Configuration NACE

Hi All,
What configuration had to be done for an output type in order to get the output type printed just for one specific partner (bill-to-party)?
Regards,
Florina

Hi VJ,
I made this configuration:
transaction code: NACE application V3 Billing Condition records Output type MFSR Billing type ZF2 and here I maintained that partner: ZF2 Invoice BP 0000010049 5 4 RO. For Communication I have strategy CS01 (Internet/Letter), for output device I have LP01 and Print immediately is checked.
The consequences of this configuration are:
-for any invoice created (even if the partner is diffrent from 0000010049) the system creates automatically (for example):
Invoice 1 (Bill-to-party and Payer 10049)
 MFSR Invoice 5 External send BP 10049 RO (for 10049 bill to party, is ok)
 RD00 Invoice 1 Print output BP 10049 RO (for 10049 bill to party, is ok)
Invoice 2 (Bill-to-party and Payer 15964)
 MFSR Invoice 5 External send BP 10049 RO (for 15964 bill-to-party, is not ok)
 RD00 Invoice 1 Print output BP 15964 RO (for 15964 bill-to-party, is ok)
- any invoice created in the system is printed once at the appropriate output device (configured for the output type RD00, and is ok) and once at the LP01 device (I guess because I configured LP01 device for MFSR output type; this isnt ok)
Which one was my mistake? How can I correct the configuration?
Thanks,
Florina

Similar Messages

Configuring NAC 2 in acs 4.0

How can configuring NAC L3 in acs 4.0?

Click on the Network Access Profiles button on the left side of the page.
Next click Add Template Profile button
Select L3 IP
This will preconfigure the L3 RAC's and ACL's
You will need to edit the RAC's and ACL's and configure your posture validation policies

Configuring NAC MANAGER HA - link failure detection

Hello,
I'm configuring HA in NAC Manager and want to enable "eth0 link failure detection based failover". Is this possible in version 4.1.2.1 ?
Where can i configure this in NAC Manager?
See my configurations for the Primary HA on pic attached.
kind regards,
Daniel Stefani

Hi Daniel,
It doesn't look like that's an option in the 4.1.2 line. You can configure this in 4.1.3 line, however - see the configuration guide here: http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_ha.html#wp1040221
HTH,
Lauren

Installing and configuring NAC/CAM/CAS/COLLECTOR

Hi everybody,
I have been new to this community and I just joined this.
I need some help regarding CISCO Nac profiler.
I have 3 cisco nac appliances as below.
1. 3355
2. 3315
3. 3315.
My question is that when I power on these devices CAS is pre-configured in it but I have to install profiler, CAS, CAM.
Got 5 hardware total of cisco which are as follows.
1. CISCO NAC 3355.
2. CISCO NAC 3315
3. CISCO NAC 3315.
4. CISCO Router.
5. CISCO Switch.
I have to installed these devices into a network.
But the confusion is that whom to make profiler server, CAM, CAS and Collector.
Please help me on this if you have a simple document describing about NAC profiler server, NAC profiler collector, CAS, CAM and how to configure these devices.
Please help me on this its urgent

Abuzar,
Welcome.
As for your questions, you can install the Profiler, CAM and CAS on any of these devices. Which ever device you make the CAS can act as a collector also. I would suggest making the biggest box you have (3355) the Profiler, and putting CAM/CAS on the 3315s.
As for a simple document, I'm afraid no such thing exists. NAC installations are complex by nature and you really have to have a very good idea of what you're looking to accomplish before you even touch the first piece of hardware.
HTH,
Faisal

Configuring NAC Framework ( NAC-L3-IP ), any guides or help?

