MS AD?

hi, I would like to using MS AD account as a tacacs authentication account. I use tac_plus-F4.0.4.7 on Freebsd. Does anyone get some ideas? thank you!

Although that is an interesting thought, I am also not up on that software and not sure this would be the best place to get that answer. For Cisco's Secure ACS, it is merely a click of the button. ACS from Cisco has many other features that I do know are not availabe in the few open source TACACS+ servers i have seen. I see no advantage even for small companies going this route given that the savings in dollars is little compared to the loss in functionality and interoperability among Cisco's products.

Similar Messages

  • Can I use Windows authentication with Firefox?

    My company has a website that I need to login to on a daily basis. With IE I can set up Windows Authentication to have a "single sign-on" for this website and it automatically logs me in when I open the site. I do not see any options for authentication under the Tools menu. Using Firefox's password memory does not give the same functionality.

    You can do it by adding the server host name to a list of trusted host names. Obviously you need to be very careful about not adding untrustworthy servers to the list. See this article for how: [http://support.mozilla.com/en-US/kb/Firefox%20asks%20for%20user%20name%20and%20password%20on%20internal%20sites Firefox asks for user name and password on internal sites | Troubleshooting | Firefox Help].

  • Tacacs authentication with ACE appliance not working

    Hi All,
    I'm having trouble with a Cisco ACE 4710 appliance using tacacs to authenticate ssh/telnet remote users. Following the CCO documentation we have configured the backend tacacs server (Cisco Secure ACS) and setup the ACE with the required configuration.
    tacacs-server key 7 "letmein"
    tacacs-server host 192.168.1.1 timeout 5
    aaa group server tacacs+ ACStac
      server 192.168.1.1
    aaa authentication login default group ACStac local
    So far no luck in successfully authenticating any users. I can see in the log on the ACS a key mismatch error however I have 100% verified the keys are identical, im thinking this may be a bug?
    Furthermore when I paste in the tacacs-server key it gets converted to a type 7 in the running configuration even though I use the no encryption option. Anyone have any ideas? The ACE is running version A3(2.3)
    Thanks in advance

    Hi Matt,
    Please remove the shared secret of teh NDG and test.
    Regards,
    Anisha
    P.S.: please rate this post if ypou feel your query is answered

  • Tacacs authentication with dedicated passwd file

    Hi all,
    i'm trying to setup a tacacs server (the free version for linux). It is possible to use the linux /etc/passwd file to store the users/passwords.
    But i am trying to setup a dedicated passwd-style file to keep the tacacas users seperate from the linux OS users.
    There is a command in the tacacs config like: 
    default authentication = file /etc/passwd
    enable = file /etc/passwd
    How can i use a seperate file for this authentication type? I used the statemend "default authentication = file /etc/mypasswd.txt"
    but this does not work
    The mypasswd.txt looked like this:
    testuser:mypasswordcleartext
    testuser2:mypassworddesencrypted
    None of these statemens worked for me and i always get "authentication error"
    I was not able to find a documentation about this. Does anybody know if this is possible at all, and how the mypasswd.txt must look like??
    Thanks in advance.

    There's some documentation that tells you about setting
    remote credentials. Have a look here:
    http://livedocs.adobe.com/flex/2/docs/wwhelp/wwhimpl/common/html/wwhelp.htm?context=LiveDo cs_Parts&file=00001109.html
    And here
    http://livedocs.adobe.com/flex/2/docs/wwhelp/wwhimpl/common/html/wwhelp.htm?context=LiveDo cs_Parts&file=00001109.html

  • Help please with TACACS authentication from a Nexus 5548

    I cannot get login working via TACACS from my Nexus 5548.  I've tried creating a group and a single server with key etc.
    Config is simple:
    tacacs-server key 7  ************
    ip tacacs source-interface Vlanx
    aaa group server tacacs+ tacacs
        server 10.x.y.z
    The test aaa command shows it's authenticating:
    NEX01# test aaa server tacacs+  10.x.y.z <username> <password)
    user has been authenticated
    Debug shows this:
    NEX01# 2011 Jun  8 12:31:03 NEX01 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed for user <username>  from 10.x.y.z- login[1691]
    Am I doing something glaringly wrong here?
    Any advice is greatly appreciated.
    Thank you.

