IAS Policy with Pix

I have a pix 501, with vpn users authenticating off of MS 2000 IAS. Works great although I want to filter a few users to only be able access a couple PC's when they come in through the pix.
I created a new group on NT called Vendors, added the users to that group. I then created a new remote access policy that when the IP of the pix is used, and the vendor group condition is met, to only permit traffic to a certain subnet.
The users in that group can still login, but they can get to all the subnets. Not sure what I am missing here, any help would be appretiated.

I read through it, still a little curious on how this can work. The radius part is working, all of my users are authentication useing their MS2000 logins. What isn't working is group restrictions, again these are NT restrictions.
Currently as long as they are allowed to have remote access on the server they can get in. Regardless of what Remote access policy I put on the account it still seems to let them through.
I did stumble on something about how the Radius server needs to download an access list off the pix, and it can do this by adding an atribute on the Remote access settings within IAS. I haven't tried that method yet.
The only other thing I can think of is to have two groups, one local one through radius. All the users except the ones that need restrictions use radius.
Only catch to this, can the pix 501 handle 2 groups, and if it does, in what order does it authenticate, meaning does it look in local then go to radius or the opposite.

Similar Messages

How to restrict users working on Windows 7 clients from accessing Windows Explorer and other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2

Dear All,
We are having an infrastructure setup of around 500 client computers managed through group policy.
Recently the domain controllers have been migrated from Windows Server 2003 to Server 2008 R2.
Since this account requires extremely strict environment, we need to figure the solution for restricting the users from access anything locally.
It would be great if you can assist me with the following query.
How to restrict users logged on Windows 7 clients from accessing Windows Explorer and browsing other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2 ?
Can we disable Network Tab on the left hand pane ?
explorer.exe is blocked already, but users are able to enter the Windows Explorer by clicking on the name which is visible on the Start Menu.

>   * explorer.exe is blocked already, but users are able to enter the
>    Windows Explorer by clicking on the name which is visible on the
>    Start Menu.
You cannot block explorer.exe when you do not replace the shell - the
desktop you see effectively IS explorer.exe...
Your requirement sounds like you need a custom shell:
http://gpsearch.azurewebsites.net/#2812
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

DMZ zone with PIX 501

- How do I setup a DMZ zone with PIX 501 firewall? Do I need to use an additional router? I have CISCO 1605 at my disposal.
- If I can't do that, what would be an alterantive way to set an FTP server similarly to the DMZ way.
(We're using IPsec/GRE VPN between our 3 sites. we're on W2K network).
thanks,
oleg

When talking about setting up a DMZ, a PIX model with atleast three interfces is required. On a PIX 501, only two interfaces are available, an outside interface (ethernet) and an inside interface (availabe as a 4 port switch). For stting up a DMZ, you will need an additional interface and that would mean getting a higher model of the PIX. The idea of using a router on the inside interface and then configuring restrictive policies on it might work but will make the setup messy and you are unlikely to find a satisfactory level of support for it for the simple reason that not many neworks are deployed that way.

Blocking protocols with pix version 7.2.1

somebody knows like blocking protocols like skype with pix version 7.2.1.
i know msn messenger or yahoo messenger can be blocked.
but I need to blocked things like skype.
thanks.

Try this link
http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/conf_gd/firewall/inspect.htm#wp1480861

How to Intergrate Policy with applet

hi my name is easan. I created an applet which reads and writes to a file but i had problems accessing the file. I solved that by granting read and write permission to the file by creating a policy. I can run the applet in the appletviewer using this line
c:\>appletviewer -J-Djava.security.policy=<policyname> applet.html
I would like to know hw to intergrate this policy with my applet so that i can run my applet from a browser.
I would appreciated any help from anyone..... thank you in advance.
Easan

It's not possible to integrate policy file together with applet. If you want to perform these dangerous operation (read,write) from applet, you have to sign applet's jar file. And in applet's code you have to use AccessController.doPrivileged(PrivilegedAction action) for possibly unsafe parts of code.
tina

Manual key negotiation with pix 501

how to use manual key negotiation with pix 501 6.3 to solve VPN tunnel negotiation problem

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/ipsecint.html#wp1045493
"Manual configuration of SAs is not supported on the PIX 501 because of the restriction in the number of ISAKMP peers allowed on that platform."
However I'm sure a proper solution can be found to your original problem (establishing VPN with huawei)
Please rate helpful posts.
Regards
Farrukh

Are you allowed to return devices within 14 day policy with cosmetic damages

Hello,
Are you allowed to return devices within 14 day policy with cosmetic damages?