So I've been doing some research on the NAC Framework and the various modes of operation. So far, I've gotten NAC-L2-802.1x working great and I'd like to add on the NAC-L3-IP on our edge routers/firewalls, but I can't find any guides detailing how to do so...everything says to see the "NAC Implementation Guide" which I can't find anyplace. Can anyone direct me to a NAC-L3-IP guide? Thanks very much.
Jason

Hi,
below is the link, On left had side you will find tech doc.
http://www.cisco.com/en/US/netsol/ns617/networking_solutions_sub_solution_home.html
The below link also will help more.
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_cca.html
Hope this helps.
Regards
pravin

Configured Nacs- how to restrict AAA client access by specified Password

Hi all
i hav given the below config in AAA Client& added the Client in User,Group, the NAR is configured for all Clients ,
But my requirement is restrict AAA client access by specified Password
aaa new-model
aaa group server tacacs+ NACS_Group1
server 10.x.x.x
server 10.y.y.y
aaa authentication login default group NACS_Group1 local
aaa authentication enable default group NACS_Group1 enable
aaa authorization config-commands
aaa authorization exec default group NACS_Group1 if-authenticated
aaa authorization exec NACS_Group1 group tacacs+ local
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

You use the Network Access Restrictions table in the Advanced Settings area of User Setup to set NARs in three ways:
Apply existing shared NARs by name.
Define IP-based access restrictions to permit or deny user access to a specified AAA client or to specified ports on an AAA client when an IP connection has been established.
Define CLI/DNIS-based access restrictions to permit or deny user access based on the CLI/DNIS that is used.
Note: You can also use the CLI/DNIS-based access restrictions area to specify other values. See the Network Access Restrictions section for more information.

NAC 4.5 ADSSO on multiple AD servers not working, how to troubleshoot?

Hi All,
I'm handling a NAC (CAS and CAM ver 4.5) to be implemented to a network on production. The network has two working AD servers, one acting as back-up. We want to configure the NAC to be able to run ADSSO even if the active AD fails, so we configured NAC to run ADSSO on multiple servers. I followed the documents, run ktpass for multiple ADs, installed kerbtray to see Kerb tickets, but still I'm puzzled of the problem. My CAS shows the the ADSSO service is already started, but my workstation cannot perform Single-sign On. After the "performing AD authentication" window, the agent then reverts back to as a local account. Please help guys. I'm willing to share other details about this. Thanks.
Regards,
Dan

Hi Faisal,
The Unauthorized role is already in all trafic enabled policy. My problem is that the KT that is shown in the workstation is different from the one I created using ktpass, although I matched the cases of the domain and the one in the ktpass. I deeply appreciate if you can help. Thanks.
Regards,
Dan

NAC-L2-802.1x with 7940 IP Phones and builtin swithport?

Hi
I've got the NAC Framework, NAC-L2-802.1x working in a test LAB with network hosts (PCs) connected directly to the L2 switch. In our production environment, we have Cisco 7940 IP phones on every desk, and the PCs connect to the switchport on the back of these phones. How would one configure NAC-L2-802.1x to work in a setup like this? I've done quite a bit of searching on Cisco and only found this reference to IP phones and NAC;
IP Telephone and Device Mobility
The computer connected to the PC port on an IP phone will get posture validated successfully.
It does not help much...
Thanks very much.
Jason

You have 2 choices:
1) Ignore the phones based on CDP. You get this be just configuring 802.1X along with a VVID. Here's an example port config from a 3750:
interface GigabitEthernet1/0/2
description endpoints
switchport access vlan 2
switchport mode access
switchport voice vlan 200
srr-queue bandwidth share 10 10 60 20
srr-queue bandwidth shape 10 0 0 0
queue-set 2
mls qos trust device cisco-phone
mls qos trust cos
dot1x pae authenticator
dot1x port-control auto
spanning-tree portfast
spanning-tree bpduguard enable
ip verify source
ip dhcp snooping limit rate 10
The config above will allow a Cisco phone in "for free" just b/c it can do CDP.
2) Authenticate IP phones via 1X or MAC-Authentication for phones that cannot support 1X. This would be the same config as above, with the addition of this line:
dot1x host-mode multi-domain
And if your IP phone cannot do 1X (for example the 7940 cannot) then you'll need to check it's MAC for entry into the network by adding this line:
dot1x mac-auth-bypass
Hope this helps,

J_3RVINVOICE script form used in SD(NACE)

Dear Experts,
I am configuring NACE output type (Appl V3) to update Russian Journal while invoice creation. In the NACE below are the configuration
Output type - ZRU1
Program - J_3RV_INV_A
Form Routine - Entry
PDF form - J_3RVINVOICE
Problem is that , we don't have adobe lifecycle implemented in our system. When we print the document via VF03/VF02, it is not successful with following error.

