Cisco-assign-ip-pool RADIUS VSA is an integer?

Hi all,
I'm trying to configure IP pool selection by RADIUS on ACS 5-3-0-40-7.
So, I went to configuring the cisco-assign-ip-pool (Cisco VSA 218) attribute within some test authorization profile but discovered that cisco-assign-ip-pool is an integer (?!) and (therefore) accepts digits only.
As far as I can remember, we used to put pool *names* within ip:addr-pool (something along those lines: cisco-avpair = "ip:addr-pool=test-pool-1").
So how should we configure the values for this attribute in ACS 5?

If your NAS is "RADIUS (Cisco IOS/PIX)" it will use a Cisco-AVPair attribute with "ip:addr-pool=poolname" inside it.
If your NAS is just about any other RADIUS type, it will use attribute 88, Framed-Pool.
Use the dictionary Radius-Cisco and then select cisco av-pair in the radius authorization profile.
After that configure:
ip:addr-pool=poolname
The pool should be defined on the device itself like ASA. The ACS will only push the name of it.
Jatin Katyal
- Do rate helpful posts -

Similar Messages

Parsing vsa:not a cisco vendor id:311 – radius

Hi,
We are getting "parsing vsa:not a cisco vendor id:311 – radius" error logs from Nexus. What is the impact of this log?

Hello Folks,
The error msg occurs when a Cisco device receives a Radius VSA that is not cisco. VSA 311 belongs to Microsoft so it might be that you are indeed not using a Cisco radius VSA. The error is not harmful.
https://technet.microsoft.com/en-us/library/cc958030.aspx
RADIUS: Attribute length = 12 (0xC)
RADIUS: Vendor ID = 311 (0x137)<<<<<<<<<<<<<<<<<<<
RADIUS: Vendor string = _
The way to stop seeing the error messages depend on the Cisco device in which you are seeing it, in nexus it is "Logging level user 2".
I hope it helps.

Adding RADIUS VSAs on ACS 3.2 SE

I have tried to add a VSA to enable a Packeteer to authenticate using RADIUS on the ACS.
Using RDBMS synchronization to import the csv file below.
SequenceId,Priority,GroupName,Action,ValueName ,Value1,Value2,Value3
1,1,External,163,26,access=look,2334,1
The group name is 'External', Action is 163 which corresponds to ADD_RADIUS_ATTR.
From RDBMS Sychronization Import Definitions (http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user/ag.htm#wp35130)
To add a vendor-specific attribute (VSA), set VN = "26" and use V2 and V3 as follows:
V2 = IETF vendor ID (which in this case is 2334)
V3 = VSA attribute ID (1)
V1 = In this case 'access=look'
After a couple of attempts I got the format correct but when I try and import the file I don't get an "INFO" message in the "Reports" section of the ACS indicating that the process was successful. I don't get any message at all, WARNING, ERROR or INFO.
From the FTP server I can confirm that the file was transferred.
What I should get is an INFO message similar to:
08/30/2004 16:27:50 INFO Sync complete: 1 transaction(s) 0 parse error(s) 0 process error(s)
Any ideas as to what is wrong would be much appreciated.
Cheers,
Aylmer.

