Cisco NAC Guest Server and shellshock

Hello,
We are running NAC server v2.0.2 and would like to know if it's vulnerable to shellshock as the bug report CSCur05629 isn't clear on this. 

Well you will need to use a 3rd party certificate..  Here is a link to generate and install a 3rd party certificate on the WLC for the use with Web-Auth:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml
Here is a link for the NGS:
http://tools.cisco.com/search/display?url=http%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fdocs%2Fsecurity%2Fnac%2Fappliance%2Fconfiguration_guide%2F410%2Fcas%2Fcas41ug.pdf&pos=1&strqueryid=2&websessionid=RK88fQNWy8TCDUakpNGLOqZ
The applicances are using a self generated Cisco certificate which of course is not a trusted certificate store in most of all operating systems.  So using a 3rd party certificate like RapidSSL, Verisign, etc will eliminate the certificate issue.

Similar Messages

  • Cisco NAC Guest Server for Wireless Users integration with IP telephony

    Hi Team
    I have a client who has the following requirement. The cleint requires a Guest server inorder to serve wireless needs for guests at their office. They want the guest to get their authentication codes via SMS. The cleint will have a lobby IP Phone where the guest will press the services button confgiured on the IP Phone. IT will then prompt the guest to enter his mobile number. Once the guest enters his mobile number, the guest will recieve a text via sms gateway with login credentials. They want to offload this from the receptionist and it is for this reason that they require this functionality.
    Has anyone done this sort of deployment ? We have already proposed NAC guest server and Wireless controller but we do not know whether the XML application for subscribing the service on the IP Phone is available directly with cisco or does it need to developed.
    Kindly advice on the same.
    Regards
    Azeem

    Hi Vishal,
    Please note that if you want to return ACLs (and usually in wired web auth you need to), you will have to integrate with ACS as NGS itself cannot return ACLs in the reply radius attributes.
    Basically the process is as follows:
    1 - Client plugs cable on switch.
    2 - Web auth is triggered on the port.
    3 - default ACL permiting only DNS and DHCP is applyed so that the client PC can obtain IP address and open a browser.
    4 - Client will be redirected to the NGS hotspot login page.
    5 - Client will enter credentials.
    6 - Client broswer will send an HTTP POST packet containing the credentials.
    7 - The switch will intercept the POS packets and retrieve the credentials entered.
    8 - The switch will send Radius Access-Request to the ACS.
    9 - The ACS will use the NGS as External Identity source to authenticate the client.
    10 - The NGS will reply with Radius Access-Accept to the ACS and the ACS will reply to the switch including the ACL in the Access-Accept.
    11 - the Switch authorizes the client on the port and applies the ACL it received from the ACS.
    Please follow the document Nicolas posted as it is a good one.
    HTH,
    Thanks

  • NAC guest server and pre-configured duration of accounts

    There seems to be a bug in the way the NAC guest server handles the pre-configured duration of guest accounts.
    I have followed the manual and I did:
    - Configured 3 durations (24h, 48h and 1 week) under the templates/accounts/accounts durations.
    - And set "maximun duration of account" under User Groups
    As I understand I should now be able to select one of the three configured durations when I login as a sponsor.
    However I only get the number which I specified under User Group.
    The odd thing is that if I change the Maximum duration under User Group, I get this as the only choice (e.g. 14 days).
    Have other experienced this?
    Best regards,
    Steffen Lindemann

    You can use any one of the option ie number of days or number of hours.
    For days;
    Authentication > User Groups > Add Group | Edit Group includes two new settings for Number of days in the future the account can be created and Maximum duration of account (in days)
    For hours:
    User Interface > Templates > Add Template | Edit Template > Accounts > Account Duration
    http://www.cisco.com/en/US/docs/security/nac/guestserver/release_notes/11/gsrn110.html

  • NAC guest server and guest proxy filtering issue.