Hi Santoshi,
that means, that your ADS-Connection is not working properly.
But what is your question, if you know that? Anyway, here is some informations which could you bring further.
You can easily check the ADS with the report FP_TEST_00
If this isn't working, your ADS is not working.
But this is a big theme and it is not possible to give you now one proper solution how to solve it.
That's why I refer to the official configuration guide provided by SAP
Adobe Document Services Configuration Guide - SAP Library
The main part of the work belongs to your basis and as you shared in your question, the entries doesn't look bad, because you get a protocol out of it
Hope I could give you a solution to solve your problem in the end. If you got problems with a specific item right here come back and let us know.
~Florian
PS: There is an own space SAP Interactive Forms by Adobe

NAC Inband RealIP-Gateway address

Hi Experts,
I want to configure NAC appliance in INBAND-CENTRAL DEPLOYMENT-REAL IP GATEWAY.
In this scenario, my clients are in different VLANs say 2 & 3. To all my clients the default gateway should be the IP Address of NAC. Correct?
Where I will configure this IP address in the NAC box so that this IP Address will be the default gateway for my clients.
I know that the "managed subnet" option in the NAS is for ARP resolution only and not this IP can be used as default gateway for Clients.
Do i have to create some virtual IP address in the NAC Ethernet card?
Please help me by sharing your thoughts
Sairam

Hi Sairam,
I put some configure samples about L2 IB for you:
interface GigabitEthernet1/33
description To Trusted
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 998
switchport trunk allowed vlan 31,40,110
switchport mode trunk
interface GigabitEthernet1/34
description To Untrusted
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport trunk allowed vlan 41,311,400
switchport mode trunk
There are some notes you should know:
1) NAC server -> core sw: trunking (see details on the above configuration)
2) Authen VLan: 311, 400 (these should NOT have SVI (Layer 3) interface anywhere on the network)
Access Vlan: 31, 40
You should map 311 -> 31, 400 -> 40 on NAC server.
3) CAS is going to be the default gateway for users
Hope this help!
NamNT

NAC in Inband & Outband

Hi,
Please let me know whether anybody has configured single NAC appliance to function in both Inband and Outband simultaneously.
I Have one NAC appliance. I want this to function in inband mode for wireless users and outband for wired users.
please tell me whether it is possible and how to do?
R.B.Kumar

Thank you Rob,
I appreciate you effort in explaining the concept. I also have one setup here for which i am going to configure the NAC. Can you please explain how it works.
REQUIREMENT:
I am configuring NAC Appliance. The following is the deployment scenario.
I am establishing this in a campus LAN environment.
I have a Cisco 4510R Layer 3 switch as the Core switch.
I have Cisco 3550 Layer 3 switch as the distribution switch
I have some unmanaged and managed switch as the Access layer Switches. All Desktop computers are connected in this access swtich only.
Distribution Switch and core switch is connected in the Routed backbone (Trunking is not configured between Distribution and Core)
Since I have unmanaged switches at the access layer and Core to Distribution is Routed backbone (Layer 3) i have decided to configure the NAC appliance in the following setup:
Layer 3 Inband Virtual Gateway
I request you to provide solution and configuration steps to achieve the following:
1. What will be the VLAN the ETH0 & ETH1 of CAS will be in.
2. Users/Desktop computers should authenticate by username/password & Mac Address/IP address to get into the network. If the Users/Desktop computers do not match the IP address with MAC Address combination configured in the NAC appliance they should be in quarantine role.
regards

NAC L2 802.1x (wireless)

Can somebody advice me - where i can find information about configuring NAC L2 802.1x on wireless AP 1200 series? Or can somebody show me example of configuration file? I have found configuration guide only about wired solutions (configuring NAC L2 IP and NAC 802.1x on switch).
Thank you in advance!