HI you need to import the RADIUS VSA for PAcketeer from their site.
The link to the steps as shown below is ( might require u to subscribe & login)
https://packeteer.custhelp.com/cgi-bin/packeteer.cfg/php/enduser/std_adp.php?p_faqid=399&p_created=1046793530&p_sid=gszcDFBh&p_lva=&p_sp=cF9zcmNoPTEmcF9zb3J0X2J5PWRmbHQmcF9ncmlkc29ydD0mcF9yb3dfY250PTImcF9wcm9kcz0wJnBfY2F0cz0wJnBfcHY9JnBfY3Y9JnBfc2VhcmNoX3R5cGU9YW5zd2Vycy5zZWFyY2hfZm5sJnBfcGFnZT0xJnBfc2VhcmNoX3RleHQ9YWNz&p_li=&p_topview=1
IN any case the same content is copied below:-
Also the stpes on how to do them is listed here
Create a User Defined Vendor
First, you need to create a User Defined Vendor.
1. Create a text file (packet.ini) and enter the following:
[User Defined Vendor]
Name=Packeteer
IETF Code=2334
VSA 1=Packeteer-AVPair
[Packeteer-AVPair]
Type=STRING
Profile=OUT
2. Name the file packet.ini.
Add the Vendor to the Database
Next, you need to add the above vendor to the database.
1. Go to the command prompt, and change the directory to the Cisco Secure utils directory (typically C:\Program Files\CiscoSecure ACS v3.0\Utils).
2. The instructions below install the vendor into User Defined slot 0. If you have other vendors, you need to change this number to a free slot. To see a list of slots and their assignments, use the csutil -listudv command. For example:
C:\Program Files\CiscoSecure ACS v3.0\Utils>csutil -listudv
CSUtil v3.0(2.5), Copyright 1997-2002, Cisco Systems Inc
UDV 0 - Unassigned
UDV 1 - Unassigned
UDV 2 - Unassigned
UDV 3 - Unassigned
UDV 4 - Unassigned
UDV 5 - Unassigned
UDV 6 - Unassigned
UDV 7 - Unassigned
UDV 8 - Unassigned
UDV 9 - Unassigned
3. Run csutil -addudv to and add Packeteer to UDV (User Defined Vendor) slot 0 or the next
open slot.
C:\Program Files\CiscoSecure ACS v3.0\Utils>csutil -addudv 0 c:\temp\packet.ini
CSUtil v3.0(2.5), Copyright 1997-2002, Cisco Systems Inc
Adding or removing vendors requires ACS services to be re-started.
Please make sure regedit is not running as it can prevent registry
backup/restore operations
Are you sure you want to proceed? (y/n)y
Parsing [c:\temp\packet.ini] for addition at UDV slot [0]
Stopping any running services
Creating backup of current config
Adding Vendor [Packeteer] added as [RADIUS (Packeteer)]
Adding VSA [Packeteer-AVPair]
Done
Checking new configuration...
New configuration OK
Re-starting stopped services
Verify that Packeteer was added.
C:\Program Files\CiscoSecure ACS v3.0\Utils>
C:\Program Files\CiscoSecure ACS v3.0\Utils>csutil -listudv
CSUtil v3.0(2.5), Copyright 1997-2002, Cisco Systems Inc
UDV 0 - RADIUS (Packeteer)
UDV 1 - Unassigned
UDV 2 - Unassigned
UDV 3 - Unassigned
UDV 4 - Unassigned
UDV 5 - Unassigned
UDV 6 - Unassigned
UDV 7 - Unassigned
UDV 8 - Unassigned
UDV 9 - Unassigned
4. Return to ACS Admin and select Network Configuration.
From the main screen select Network Configurtion and add the PacketShaper by supplying the AAA client Hostname, IP address: , Key. Scroll through the Authenticate Using choices and select RADIUS (Packeteer).
5. From the main screen select User Setup and enter a user name for a Touch or Look access user to the Packet Shaper. Supply the PAP/CHAP password. Leave other fields at defaults and scroll to the bottom
of the form. Be sure the Packeteer-AVPair box is selected and supply either
"access=touch" or "access=look" in the available entry space.

Pack and unpack Radius VSA attributes

Hi
As far as I know there are some methods to pack radius VSA attributes. Here are:
As the part of Cisco-AVPair
26 - VSA
Length
9 - Vendor ID
1 - Vendor Type (Cisco-AVPair Attribute ID)
Attribute Name=Value
In the Vendor Specific attribute ("throught attribute ID")
26 - VSALength
9 - Vendor ID
2 - Vendor Type (Attribute ID)
Vendor Length
Attribute Name=Value
In the Vendor Specific attribute ("throught attribute ID")
26 - VSA
Length
9 - Vendor ID
2 - Vendor Type (Attribute ID)
Value
i.e. with attribute name and witout.
How to understand which attribute needs attribute name in value string?
For example:
26|Length|9|2|Vendor Length|1|h323-incoming-conf-id=82b5fc8cd6f411dfa3c6080027716a9a
26|Length|9|2|Vendor Length|35|h323-incoming-conf-id=82b5fc8cd6f411dfa3c6080027716a9a
26|Length|9|2|Vendor Length|35|82b5fc8cd6f411dfa3c6080027716a9a
which of the methods is right?

