EAP-TLS Authentication failure happening in ACS for Wireless End User Authentication

Hi All,
We have the Win 3.2 ACS setup in the production environment, We are migrating it with 4.2 Appliance version. We have succesfully migrated the database and other stuffs from 3.2 to 4.2. Same way we have exported the certificates from 3.2 to 4.2 and installed it.
We have the leap as well as eap-tls in the authentication part.
We were able to test successfully with the leap. But when it comes to eap-tls. In 4.2 version its throwing the error.
5/3/2011
23:16:38
Authen failed
[email protected]
EAP-TLS users
0023.1413.de18
(Default)
EAP-TLS or PEAP authentication failed due to unknown CA certificate during SSL handshake
21356
10.121.198.38
13
EAP-TLS
ap-1242b4
Bangalore APs
We have used the same certficate exported and installed in the 4.2 version. But its working in the existing 3.2 version and why it is not working with the 4.2 version.
Could anyone help me out in this?
Regards
Karthik

Hi,
Looks like the CA Cert is not installed on the ACS.
The following link will help you install the CA cert.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/SCAuth.html#wp327056
Also trust the CA certificate in the Edit trust list list.
Hope this helps.
Regards,
Anisha
P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.

Similar Messages

Questions for the end users in Building an application.

Questions for the end users in Building an application.
Hello,
I am assigned a project in building a CF application. As far
as the business requirements, I have an idea from the MIS people.
However, I have a meeting with direct users and I have to ask
questions to add to my requirements. I am still a beginner in this
but I need to ask questions.
Can anyone give me tips? what basic / important questions?

For starters,
DO:
Ask them to discuss what they want to do with the application
Try to understand their level of computer literacy
Keep your conversation non-technical
Continue to interact with the users during the design and
development process
Try to identify a "champion" with whom you can interface as the
project progresses
DON'T:
Use technical terms or discuss technical issues
Talk down to them
Promise delivery dates until you have documented their
requirements and they have approved them

Is it possible for an end user to change application Theme?

Hi
Is it possible for an End user to change the theme or Font of the application.
We have a requirement where End user should able to change color or font of application (like we do theme change in some social networking websites)
Please provide some suggestions.
Many Thanks
--Vijay

You could:
1. export your current theme
2. change the exported file using a good editor and change the path
#IMAGE_PREFIX#themes/theme_10/
to
#IMAGE_PREFIX#themes/theme_&THEME_NUMBER./
and do that also with all strings related to that theme number.
3. crete an application item THEME_NUMBER
4. create an application computation for THEME_NUMBER to set it to a value (10) in case the value is null
5. import the theme and make it the current theme
6. create a link in your application which will set the value of THEME_NUMBER to whatever - 1 to 20 for the standard themes - and submit the change
This will change the template as you specify.
This explanation is of course simplified. Depending on the design of your application it may require considering some other details that need to be adjusted.
Something like in this example:
http://apex.oracle.com/pls/otn/f?p=25882:1
The assumption is that all of your referenced classes in all css files have the same name for the same class with a leading theme number (which istn't the case in standart themes). However, this can at least give you an idea on how to proceed. I have done that with some custom themes I created and it works very well.
Denes Kubicek
http://deneskubicek.blogspot.com/
http://www.opal-consulting.de/training
http://apex.oracle.com/pls/otn/f?p=31517:1
-------------------------------------------------------------------

How to add a switch to acs for login and ads authentication

Hi all
I want to add my switch so that it authenticates to my acs for login auth, I have done the switch end, using radius, also added the switch on the acs, how do I force the acs to use windows auth for this login? do i just go under the network config where the device is and tick the box saying use windows database for authentication, and then do a group mapping ?
cheers

Hi,
Easiest way is to download the table eg into an Excel table (if possible) or text table. Drop the table from the database. Build your table with the new key field. Build the database table again and fill it.
You can do it also over the database into a new table. Drop the old one. Build the enhanced one and fill it. Afterwards drop your (temporary) table.
Maybe there are other ways, but this works.
Success,
Rob

Wireless PEAP users authenticated by TACACS+

Hello,
I have the following scenario, access points 1214 (fat AP) connected to ACS (RADIUS) and the ACS integrated with Novell LDAP as external database.
The wireless users use PEAP for authentication, here the problem when I tried to connect wirelessly with username and password configured locally on the ACS database it works fine but if I use a username and password listed on the Novell LDAP I got the error ?Auth type not supported by External DB? .
Note:
For VPN users, I can connect and access the network resources from outside with username and password listed on Novell LDAP database (integration between ACS and Novell LDAP is fine). Maybe this note could help you!!
Regards,
Belal

Hello Darran,
Thx for your feedback..
now i'm trying to configure EAP-TLS but as stated in the configuration guide i should have CA certificates for both ACS and the wireless users. here the question, shall i have CA server or thers is another way to complete the task (use local generated certificate for example if possible) ?
Regards,
Belal

Activating a Windows 7 installation (for an end user) as a MS Registered Refurbisher.

