Guest portal using ACS to authenticate against AD

Running ACS 5.3, I have a Wireless Access policy that authenticates wireless users either by mac address, AD user name or computer name, depending on what AD groups the accounts belong to.  My Network Authorization policy has rules because only certain groups should access certain SSIDs.
I am trying to get the Guest authentication portal to accept and authenticate AD users belonging to a certain group, but I run into 15039 Selected Authorization Profile is DenyAccess
Somewhere for some reason my authorization policy is denying access. 
Needing some assistance in troubleshooting these rules.

You have to change the Group Map Attribute to "member" and authorization  will work.

Similar Messages

  • Using ACS to authenticate mac addresses

    I am wanting to use ACS 3.3 to be the authentication source for mac address authentication on a WLAN. All AP's are 1200's. Configuring the AP to look to to ACS box seems pretty straight forward. But how do you configure the ACS box. Do you just enter the mac address as the user name? What do you enter as the password?

    You have to use the MAC address for both user id and password. This MAC address should be in the same format seen by the AP.
    Please go to "MAC Authentication" portion of the following document for more information http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00805e7a13.shtml
    http://www.cisco.com/en/US/products/hw/wireless/ps430/products_configuration_guide_chapter09186a008010f63d.html#wp1029067
    HTH

  • Guest Portal Using ISE with Flexconnect Mode

    Folks,
    I have configured my guest web authentication using ISE with flexconnect mode like this:
    http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bcb905.shtml
    After done, I connect the SSID but cannot log in. I cannot get IP address and in the ISE I can see that my device has already hit my authorization profile and the status is pending. Can anyone help me with this?

    As Richard says, check to see if you have an IP address.  If not check the AP settings for FlexConnect.  Is the mode on the AP set right?  Please confirm that you are using FC local switching and not centralised switching? 
    Is the VLAN tagging enabled on the AP, and/or the VLANs on the AP switchport set right?

  • OSX 10.10.1 with Cisco ISE guest portal using (CWA) central web authentication issue

    We have Cisco Wireless with ISE (Identity Service Engine) to provide guest access with CWA (central web authentication). The idea is to provide guest access with open authentication, so anyone can connect. Then when the guest trying to browse the internet it will be redirected to guest protal for authentication. So only corporate guest with valid password can pass the portal authentication. This is been working fine for windows machine, android, and apple devices with earlier OS version (working on OSX 10.8.5). For clients that's been upgraded to OSX 10.10.1 or IOS 8 they can no longer load the CWA redirection page.
    Please let us know if there's any setting under the OSX to solve the issue, or plan from apple to fix the issue on the next OSX/IOS release ?
    thanks - ciscosx

    Robert,
    Manual assignment has been made available in ISE 1.2 release.
    M.

  • 5760 v3.6 guest portal redirect to ISE

    I'm testing a new set of 5760 controllers for a future production rollout, running software version 3.6.  Our current production setup consists of older WISM-1 and 4402 controllers running CUWN 7.0.  Our guest network has an anchor in the DMZ, redirecting to ISE.
    In the recent thread (https://supportforums.cisco.com/discussion/12319151/3850-ise-guestportal-no-redirect-v-334), one of the posters said that guest redirection in 3.6 works similarly to redirection in CUWN, while in 3.3 it is very different.  I found the documentation for 3.3 (http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html), which I have to say I don't like very much.  However, I find the configuration and command reference guides for 3.6 are less than helpful on this point. 
    So the question I have is whether guest networking with an external redirect to ISE looks like the following in 3.6?  Or does it work like CUWN, where the SSID is configured with layer 3 security?  If it uses layer 3 security like CUWN, does anybody have a quick configuration sample for how it can work end to end in 3.6?
    ------ From the document http://www.cisco.com/c/en/us/support/docs/wireless/5700-series-wireless-lan-controllers/117717-config-wlc-00.html ---------
    The flow includes these steps:
    The user associates to the web authentication Service Set Identifier (SSID), which is in fact open+macfiltering and no Layer 3 security.
    The user opens the browser.
    The WLC redirects to the guest portal.
    The user authenticates on the portal.
    The ISE sends a RADIUS Change of Authorization (CoA - UDP Port 1700) in order to indicate to the controller that the user is valid, and eventually pushes RADIUS attributes such as the Access Control List (ACL).
    The user is prompted to retry the original URL.

