Machine Access Restriction Timeout

Hi Community,
we use Anyconnect Client for Machine Authentication. Authentication is for WLAN done by WLC that asks ACS5.3 that uses Active Directory as the identity store. You have enabled Machine Authentication and Machine Access Restrictions (MAR) with an Aging time of 2160 hours (90days).
Problem appears if user Hibernate or ACS is reloaded and machine Authentication timer expired. User need to Logout and wait or reboot that machine authenticates and then user can login again.
ACS logs:"ACS has not been able to confirm previous successful machine authentication for user in Active Directory"
Somebody mentined ther is a hiddeen feature in Anyconnect that allows machine authentication while user is logged in to the machine. Somebody know how to enable this?
Thank you.

After further troubleshooting,
The machine itself is always on wireless
But as for the username, most of the users says it's just used for wireless. Some users says they use their usernames on wired pc, but the wired pc should have a different mac so it should be the issue
The machine authentication period is 6 months so it should not get expired from the ACS..
but somehow when the clients get disconnected, somehow they can't reconnect since the ACS asks for another machine authentication
the ACS logs then show the error message..
Is there any way to see the machine authentication cache in the ACS?

Similar Messages

Cisco ISE Machine Access Restrictions MAR

I want to test out MAR. I notice there is a tick box on the ISE for MAR under: Identity Management --> External Identity Sources --> Active Directory --> Advanced Settings --> [tick] Enable Machine Access Restrictions
but also there is this condition that is to be used in the AuthZ Policy
Network Access:WasMachineAuthenticated
So...
What does the tick box option do?
Are they related or refer to different things?
Are both needed to get a MAR AuthZ to work?
Any of clarifying or beneficial info?
thanks

Hi,
Your are correct you will have to create an authorization condition that checks if the machine authenticated successfully.
So...
What does the tick box option do?
When you enable MAR globally it lets the ISE know to build a cache for endpoints that successfully perform machine authentication.
Are they related or refer to different things?
They work hand in hand.
Are both needed to get a MAR AuthZ to work?
Yes, you will have to create another authorization policy to allow domain computers to connect.
Any of clarifying or beneficial info?
When MAR is enabled, you will have to enable machine and user authentication to your laptop, after MAR succeeds ISE builds an entry in its database mapping the endpoint (mac address) to a successful machine authentication, after when a user authenticates not only do they have to provide the correct credentials but the mac address they are authenticating through will have an entry in the "MAR cache", keep in mind that some supplicants only perform machine authentication when logging on and off, and on boot up. If you want to use MAR i suggest using the Anyconnect NAM client, there is a new feature in ISE 1.1.1 and the latest client that allows you to perform eap chaining.
Thanks,
Tarik Admani
*Please rate helpful posts*

"access restrictions" did not work sometimes when using 3-tier DeskI.

My customer found that "access restrictions" did not work sometimes when using 3-tier DeskI.
But this issue can be solved by logging on from another machine, or restarting the DeskI.
For I can reproduce this issue, so I just want to know that:
1.What is it probably related to?
2.If this issue happens again, what can I suggest my customer for tracking it?
For example, get some log files from servers etc.
Thanks!

Hi Sarah,
Also you can try the following solution.
1. Import the universe.
2. Go to manage access restrictions
3. Remove the restriction .
4. Again create the rescrition and unchecked the " limit size of result set to"
5. Now assign it to the unlimited results group ( this is the name of
the group we have given to those users who should be able to retrieve
more than X rows)
6. Now we save the universe. (Dont export the universe).
I hope this will help you.
Regards,
Sarbhjeet Kaur

WRT54GS V6 multiple access restrictions

I have setup access restrictions for my kids machine but can only get 1 profile to work.
I would like to have access for then between 6pm and 10pm Monday - Friday and 24 Hrs Saturday & Sunday.
In the profile I have created (that works) is the IP address for my kids machine as well as the MAC address.
Can someone help please.
I can only find help on single policies.
Thanks

Oh, I didn't seem to get it right. You were asking why you can't enable 2 policies at the same time right? (e.g. policy 1 & 2 is selected)
Well, here's the thing, the router will be the one to enable the policy on that specific date. For example, policy 1 is for weekdays and policy 2 is for weekends. Just double-check that the router's time is the same with the pc. The router will be the one to disable policy 1 and enable policy 2 on weekend. When on weekdays it will then disable policy 2 and enable policy 1.
Hope this clears things up!