I have applied to join the MRR program and have passed the test and am awaiting approval.
I was reading in the MRR manual that MS prefers that a refurbished PC is set up with sysprep so that the end user has to accept the license agreements and activate before using Windows.
However, the manual went on to say that the Refurbisher can choose to activate windows as a courtesy for his customers as long as he configures the PC to display the license agreements when the end user uses the PC for the first time.
This is probably a stupid question, but how is this achieved? Can Sysprep be somehow set to retain the activation information?
Or is this achieved using one of the tools on the OEM Preinstallation Disk or with the RPK tools described in the MRR manual?
Thank you for your patience with me :)

Hi,
Regarding to sysprep, the activation information will be removed or I mean it doesn't work (even the reference PC is activated) when you deploy the image to other computers.
This is the exact sentence from TechNet website
You cannot make an image of an activated Windows installation and duplicate that image to another computer. If you do, Windows fails to recognize the activation and forces the end user to reactivate the installation manually.
http://technet.microsoft.com/en-us/library/cc766514(v=ws.10).aspx
Add:
For a Refurbished PC, the PC has two labels; either the original Certificate of Authenticity (COA) label the PC manufacturer installed or the Genuine Microsoft Label AND a COA from the PC refurbisher. for manually activation, the end user can only use
COA from the PC refurbisher.
Yolanda Zhu
TechNet Community Support

End-to-End user authentication with XI

Dear community,
we sit in a situation where the customer wants to have an end-to-end-authentication throughout an integration process.
The setup is as follows: a dialog-user in a legacy system uses an application that triggers an integration process through XI into SAP ERP. The dialog-user in the legacy system must be used for authentication in XI as well as SAP ERP.
To avoid having to re-create all users in XI and SAP ERP, ideally an LDAP instance would be used for authentication.
Based on my knowledge, the above scenario is not possible with XI and there is a 2 year old thread discussing the same without any positive outcome:
XI and user authentication VS R/3 systems
Nevertheless I consider this requirement as a pretty standard one. Has there been any development in this area - or how have similar customer requirements been met ?
Thanks a lot in advance !
Jochen

Hi Jochen,
i've heard rumours saying that credential forwarding will be incorporated in the next XI release as it is a rather frequent requirement by customers and will make live much easier.
Maybe you can get a statement through your clients SAP account representative on the release date and the planned feature.
Regards
Christine

WLC 2500 and WCCP for Wireless Guest Users

Hi there
I would like to redirect web traffic from WLANs on a Wireless LAN Controller 2500 to a proxy server in a remote site. I'm using ironport proxy server and Cisco 3560 Layer 3 switch. Basically current scenario is:
Wireless Guest Users get authenticated by web-auth through Access Point 3501 HREAP configured. Guest client gets an IP address on VLAN 100 in remote site. Once they connect to VLAN 100, I want all web traffic to be redirected to the proxy server. I know PAC file may be the easier solution however our guest clients want seamless solution for internet. I am not sure whether WCCP is supported for this.
You advice will be highly appreciated.
Regards

For guest wireless traffic redirect to proxy server
https://supportforums.cisco.com/thread/2126486

Is there a way for an end user to see who has membership in a security group

Windows Server 2008 R2
Active Directory Domain
Windows 7 workstations
I am looking for a way that my end users can look at a folder security tab and then discover who has membership in the security groups listed.
Is that possible? Any drawbacks or concerns?

Hi Tod,
Based on my research, other than viewing group membership in ADUC, we can use this PowerShell cmdlet
Get-ADGroupMember GroupName and Net Group GroupName to view members in a group:
However, these commands can only be used on Domain Controllers or when connecting to DCs remotely. That’s because accounts and account membership are stored on Domain Controllers, therefore we can only view group membership on DCs.
More information for you:
Viewing the Direct Members of a Group
http://technet.microsoft.com/en-us/library/dd391915(v=WS.10).aspx
Net group
http://technet.microsoft.com/en-us/library/cc754051.aspx
Best Regards,
Amy

Jabber for Mac - End User unable to Cut & Paste Images in IM

Full discloure: I am an END USER, not an IT admin or anything like that. Not sure if this is the proper forum to ask this question but figured it was worth a shot...
Running OSX 10.9.1 and Jabber 9.2.1.
I am unable to copy-and-paste images into IM conversations with co-workers.
My "cachedPresenceConfigStore.xml" file shows:
"<im_cutandpaste_enabled>TRUE</im_cutandpaste_enabled>"
and
"<screen_capture_enabled>TRUE</screen_capture_enabled>"
...yet these functions seem to be missing from the IM client. As far as I know our organization's service-side policy allows for sending images over IM (confirmed this using the jabber client on a windows machine).
Am I just "doing it wrong" somehow? Is there some special method I need to use to be able to paste images into an IM conversation?
Any help or direction is appreciated.
Thank you,
Jason

It appears they disabled it server-side as the button (a paperclip) normaly appears to the right of the emoticon button. While the jabber-config.xml file can block specific file extensions, it cannot disable the feature entirely. This is done within the Service Parameters of the server, which only an admin can see.
ProcedureStep 1 Choose Cisco Unified CM IM and Presence Administration > System > Service Parameters.Step 2 From the Server menu, choose an IM and Presence node .Step 3 In the Service Parameter Configuration window, choose Cisco XCP Router as the service.Step 4 From the Enable file transfer drop-down list, click On or Off.Step 5 Click Save.Step 6 Restart the Cisco XCP Router Service on every node in the cluster. For more information, see Restart CiscoXCP Router service, on page 43.
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/im_presence/deployment/9_1_1/CUP0_BK_D5B4C107_00_deployment-guide-for-imp-91.html
Please remember to rate helpful responses and identify helpful or correct answers.