    Hi Paul,
    Looks like may be the packet dont have the route ACS when you try to login .
    Can you share sh run of the switch  ?
    Also do you see failed attempt on tacacs server side. ?
    Can you ping tacacs server with source interface Vlanx?
    Thanks
    Waris Hussain

  • TACACS+ Authentication For Cisco NAM

    Hi All,
    I have an cisco ACS v5.1 and also a cisco NAM. Currently, I have configured TACACS+ on the NAM and the ACS v5.1 however when I try to access the NAM, the ACS v5.1 has an error message of "TACACS+ authentication ended with error" and I am not able to access the equipment.
    For your information, I have no problem with others equipment TACACS+ authentication with the same ACS.
    Please advise.
    Thks and Rgds

    Steven
    I would first suggest that you verify that your ACS has an appropriate and correct entry configured for the NAM as a client. Assuming that is correct then I would suggest that you check and verify that the NAM is originating its TACACS requests from the address that you configured for the client on the ACS and that the shared secret is the same on both devices.
    If those are correct then I would suggest to look in the Failed Attempts report of ACS and see if it provides a better identification of the problem.
    HTH
    Rick

  • PIX 525 aaa authentication with both tacacs and local

    Hi,
    I have configured the aaa authentication for the PIX with tacacs protocol (ACS Server).
    It works fine, now i would like to add the back up authentication, as follows:
    - If the ACS goes down i can to be authenticated with the local database.
    Is it possible with PIX, if yes how?

    Hi,
    I am trying to configure aaa using TACACS+ , i am not able to close.Problems are
    1.It dosent ask for username /password in first level.
    2.on second level it asks for user name it dosent authenticate the user .
    Cud u pls let me know if the following config is correct.If not cud u help me .
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ (outside) host ip.ip.ip.ip key timeout 15
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    aaa authentication include tcp/0 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 TACACS+
    aaa authentication include tcp/0 outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 TACACS+
    aaa authen enable console TACACS+

  • How can I implement  Multi Factor authentication with IAM products?

    Hi I would like to implement multi factor authentication that can be made generic with all IAM produts. Can anyone suggest an MFA factor like that? It shudnt be an add on or plug in. Instead it should be an in built feature. Can anyone suggest any idea?

    Opensso has such feature built-in. You can create an authentication chain in which you can add as many authentication mechanisms as you need.
    Although it is a built-in feature, there's no full support for all sorts of authentication methods. Some of them exist as plugins, like authentication modules for smart cards and biometrics because they are not sold by Sun Microsystems. However, there's a solution for you requrement even tough you might add some auth modules as plugins like biobex, activcard or auth modules from other vendors.
    Regards.

