Control access using Radius without ACS

I want to log into my IPS using my existing RSA SecurID using Radius. Is it possible to use a Radius attribute in the RSA to tell the IPS what privillege\role the user is? The idea is I dont create users on the IPS, if a user tries to logon it authenticates them via radius running on the RSA server and if the user is allowed to log onto that clietn IP (the IPS) then it will allow them to logon but also pass a message back to the IPS to say this person has full admin access. Is that possible using an attribute? ANy guidance would be great.

Yes, you should be able to specify the user role on the radius server.
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_setup.html#wp1276213
Regards,
Sawan Gupta

Similar Messages

Can't auth to Nortels networks devices using RADIUS with ACS 5.1

Hi,
I've got a problem with the ACS 5.1 RADIUS Authentication for Nortel network devices (Baystack 470, ERS 5530 5510, Passport 8606).
After configuring RADIUS on these device (primary serv, secondary serv, secret key, port...) and adding them to my ACS Servers.
I can't manage to login using RADIUS and i get the following message.
"Permission denied, please try again" or "No response from RADIUS server"(?) (depending on the device type)
But in my ACS View, I can see : "Authentication succeeded."
I've also checked the RADIUS frames, the "Access-Request" and "Access-Accept" are correctly transmitted.
I've got no problems with RADIUS Auth using other brand devices
Is there any known issues with Nortels devices using Cisco ACS 5.1 with RADIUS Authentication ?
Regards.

Are you sure that setting up a compound condition will help ?
To me, the RADIUS Nortel VSA are used for Authorization,and my problem is about Authentication (usually for a simple authentication, we stay in the IETF RADIUS Standards ? no ?)
Also, does setting this condition will change the Access-Accept packets sent by the ACS to the device ?
Here is my steps in the ACS View
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15004 Matched rule
15012 Selected Access Service - Default Network Access
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store - Internal Users
24210 Looking up User in Internal Users IDStore - radius
24212 Found User in Internal Users IDStore
22037 Authentication Passed
Evaluating Group Mapping Policy
Evaluating Exception Authorization Policy
15042 No rule was matched
Evaluating Authorization Policy
15006 Matched Default Rule
15016 Selected Authorization Profile - Permit Access
11002 Returned RADIUS Access-Accept
So I think the ACS does its job

Using RADIUS without enabling AAA

is there anyway I can use a RADIUS server without enabling/using AAA.
is there any command "ip auth radius ... " ?
cudnt find anything on cisco as such.

Swapnendu
Am I correct in assuming that you are talking about on IOS based routers or catOS switches? If so I believe that the only way to use Radius is to use AAA.
HTH
Rick

Is it possible to create a login page to access the internet without ACS ?

Hello
My company would like a solution where guests can only access the intenet with a username or password so a web login page before accessing the internet. is this possible to configure onm a cisco router with no ACS ?
Thanks
Andy

Maybe.
Are they wired or wireless clients? What model and IOS version is your router and switch?

AAA using RADIUS

GOod morning all,
I am trying to configure AAA using RADIUS with ACS 4.1 SE and various Cisco Devices. I have configured the ACS to perform group mapping on personnel who I want to give access privileges. What I would like to do is give that group privilege level 15 and do away with enable passwords. However, I need local level authentication for our console options with enable privileges. Can this be done? Any help would be appreciated.
Dwane

For routers and IOS switches:
aaa new-model
aaa authentication banner *Unauthorized Access Prohibited*
aaa authentication login default group radius
radius-server host 10.10.10.10 (your acs device)
radius-server key cisco123
radius-server configure-nas
username nmg password telnet
aaa authentication ppp dialins group radius local
aaa authentication login nmg local
aaa authorization network default group radius local
aaa accounting network default start-stop group radius
aaa processes 16
line 1 16
login authentication
For CatOS switches:
Set radius-server 10.10.10.10
show radius
set radius key cisco123
set authentication login radius enable
set authentication enable radius enable
show authentication
set radius timeout 5
set radius retransmit 3
set radius deadtime 3
For Pix Firewalls:
aaa authentication ssh console radius LOCAL
aaa authentication telnet console radius LOCAL
aaa-server radgroup protocol RADIUS
max-failed-attempts 2
reactivation-mode depletion deadtime 5
exit
(NOTE: This will depending on the location of the pix firewall)
aaa-server radgroup (inside) host 10.10.10.10
key XXXXXXX
exit
aaa-server radgroup(inside) host 10.10.10.10
key XXXXXX
exit
This is pretty much what we used for configurations on our test. It looks like most of your switches are IOS based so that will be nice for you.
If you are using local authentication, you can create a group and assign the local addresses to that group. What I did in the radius IETF attribute, you ensure that [006] Service-Type is checked and scroll down to Administrative and click Submit & Restart.
Hope this helps some. I had alot of help from Cisco TAC on this.
Dwane