Forms application not opening for the end user.

I have an Oracle Form that works fine when I copy the url into the browser and user the login credentials of the schema owner. But when I use the credentials of the end user, it does not open the form. I receive no error messages.
To troubleshoot, I opened the form in Forms Builder, log in as the end user and Compile, but I get no error messages.
I also took a call to a server-side procedure that is in the Form, and ran it in SQL Developer, once again while logged in as the end user, and it ran successfully.
I’m not sure what could be wrong. Any suggestions on how to debug this?

To troubleshoot, I opened the form in Forms Builder, log in as the end user and Compile, but I get no error messages.What happens if you run the form from forms-builder with that credentials.

Is there a way to have an AppleID for an end-user without credit card info attached to it?

I am in charge of managing the Macs in our department. We have purchased a volume license for Mountain Lion (can't jump to Mavericks yet until we upgrade other software). I have a code to redeem, but the end-user is supposed to have an AppleID. I went ahead and started creating one for her, but it asks for credit card information, and corporate does not wish to have this information attached to an end-user's ID - they just want to supply it at the time of purchase for any future purchases (fear of identity theft and/or unauthorized purchases, I guess).
Our Mountain Lion software is already purchased, so Apple shouldn't need the credit card info for us to be able to install it. I can't install Adobe's Creative Cloud software until she's at least up to Mountain Lion … I feel I am hitting a major roadblock here! Any suggestions? Is this a new requirement? My own AppleID (for work) that I've had for awhile has no credit card currently attached to it … must not have been required at the time.

Try this on that Apple ID to get the None payment method option;
This user, mountaingoatgirl, explains how to get a None option in your account details in the iTunes app on a Mac or PC. -
https://discussions.apple.com/message/24907941
Then in the future use Apple's suggested method to create Apple IDs that don't require a credit card.
Creating a new Apple ID for an iTunes Store, App Store, iBookstore, and Mac App Store account without a credit card -
http://support.apple.com/kb/HT2534

Minimal access for the end users to access a page sharepoint.

I have a list Projects which i have put in a different aspx page by the name ProjectPage.
I have end users accesing that page where i have applied certian styles for dsplaying in a customized way.
However, i need to configure their permissions in such a way that they should be able to access any page other than the project page.
They should not even see the site actions bar and should not be able to access the _layouts/viewlsts.aspx page as well as settings page form the address bar.

Hello,
To restrict application page, either you can hide them from UI (but still be accessible by putting direct url) OR create a custom permission and uncheck "view application page" option. Refer this link for more info:
https://social.technet.microsoft.com/Forums/office/en-US/bc3e9e2e-e606-47a1-ace3-94aadd860e44/is-there-any-way-i-can-disable-site-actions-menu-for-readonly-users?forum=sharepointgeneralprevious
Hemendra:Yesterday is just a memory,Tomorrow we may never see
Please remember to mark the replies as answers if they help and unmark them if they provide no help
(On vacation from 16th Oct to 28th Oct 2014)

Adding a custom field for the end user in ecommerce

I'm working with a client that is selling a product that requires the end user to enter custom information before adding the product to the cart.
Its something like entering the name they want to engrave on the gift. How can i add this functionality within BC?

Depending on your requirements for a "signature", some people will just use a checkbox that indicates that you are "signing" the form, maybe some text for the agreement and a checkbox to agree. I don't know if your work flow requires an actual signature, but wanted to give you that bit of information.
Thanks,
Josh

Roles for Power & End User

Hi Guys,
I have two roles like Power User & End User, i would like to know what i need
to add in the "Menu" tab of the PFCG for each user.
Thanks a lot.

Karunakar -
Few things you have to keep in mind when you are giving access to the reports and queries.
S_RS_COMP only will not do.
have you assigned S_RS_COMP1 and S_RS_MPRO for info areas and multi/info providers.
and one more auth object S_RS_ICUBE for info cubes. you have to assign what ever the info cubes that you need to give access to the users.
Then only user will get full access.
precisely in order you can say,
S_RS_COMP
S_RS_COMP1
S_RS_ICUBE
and S_RS_MPRO.
These are main auth objects which are related to info cube, info area access and BEx access.
Hope this would give you clear pic.

EAP-TLS Authentication failure happening in ACS for Wireless End User Authentication

Similar Messages

Maybe you are looking for