    Hi all
    Continuing our issues log for the NAC guest server install, our toplogy and issue is as follows:
    We have a guest NAC server and a 4404 anchor controller successfully deployed in the DMZ, the anchor WLC has a mobilty anchor which is a WISM on the corporate network, DHCP services for guest clients are issued with no problems from the WLC in the DMZ. The first port of the DMZ controller is located on the DMZ and the second port directly connects to the firewall interface.
    All works correctly, DNS, DHCP, NTP, SNMP etc all work fine through the firewall.
    What options do I have to filter Internet access in this scenario, we have Websense and Nokia firewalls, don't think I can use WCCP as I have nowhere to place it, the second connection on the WLC is directly connected to the firewal so nowhere to intercept the traffic, our security team has tried some tricks on the Nokia to try to redirect the traffic on the firewall using a type of redirect, WPAD, I can't see as an option. Any ideas. If I place the second interface into the DMZ, could I use WCCP that way maybe, but won't traffic still have to go to the firewall??
    options please ??

    Well you will need to use a 3rd party certificate..  Here is a link to generate and install a 3rd party certificate on the WLC for the use with Web-Auth:
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml
    Here is a link for the NGS:
    http://tools.cisco.com/search/display?url=http%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fdocs%2Fsecurity%2Fnac%2Fappliance%2Fconfiguration_guide%2F410%2Fcas%2Fcas41ug.pdf&pos=1&strqueryid=2&websessionid=RK88fQNWy8TCDUakpNGLOqZ
    The applicances are using a self generated Cisco certificate which of course is not a trusted certificate store in most of all operating systems.  So using a 3rd party certificate like RapidSSL, Verisign, etc will eliminate the certificate issue.

  • NAC Guest Server and WLC's

    Just wanted to know if this will work or not...
    I was looking at a design from a client and they had two CAM and CAS plus a Guest server. My client wants to use the equipment above for guest access. The problem I'm having is that I'm building a wireless network with guest anchor WLC's in the DMZ. So my wireless users will be tunneled to the DMZ controller. Also, the WLC can have a splash page uploaded to it and also authenticate users locally in the DB. They don't want any remediation, just authentication.... is this a waste of money or would would actually implement this?

    I've some (very) basic questions.
    Let's say guest vlan = x
    1)vlan x should be created on the foreign controllers as on the anchor controller, with the same properties
    2)on the anchor controller a dynamic interface has to be created acting as default gateway for the guest clients.
    3)it's advised to place the guest server in the guest vlan? Eg. Somewhere in the server farm?
    4)Once traffic coming from the guests is arrived at the anchor controller. (I know to less of WLC ;)) Will it forwarded with as source IP, the IP of the anchor controller towards the anchor default gateway (firewall or internet router?)
    4)authentication: user connect to SSID guest and opens a browser. The user is redirected and a login page is displayed. Is this page downloaded from the anchor controller? I think it is and pushed via WCS. So Guest NAC server has nothing to deal with this page? Correct?
    The anchor controller polls the nac guest server with the given credentials. Anchor controller forwards the credentials to the NAC guest server. The NGS replies with authenticated or not. If authenticated. The guest can browse. Probably on regular base, the anchor controller will poll the NAC guest in order to check if he's still authenticated and if enabled pass information to the NAC guest for accounting. Is this somehow ok?
    I've found to open the following ports in the firewall:
    UDP 97 for EoIP
    UDP 16666 for intercontroller traffic
    and 1812/1813 for Radius.
    Thanks in advance

  • NAC Guest Server and WLC, WCS

    I have setup a NAC Guest Server to allow users to sign up guest account via Active Directory. How do I tight this into WLC or WCS?

    Hi
    Try this:
    http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a00809d6b9a.shtml
    Regards
    Greg

  • NAC Guest Server and Multiple Guest SSID's/Splashpages

    Hi All,
    If I have multiple guest SSID's on a single controller and I use NGS as the Radius. How do I configure NGS to "send" the clients to differnet login pages corresponding to the SSID they came from.
    I can configure different splash pages in HotSpots section but how do I map the different SSID's from the controller to the different splash pages. Then I guess that raises the question when I generate guest users on NGS is it possile to only allow them associate to a specific SSID.
    TIA,
    Eoin.

