FWSM user and administrator multi-contexts authentication under ACS radius

Hi,
I’m preparing the setup of an ACS radius server for FWSM-related authentication operations.
FWSMs will be in release 2.2, inserted in Catalyst 6500 (MSFC – IOS), in routed mode, in multi-switch active / standby setup, with multiple contexts configured.
User and administrator access management will be performed thanks to a radius ACS server.
I intend to install ACS onto an armored windows 2000 server SP4 , using a local database.
PDM 4.0 is needed in order to manage multiple-contexts on FWSMs.
Are there any points I should be aware about such a configuration, especially regarding the user and administrator authentication access management setup ?
The fact is that administrators will have to be defined and restricted to their own context, without privileges onto other contexts. Do you have feedback about such a setup or relevant information to point to me ?
Many thanks in advance for your attention.
Best regards,
Arnaud

Each of the contexts will behave like individual firewalls for your purposes here. So, they each get a AAA config, and you could put them into their own groups for access control. Protect the Admin context especially well, it controls system resources for the others. Depending on how many FWSMs you have, you may want to look into the Pix MC, which is similar to PDM, but works for multiple FWSMs. It is a part of CiscoWorks VMS.
-Paul

Similar Messages

  • Photoshop Elements 11 installed on Mac Mini OS X 10.9.5. Application running successfully on bot main user and administrative accounts for considerable time with no warning messages. When established a new user account on same computer and try to call up

    Photoshop Elements 11 installed on Mac Mini OS X 10.9.5. Application running successfully on bot main user and administrative accounts for considerable time with no warning messages. When established a new user account on same computer and try to call up elements receive message “Some ot the application components are missing from the Application directory. Please reinstall the application.” How do I correct this problem without disturbing application in main user account?

    Brooks lansing if you create a new Administrator account does the same issue occur?  If so then it is likely that there is a file permission failure and file permissions have been set for the existing Users instead of the groups they belong to.
    Have you removed and reinstalled Photoshop Elements 11?  This may reset the file permissions to the correct state to allow it to work under new accounts.

  • User and administration guide.

    We have to prepare our applet for Common Critera certification. We have to write lots of documents. Among them there is User Guide and Administrator Guide.
    What must be wriitten inside the User Guide. Some of us thinks that it should be written for the middleware
    because the middlewatre is the user of our applet and that this document should contain the interface description (APDU commands/responses).
    Is this right? What about the Administrator guide? Is this a document that describes how the applet is installed and how the pre-personalization is done
    in case the applet is installed inside the EEPROM? In case of ROM, the NXP does the ROM masking. In that case, the document would contain what
    have to be delievered to the NXP in order to perform masking and the pre-personalization steps?

    Hi Jianbai,
    Would request you to implement SAP Note: 1294047 for this issue. Here is the excerpt:
    BPC provides 'System user group' on Server Manager to get group users list from different domain. There is also another way to get different domain users list not by adding to the 'System user group'.User can use 'Custom Filter' functionality on admin console when user adds or modifies users.
    For example,
    1. Domain1\BPC_User1;Domain2\BPC_User2;..
    2. Domain2\BPC_User*
    3. Domain1\ BPC_User;Domain2\ BPC_User
    Hope this helps in resolving your issue.
    Regards,
    Poonam

  • Import user and group from dump.txt to ACS Solution Engine 3.3

    I have export the user and group using the CSUtil -d on my acs v2.6. But ACS Solution Engine 3.3 does not have the CSUtil command to import the user and group database. Can anyone advise me?

    I'm trying to do the same thing with no luck so far.
    Documentation seems to indicate you can do this using RDBMS Synchronization but we haven't got it to work yet.
    I read the doco as saying you create a csv and place it on an FTP server and ACS will read from that file. When we've tried, it rights its own file with a different extension and says it can't find the one we place in that same directory.

  • Error in Windows 7: User Profile Service was not logged on. The user and administra​torprofile

    Error in Windows 7: User Profile Service was not logged on. The user profile can not be loaded. Administrator profile and the code does not work. What do I do?
    HP G5384sc desktop pc

    Hello
    Unfortunately I did not manage to fix my computer yet. My printer is broken so I bought a new one, but since I do not have administrator rights, I can not connect the new printer, so I have to write all-installing notes down with pencil and simultaneously translate them into Danish so it is a very slow process. I'll tell you if it succeeds, otherwise there is of course the primitive way to buy a new computer, but it's the same as giving up. Not yet.
    Until now, many thanks for the good suggestions.
    Kind regards
    Birgeres

  • How do I log off the current user and bring back the authentication dialog box for another user to log in on Iplanet webserver?

    I am using JSP.

    Hey there Mike Novack,
    My understanding is that she replaced the Windows Login with a fingerprint swipe correct? I found some instructions surrounding this here
    So that we can best direct you through the process what operating system are you using on your T61?
    If you are using Windows 7, try going to the control panel, then to the biometric devices, click the option to change your biometric device settings and you should be able to disable it there.
    Did someone help you today? Press the star on the left to thank them with a Kudo!
    If you find a post helpful and it answers your question, please mark it as an "Accepted Solution".! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.