Could access websites even after access restriction?

Hello!
My employees could open the sites even after I have blocked them through "Linksys Router >> Access Restrictions >> Website Blocking by URL".
I have given the URL for example as - http://www.facebook.com/ and enabled the restriction. Simply, my employees could get other related URL, say for example, https://www.facebook.com/index.php?stype=lo&lh=Ac_Q5kLYJ8vHMkRy" and simply they could browse the site.
This should not happen. Tried many ways to solve it, but hopeless. Could anyone please help.

The only way to prevent this is to setup securities in windows that prevents them from going to a specific website. Go to internet properties and then go to restricted sites. Here you can add in https: and http: this will have to be done on all the windows machines unfortunatly. There are other ways to do this but without knowing your exact network / pc setup it would be fruitless to try to explain.

WRT54G access restrictions

Hi
I've (foolishly perhaps) just updated the firmware of this router and I'm trying to replace the access restrictions.
I am trying to permit continuous internet access for one machine (identified by MAC address) but block facebook from 10.30pm.
The current policy (set from 10.30pm to 11.55pm) allows me to do this but then refuses the machine ANY internet access outside of this time.
Anyone had this problem before?

Thanks for you help with this. Unfortunately there doesn't seem to be a way around the problem. It would appear that I can set a policy to allow internet access and block a URL (in this instance, facebook) but this also establishes the parameters for the time available to access the internet.
An example is as follows:
Allow internet access and block facebook for one machine (identified by MAC adress) from 10:30 to 11:55 (only 5 min blocks of time are available).
This has the effect of the diasallowing ALL internet access at other times. Writing a second policy that states internet access IS permitted has no effect - all other machines on the network are unaffected.
Presumably it's just not possible to achieve what I want which is very frustrating - firmware is v4.30.15. It's simply become an academic challenge now!
Again - thanks for the help. Must sleep now!

WRT610N V2 Access restrictions & https protocol (bug?)

In case this helps anyone else.
I was having problem setting up a simple access restriction. A 'Everyday' time blockage for one particular MAC address.
When I changed the time range and tried to save the change I would lose contact with the router and it would not take effect.
I have the router set to use https. I administer it over wireless using the html interface from Firefox on various WIndows machines.
What seems to be the problem is that I cannot save the settings change in https mode. When I do that I do not get confirmation that the setting was changed and the router changes back to http mode - so continued attempts to reach it on https fail.
Once I get smart enough to change back to http I can access it. I see the change was not saved. The interface still has the https option checked... I have to toggle it off and toggle it back on to re-stablish https operation.
(I am using the current 2010 firmware release)
Solved!
Go to Solution.

Thanks that did it - re-reading your post I perhaps didn't do it quite right - I did the full reset before flashing it but it seems to have worked.
Also I found I did not have the latest firmware - not sure why I missed it before as I definitely checked since the created date - but perhaps it was uploaded later. That resolved a couple of other minor issues I had.
One minor remaining irritation is I think I cannot set an access restriction between 23:55 and 24:00. Assuming it still doesn't allow a Deny time range crossing midnight then the latest end time I can set it to is 11:55 PM (I tried 12:00 AM but it refused to permit an end time prior to the start time).
Hope my son doesn't discover that 5 minute window.

How to set 'colliding' access restrictions in wrt610n - what are rule preferences?