    I have a project with a 5760 running 3.6 working to a 5508 anchor controller in a DMZ.
    I have web authentication working to an ISE OK.
    Regards
    Roger

  • How to use ISE Guest Portal for AD users

    Hi there,
    As  subject explains all, I want to use ISE Guest Portal for my domain  users. I have tried many different ways to authenticate users and  finally I came to the conclusion that ISE CWA works pretty well and is  very stable. WLC Webauth sucks alot, does not redirect to the login page  always.
    Can  you please share what other ways are stable ways to authenticate AD  users? I know about WPA 802.1x authentication but that requires a CA in  the network which is not available at the moment. So can you please  Suggect?
    Otherwise,  I want to use ISE Guest Portal for my AD users as well. AD is already  integrated to ISE, the issue happens when I attempt to athenticate using  AD user account, the user gets authenticated but the Guest Portal  redirects me to Device Provissioning page and there it shows an error  saying "there is not policy to register the device, contact system  admin"
    Am I missing something??
    I am running WLC 5760 with ISE 1.2
    Thanks in advance..

    Hi,
    Can you post a screenshot of your current policies? Also for 802.1x authentication although it is best practices you do not have to have an internal CA to make this solution work. You can disable the option to "validate server certificate" or you can use a trusted CA to sign the certificate for the eap interface.
    In most cases 802.1x is the method to go because it provides dynamic authentication without forcing users to redirected to a web page multiple times throughout the day, scenarios such as computers that sleep or users that are mobile will not have connectivity until they redirect to the portal if one of the scenarios exist. You also gain WPA encryption on your WLAN, if you are using strictly layer 3 web auth you run into issues where encryption is not used and rely on encryption from the application as your method of data integrity and security.
    Thanks,
    Tarik Admani
    *Please rate helpful posts*

  • ACS cannot Authenticate Aironet Users against Exernal DB (LDAP)

    ACS cannot Authenticate Aironet Users against Exernal DB (LDAP)
    Can anyone point me to a technical explanation of why this is true?
    All I have found so far is one small note in a help file and something that might be related under EAP-FAST explanation.
    I have posed this question to our Cisco account team but no response yet.
    Just need to have a good explanation when explaining to mgmt why we need to have a special setup for WLAN users.

    Hmmm....you should be getting more than that from debug radius and debug aaa authen if your AP is truly attempting EAP authentication. The debugs I generally use for this are 'debug aaa authen', 'debug radius', and 'debug dot11 aaa dot1x all' coupled with gathering the detailed support logs from ACS. A warning about 'debug dot11 aaa dot1x all'....it is VERY verbose and cryptic if you don't have alot of experience looking at it so it may be best to open up a TAC case. With these debugs turned on, you should see an EAPOL logon show up from the client (usually says 'received EAPOL packet...') and then a request for identity from the switch and a response from the client with a username and password. Then a series of RADIUS challenge/response packets will be passed which consists of the server cert being passed to the client for validation and then the client sending the username and password to the server. Then you will finally get an access-reject or access-accept packet from the RADIUS server. The failed and passed attempts logs in ACS can also provide good info as to what the source of the failure may be. Do you get any passed or failed attempts for these authentications?

  • Problem when try to use ACSE+ Windows AD to authenticate two kind of WLAN c

    I met a problem when try to use ACSE+ Windows AD to authenticate two kind of WLAN clients:
    1. Background:
    We have two WLAN: staff and student, both of them will use PEAP-MSCHAPv2, ACSE will be the Radius server, it will use Windows AD's user database. In AD, they create two groups: staff and student. The testing account for staff is staff1, the testing account for student is student1.
    2. Problem:
    If student1 try to associate to staff WLAN, since both staff and student WLAN using the same authentication method, the auth request will be send to AD user database, since student1 is a valid user account in AD, then it will pass the authentication, then it will join the staff WLAN. How to prevent this happen?
    3. Potential solution and its limitation:
    1) Use group mapping in ACSE(Dynamic VLAN Assignment with WLCs based on ACS to Active Directory Group Mapping), but ACS can only support group mapping for those groups that have no more than 500 users. But the student group will definitely exceed 500 users, how to solve it?
    2) Use methods like “Restrict WLAN Access based on SSID with WLC and Cisco Secure ACS”: Configure DNIS with ssid name in NAR of ACSE, but since DNIS/NAR is only configurable in ACSE, don't know if AD support it or not, is there any options in AD like DNIS/NAR in ACSE?
    Thanks for any suggestions!

    I think the documentation for ACS states:
    ACS can only support group mapping for users who belong to 500 or fewer Windows groups
    I read that as, If a user belongs to >500 Windows Group, ACS can't map it. The group can have over 500 users, its just those users can't belong to more than 500 groups.