  • Aironet 2702i Autonomous - Web-Authentication with Radius Window 2008

    Hi Guys,
    I have a problems with case, i have diagrams sample like then : AD(Win2008) - Radius(Win2008) - Aironet 2702i => Use methods Web-Auth for EndUser  
    This is my Configure file on Aironet 2702i
    Aironet2702i#show run
    Building configuration...
    Current configuration : 8547 bytes
    ! Last configuration change at 05:08:25 +0700 Fri Oct 31 2014 by admin
    version 15.3
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname Aironet2702i
    logging rate-limit console 9
    aaa new-model
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login default local
    aaa authentication login DTSGROUP group radius
    aaa authentication login webauth group radius
    aaa authentication login weblist group radius
    aaa authentication dot1x default group radius
    aaa authorization exec default local 
    aaa session-id common
    clock timezone +0700 7 0
    no ip source-route
    no ip cef 
    ip admission name webauth proxy http
    ip admission name webauth method-list authentication weblist 
    no ip domain lookup
    ip domain name dts.com.vn
    dot11 syslog
    dot11 activity-timeout unknown default 1000
    dot11 activity-timeout client default 1000
    dot11 activity-timeout repeater default 1000
    dot11 activity-timeout workgroup-bridge default 1000
    dot11 activity-timeout bridge default 1000
    dot11 vlan-name DTSGroup vlan 46
    dot11 vlan-name L6-Webauthen-test vlan 45
    dot11 vlan-name NetworkL7 vlan 43
    dot11 vlan-name SGCTT vlan 44
    dot11 ssid DTS-Group
       vlan 46
       authentication open eap DTSGROUP 
       authentication key-management wpa version 2
       mbssid guest-mode
    dot11 ssid DTS-Group-Floor7
       vlan 43
       authentication open 
       authentication key-management wpa version 2
       mbssid guest-mode
       wpa-psk ascii 7 013D03104C0414040D4D5B5E392559
    dot11 ssid L6-Webauthen-test
       vlan 45
       web-auth
       authentication open 
       dot1x eap profile DTSGROUP
       mbssid guest-mode
    dot11 ssid SaigonCTT-Public
       vlan 44
       authentication open 
       authentication key-management wpa version 2
       mbssid guest-mode
       wpa-psk ascii 7 04480A0F082E424D1D0D4B141D06421224
    dot11 arp-cache optional
    dot11 adjacent-ap age-timeout 3
    eap profile DTSGROUP
     description testwebauth-radius
     method peap
     method mschapv2
     method leap
    username TRIHM privilege 15 secret 5 $1$y1J9$3CeHRHUzbO.b6EPBmNlFZ/
    username ADMIN privilege 15 secret 5 $1$IvtF$EP6/9zsYgqthWqTyr.1FB0
    ip ssh version 2
    bridge irb
    interface Dot11Radio0
     no ip address
     encryption vlan 44 mode ciphers aes-ccm 
     encryption vlan 46 mode ciphers aes-ccm 
     encryption mode ciphers aes-ccm 
     encryption vlan 43 mode ciphers aes-ccm 
     encryption vlan 1 mode ciphers aes-ccm 
     ssid DTS-Group
     ssid DTS-Group-Floor7
     ssid L6-Webauthen-test
     ssid SaigonCTT-Public
     countermeasure tkip hold-time 0
     antenna gain 0
     stbc
     mbssid
     packet retries 128 drop-packet
     channel 2412
     station-role root
     rts threshold 2340
     rts retries 128
     ip admission webauth
    interface Dot11Radio0.1
     encapsulation dot1Q 1 native
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface Dot11Radio0.43
     encapsulation dot1Q 43
     bridge-group 43
     bridge-group 43 subscriber-loop-control
     bridge-group 43 spanning-disabled
     bridge-group 43 block-unknown-source
     no bridge-group 43 source-learning
     no bridge-group 43 unicast-flooding
    interface Dot11Radio0.44
     encapsulation dot1Q 44
     bridge-group 44
     bridge-group 44 subscriber-loop-control
     bridge-group 44 spanning-disabled
     bridge-group 44 block-unknown-source
     no bridge-group 44 source-learning
     no bridge-group 44 unicast-flooding
     ip admission webauth
    interface Dot11Radio0.45
     encapsulation dot1Q 45
     bridge-group 45
     bridge-group 45 subscriber-loop-control
     bridge-group 45 spanning-disabled
     bridge-group 45 block-unknown-source
     no bridge-group 45 source-learning
     no bridge-group 45 unicast-flooding
     ip admission webauth
    interface Dot11Radio0.46
     encapsulation dot1Q 46
     bridge-group 46
     bridge-group 46 subscriber-loop-control
     bridge-group 46 spanning-disabled
     bridge-group 46 block-unknown-source
     no bridge-group 46 source-learning
     no bridge-group 46 unicast-flooding
    interface Dot11Radio1
     no ip address
     shutdown
     encryption vlan 46 mode ciphers aes-ccm 
     encryption vlan 44 mode ciphers aes-ccm 
     encryption vlan 1 mode ciphers aes-ccm 
     encryption vlan 43 mode ciphers aes-ccm 
     encryption vlan 45 mode ciphers ckip-cmic 
     ssid DTS-Group
     ssid DTS-Group-Floor7
     ssid SaigonCTT-Public
     countermeasure tkip hold-time 0
     antenna gain 0
     peakdetect
     dfs band 3 block
     stbc
     mbssid
     packet retries 128 drop-packet
     channel 5745
     station-role root
     rts threshold 2340
     rts retries 128
    interface Dot11Radio1.1
     encapsulation dot1Q 1 native
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface Dot11Radio1.43
     encapsulation dot1Q 43
     bridge-group 43
     bridge-group 43 subscriber-loop-control
     bridge-group 43 spanning-disabled
     bridge-group 43 block-unknown-source
     no bridge-group 43 source-learning