From: Return Policy & Early Termination Fee - Verizon WirelessTT
At our discretion, we may decline your return or charge you a fee for a missing item, or for items that we determine are damaged or require service. If you return and we accept your merchandise within the return period, we will refund your purchase price, subject to the restocking fee.

Create Access Policy with OIM API: can't fill child form

Hi!
I'm having a problem with creating OIM Access Policy with API. I'm doing the following:
1. Create a new access policy via AccessPolicyIntf
2. Add a resource object which will be provisioned to all users who are within policy scope
3. Get Resource Object (Parent) Form Definition via FormDefinitionIntf
4. Add data to parent form (AccessPolicyIntf setFormData(FormDefinitionKey))
5. Now I want to add data to the child form, for that purpose I need to know child form definition key, but I can' get one, because there's no method like 'getChildFormDefinitionKey' in FormDefinitionIntf interface.
Please, help me to get child form definition key, knowing parent form definition key and version

See if this code helps:
public String addChildTableValue(long userKey, String group, String objectName, String fieldName tcDataProvider ioDatabase) {
log.debug("addChildTableValue() Parameter Variables passed are:" +
"userKey=[" + userKey + "]" +
"group=[" + group + "]" +
"fieldName=[" + fieldName + "]" +
"objectName=[" + objectName + "]");
try{
tcUserOperationsIntf userIntf = (tcUserOperationsIntf)tcUtilityFactory.getUtility(ioDatabase, "Thor.API.Operations.tcUserOperationsIntf");
tcFormInstanceOperationsIntf formIntf = (tcFormInstanceOperationsIntf)tcUtilityFactory.getUtility(ioDatabase, "Thor.API.Operations.tcFormInstanceOperationsIntf");
boolean roleExists = false;
//Result set of all Object for user
tcResultSet obResultSet = userIntf.getObjects(userKey);
if (obResultSet.isEmpty()){
log.error("User has no provisioned objects");
return "NO_OBJECTS_EXIST";
}else{
for (int ii=0; ii<obResultSet.getRowCount(); ii++){
obResultSet.goToRow(ii);
if ((obResultSet.getStringValue("Objects.Name").equals(objectName)) &&
(!(obResultSet.getStringValue("Objects.Object Status.Status").equals("Revoked")) &&
!(obResultSet.getStringValue("Objects.Object Status.Status").equals("Provisioning")))){
log.debug("Resource object found: " + objectName);
//Process Instance Key of the object
long plProcessInstanceKey = obResultSet.getLongValue("Process Instance.Key");
log.debug("Process instance key: " + plProcessInstanceKey);
//Process Key for the parent for
long plParentFormDefinitionKey = obResultSet.getLongValue("Process.Process Definition.Process Form Key");
log.debug("Parent form definition key: " + plParentFormDefinitionKey);
//Form version of the parent form
int pnParentFormVersion = formIntf.getProcessFormVersion(plProcessInstanceKey);
log.debug("Parent form version: " + pnParentFormVersion);
//Result set of Child Form information
tcResultSet childFormResultSet = formIntf.getChildFormDefinition(plParentFormDefinitionKey, pnParentFormVersion);
//Child form definition key
long plChildFormDefinitionKey = childFormResultSet.getLongValue("Structure Utility.Child Tables.Child Key");
String plChildTableName = childFormResultSet.getStringValue("Structure Utility.Table Name");
log.debug("Child form definition key: " + plChildFormDefinitionKey);
log.debug("Child table name: " + plChildTableName);
tcResultSet childFormData = formIntf.getProcessFormChildData(plChildFormDefinitionKey, plProcessInstanceKey);
if (!(childFormData.isEmpty())){
log.debug("Searching child table current values");
for (int iii=0; iii<childFormData.getRowCount();iii++){
childFormData.goToRow(iii);
String fieldValue = childFormData.getStringValue(fieldName);
log.debug("Child table entry: " + iii + " | value: " + fieldValue);
if (fieldValue.equals(group)){
roleExists = true;
log.debug("Value already exists in child table");
return "DUPLICATE_VALUE";
log.debug("Value not found in child table");
if (!roleExists){
Hashtable childFormHash = new Hashtable();
childFormHash.put(fieldName, group);
formIntf.addProcessFormChildData(plChildFormDefinitionKey, plProcessInstanceKey, childFormHash);
log.debug("Value successfully added to table");
return "VALUE_ADDED";
log.debug("Provisioned resource " + objectName + " object not found");
return "OBJECT_NOT_FOUND";
catch(Exception ex){
ex.printStackTrace();
return "ERROR";

How i replace default password policy with my custom password policy

Hi All,
can anybody help me to replace idm default password policy with my custom password policy?