  • Authenticate ADF application using adf security wizard against LDAP OID

    I have an adf application which i intend to authorise using LDAP. For now , i have actually hand coded in java for authenticating the users of my application. Using JNDI I directly connect to LDAP and authenticate users. However , recently it came to my notice that i can also do that using ADF sercurity wizard , but i am unable to do so. which securing the ADF application ,no where in the wizard LDAP configuration is mentioned. do i have to change some file manually ? i have no idea on how to proceed on that.

    i have setup wls , making th OIDAuthentication as Sufficient. but i dont know how to configure from ADF side so that it can authenticate against LDAP. when i try the ADF sercurity wizard option , it tells me to create new Roles . Is there any way where i can import the ldap credentials to the security wizard ..?

  • ISE Guest Portal and one more SSID using internal accounts

    Hi Guys,
    I have two SSIDs on WLC, the first is related with ISE Guest Portal and the second is related with employee but i realize that the
    Guest user can access the employee SSID and employee accounts can access the Guest portal page.
    I guess this is happen because i cannot split these databases under "Internal Users" on Authentication Policy.
    How can i restrict the access even if i am using the internal databse?
    thanks a lot

    using the Authorization policy is the right way.  Match the corp ID store to the corp WLAN SSID ID in the AuthZ policy, for example (where Employee is your corp ID store and yyyy is the name of your corp SSID):

  • Authenticate users by Windows group using ACS

    Currently we are using Windows IAS/RADIUS to authenticate users onto out wireless network and it is set to allow users in a certain Windows group to connect.
    Is there a way to do this with ACS?
    Please note that we are using ACS Solution Engine, not ACS for Windows.
    Thanks.

    Use Remote Agent for Windows user authentication feature or configure Windows AD as the LDAP on ACS SE.
    then configure group mapping, and put the restrictions accordingly.
    Regards,
    Prem
    Please rate if it helps!

  • Guest Portal Access using ISE

    I’m having an issue setting up the Guest Port Access for our wireless network.
    I’m trying to setup an SSID anchored in the DMZ for internet access only. The authentication to this would be granted via the ISE Guest Access Portal.
    I’ve got the SSID created and tested working with no authentication.
    When I enable the Guest Portal (per these instructions http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bba10d.shtml), I can login and create a guest account. Have the guest go to the portal, login, hit ‘I accept’, but then instead of redirecting them to whatever page they tried to access, it sends them back to the guest login page (with still no access to the network resources).
    Am I missing a simple setting somewhere? Please let me know if this should be reposted in the security/ISE forum instead of here.
    Thanks,
    Pete

    Is this related?
    11036
    ERROR
    RADIUS
    The Message-Authenticator RADIUS attribute is invalid.
    A RADIUS packet having an invalid Message-Authenticator attribute has been received. Make sure that the client device is compatible with AD Agent, has been configured properly, and is functioning properly. Make sure that the same RADIUS shared secret has been properly configured, both in the client device and in AD Agent.
    Reference: http://www.cisco.com/en/US/docs/security/ibf/setup_guide/ibf10_log_msgs.html

  • Using ACS with PIX/ASA

    Hi there,
    We have an implementation of Cisco Secure ACS 4.1.4 using RSA SecurID as its authentication source to provide role-based access control and command level authorisation.
    We have succesfully deployed this our routers/switches, and are now looking at configuring Cisco PIX/ASA devices to use ACS and have stubbled across issues.
    Config on PIX/ASA (note we actually have 4 ACS servers defined for resilience etc):
    aaa-server XXXXX protocol tacacs+
    accounting-mode simultaneous
    reactivation-mode depletion deadtime 1
    max-failed-attempts 1
    aaa-server XXXXX inside host <SERVER>
    key <SECRET>
    timeout 5
    aaa authentication telnet console XXXXX LOCAL
    aaa authentication enable console XXXXX LOCAL
    aaa authentication ssh console XXXXX LOCAL
    aaa authentication http console XXXXX LOCAL
    aaa authentication serial console XXXXX LOCAL
    aaa accounting command XXXXX
    aaa accounting telnet console XXXXX
    aaa accounting ssh console XXXXX
    aaa accounting enable console XXXXX
    aaa accounting serial console XXXXX
    aaa authorization command XXXXX LOCAL
    Problems:
    Enter PASSCODE is NOT displayed on first attempt to logon to the PIX/ASA because it does not attempt to communicate with ACS until username/pass is sent.
    Username with null password (e.g. CR) will correctly then display Enter PASSCODE prompt received from ACS.
    PIX/ASA does not attempt to authenticate against all configured TACACS+ servers in one go, instead it tries each sequentially per authentication attempt….e.g.
    1st Attempt = Server 1
    2nd Attempt = Server 2
    3rd Attempt = Server 3
    4th Attempt = Server 4
    This means that in total failure of ACS users will have to attempt authentication N+1 times before failing to LOCAL credentials depending on number of servers configured, this seems to be from setting "depletion deadtime 1" however the alternative is worse:
    With “depletion timed” configured, by the time the user has attempted authentication to servers 2,3 and 4 the hard coded 30 second timeout has likely elapsed and the first server has been re-enabled by the PIX for authentication attempts, as such it will never fail to local authentication locking the user out of the device, the PIX itself does warn of this with the following error:
    “WARNING: Fallback authentication is configured, but reactivation mode is set to
    timed. Multiple aaa servers may prevent the appliance from ever invoking the fallback auth
    mechanism.”
    The next issue is that of accounting.....AAA Accounting does not record “SHOW” commands or session accounting records (start/stop) or “ENABLE".
    The final issue is ASDM. We can login to ASDM successfully using ACS/RSA SecurID, however when a change is made to the configuration ASDM repeatedly sends the users logon credentials multiple times.
    As RSA SecurID token can only be used once this fails and locks the account.
    Any ideas on how to make two of Ciscos leading security products work together better?