    Hi Nicolas,
    Thanks for the reply. I can see that config on the WLC and have used it before where there is only a single guest SSID. What I dont know is if the NAC Guest server sees radius requests coming from different guest SSID's on the same WLC. How does the NAC Guest server apply the correct guest policy to that user. And when sponsors genereate guest accounts how do they specific which policy is to be applied to that guest so it can only get access to a specfic guest network/SSID I'm not sure where the "mapping" of accounts/splash pages/policies takes place on the NAC guest server. I've only ever set up NAC Guest when there has been a single guest SSID.
    Regards,
    Eoin.

  • Cisco NAC Guest Server

    Is there any custom reports for security log on NAC Guest Server?
    I want to have report show all guest accounts has been created by the employees for the last month from the Security officer view.

    yes you can do this.
    in the admin console look at the permissions for the sponsor group.
    what i've done is created a superuser account and assigned it to a superuser sponsor group. the superuser sponsor group can see & manage all accounts. default group sponsors can only see & manage their own accounts and they dont have the management reporting capability.

  • NAC Guest Server and Entrust Intermediate CA

    Chaps,
    Trying to install an Entrust cert with a intermediate and root cert, but haivng problems.
    I've managed to install both the imtermediate and root but putting them into a single file.
    The certs and root are accpeted without an error, but after a reboot there is still an error in IE.  Looking at the error the end user cert looks fine but only the intermediate cert is in the chain, not the root.
    Any ideas?  Is this is known issue or am i doing something wrong?
    Jim

    Hi
    I've just had a reply from our Cisco SE. It appears that the TAC already has a case open for this error and it's been escalated to the Development Engineering Team.
    Resolution is to downgrade to version 1.1.2, which I've already done, and it works fine. Please note that v2.0.0 is a ED release.
    regards
    Martyn

  • NAC guest server hangs and guest portal is not working

    Hi all ,
    Our guest nac server NAC3315 is oftenly getting hung state . And our guest wireless network is not working . We are able to ping the NAC server but web page is not opening for the clients if they connected to guest network.
    Any clue on this ....
    Thanks!,
    Regards,
    Vijay.

    All  actions within the Cisco NAC Guest Server are logged into the database.  This enables you to see any action that occurred as part of the normal  operating process of the application.
    To access the system log from the administration interface select Server > System Log from the left hand menu
    Please check the Error Logs for troubleshooting of NGS

  • NAC guest server with RADIUS authentication for guests issue.

    Hi all,
    We have just finally successfully installed our Cisco NAC guest server. We have version 2 of the server and basically the topology consists of a wism at the core of the network and a 4402 controller at the dmz, then out the firewall, no issues with that. We do however have a few problems, how can we provide access through a proxy without using pak files obviously, and is there a way to specify different proxies for different guest traffic, based on IP or a radius attribute etc.
    The second problem is more serious; refer to the documentation below from the configuration guide for guest nac server v2. It states that hotspots can be used and the Authentication option would allow radius authentication for guests, I’ve been told otherwise by Cisco and they say it can’t be done, has anyone got radius authentication working for guests.
    https://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/g_hotspots.html
    -----START QUOTE-----
    Step 7 From the Operation mode dropdown menu, you can select one of the following methods of operation:
    •Payment Provider—This option allows your page to integrate with a payment providing billing system. You need to select a predefined Payment Provider from the dropdown. (Refer to Configuring Payment Providers for details.) Select the relevant payment provider and proceed to Step 8.
    •Self Service—This option allows guest self service. After selection proceed to Step 8.
    •Authentication—This option allows RADIUS authentication for guests. Proceed to Step 9.
    ----- END QUOTE-----
    Your help is much appreciated on this, I’ve been looking forward to this project for a long time and it’s a bit of an anti climax that I can’t authenticate guests with radius (We use ACS and I was hoping to hook radius into an ODBC database we have setup called open galaxy)
    Regards
    Kevin Woodhouse

    Well I will try to answer your 2nd questions.... will it work... yes.  It is like any other radius server (high end:))  But why would you do this for guest.... there is no reason to open up a port on your FW and to add guest accounts to and worse... add them in AD.  Your guest anchor can supply a web-auth, is able to have a lobby admin account to create guest acounts and if you look at it, it leaves everything in the DMZ.
    Now if you are looking at the self service.... what does that really give you.... you won't be able to controll who gets on, people will use bogus info and last but not least.... I have never gotten that to work right.  Had the BU send me codes that never worked, but again... that was like a year ago and maybe they fixed that.  That is my opinion.