Restricting Wireless Access using ACS 3.3

We are currently running ACS 3.3 and I am trying to figure out how to restrict Wireless access to specific user groups. Our current setting is using PEAP and ACS as the Radius. Our user database is mapped to Windows 2003 AD. I've got the PEAP working and the radius authentication is also working but I cannot seem to figure out how to restrict the wireless access to specific Windows/ACS groups.
Erik

Hi,
On ACS 3.3.x You can certinly achive this, al you have to do is configure NAR( Network Access Restriction) Here is the link which should provide you further informatio on it.
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_white_paper09186a00801a8fd0.shtml
-Parm

Have not used Itunes in a while and I cant access Itunes Store with out downloaded new version but I keep getting error message with download. Can I just access the Istore without downloading new version?

Have not used Itunes in a while and I cant access Itunes Store with out downloaded new version but I keep getting error message with download. Can I just access the Istore without downloading new version?

downloaded new version but I keep getting error message with download.
What does the error message say, andrea? (Precise text, please.)

How access an element using getElementById() without absolute path?

hello,
Currently I'm working on a JSF woodstock project.
I'm trying to acceess the different components used the JSF page inside a javascript by using document.getElementById()
this is a part of code in my JSF file. please have a look on it.
<webuijsf:form id="form1">
                        <webuijsf:panelGroup id="pnlGrpBankListMainContainer" style="left:2px; top:89px; margin-left:1.5%; margin-top:1%; width:50%; position:absolute;">
                            <webuijsf:table augmentTitle="true" title="#{BankList.screenName}" id="table1" paginateButton="true"
                                paginationControls="true" clearSortButton="true" extraActionTopHtml="style='height:35px'">
                                <f:facet name="actionsTop" >
                                    <webuijsf:panelGroup id="grpPnlButtons">
                                        <webuijsf:checkbox binding="#{BankList.chkBoxSelectAllItems}" id="chkBoxSelectAllItems" name="chkBoxSelectAllItems" rendered="#{BankList.renderChkBoxAndImgSeparator}"
                                            selectedValue="selectAllItems" onClick="selectAllTableRows(this,'chkBoxBankListSelectedRowId',5);"/>
                                        <webuijsf:image id="imgSeparator" url="/resources/images/select_image_separator.gif" rendered="#{BankList.renderChkBoxAndImgSeparator}" />
                                        <webuijsf:button id="btnAdd" rendered="#{BankList.renderAddButton}" text="Add" styleClass="btnStyle" immediate="true"
                                            onClick="return openAdd('#{BankList.requestContextPath}/faces/BankEntry.jsp', 500, 755,'Add #{BankList.screenIdentifier}', '&action=ADD');"/>
                                        <webuijsf:button id="btnEdit" rendered="#{BankList.renderEditButton}" text="Edit" styleClass="btnStyle" disabled="#{BankList.disableEditButton}"
                                            onClick = "return openEdit('#{BankList.requestContextPath}/faces/BankEntry.jsp', 'chkBoxBankListSelectedRowId', 500, 755,'Edit #{BankList.screenIdentifier}', '&action=EDIT');"/>
                                        <webuijsf:button id="btnDelete" text="Delete" onClick="return confirmRecordsDelete();" rendered="#{BankList.renderDeleteButton}" styleClass="btnStyle" disabled="#{BankList.disableDeleteButton}"/>
                                        <webuijsf:button id="btnExportXls" disabled="#{BankList.disableExcelButton}" rendered="#{BankList.renderXlsButton}"
                                            styleClass="btnStyle #{BankList.excelButtonStyleClass}" style="position:relative; margin-left: 10px"
                                            text="x" onMouseOver="setMouseOverStyle(this);" onMouseOut="setMouseOutStyle(this);"
                                            onClick="return openXlsExport('#{BankList.requestContextPath}/faces/Export.jsp', 'chkBoxBankListSelectedRowId', 'Export #{BankList.screenName}', '&screenIdentifier=#{BankList.screenIdentifier}');">
                                        </webuijsf:button>
                                    </webuijsf:panelGroup>
                                </f:facet>when i access button element using absolute path like
document.getElementById("form1:pnlGrpBankListMainContainer:table1:grpPnlButtons:btnEdit") it works fine.
But when i try to access it using
document.getElementById("form1:table1:btnEdit") it returns null.
I've common javascrpt functions for all the screens.
so i do not want to change the current javascript functionality nor do i want want to specify complete path for an element.
So is there any way so that i can access the elements without absolute path or any othet solution?
Edited by: sonali_amonkar on Apr 1, 2008 11:17 PM