    Just re-reading the PIX/ASA 7.2 command reference guide below:
    http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/crt_72.pdf
    It appears some of the above are known issues.
    PASSCODE issue, page 2-17 states:
    We recommend that you use the same username and password in the local database as the
    AAA server because the security appliance prompt does not give any indication which method is being used.
    Failure to LOCAL, page 2-42 states:
    You can have up to 15 server groups in single mode or 4 server groups per context in multiple mode. Each group can have up to 16 servers in single mode or 4 servers in multiple mode. When a user logs in, the servers are accessed one at a time starting with the first server you specify in the configuration, until a server responds.
    AAA Accounting, page 2-2 states:
    To send accounting messages to the TACACS+ accounting server when you enter any command other than show commands at the CLI, use the aaa accounting command command in global configuration mode.
    ASDM issue, page 2-17 states:
    HTTP management authentication does not support the SDI protocol for AAA server group
    So looks like all my issues are known "features" of PIX/ASA integration with ACS, any ideas of how to achieve a "slicker" integration?
    Is there a roadmap to improve this with later versions of the OS?
    Will the PIX/ASA code ever properly support the same features as IOS?
    Would it be better to look at using something like CSM instead of ASDM?

  • ISE, guest portal on WLC

    Hi,
    Currently we have wireless guest login through a guest portal in the WLC. Is it possible to implement ISE and keep the guest portal in the WLC?
    Example:
    User connects to a SSID with an laptop. That laptop is profiled as not belogning to the company network and is then redirected to the WLC guest portal.
    All the guides I find is about having the guest portal in the ISE.
    Regards
    Philip

    You can use LWA for this . he WLC redirects  the HTTP traffic to an internal or external server where the user is prompted to  authenticate. The WLC then fetches the credentials (sent back via an HTTP GET  request in the case of external server) and makes a RADIUS authentication. In  the case of a guest user, an external server (such as Identity Service Engine  (ISE) or NAC Guest Server (NGS)) is required as the portal provides features  such as device registering and self-provisioning.
    Refer to the following link for  configuration  example
    http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml

  • Guest Portal - untrusted certificate

    All,
    My ISE integration is on our local domain,for example  company.local. I created a rule in the authorization policy that used a static IP address, say guest.company.com for our guests to use for the redirection. When guests get the web auth redirection to guest.company.com they are getting the untrusted certificate.
    I tried to import a certificate from our external CA, and faced errors because it didnt have the .company.local SAN. I did generate that with the CSR but my external CA doesnt give me an option to include this.
    How is this rectified so our guests hit the web portal without getting a certificate error?

    Hi Jason,
    From my experience, this is a common problem.  Typically, what I do on deployments is obtain a trusted 3rd-party signed certificate for my HTTPS usage on the ISE appliances. If you want to use your internal CA certificate to authenticate EAP for your domain computers and other sessions,  you can still do so.
    Note: Sometime in 2014 (it may already be active) the 3rd-party certificate signers are no longer going to allow .local or other internal domains on their certificates. 
    With that said, I've normally been deploying the ISE appliances with an external domain name, example, ise.company.com rather than ise.company.local.  You can setup split DNS on your network to allow ise.company.com to resolve to your internal IP.
    Hope this helps.

Maybe you are looking for