Hi,
For the specific VSA you used in the example (h323-incoming-conf-id), (1) is the correct encoding, since Cisco VSA vendor type 1 (also more commonly referred to as cisco AV Pair) is always encoded in strings with the format of "attribute=value". This applies to other cisco VSAs that use string encoding as well. For VSA's that don't use string encoding, eg., fax-pages (vendor type 5, encoding integer), it typically doesn't include the value. You should be able to check that against the vendor dictionary to confirm. Please also see:
http://www.cisco.com/en/US/docs/ios/voice/cdr/developer/guide/cdrdefs.html
Thanks,
Wen

ASA , Cisco VPN client with RADIUS authentication

Hi,
I have configured ASA for Cisco VPN client with RADIUS authentication using Windows 2003 IAS.
All seems to be working I get connected and authenticated. However even I use user name and password from Active Directory when connecting with Cisco VPN client I still have to provide these credentials once again when accessing domain resources.
Should it work like this? Would it be possible to configure ASA/IAS/VPN client in such a way so I enter user name/password just once when connecting and getting access to domain resources straight away?
Thank you.
Kind regards,
Alex

Hi Alex,
It is working as it should.
You can enable the vpn client to start vpn before logon. That way you login to vpn and then logon to the domain. However, you are still entering credentials twice ( vpn and domain) but you have access to domain resources and profiles.
thanks
John

SSL VPN IP Address Assignment from IAS radius server

Can I use SSL VPN IP Address Assignment from IAS radius server?it can be done with acs server.are there some differ from the acs and IAS?

Hi,
I will suggest to setup a sniffer capture with ACS and look for the attribute that ACS sends for IP Address Assignment, once you know the attribute apply it on the IAS.
If you have any question do not hesitate to contact me.

RADIUS VSAs for Airespace and ACS 3.3

How/Where do we get the RADIUS VSA downloads for ACS 3.3 for the Airespace hardware?
I can only find reference to them in ACS 4.0 documentation.

Did you manage to get these???
Cheers,
Dean

Assign DHCP Pools to VLAN on SG500

Hello,
I want to use the internal DHCP Server of a SG500-Stack (Layer3-Mode) to assign addresses to several VLANs.
I was able to create several Pools, but I didn't find any option to assign these pools to VLANs or Ports.
For Example:
Addresses from Pool 192.168.0.0/24 are assigned to VLAN10
Addresses from Pool 10.0.0.0/24 are assigned to VLAN20
Addresses from Pool 10.128.128.0/24 are assigned to VLAN30
Is this possible with a SG500?
If it is, please give me a hint where I can set this up as I didn't find anything about this.
Thanks in advance,
Christoph

This is an example to create Vlan and DHCP per vlan and how to assign the port to vlan
but before please change the mode of the router to layer 3 and ensure you have the latest firmware
1. Create a vlan
#configure terminal
#vlan database
#vlan 10
#vlan 20
#vlan 30
#exit
2. Create interface of the Vlan's
#interface vlan 10
#ip address 192.168.0.254 255.255.255.0
#interface vlan 20
#ip address 10.0.0.254 255.255.255.0
#interface vlan 30
#ip address 10.128.128.254 255.255.255.0
#exit
3. Enable DHCP server on vlan's in this example the range is from 100 to 200 hosts
#address low 192.168.0.100 high 192.168.0.200 /24
#address low 10.0.0.100 high 10.0.0.200 /24
#address low 10.128.128.100 high 10.128.128.200 /24
#exit
4. Assign the port to Vlan 10 and 20 and 30 in my example I assign port 1 to vlan 10 , port 2 to vlan 20 and port 3 to vlan 30
#interface gigabitethernet 1/1
#switchport mode access
#switchport access vlan 10
#exit
#interface gigabitethernet 1/2
#switchport mode access
#switchport access vlan 20
#exit
#interface gigabitethernet 1/3
#switchport mode access
#switchport access vlan 30
#exit
So now connect pc with on port 1,2,3 to make a test
Please lets me know and please rate the post and mark answered to help other customers
Thanks
Mehdi

Assign ip pool per nas on ACS 3.2 with radius

Hello
is it possible to assign different ip pools defined on the ACS to different NAS? For eg. I like to assign the IP pool x to the NAS X and the IP pool y to the nas Y. So if a user logins in to X he gets the pool x and on Y the pool y.
thanks for any answers.
Andre

Its not possible to assign end users an ip address based on the NAS equipment that they currently are connected too.

Sf302-08 and radius vsa keys

Greetings all,
I recently received a SF302-08 to configure and I have to say quite an improvement over the SRW208 I had earlier. One thing bugs me though, with authentication requests it does not send the Service-Request parameter. On our Catalyst switches I have been experimenting with adding vsa keys to the requests and replies but on the SF302-08 I cannot find that feature yet. Can anyone tell me if it is at all possible to add custom or cisco proprietary vsa keys to an authentication request?
Thanks in advance,
Chris Schaatsbergen