thanks for your reply mjswallow.
Do you mean that I'll write a new javascript which will accept all the parent elements and inside this method I'lll call the common javascript methods that are present in our project?
but this solution would result in changing the already existing javascript methods that i coded for all screens. right?
that is i do not want to change.
any other solutions you can think of?

Is following message due to 'Java' setting left unchecked? Mac OSX supportsUser Authentication Mechanism (UAM) plug - ins from other manufacturers to control access to servers.To use a UAM, copy the plug - in to: Library/ Filesystems/ AppleShare/ Authenti

Is following message due to 'Java' setting left unchecked?
Mac OSX supportsUser Authentication Mechanism (UAM) plug - ins from other manufacturers to control access to servers.To use a UAM, copy the plug - in to: Library/ Filesystems/ AppleShare/ Authenti

Man that is an ancient message.
The last time I saw that was using Mac clients connected to a Microsoft (Windows) Server running 'Services for Macintosh' which included the ability to act as an AppleShare compatible file server. Because Microsoft have a different security system for defining accounts which includes the 'domain' as well as username, the standard Mac AFP client did not know how to send that information.
Therefore Apple made it possible to installed a plugin in the form of a UAM or User Authentication Mechanism which added the ability to send this information to login to the fileserver.
See http://support.microsoft.com/kb/101747
However Microsoft have long discontinued 'Services for Macintosh' and now the only way for a Mac to connect to a standard Windows Server is via SMB not AFP. I don't believe this plugin is available to download anymore.

VPN access to a Watchguard firewall using Radius credentials

Good morning, I have an Ipod Touch 4G that I would like to use to connect to our Watchguard firewall using the built in VPN client and pptp
I am the person onsite that manages the Watchguard firewall(s) (x553 with 10.2.12 firmware) , which are setup for pptp vpn access using Windows Radius servers. The users use their Active Directory credentials to make the VPN connections.
I have several macs at home, including an iMac and Mac mini and both of them can easily make VPN connections to the Watchguard firewall using pptp VPN access with Radius credentials. T
The setup I have been trying on the ipod Touch 4g is using the dns name for the firewall (published in Network Solutions DNS). I have also tried the outside address of each firewall. For the account, since we are using a Radius connection into Active Directory, I put my login in the format of domain\username . RSA SecurID is On, the Encryption level is set to Auto and Send all traffic is off.
In my testing so far, the Ipod Touch starts the connection, starts authenticating to Radius and fails. If I turned off RSA SecurID, no authentication is attempted, so it looks like this needs to stay turned on. It doesn't seem to matter is Send all traffic is off or on. Having it off is preferable as I don't want to send all Internet traffic through the firewall when connected via VPN.
So, I basically duped the setup of the VPN on the Ipod Touch based on my setup that's working on the Mac Mini and Imacs at home. But VPN on the iPod Touch 4g with the latest version of IOS is not working.
Does anyone have this kind of configuration working on the iPod Touch 4g or know if this is a shortcoming of this version of the Ipod or IoS?
Thanks,
Leo

I fixed my vpn connection on the iPod Touch. This is what works for Radius login to a Watchguard firewall:
Server (DNS name or ip address).
Account domainname\username
RSA SecurIT off
Encryption level Auto
Send All Traffic off.
Leo

802.1X for wired environments using Radius/ACS for Dynamic Vlan Assignment

Currently Being Moderated
802.1X for wired environments using Radius/ACS for Dynamic Vlan Assignment
Could someone please provide me with a simplest set of configuration steps to fire up Radius in ACS and 802.1X for dynamic vlan assignment. The objective is to roll out NAC L2 OOB using the 802.1X method for dymamic vlan assignments.
If possible show:
1. ACS/Radius Configurations.
2. End User Switch Configurations
Variables:
Switch A
MAC Address aaaa.bbbb.cccc     Vlan 10
            bbbb.cccc.dddd     Vlan 20
Also, if someone posts the Pros and Cons of using Radius/ACS/802.1X for Dynamic Vlan Assignments.
Other technology sets that can be used for Dynamic Vlan assignment EXCEPT from deprecated/obsolete VMPS.
Thanks in advance. .