1. Go to Security --> Policies
2. New --> String Quality Policy --> define rules --> save
3. New --> Identity System account policy --> define rules and set the policy created in step2 to for password policy --> save
4. Assign the policy created in step 3 to the user
a. when create a user, under the 'Security' tab , for the 'Account policy' select the policy created in step
b. Programattically, create /check out user view, assign the step 3 policy
<set name='user.waveset.assignedLhPolicy'>
<s>step 3 policy</s>
</set>
and checkin the view

Is Part# SSM-4GE compatible with PIX ?

suggested replacement for PIX-1FE is SSM-4GE. does it mean it is compatible with PIX ?
http://cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/end_of_life_notice_for_cisco_pix_sec_app_cards_and_hwacc.html

No it is not. Since the PIX is now EoS, they assume you have/will upgrad to the ASA.
HTH

Digital Signatures with PIX and MS IAS

Does the PIX support simple digital signatures? I would like to find a away for an IAS server and a PIX to exchange signed packets.
In particular I am trying to increase the security of the initial PAP shared key exchange during user authentication.
Any help is appreciated. I am coming at this from a windows background.
TIA - Willem

I believe PIX supports simple Dig Sig.

L2TP/IPSec with PIX using EAP-TLS

Hi,
i have big problems with using my PIX515 (SW 7.2.1) for L2TP/IPSec VPN-Connections using EAP-TLS. With the option EAP-Proxy activated on PIX a RADIUS Access-Request Message reaches the configured RADIUS-SERVER (IAS2003), but the request is rejected by Radius. I did inspection of the packets with a sniffer and see following strange behavior:
- There is a Tunnel-Client-Endpoint AVP with no value and, even stranger, an existing AVP titled User-Password with an encrypted value.
I dont understand where the encrypted Password comes from in the first RADIUS Access-Request message received from the PIX, since the authentication method should be certificate-based (EAP-TLS). And I dont know either if the Tunnel-Client-Endpoint MUST be present in the message. Fact is the RADIUS responds with an Access-Reject Message.
The other AVPs in the request seem to be OK, and there is an existend AVP titled EAP-Message (79) that seems alright...
Other detail: In the event log on the IAS the request is logged as Type "PAP" (and not EAP as it should be!) and the log tells me about a problem with wrong username/password.
Tested the same client and Radius configuration using a RRAS-Server from Microsoft instead of the PIX and it worked fine! Could this be a bug of the Pix EAP-Proxy function?
EAP-Proxy should pass all EAP packets unmodified to the Radius, right? This seems not to be the case. Comparing the RADIUS Access-Request Message received from the Pix (which fails) with the RADIUS Access-Request Message received from the RRAS-Server (which successes) shows significant differences.
Every help appreciated. Please ask me for further infos if needed or if you would like me to post the Packet Capture file (Ethereal format)/Configuration information.
Thank you very much!!
Best regards,
Matthias

The Cisco Secure PIX Firewall Software Release 6.0 supports VPN connections from the Cisco VPN Client 3.5 for Windows.Refer the following URL for more information
http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/products_configuration_example09186a00800b6099.shtml#configuringthepixfirewall

Policy with route-map

Hi all,
may some of you tell me the real meaning of the sub-command "set interface <intf>" under the route-map section?
I thought it was like the <intf> parameter whe you set a route out of an interface.
I tried it with a PIX that should have to act as proxy-arp device but nothing happened.
Everything worked fine using "set ip next-hop ..."
The topology appears a little bit complicated if explained how I built it in practice.
Just a PIX525, a switch and a router 877 that manages VLANS.
I reproduced the environment that doesn't see 2 ethernet interfaces on the router where the policy is applied but 1 serial and 1 ethernet. By now there are 2 devices, one per link, and the def route is based on proxy-arp both for the serial and the ethernet.
Hope the scenario was clearly depicted.
TIA
Alex

Please refer to this document..
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009481d.shtml
HTH,
Ahmed