Hello. I want to set up access restrictions to one MAC address (my kid's machine) basing on week days. From Su to Th allow less access time while during Fr-Sa afternoons access time should be longer. The question is how to program it in router. I know I can set rules with "allow" and "disable" keyword, but I don't know rules preference.
When I set (Su-Th 6-21) allowed access time then router automatically denies defined machine internet access outside this time range. The problem is in the power of thus calculated denying time. I want to allow more access time in weekend, so I hoped if I can simply add "Fr-Sa 6-22:30 allowed access time" rule. I hoped that router will regard explicitly set time over inexplicitly set time but it appears it is not so.
Does anyone know the rule of rules? What are their preferences/priorieties, iis it possible to stack more rules affecting one MAC address or it is so simple that the first rule "rulez"? Is it possible to set more than one time rule affecting the one machine?
Solved!
Go to Solution.

Agh! Thanks for your reply, it was good incentive to test the problem little more. Now I'm pretty sure that wrt610n algorithm has problem - it lies with power cuts. In my flat, the last internet user usually turns off power board when goes to sleep. After power is resumed router seemed to work flawlessly yet herein lies the problem and I hope I've found solution.
The tests I have done:
1. 2 rules (as mentioned in my first post). Kid's machine works (this is day now). Didn't played with rules times. Just turned router off. When router was turned on, two other (parents) machine get internet access while kid's machine didn't! Kid's machine was banned from internet against the rules. Router has proper time set - I checked it's status.
2. I turned both rules to "disable access" versions (1. disable access Su-Th 21-23:55; 2. disable access Fr-Sa 22:30-23:55). This rules should work almost the same way (the only problem is, that no rule can expand over midnight, so the third rule should be added, banning access from midnigts to early mornings). The router was switched off. Then on. All three machines now has internet access. I hope, router will ban access in the afternoon automatically, as is set
My deduction. Algorithm bases on time points. When marked time comes, algorithm do, what it should do (but only, if router is powered). When you set "turn internet access on" time (this is "allow rule"), router turns on the access precisely at the chosen moment of time. If router was dead at that time, it doesn't turn the access on however, when power is restored. But when you set "disable rules" in place of "enable rules" I hope it should work and I tested, that this way router gives access after turning it on. Router should disable internet access to the kid's machine at selected time - at least until smart kid does not turn the router off a few seconds before the switch_off time and soon after turn it on But then there is plenty of more powerfull means of control, so I don't worry too much Yet it seems to me, there is a flaw in algorithm, which doesn't run properly after power on.

WRT54G2 and WRT54G locks-up (freezes) when blocking web sites using Access Restrictions

I am convinced that a few Linksys routers such as WRT54G2 and WRT54G have a major issue when blocking web sites using Access Restrictions (Internet Access Policy). After a few hours of internet access by 15 wired users the Linksys locks-up and blocks all internet web access. The only solution is to restart the power on the router.
We are currently using a Linksys WRT54G2 v1 (firmware 1.0.04). We upgraded the WRT54G2 v1 firmware to the latest 1.0.04 version which did not resolve the issue. NOTE: We were previosuly using a a Linksys WRT54G v1.1 (firmware 4.21.1) until the power supply blew a week after we started blocking web sites using Access Restrictions (Internet Access Policy).
Basically, we have a T1 internet connection and a hub connected to the Linksys router. We are trying to block several web sites such as facebook, myspace, etc. for 15 wired users. We do not use wireless connections.
This is the 2nd time it happened with 2 different models.
Please help ASAP.
Thank you,
Lance
(Mod note: Edited post. Some parts off topic.. Thanks!)

Also, you have already upgrade/re-flash the firmware of your Linksys Router you need to reset and reconfigure your router from scratch. Press and hold the reset button for 30 seconds...Release the reset button...Unplug the power cable from your router, wait for 30 seconds and re-connect the power cable...Now re-configure your router...

How to configure CLI/DNIS based access restriction in 5.3 ?