     no bridge-group 43 unicast-flooding
    interface Dot11Radio1.44
     encapsulation dot1Q 44
     bridge-group 44
     bridge-group 44 subscriber-loop-control
     bridge-group 44 spanning-disabled
     bridge-group 44 block-unknown-source
     no bridge-group 44 source-learning
     no bridge-group 44 unicast-flooding
     ip admission webauth
    interface Dot11Radio1.45
     encapsulation dot1Q 45
     bridge-group 45
     bridge-group 45 subscriber-loop-control
     bridge-group 45 spanning-disabled
     bridge-group 45 block-unknown-source
     no bridge-group 45 source-learning
     no bridge-group 45 unicast-flooding
     ip admission webauth
    interface Dot11Radio1.46
     encapsulation dot1Q 46
     bridge-group 46
     bridge-group 46 subscriber-loop-control
     bridge-group 46 spanning-disabled
     bridge-group 46 block-unknown-source
     no bridge-group 46 source-learning
     no bridge-group 46 unicast-flooding
    interface GigabitEthernet0
     no ip address
     duplex auto
     speed auto
     dot1x pae authenticator
     dot1x authenticator eap profile DTSGROUP
     dot1x supplicant eap profile DTSGROUP
    interface GigabitEthernet0.1
     encapsulation dot1Q 1 native
     bridge-group 1
     bridge-group 1 spanning-disabled
     no bridge-group 1 source-learning
    interface GigabitEthernet0.43
     encapsulation dot1Q 43
     bridge-group 43
     bridge-group 43 spanning-disabled
     no bridge-group 43 source-learning
    interface GigabitEthernet0.44
     encapsulation dot1Q 44
     bridge-group 44
     bridge-group 44 spanning-disabled
     no bridge-group 44 source-learning
    interface GigabitEthernet0.45
     encapsulation dot1Q 45
     bridge-group 45
     bridge-group 45 spanning-disabled
     no bridge-group 45 source-learning
    interface GigabitEthernet0.46
     encapsulation dot1Q 46
     bridge-group 46
     bridge-group 46 spanning-disabled
     no bridge-group 46 source-learning
    interface GigabitEthernet1
     no ip address
     shutdown
     duplex auto
     speed auto
    interface GigabitEthernet1.1
     encapsulation dot1Q 1 native
     bridge-group 1
     bridge-group 1 spanning-disabled
     no bridge-group 1 source-learning
    interface GigabitEthernet1.43
     encapsulation dot1Q 43
     bridge-group 43
     bridge-group 43 spanning-disabled
     no bridge-group 43 source-learning
    interface GigabitEthernet1.44
     encapsulation dot1Q 44
     bridge-group 44
     bridge-group 44 spanning-disabled
     no bridge-group 44 source-learning
    interface GigabitEthernet1.45
     encapsulation dot1Q 45
     bridge-group 45
     bridge-group 45 spanning-disabled
     no bridge-group 45 source-learning
    interface GigabitEthernet1.46
     encapsulation dot1Q 46
     bridge-group 46
     bridge-group 46 spanning-disabled
     no bridge-group 46 source-learning
    interface BVI1
     mac-address 58f3.9ce0.8038
     ip address 172.16.1.62 255.255.255.0
     ipv6 address dhcp
     ipv6 address autoconfig
     ipv6 enable
    ip forward-protocol nd
    ip http server
    ip http authentication aaa
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1 
    radius-server attribute 32 include-in-access-req format %h
    radius server 172.16.50.99
     address ipv4 172.16.50.99 auth-port 1645 acct-port 1646
     key 7 104A1D0A4B141D06421224
    bridge 1 route ip
    line con 0
     logging synchronous
    line vty 0 4
     exec-timeout 0 0
     privilege level 15
     logging synchronous
     transport input ssh
    line vty 5 15
     exec-timeout 0 0
     privilege level 15
     logging synchronous
     transport input ssh
    end
    This is My Logfile on Radius Win 2008 : 
    Network Policy Server denied access to a user.
    Contact the Network Policy Server administrator for more information.
    User:
    Security ID: S-1-5-21-858235673-3059293199-2272579369-1162
    Account Name: xxxxxxxxxxxxxxxx
    Account Domain: xxxxxxxxxxx
    Fully Qualified Account Name: xxxxxxxxxxxxxxxxxxx
    Client Machine:
    Security ID: S-1-0-0
    Account Name: -
    Fully Qualified Account Name: -
    OS-Version: -
    Called Station Identifier: -
    Calling Station Identifier: -
    NAS:
    NAS IPv4 Address: 172.16.1.62
    NAS IPv6 Address: -
    NAS Identifier: Aironet2702i
    NAS Port-Type: Async
    NAS Port: -
    RADIUS Client:
    Client Friendly Name: Aironet2702i
    Client IP Address: 172.16.1.62
    Authentication Details:
    Connection Request Policy Name: Use Windows authentication for all users
    Network Policy Name: DTSWIRELESS
    Authentication Provider: Windows
    Authentication Server: xxxxxxxxxxxxxx
    Authentication Type: PAP
    EAP Type: -
    Account Session Identifier: -
    Logging Results: Accounting information was written to the local log file.
    Reason Code: 66
    Reason: The user attempted to use an authentication method that is not enabled on the matching network policy.
    So i will explain problems what i have seen:
    SSID: DTS-Group using authentication EAP with RADIUS and it working great (Authentication Type from Aironet to RADIUS is PEAP)
    SSID:L6-Webauthen-test using web-auth and i had try to compare with RADIUS but ROOT CAUSE is AUTHENTICATION TYPE from Aironet to RADIUS default is PAP. (Reason Code : 66)
    => I had trying to find how to change Authentication Type of Web-Auth on Cisco Aironet from PAP to PEAP or sometime like that for combine with RADIUS.
    Any idea or recommend for me ?
    Thanks for see my case  