How ias integrate with Snacktory for getting main text from an html page

Hi All,
i am new to endeca and ias, i have an requirement, need to get main text from whole html page before ias save text to Endeca_Document_Text property,
as ias save all text in page to endeca_document_text property, it is not ok for reading when show in web page, i use an third party API to filter out the main text from original page,
now i want to save these text to endeca_document_text property,
an another question,
i get zero page when doing the logic of filtering main text from original html text in ParseFilter( HTMLMetatagFilter implements ParseFilter) using Snacktory.
if only do little things, it will work fine, if do more thing, clawer fail to crawl page. any one know how to fix it.
log for clawler.
Successfully set recordstore configuration.
INFO    2013-09-03 00:56:42,743    0    com.endeca.eidi.web.Main    [main]    Reading seed URLs from: /home/oracle/oracle/endeca/IAS/3.0.0/sample/myfirstcrawl/conf/endeca.lst
INFO    2013-09-03 00:56:42,744    1    com.endeca.eidi.web.Main    [main]    Seed URLs: [http://www.liferay.com/community/forums/-/message_boards/category/]
INFO    2013-09-03 00:56:43,497    754    com.endeca.eidi.web.db.CrawlDbFactory    [main]    Initialized crawldb: com.endeca.eidi.web.db.BufferedDerbyCrawlDb
INFO    2013-09-03 00:56:43,498    755    com.endeca.eidi.web.Crawler    [main]    Using executor settings: numThreads = 100, maxThreadsPerHost=1
INFO    2013-09-03 00:56:44,163    1420    com.endeca.eidi.web.Crawler    [main]    Fetching seed URLs.
INFO    2013-09-03 00:56:46,519    3776    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-1]    come into EndecaHtmlParser getParse
INFO    2013-09-03 00:56:46,519    3776    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-1]    come into HTMLMetatagFilter
INFO    2013-09-03 00:56:46,519    3776    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-1]    meta tag viewport ==minimum-scale=1.0, width=device-width
INFO    2013-09-03 00:56:52,889    10146    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-1]    come into EndecaHtmlParser getParse
INFO    2013-09-03 00:56:52,889    10146    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-1]    come into HTMLMetatagFilter
INFO    2013-09-03 00:56:52,890    10147    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-1]    meta tag viewport ==minimum-scale=1.0, width=device-width
INFO    2013-09-03 00:56:59,184    16441    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-2]    come into EndecaHtmlParser getParse
INFO    2013-09-03 00:56:59,185    16442    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-2]    come into HTMLMetatagFilter
INFO    2013-09-03 00:56:59,185    16442    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-2]    meta tag viewport ==minimum-scale=1.0, width=device-width
INFO    2013-09-03 00:57:07,057    24314    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-2]    come into EndecaHtmlParser getParse
INFO    2013-09-03 00:57:07,057    24314    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-2]    come into HTMLMetatagFilter
INFO    2013-09-03 00:57:07,057    24314    com.endeca.eidi.web.parse.HTMLMetatagFilter    [pool-1-thread-2]    meta tag viewport ==minimum-scale=1.0, width=device-width
INFO    2013-09-03 00:57:07,058    24315    com.endeca.eidi.web.Crawler    [main]    Seeds complete.
INFO    2013-09-03 00:57:07,090    24347    com.endeca.eidi.web.Crawler    [main]    Starting crawler shut down
INFO    2013-09-03 00:57:07,095    24352    com.endeca.eidi.web.Crawler    [main]    Waiting for running threads to complete
INFO    2013-09-03 00:57:07,095    24352    com.endeca.eidi.web.Crawler    [main]    Progress: Level: Cumulative crawl summary (level)
INFO    2013-09-03 00:57:07,095    24352    com.endeca.eidi.web.Crawler    [main]    host-summary: www.liferay.com to depth 1
host    depth    completed    total    blocks
www.liferay.com    0    0    1    1
www.liferay.com    1    0    0    0
www.liferay.com    all    0    1    1
INFO    2013-09-03 00:57:07,096    24353    com.endeca.eidi.web.Crawler    [main]    host-summary: total crawled: 0 completed. 1 total.
INFO    2013-09-03 00:57:07,096    24353    com.endeca.eidi.web.Crawler    [main]    Shutting down CrawlDb
INFO    2013-09-03 00:57:07,160    24417    com.endeca.eidi.web.Crawler    [main]    Progress: Host: Cumulative crawl summary (host)
INFO    2013-09-03 00:57:07,162    24419    com.endeca.eidi.web.Crawler    [main]   Host: www.liferay.com: 0 fetched. 0.0 mB. 0 records. 0 redirected. 4 retried. 0 gone. 0 filtered.
INFO    2013-09-03 00:57:07,162    24419    com.endeca.eidi.web.Crawler    [main]    Progress: Perf: All (cumulative) 23.6s. 0.0 Pages/s. 0.0 kB/s. 0 fetched. 0.0 mB. 0 records. 0 redirected. 4 retried. 0 gone. 0 filtered.
INFO    2013-09-03 00:57:07,162    24419    com.endeca.eidi.web.Crawler    [main]    Crawl complete.
~/oracle/endeca
-======================================
source code for parsefilter
package com.endeca.eidi.web.parse;
import java.util.Map;
import java.util.Properties;
import org.apache.hadoop.conf.Configuration;
import org.apache.log4j.Logger;
import org.apache.nutch.metadata.Metadata;
import org.apache.nutch.parse.HTMLMetaTags;
import org.apache.nutch.parse.Parse;
import org.apache.nutch.parse.ParseData;
import org.apache.nutch.parse.ParseFilter;
import org.apache.nutch.protocol.Content;
import de.jetwick.snacktory.ArticleTextExtractor;
import de.jetwick.snacktory.JResult;
public class HTMLMetatagFilter implements ParseFilter {
    public static String METATAG_PROPERTY_NAME_PREFIX = "Endeca.Document.HTML.MetaTag.";
    public static String CONTENT_TYPE = "text/html";
    private static final Logger logger = Logger.getLogger(HTMLMetatagFilter.class);
    public Parse filter(Content content, Parse parse) throws Exception {
        logger.info("come into EndecaHtmlParser getParse");
        logger.info("come into HTMLMetatagFilter");
        //update the content with the main text in html page
        //content.setContent(HtmlExtractor.extractMainContent(content));
        parse.getData().getParseMeta().add("FILTER-HTMLMETATAG", "ACTIVE");
        ParseData parseData = parse.getData();
        if (parseData == null) return parse;
        extractText(content, parse);
        logger.info("update the content with the main text content");
        return parse;
    private void extractText(Content content, Parse parse){
        try {
            ParseData parseData = parse.getData();
            if (parseData == null) return;
             Metadata md = parseData.getParseMeta();
            ArticleTextExtractor extractor = new ArticleTextExtractor();
            String sourceHtml = new String(content.getContent());
            JResult res = extractor.extractContent(sourceHtml);
            String text = res.getText();
            md.set("Endeca_Document_Text", text);
        } catch (Exception e) {
            // TODO: handle exception
    public static void log(String msg){
        System.out.println(msg);
    public Configuration getConf() {
        return null;
    public void setConf(Configuration conf) {