That would be a pity, but maybe you can help me a supported vsa set to work properly. I am Radius VLAN assignment and am unable to get it to work properly.
I am sending the attributes as described but it fails on the Tunnel-Private-Group-ID.
For the Dynamic VLAN Assignment feature to work, the switch requires the
following VLAN attributes to be sent by the RADIUS server (as defined in
RFC 3580):
[64] Tunnel-Type = VLAN (type 13)
[65] Tunnel-Medium-Type = 802 (type 6)
[81] Tunnel-Private-Group-Id = VLAN ID
VLAN 7 (Guest) is the VLAN that the port should be assigned to, but for the different ways of sending the data I get these results.
"7"
Mar 2 12:53:53 10.1.1.181 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 00:22:15:8e:a4:ac was rejected on port e1 because Radius accept message does not contain VLAN ID
"Guest"
Mar 2 12:57:36 10.1.1.181 %AAAEAP-W-RADIUSREPLY: Invalid attribute 81 ignored - wrong length
7
Mar 2 13:04:00 10.1.1.181 %AAAEAP-W-RADIUSREPLY: Invalid attribute 81 ignored - cannot decode VLANID
Any thoughts?

How to configure wireless Cisco 1041/EAP2 with Radius

Hello,
Having trouble configuring wireless on a Cisco 1041 with a 2012 Radius Server
I have a cisco ASA 5505 and Windows server 2012 Radius with NAP and Network Security policy
Guest Test guest works, test does not, I want the users to log into test with their AD credentials
Here is the AP config:
Thanks for any help
o service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap1
logging rate-limit console 9
aaa new-model
aaa group server radius rad_eap
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa group server radius rad_eap2
server x.x.x.x auth-port 1645 acct-port 1646
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication login eap_methods2 group rad_eap2
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
clock timezone -0500 -5
clock summer-time -0400 recurring
ip domain name ser.local
dot11 syslog
dot11 ssid test
   vlan 1
   authentication open eap eap_methods2
   authentication network-eap eap_methods2
   authentication key-management wpa
   mbssid guest-mode
dot11 ssid test guest
   vlan 12
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7
dot11 priority-map avvid
dot11 phone dot11e
power inline negotiation injector 001b.8fac.990a
power inline negotiation prestandard source
class-map match-all _class_data_policy0
match ip dscp default
class-map match-all _class_voice_policy0
match ip dscp ef
policy-map voice_policy
class _class_voice_policy0
set cos 6
policy-map data_policy
class _class_data_policy0
set cos 0
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption vlan 1 mode ciphers aes-ccm
encryption vlan 12 mode ciphers aes-ccm
ssid ihiCorp
ssid ihiGuest
antenna gain 0
mbssid
station-role root
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
service-policy input data_policy
service-policy output data_policy
interface Dot11Radio0.12
encapsulation dot1Q 12
no ip route-cache
bridge-group 12
bridge-group 12 subscriber-loop-control
bridge-group 12 block-unknown-source
no bridge-group 12 source-learning
no bridge-group 12 unicast-flooding
bridge-group 12 spanning-disabled
service-policy input data_policy
service-policy output data_policy
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
interface GigabitEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface GigabitEthernet0.12
encapsulation dot1Q 12
no ip route-cache
bridge-group 12
no bridge-group 12 source-learning
bridge-group 12 spanning-disabled
interface BVI1
ip address x.x.x.x 255.255.255.0
no ip route-cache
ip default-gateway x.x.x.x
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server attribute 32 include-in-access-req format %h
radius-server host x.x.x.x auth-port 1645 acct-port 1646 key 7
radius-server vsa send accounting
bridge 1 route ip
line con 0
line vty 0 4
end

in order I get these messages;
The processing of Group Policy failed. Windows attempted to read the file \\test.local\sysvol\test.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
A LDAP connection with domain controller IHIserver01.ihi-press.local for domain TEST is established.
A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 48.

Cisco Nexus to use Radius AAA authentication using Microsoft 2008 NPS

I have a Nexus 7010 running
Just wondering if you can help me with something. I'm having an issue with command authorization thru our aaa config. We don't have a problem authenticating its command authorization that is not working. From what I have seen and read Nexus NX-OS 6.x does not have any commands for aaa authorization unless you are configuring TACACS+. My basic config is below if you can help it would be much appreciated.
>>ip radius source-interface mgmt 0
>>radius-server key XXXXX
>>radius-server host X.X.X.X key XXXXX authentication accounting
>>radius-server host X.X.X.X key XXXXX authentication accounting aaa
>>authentication login default group Radius_Group aaa authentication
>>login console local aaa group server radius Radius_Group
>>    server X.X.X.X
>>    server X.X.X.X
>>    source-interface mgmt0
Also does anyone know how to configure Microsoft 2008 NPS as a Raduis server to work with Nexus? I have read a few post that suggest changing the
shell:roles="vdc-admin" in the Attribute Value field in the RADIUS server
Does anyone know if this works????
Thanks