    Hi Dhiresh Yadav,
    Many thanks for your reply me,
    I will explain again for clear my problems.
    At this case, i had setup complete SSID DTS-Group use authentication with security as PEAP combine Radius Server running on Window 2008.
    I had login SSID by Account create in AD =>  It's work okay with me. Done
    Problems occurs when i try to use Web-authentication on Vlan45 With SSID :
    dot11 ssid L6-Webauthen-test
       vlan 45
       web-auth
       authentication open 
       dot1x eap profile DTSGROUP
       mbssid guest-mode
    After configured on Aironet and Window Radius , i had try to login with Account create in AD by WebBrowser but it Fail ( i have see mini popup said: Authentication Fail" . So i go to Radius Server and search log on EventViewer.
    This is My Logfile on Radius Win 2008 : 
    Network Policy Server denied access to a user.
    NAS:
    NAS IPv4 Address: 172.16.1.62
    NAS IPv6 Address: -
    NAS Identifier: Aironet2702i
    NAS Port-Type: Async
    NAS Port: -
    RADIUS Client:
    Client Friendly Name: Aironet2702i
    Client IP Address: 172.16.1.62
    Authentication Details:
    Connection Request Policy Name: Use Windows authentication for all users
    Network Policy Name: DTSWIRELESS
    Authentication Provider: Windows
    Authentication Server: xxxxxxxxxxxxxx
    Authentication Type: PAP
    EAP Type: -
    Account Session Identifier: -
    Logging Results: Accounting information was written to the local log file.
    Reason Code: 66
    Reason: The user attempted to use an authentication method that is not enabled on the matching network policy.
    Im  think ROOT CAUSE is :
    PAP is the default authentication type for web-auth users on Aironet 2702i, so it can't combine with Radius Window 2008 because they just support PEAP (CHAPv1,CHAPv2....) => Please give me a tip how to change Authentication Type from PAP to PEAP for Web Authentication on Aironet