but it only extracts URLs from <A> (anchor) tags. I want to be able to extract URLs from <MAP> tags as wellGee, do you think you could modify the code to check for "Map" attributes as well.
Can someone maybe point a page containing info on the HTML toolkit for me?It's called the API. Since you are using the HTMLEditorKit and an ElementIterator and an AttributeSet, I would start there.
There is no such API that says "get me all the links", so you have to do a little work on your own.
Maybe you could use a ParserCallback and every time you get a new tag you check for the "href" attribute.

Problem in IAS Server with generation of PDF with FOP and XML parsing

Dear co.forumers :
We are developing an application that generates a pdf document with FOP Apache utilities, and this PDf is stored in a folder of the server. Firts of all, a DDBB data is retrieved using java ( jdbc) middleware classes ( servlets ), and with these data, the pdf is generated using FOP. In these process, he data retrieved from the DDBB is converted in a XML file , and the with the XSL FOP utility, the pdf is generated.
In the other hand, we have another application that consults data from a java beans, using a JSP, generates a XML with the data of the beans, and with this XML, and with a XSL file generates and html , with the data and fixed text.
Both applications have been deployed as a separated WebApp in the IAS. Both use Xalan as XML parser amb Xerces is used aswell.
So, the problem is , after generating a pdf with the firts application, every html generated via JSP-XML-XSL transformation in the second application is shown completelly bad formated. All fixed text are wrongly composed, and the text that should appear in textFields and ComboBoxes is also bad formated. The XML with the data is well generated, so the problem is in the parsing of these XML and the conversion in html through XSL. We have to re-initiate the server and then everything goes well again. If no pdf is launched, no problem occurs with the other application.
How an a WEB APP pplication can affect to another, installed both in different folders of the IAS ? We tried to change Xalan version and FOP version, but no result.
Is this a Poltergeist ?? and X file , maybe ?
Has anyone had the same problem ?
Pleae, any help will be very wellcomed.

A PDF document may be generated in the JDeveloper OC4J server.
http://www.oracle.com/technology/pub/notes/technote_vohra_fop.html

IAS Policy with Pix

Similar Messages

Maybe you are looking for