For NAC implementation with wireless access points, the implementation is the same as the switch wired Layer 2 802.1x implementation for network admission control. The only difference is that you will need to use a third party NAC-enabled supplicant such as Meetinghouse for your wireless devices.
sample config on AP
aaa new-model
aaa authentication eou default group radius
aaa session-id common
radius-server host 10.100.100.100 auth-port 1645 acct-port 1646
radius-server key cisco123
radius-server vsa send authentication #Enable VSAs
ip radius source-interface FastEthernet0/0
ip admission name NAC-L2-IP eapoudp #Define NAC policy
ip admission name NAC-L2-IP-Bypass eapoudp bypass #
ip admission name NAC-L3-IP eapoudp1 list EoU-ACL #Define NAC trigger, routers only
ip access-list extended EoU-ACL
deny udp any any eq domain #allow DNS to bypass NAC
deny tcp any host 10.100.100.101 eq www #allow HTTP to bypass NAC
permit ip any any #all other traffic triggers
ip access-list extended Interface-ACL
permit udp any any eq 21862 #permit EAPoUDP
permit udp any eq bootpc any eq bootps #permit DHCP
Refer these links:
http://www.cisco.com/en/US/netsol/ns617/netbr0900aecd80355b2f.html
http://www.cisco.com/en/US/products/hw/wireless/ps430/products_configuration_guide_chapter09186a0080606cbe.html#wp1072071

ACS NAC and VPN

I am trying to set up NAC using ACS 4.1 and a VPN concentrator 3015 using 4.7.2K. I have had it working before using 3.3 and 4.0, but had to wipe out my server because of some issues. This is all in test, but I would like to complete this soon.
Is there some document out there that will allow me to see examples of this setup? I have googled it and checked on Cisco, but the examples are normally IOS specific. Any help would be appreciated.
Thanks
Dwane

Refer to the link to the NAC Phase One whitepaper which is the best guide to configuring NAC at the moment.
The document was released prior to NAC introduction on the VPN concentrator, but all the ACS and CTA configuration is valid.
http://www.cisco.com/application/pdf/en/us/guest/netsol/ns466/c654/cdccont_0900aecd80217e26.pdf
also refer these links to know more info about VPN concentrator with NAC:
http://www.cisco.com/warp/public/471/vpn3k-nac-config-471.html
http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee22f.html#wp1652431

NAC Guest " Account Management Manage Accounts

I'm having trouble to access:Account Management > Manage Accounts on my NAC guest server after I created some accounts. The web page stays blank.
Anyone seen this?
My Guest server is running version 2.0.1

Check on bug CSCsz80188 works and helps a lot.
When experiencing the issue I check for HTML source on the web page I cannot displayed getting an ivalid month date error.
Changing Number Format under:
User Interface > Templates > Common
make it works!
Ciao,
Massimiliano.
**********************************************ERRATA CORRIGE************************************************************************************************************
Hi,
I've experienced a similiar issue while configuring NAC guest server demo for a customer.
Check on bug CSCsz80188 doesn't help me.
I created a new sponsor associated to the DEFAULT template, but althought I'm able to create guest account Manage Accounts section under Account Management on the sponsor webpage shows nothing.
Is it possible this is because I'm using a demo license?
Currently I've configured two sponsor and only one is correctly displaying Manage Accounts page.
Thank you
Massimiliano.
**********************************************ERRATA CORRIGE************************************************************************************************************

802.1x & NAC Appliance

Hi There, Can any has implemented NAC applaice in network while 802.1x is enabled on switch ports.. can they work together..

In Cisco IOS Release 12.2(25)SED or later, you can configure NAC Layer 2 IEEE 802.1x validation, which is also referred to as IEEE 802.1x authentication with a RADIUS server.
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_40_se/configuration/guide/sw8021x.html#wp1241915

Configuration NACE

Similar Messages

Maybe you are looking for