  • Tacacs+ authentication/authorization based on user's subnet

    Hi Guys/Girls
    We have number of production cisco gears, all of which are configured with Tacacs+ and all of them working just fine. But now I have a requirement to implement SSH-ver2 across whole network, comprise of about 8000 cisco gears.
    I need to develop a proof of concept (POC), that enabling SSH on production gears will not affect existing Tacacs+ users authentication and authorization.
    In our lab cisco gears, it has been already configured with production Tacacs+ server for authentication and authorization. Now I am allowed to test SSH on these lab-gears but I without disrupting others users who are using the same lab-gears.
    So, I want to enable SSH version 2 on these lab-gears however, when user coming from a certain specific subnet, this particular user must be authenticated and authorized by LAB Tacacs+ but not from production Tacacs+, however please note that lab-gears I am testing with also already configured for  production Tacacs+ server as well. These lab-gears must be able to do authentication and authorization to two different Tacacs+ server based on users subnet that he or she coming from.
    Is this doable plan? I have been looking for a documentation to implement test this method, not being successful.
    Your feedback will be appreciated and rated.
    Thanks
    Rizwan Rafeek

    Riswan,
    This will not work, tacacs authentication starts once the ssh connection is established, the NAD (switch or router) will open a tacacs connection and send the start flag to the tacacs server in which the message "getusername" is sent from the tacacs server to the device and to the user terminal. You can not create an acl in order to pick which tacacs servers you can authenticate to either. So when it comes to authenticating users from a specific subnet to a specific tacacs server that is not the intended design of tacacs, when you configure multiple servers in a group it is to insure high availability such that when one tacacs server goes down you have a secondary to continue with the authenticaiton requests.
    Here is an example of how the tacacs authentication is performed.
    http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml#comp_traffic
    thanks and I hope that helps,
    Tarik Admani
    *Please rate helpful posts*

  • Tacacs authentication problem.

    Hy,
    I have a network with several layer 2 (c2960) attached to a layer 3 switch (c3750).
    All these switches are behind a firewall (ASA 5510) and the firewall is connected to a router c3810.
    I have an ACS v.4.x to use as a Tacacs server.
    In all the equipments I have aaa authentication with tacacs and vlans.
    To test the tacacs authentication in the switch, I created a bypass to the firewall and connected the network (using a management vlan) to the router.
    With this scenario the tacacs authentication works.
    If I disconnect the bypass, all the traffic cross over the firewall. But I will not have the tacacs working anymore with the switch.
    I do not understand why!!?
    I have another problem, this time with the firewall.
    I configured the tacacs and the aaa in the firewall, as advised by Cisco.
    But it seems that it doesn’t work!
    In this two cases only the local authentication works.
    Can you help me, please?
    Thanks in advance,
                          Rui Oliveira

    Hy,
    I am doing tests in a Lab.
    So, the addresses presented here are not Internet routable.
    The configuration for the tacacs at the ASA is:
    aaa-server TACACS protocol tacacs+
    aaa-server TACACS (OUT_MANGMT) host 172.16.20.10
    key mykey
    aaa authentication enable console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication telnet console TACACS LOCAL
    aaa authentication http console TACACS LOCAL
    aaa authentication ssh console TACACS LOCAL
    aaa authorization command LOCAL
    aaa accounting enable console TACACS
    aaa accounting telnet console TACACS
    aaa accounting ssh console TACACS
    aaa local authentication attempts max-fail 5
    aaa authorization exec LOCAL
    I´m doing the tests with an ASA with a the IP address 10.183.0.61.
    And this address is seen from the outside, but I do a NAT between the 10.183.0.61 and the IP address 192.168.100.2 in the TCP/23.
    Besides that I have an interface called OUT_MANGMT, with IP address 192.168.100.2 .
    I have another interface that a called GESTAO, with IP address 10.183.0.61.
    This interface GESTAO is connected to a management vlan.
    My ACS has IP 172.16.20.10 and the standard port for tacacs is tcp/49.
    I send the logging file that I take from my firewall.
    Thanks,
               Rui