I have never done this before with ACS but not with NPS. However, you are in the right path. Nexus uses NX-OS which is different in some regards to regular IOS. One of those differences is the AAA setup. In NX-OS you assign users to roles. So for full access you will need to return the following attributes from your Radius server:
Attribute: cisco-av-pair
Requirement: Mandatory
Value: shell:roles*"network-admin vdc-admin"
For more information take a look at this link:
http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/115925-nexus-integration-acs-00.html
Hope this helps
Thank you for rating helpful posts!

802.1x authetication with dynamic Vlan assignment by a radius server

Hi
At school I want to start using 802.1x authentication with dynamic Vlan assignment by a Windows Server 2012R2 Radius server.
When a student logs in, I want it to be placed in the "Students" Vlan, when a Administrative employee logs in, I want it to be placed in the "Administative" vlan and when the client is unknown I want to place it in the "Guest" Vlan.
I have several SG200 switches and I configured everything as mentioned in the administrative guide but I cannot get it to work as desired.
What does work:
- If the client is permitted, the switch changes to "authorized" state. (before anyone logs on to the domain with that client)
- When a User logs on that is part of the Administrative employees, the switch changes to "authorized" and when a student logs on, it changes to "unauthorized".
So far so good.
But what doesn't work:
- it does not put the administrative employee in the Vlan "Administrative", it just enables the port on the switch but leaves it in the default vlan 1.
- I can not find the Guest VLAN.
Any help would be appriciated.

Hi Wouter,
Can you see in the packet capture Radius accept message VLAN attribute? Also please ensure you have the latest firmware and boot code:
http://www.cisco.com/c/en/us/support/switches/sg200-26-26-port-gigabit-smart-switch/model.html#~rdtab1
I would recommend you to open ticket with Small Business team so they can go with you through packet capture and configuration steps:
http://www.cisco.com/c/en/us/support/web/tsd-cisco-small-business-support-center-contacts.html
Regards,
Aleksandra

Cisco WSA : What is RADIUS CLASS attribute ?

Hello !
I am trying to use a radius server Cisco ISE as an external authentication server for WSA. I would like to assign roles for groups of users but i don't understand the meaning of RADIUS CLASS attribute. What am I supposed to write in this field ?
Thank you,
Stéphane Walker

The CLASS attribute is generic, in that you can put anything in it. So you get to decide what you use.
On your RADIUS box, for the users or group that it applies to, set it to something like "WSAAdmin" for admins, "WSARO" for read only users...
Then when you config the WSA, you set them appropriately there...
But you can really use any string you want to, they just need to match appropriately.
HTH,
Ken

Cisco Nexus 5K + Micrososft Radius for Admin Authentication

Hi,
I have cisco 3750 switches configured to use MS radius for administrator authention. however, now I would like to add our cisco nexus switches to MS radius as well so that administrators are authenticated against the Microsoft radius for admin authention.
I tried it earlier but it won't accept 3750 commands.. Can you please help with me with a configuration example please that I can follow?
the commands I have used on 3750 are as follows:
aaa new-model
aaa authentication login vtylogin group radius local
aaa authentication login conlogin group radius local
aaa authentication enable default group radius enable
aaa authorization console
aaa authorization exec vtylogin group radius local
aaa authorization exec conlogin group radius local
radius-server host x.x.x.x key SECRETE
line con 0
exec-timeout 5 0
authorization exec conlogin
logging synchronous
login authentication conlogin
line vty 0 4
exec-timeout 0 0
authorization exec vtylogin
login authentication vtylogin
transport input ssh
line vty 5 15
exec-timeout 0 0
authorization exec vtylogin
login authentication vtylogin
transport input ssh

I have never done this before with ACS but not with NPS. However, you are in the right path. Nexus uses NX-OS which is different in some regards to regular IOS. One of those differences is the AAA setup. In NX-OS you assign users to roles. So for full access you will need to return the following attributes from your Radius server:
Attribute: cisco-av-pair
Requirement: Mandatory
Value: shell:roles*"network-admin vdc-admin"
For more information take a look at this link:
http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/115925-nexus-integration-acs-00.html
Hope this helps
Thank you for rating helpful posts!

Cisco-assign-ip-pool RADIUS VSA is an integer?

Similar Messages

Maybe you are looking for