Hi Guys,
    Hmmm, well if your just looking for Mac based authentication the good news is that is very easy. Just set create your Radius server, ACS, FreeRadius, Steelbelted radius etc. Then create user with the name of the Mac address, in other words if the mac address is 0012.0021.1122 the the name would be 001200211122 and the password would be the mac address. Then you set the vlan and tunnel stuff, like so tunnel-Type would be vlan, Tunnel-medium would be 802 and Tunnel-Private-Group-ID is the name of the vlan(not the vlan number)
   So for the Cisco ACS 4.x you would create a user as specified above, fill in all the password boxes with MAC address, I believe the mac has to be all lower case in the name and the password. Then check the Separate(Chap/MS-Chap/ARAP) box. Then you pick the group the machine belongs to, the group is the part that defines what vlan it is on.
   Before you create the user, create the group with info I wrote above and in addition specify the Service-Type as Authenticate Only.
    Freeradius is a bit harder to configure the specifics and I am just now testing a freeradius server so I do not know the process for Machine authentication.
    If, however, you are trying to authenticate a user that gets a bit trickier and is not so straight forward.

Using Oracle 11gR1 OID to control access to 11gR2 RAC database ?

I have a two 11gR2 RAC Node database that I would like to implement Oracle 11gR1 OID to manage all access to the RAC database.
Should I install and configure Oracle 11gR1 OID into the same RAC database to control access to the RAC database? Is this the appropriate approach?
Please share your ideas... I couldn't make it to Openword to ask this type of question.

Hi,
I think there is some confusion here. OID doesnt protect your database. All OID is doing is taking the authentication of the user and authorization (privileges) of the user to OID and out of the database. This way you can centralize the management of all user accounts in one place and not worry about it in the database. This is helpful only if you have many databases. If you have a very small number of databases and small number of user accounts, then OID is not really buying you anything. The best practices is published in the oracle docs. Just that you have to read a lot to figure it all out. Here are some info from our installation.
1. weblogic and oid application is installed on a application server
2. Repository database is a independant database (not shared with other apps) in a shared RAC cluster.
3. Replication (OID application replication) setup between a primary oid server and a secondary oid server in the DR site
4. Load balancer configured to point to the primary server and if primary server is not available, point the connection to secondary server
5. DIP configured to pull all users and groups from active directory
6. Password filter installed on all DC's to capture passwords and ship it to oid.
7. Users creation, modification,deletion, expiry, etc., is all controlled on active directory.
8. Database registered with OID for user authentication and authorization
For protecting you data, you will need to use additional security methods/products like :
1. Database vault (to prevent privileged users from operating on the data)
2. Database auditing
3. Fine-grained access control
4. table level policies
5. Fine-grained auditing (column level)
6. Audit vault (to consolidate all audit records to a central place for auditors to classify and research each audit event)
7. operational/process to enforce security.
Good luck :-).
Regards,
Shaji.

HT4993 getting error message could not activate cellular data network when trying to access the internet without using wifi. what do i need to do? i have already restore the phone.

getting error message could not activate cellular data network when trying to access the internet without using wifi. what do i need to do? i have already restore the phone.

contact your phone carrier as they handle cellular network.

After time capsule 7.6 Firmware upgrade I can't set up Access Control / Timed Access using mac adresses.

After time capsule 7.6 Firmware upgrade I can't set up Access Control / Timed Access using mac adresses.
I have a Time Capsule and an Airport express and when I change access control parameters on whatever one of those
two devices through Airport Utility its duplicating the same setup on the other device !
What a mess !
I had to choose "Not Enabled" in the Access Control stup window.
Has anyone experienced same problem ?
Jean.

I did downgraded firmware to 7.5.2 ...
and the Acess Control Setting from Airport Utility is back to normal behaviour.
Jean.

I turned off Internet access, using airport timed access control. Now, I can't turn it back on. The base station can't be found. Please help.

I turned off Internet access, using airport timed access control. Now, I can't turn it back on. The base station can't be found. Please help.

Can you take a look at this one and offer your opinion please?
https://discussions.apple.com/message/21889032#21889032

Control access using Radius without ACS

Similar Messages

Maybe you are looking for