  • TACACS+ authentication fails VPN3000 administration sessions

    I have a problem when running TACACS+ authentication of VPN3000 administration sessions. If the admin account in the AAA-server has an expired password the login fails to the VPN3000. If I login to a router with the same account connected to the same AAA-server I get a prompt that tells me to change password since it has expired. After changing password through that login to a router I can also login to the VPN3000. Is it a limitation in VPN3000? Does it have a hard time presenting a password change dialog on a webpage?
    Any help appreciated.
    Håkan

    In concentrators you won't get any prompt for password expiry. You will have to change the password before it expires.

  • Problem setting 7606 router for TACACS+ authentication

    Hello Support Community,
    I have two Cisco 7606 routers which I have tried in vain to have users authenticated using TACACS+ servers. As shown below, I have two servers (1.1.1.1 and 2.2.2.2) reachable via vrf OAM which is reachable from desktops for ssh login. The true IP addresses and vrf have been altered because it's a company router.
    I use the two servers to authenticate many other Cisco devices in the network they are working fine.
    I can reach the servers from the vrf and the source interface in use. I can also telnet port 49 if the servers from the source interface and the vrf.
    The server key is hidden but at the time of configuration, I can ascertain that it's correct.
    The problem is that after confuring for TACACS authentication, the router still uses the enable password instead of TACACS. While the debug output shows 'bad password', why is the router not authenticating using TACACS? Why is it using the enable password?
    Please study the outputs below and help point out what I may need to change.
    PS: I have tried out many other combinations, including deprecated ones without success including the method suggested in this page;
    http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_vrf_tacas_svrs.html
    Please help I'm stuck.
    ROUTER#sh running-config | sec aaa
    aaa new-model
    aaa group server tacacs+ admin
    server name admin
    server name admin1
    ip vrf forwarding OAM
    ip tacacs source-interface GigabitEthernet1
    aaa authentication login admin group tacacs+ local enable
    aaa session-id common
    ROUTER#sh running-config | sec tacacs
    aaa group server tacacs+ admin
    server name admin
    server name admin1
    ip vrf forwarding OAM
    ip tacacs source-interface GigabitEthernet1
    aaa authentication login admin group tacacs+ local enable
    tacacs server admin
    address ipv4 1.1.1.1
    key 7 XXXXXXXXXXXXXXXXXXXX
    tacacs server admin1
    address ipv4 2.2.2.2
    key 7 XXXXXXXXXXXXXXXXxxxx
    line vty 0 4
    login authentication admin
    ROUTER#sh tacacs
    Tacacs+ Server -  public  :
                   Server name: admin
                Server address: 1.1.1.1
                   Server port: 49
                  Socket opens:         15
                 Socket closes:         15
                 Socket aborts:          0
                 Socket errors:          0
               Socket Timeouts:          0
       Failed Connect Attempts:          0
            Total Packets Sent:          0
            Total Packets Recv:          0
    Tacacs+ Server -  public  :
                   Server name: admin1
                Server address: 2.2.2.2
                   Server port: 49
                  Socket opens:         15
                 Socket closes:         15
                 Socket aborts:          0
                 Socket errors:          0
               Socket Timeouts:          0
       Failed Connect Attempts:          0
            Total Packets Sent:          0
            Total Packets Recv:          0
    Oct 22 12:38:57.587: AAA/BIND(0000001A): Bind i/f 
    Oct 22 12:38:57.587: AAA/AUTHEN/LOGIN (0000001A): Pick method list 'admin'
    Oct 22 12:38:57.587: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:38:57.587: AAA/AUTHEN/ENABLE(0000001A): Done status GET_PASSWORD
    Oct 22 12:39:02.327: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:02.327: AAA/AUTHEN/ENABLE(0000001A): Done status FAIL - bad password
    Oct 22 12:39:04.335: AAA/AUTHEN/LOGIN (0000001A): Pick method list 'admin'
    Oct 22 12:39:04.335: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:04.335: AAA/AUTHEN/ENABLE(0000001A): Done status GET_PASSWORD
    Oct 22 12:39:08.675: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:08.675: AAA/AUTHEN/ENABLE(0000001A): Done status FAIL - bad password
    Oct 22 12:39:10.679: AAA/AUTHEN/LOGIN (0000001A): Pick method list 'admin'
    Oct 22 12:39:10.683: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:10.683: AAA/AUTHEN/ENABLE(0000001A): Done status GET_PASSWORD
    Oct 22 12:39:14.907: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:14.907: AAA/AUTHEN/ENABLE(0000001A): Done status FAIL - bad password
    ROUTER#sh ver
    Cisco IOS Software, c7600rsp72043_rp Software (c7600rsp72043_rp-ADVIPSERVICESK9-M), Version 15.1(3)S3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Fri 30-Mar-12 08:34 by prod_rel_team
    ROM: System Bootstrap, Version 12.2(33r)SRE, RELEASE SOFTWARE (fc1)
    BOOTLDR: Cisco IOS Software, c7600rsp72043_rp Software (c7600rsp72043_rp-ADVIPSERVICESK9-M), Version 15.1(3)S3, RELEASE SOFTWARE (fc1)
    ROUTER uptime is 7 weeks, 5 days, 16 hours, 48 minutes
    Uptime for this control processor is 7 weeks, 5 days, 16 hours, 49 minutes
    System returned to ROM by reload (SP by reload)
    System restarted at 20:00:59 UTC Wed Aug 28 2013
    System image file is "sup-bootdisk:c7600rsp72043-advipservicesk9-mz.151-3.S3.bin"
    Last reload type: Normal Reload
    Last reload reason: power-on
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco CISCO7606-S (M8500) processor (revision 1.1) with 3670016K/262144K bytes of memory.
    Processor board ID FOX1623G61B
    BASEBOARD: RSP720
    CPU: MPC8548_E, Version: 2.1, (0x80390021)
    CORE: E500, Version: 2.2, (0x80210022)
    CPU:1200MHz, CCB:400MHz, DDR:200MHz,
    L1:    D-cache 32 kB enabled
            I-cache 32 kB enabled
    Last reset from power-on
    3 Virtual Ethernet interfaces
    76 Gigabit Ethernet interfaces
    8 Ten Gigabit Ethernet interfaces
    3964K bytes of non-volatile configuration memory.
    500472K bytes of Internal ATA PCMCIA card (Sector size 512 bytes).
    Configuration register is 0x2102