  • I a owner and administrator. I can't change any file permissions. Help tells me to 'get info' on a file, them click on the lock icon to enter password. The lock icon is not present on any files I 'get info' on. How can I change permissions

    I attached an external drive to my macbook pro for backup purposes. I found that the device is 'read only' for me. I read that I could change permissions by selecting 'get info' for a item and clicking the lock icon to submit my password. The lock icon is not displayed on any 'info' window for any file on my macbook, much less the attached drive. I am the only user and administrator as far as I know. What steps can I take to change permissions? Thanks. My 1st post.

    How can I tell? The 'get info' window has no lock and under sharing and permissions, on says 'you can only read'. I did a get info on the Macintosh HD and it had a lock on it but said I could only read, for what that it worth.

  • How to use different (not local) user for NTLM auth in Authenticator?

    Hi All,
    I use custom authenticator to provide user / passwords to connect to .NET Web Services. I overloaded function getPasswordAuthentication() that returns right user / password combination for the requested URL. It all works perfectly for many kinds of HTTP connections: basic, ntlm, ntlm-v2, through proxy, ssl, etc.
    My problem is that during NTLM authentication from Windows computers JVM uses credentials of the currently logged in domain user instead of calling Authenticator to get other user / password provided by the user. In case when local user credentials fail to authenticate, JVM calls my Authenticator but in case authentication is successful it does uses local domain user and never calls my Authenticator. The issue is when this local domain user does not have enough permissions but authenticated correctly there is no way to supply JVM with another user to begin with.
    What can I do to force JVM to ignore local domain user and to use Authenticator to collect credentials during NTLM authentication requested by the server in case the software runs on a Windows box with currently logged in domain user?
    I am looking for the answer for a long time already but found only questions and suggestions to switch server from NTLM authentication which is not an option for me. From the developer's view it has to be pretty simple change for Sun to do in Java networking API. Is there any way to escalate it to Sun support? Maybe there is some property in some JRE patch level that allows to do this?
    Thank you very much!
    Mark

    Thank you for the reply. I have kind of an opposite problem. I can perfectly connect from Linux computers to Microsoft IIS servers using NTLM or even NTLMv2 authentication. My problem is connecting from Windows client computer joined to the same domain as IIS server with the domain user logged in to this computer. In this case this user account will be used in any HTTP connections I initiate to this IIS server instead of the one that I want to supply in my custom Authenticator.
    I have graphical interactive application that connects to IIS Server. When user runs it and connects to IIS server I want to prompt for the user/password regardless whether JRE may correctly authenticate using current user account credentials. The current user may not have enough permissions in IIS application so I want to use different user to login to IIS application.
    Thank you anyway,
    Mark

  • Importing user and group database from 2.6 to 4.0

    Hi,
    I need to import the user and groups from version 2.6 ACS to version 4.0. The 2.6 online documentation talks of using the CSUtils to create a .txt back up of the users and group. But I cannot see how to import that into 4.0. Has anyone done this. Any info would be appreciated,
    cheers,

    Hi Darran,
    I looked at what I had imported using the instructions you had supplied me and it looked fine, all users and group, tacacs privelege levels had been imported. I modified a router on our network to point at the ACS 4.0. on testing it looks like the passwords hadn't been copied across successfully. Logins are failing with 'invalid CS password' in the failed authentication log. If I changed the password manually it was fine.
    Have you seen that before?
    Thanks for your help on this.
    Rgds,
    Russell.

  • Contractual User Type: 11 Multi-Client/System

    Hi,
    In BW 3.5 we had option to select Contractual User Type: 11 Multi-Client/System under Licence Data of Users.
    However, in BI 7.0, we do not see option 11 Multi-Client/System at all.
    Can you please advise,why this is not there? Is it replaced by some other type?
    Best Regards,
    UR

    Hello,
    you can select the available license types in transaction USMM (Tab User types). Check before you use license type 11 if there is only the need for it. In general you don't need license type 11 in a common SAP environment.
    Regards,
    Milan

  • Create users under Administration Server Create user and Refresh users options are disabled

    We have installed and configured 11.1.2.2 successfully, Essbase in standalone mode.
    When we try to create users under Administration Server Create user and Refresh users options are disabled. Please let me know how to create EAS users?
    Thanks,
    Satheesh.

    Please find below response.
    1.You can create users from EAS console using maxl, if you have not externalized the users .
    When we create using Maxl it will create for 'ESSBASE Servers' users but we want to create additional administrator users under 'Administrator Services' --> 'Users'. At the moment default 'Admin' users is created under 'Administrator Services' --> 'Users'.
    2.  you have installed your essbase in a stand -alone mode  , then the option of creating users will be enabled and you can give appropriate provision to applications.
    Yes. But the create users is disable for Admin.
    3. Through which url are you accessing EAS console is it http://Servername:19000/workspace/index.jsp ?
    http://prod-server:10080/easconsole/console.html
    Please suggest.