  • NAC Guest Server, unable to login with sponsor

    We have a Cisco NAC Guest Server (version 2.0.5).
    I created some sponsors and wanted them to be in another sponsor user group than the default group. So I created a sponsor user group and changed the group permissions (Allow Login is set to Yes, edit account .. are set to Own Accounts).
    No I wanted to try out the new sponsors but I can't login to the NAC Server. I get a "username or password invalid" as reply. If I change the sponsor user group of the user to DEFAULT, everything is working.
    The logfile on the NAC Server shows the following error:
    Oct  4 13:05:14 s100059 NGS_SPONSOR: [audit NGS 0 10.106.161.5] Login failure: xxx
    xxx is the username of the sponsor.
    Why can't I login with the sponsor when he's in anoter sponsor group than DEFAULT?
    Martin

    If credentials work on CCMuser CUPSuser I would suspect either some kind of communication problem between the clients and the servers and/or misconfiguration (user/device/line association, device owner, roles, CTI/CCMCIP profiles, etc) on CUCM/CUPS.
    Specially because you mention the same happens with CUPC.
    HTH
    java
    if this helps, please rate
    www.cisco.com/go/pdihelpdesk

  • NAC GUEST SERVER HA & REPLICATION

    Hi
    We are planning on a NAC Guest Server HA pair (1st NGS in One location & 2nd NGS in someother 2nd location) in Active/Active Scenerio. The two NGS boxes in 2 locations are facilitated with a L2TP tunnel to establish communication between them using a single VIP.
    Could anyone please let me know on the precautionary steps needs to be followed and how the replication, HA & load balancning happens in this scenario?
    Appreciate your response on this. Thanks
    Daniel

    Initial replication is configured by setting one of the Cisco NAC Guest Servers to copy all of the data from the other Guest Server. The Guest Server that is configured to copy the data from the other device is first set to delete all of its own data. This ensures that no conflicts exist. Cisco recommends setting up replication at initial installation of Cisco NAC Guest Server, or when adding a new Guest Server to an existing implementation. Once one of the Guest Servers has received a copy of the data from the other device they are synchronized and replication is turned on. Any data that is updated on one Guest Server is then automatically replicated to the other Guest Server.

  • Nac Guest Server Replication

    Hi;
    I configured the replication between two NAC Guest Servers. But replication is not happening because of the TWIN Service . Always its status is stopped. Could you please give some suggestions for this

    Initial replication is configured by setting one of the Cisco NAC Guest Servers to copy all of the data from the other Guest Server. The Guest Server that is configured to copy the data from the other device is first set to delete all of its own data. This ensures that no conflicts exist. Cisco recommends setting up replication at initial installation of Cisco NAC Guest Server, or when adding a new Guest Server to an existing implementation. Once one of the Guest Servers has received a copy of the data from the other device they are synchronized and replication is turned on. Any data that is updated on one Guest Server is then automatically replicated to the other Guest Server.

  • NAC Guest Server SMTP Authentication

    Does anyone know if you are able to set your SMTP server in the NAC Guest Server to do SMTP Authentication? Our old Exchange server just let us specify the SMTP server and send the guest accounts their Username and Password to their outside accounts.  Our new Exchange server requires SMTP authentication, but we do not see the option available in the NAC Guest Server interface.  We are running NAC Guest Server 1.1.3.  Any ideas would be appreciated.  Thanks!

    I have Cisco NAC Guester server 2.0.2 and have sort of similar issues.
    I configured the Base DN to the OU of the sponsor groups in AD and then map that particular group in roles. Users from that group can log on fine and create guest accounts.
    The problem is, it seems that other users from that OU seems to be able to log on as sponsors too. How do I restrcit this to just that sponsore group? I tried changing the Base DN to the OU of the sponsore group then enter CN=sponsorgroup to narrow it to just that group but still other users can log in as sponsors.

Maybe you are looking for