    In order to resolve this issue. Please replace the below listed command
    aaa authentication login admin group tacacs+ local enable
    with;
    aaa authentication login default group admin local enable
    You defined the server group name as method list and instead of using admin as a server-group, you used tacacs+
    Note: Please ensure you have local user and enable password configured in case of tacacs server unreachable.
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • I get error message: "An error occurred with the  publication of album...Authentication with server failed...whenever I open a facebook file in my iPhoto. In each file, most of my photos have disappeared. What do I need to do?

    I get error message: "An error occurred with the  publication of album...Authentication with server failed. Please check your login and password information" whenever I open a facebook file in my iPhoto. In each file, most of my photos have disappeared. I am hoping I can retrieve these "lost" files. What do I need to do?

    Message was edited by: leroydouglas
    better yet, try this solution:
    https://discussions.apple.com/message/12351186#12351186

  • Error in authentication with ldap server with certificate

    Hi,
    i have a problem in authentication with ldap server with certificate.
    here i am using java API to authenticate.
    Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed.
    I issued the new certificate which is having the up to 5 years valid time.
    is java will authenticate up to one year only?
    Can any body help on this issue...
    Regards
    Ranga

    sorry i am gettting ythe same error
    javax.naming.CommunicationException: simple bind failed: servername:636 exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed]
    here when i am using the old certificate and changing the system date means i can get the authentication.
    can you tell where we can concentrate and solve the issue..
    where is the issue
    1. need to check with the ldap server only
    2. problem in java code only.
    thanks in advance

Maybe you are looking for