  • Enterprise User and Multi Thread Server

    Hi,
    We are going to build a system which uses a configuration:
    10g2
    Enterprise User
    Multi Thread Server
    Client apps accesses db over JDBC/SSL
    Could some please share experience about issues regarding
    using Enterprise User and Multi Thread Server ?
    Is MTS transparant for Enterprise User authentication ?
    Regards,
    Cezary

    If you build simpserv with -t, and set MIN and MAXDISPATCHTHREADS, you
    should have an example of a multithreaded server.
         Scott
    Johan Philippe wrote:
    >
    We have been going to the documentation on multi-threading and contexting in servers
    on Tuxedo 7.1.
    And the impression so far is that apart from the function definitions there is
    not much information around.
    Didn't even find a simple example of a multi-threaded server in the Bea refs yet.
    Does anyone know/have such an example?
    And is anyone using multi-contexting in a server, because the limitation that
    only server-dispatched
    thread get a context puts quite a limitation on its usefullness.

  • How to Use the same iview for both KM End User and the KM Administrator

    Hi friends,
    *This is my scenario :* How to Use the same iview for both KM End User and the KM Administrator but with different Context
    Menu Options.
    i followed these steps but im getting same context menu for both KM End User and the KM Administrator .
    Assign the role Content Administrator to the user km_admin. This is needed so that km_admin can change
    the presentation settings for the KM Folder u201EReports_kmFolder‟.
    Now, login with user km_admin. Navigate to the Km Folder reports_kmFolder through Content Administration
    -> Km Content. Click on Details link of the folder reports_kmFolder.
    Go To Settings -> Presentation. Click on the tab u201ESettings for You‟-> Click on button u201ESelect Profile‟.
    Select the radio button corresponding to u201Elayout Set‟, and choose u201EConsumerExplorer‟ from the dropdown.
    Click u201EOK‟.
    Select both the check boxes corresponding to Items Affected as shown above, and click u201ESave‟
    Now, remove the u201ESuper Administrator‟ role from the user km_admin and login with this user.
    How rto resolve this????
    Regards,
    Prasad.

    Hello Prasad,
    Most likely the user km_admin still has system principal roles assigned, even though you removed the Super Admin role, you should check that this user doesn't have any other admin roles, otherwise it will be considered a System Principal user and will therefore still have access to all content. For more information see http://help.sap.com/saphelp_nw70/helpdata/en/19/56f28fbd4e11d5993b00508b6b8b11/frameset.htm
    Try creating a new user with just read access to the content and you should see that it will not be able to make any changes etc.
    Regards,
    Lorcan.

  • Can you use Multi Factor Authentication server with Central NPS and RD Gateway?

    Hi,
    Does anyone have any experience getting the Azure Multi-Factor Authentication (MFA) on-premise server, working with a Remote Desktop Gateway server, and a centralised NPS server?  I can get a solution whereby a user can get the second token (phone call/sms
    etc.) but the connection never gets established.  It looks like its looping as it repeats the phone call/text for a second time but again no connection.  I can’t figure out why.
    All the blogs are very vague as to whether you can combine a new MFA NPS connection policy with an existing username/group membership NPS policy on a centralised NPS server (with RAP/CAP policies).
    I need to understand whether we can combine both an MFA Radius policy with a Username/Password plus group membership NPS policy together to achieve two factor authentication.
    Do you have the Remote Desktop Gateway Server connect to the Central NPS server and then the NPS server use the MFA server as its proxy server? In effect turning the NPS server into a proxy Radius server?  
    Or do you configure the Remote Desktop Gateway server to use the MFA server as the proxy Radius server, and configure the MFA server to send on Radius requests to the central NPS server?
    Or either of these scenarios not supported and you can only use the MFA server as the only Radius server in the auth. process? (bypassing NPS policies?)
    Thanks if someone can assist,
    I’ve been using these blogs but to no successful effect:
    http://technet.microsoft.com/en-us/library/dn394287.aspx
    http://www.rdsgurus.com/uncategorized/step-by-step-using-windows-server-2012-r2-rd-gateway-with-azure-multifactor-authentication/
    http://dave.harris.uno/installing-and-configuring-azure-multi-factor-authentication-mfa/

    Hi Michael,
    Thank you for posting in Windows Server Forum.
    After going through your description, I can say that we can use MFA server with central NPS and RD Gateway. Also the link which you have provided points the step to apply. In addition you can refer below article.
    Configure Remote Desktop Gateway to use Multi-Factor AuthenticationConfigure Remote Desktop Gateway to use Multi-Factor Authentication 
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    TechNet Community Support

  • Once we download it brings up a box that says "Run as" and has User name: Administrator and a box for Password. We can't get past this point. What do we do?

    we tried to dowload Firefox and it tried to run..it then brought up the box that states Run as at the top. It says: You may not have the necessary permissions to use all the features of this program you are about to run. You may run this program as a different user ot continue to run the program as the current user.
    Current user(Owner-PC\Owner)
    Run the program as the following user:
    User name: Administrator
    Password:
    ok cancel

    Make sure that you do not run the Firefox directly via the download dialog in IE, but save the file to the desktop and start the installation with a double-click.
    You may need to use "Run as Administrator" via the right-click context menu if you do not get a UAC alert.

Maybe you are looking for