Hi,
does anybody have an idea how the setting
define CLI/DNIS-based access restrictions which is defined in ACS v. 4.2
can be configured in acs 5.3 ?
in v. 4 for every user in a group with 40 members a different CLI is defined for each. How can I configure that in version 5.3 ?
any help as always much appreciated!

The equivalebt to NAR functionality can be found at:
Policy Elements > Session Conditions > Network Conditions > End Station Filters
Can then define an object with a set of CLI values
These objects can then be used in policy conditions. So can create a condition with a set of CLI values and then match in authorization policy for values that are included in this set and set authorizations accoridngly
Not sure if this is your use case but hopefully may be a start

Access restrictions timing off by 1 hour

I don't know if anyone else is experiencing this problem. I have set access restrictions on my WRT610N router and they execute an hour earlier than set.
I checked the time zone settings, the system clock and all seem correct. I have a rule that is supposed to turn off access to the Internet at 11:55pm. However, the rule gets executed at 10:55pm.
This was happening on my first WRT610N which was also dropping network connections. So, I returned that unit and got a replacement.
The new unit does not drop connections but has the same timing problem. The only solution I have found is to change the time zone to the next one that is 1 hour behind my time zone.
Please let me know if anyone else has experienced this same situation.

My ISP is on the same town as I am. The information they are supplying appears to be correct as my WRT54G uses the same information and its rules execute properly.
I think there is a problem with the WRT610N. My solution is temporary I hope that Linksys will fix this problem.

WRTU54G-TM Slow Setup Page and HTML Error on Access Restrictions Page

I have a WRTU54G-TM Wireless Router. It has v1.00.21 firmware and I have done a reset with no solution. Everything seems to work, except the setup pages load very, very, very slow. Also in Internet explorer I get an HTML error on the access restrictions page. Resets don't help. The router did not have this issue until about a month ago that I recall. I can see on the access restrictions page the gray shading is all lined up except at the bottom on the page, like ther is some sort of issue in the html within the router.
One more problem, after I reset the router the saved config file I made would not change the default settings back, I had an older saved config file also, it would not work either.
Is this an issue with this firmware version? Any one else see this?
Message Edited by johnsonle9 on 01-24-2010 01:24 PM
Message Edited by johnsonle9 on 01-24-2010 01:24 PM

Are you getting the same problem with another computer...?
Try using different computer and check if you are getting the same problem or not...If yes then,I would suggest you to re-flash/upgrade the router's firmware,reset the router and re-configure it from scratch..Do not use the save config file.

Access Restrictions bug of firmware 1.01.1 for WRT54G V5 V6

I am using WRT54G V5.
The Access Restrictions function won't work properly when using firmwares 1.01.1 and 1.01.0. Ports can't be blocked by using the "Blocked Services" in this function.
Now I have to switch back to 1.00.9 to make the port blocking work, but there is a DHCP server issue which could only be fixed in 1.01.0 or above.... Could someone fix this BIG BUG and roll out a new firmware????
Thanks a bunch.
Message Edited by Dennis_Hsu on 01-08-200705:02 PM

What is your Fragmentation and RTS threshold value? I'm not sure if I'm reading your message right, but it says as far as I can understand 30. The value should be 2304 instead for both.
Ty changing the wireless channel also to either 1, 6 or 11.

Access restriction error? not sure how to fix it....

I am trying to use JPEGImageEncoder and i imported import com.sun.image.codec.jpeg.*; fine but i get the following error on my code:
CODE:
JPEGImageEncoder encoder =JPEGCodec.createJPEGEncoder(outImage);
ERROR:
Access restriction: The type JPEGImageEncoder is not accessible due to restriction on required library /usr/local/java/jdk1.6.0_07/jre/lib/rt.jar
I am not sure how to fix this... anyone know what needs to be done? I am using eclipse and i see the rt.jar in my library....
thanks!

MikeTheBorg wrote:
OK, I agree it's simpler for simple cases, but how do I do something like this:
          JPEGImageEncoder jie = JPEGCodec.createJPEGEncoder(os);
          JPEGEncodeParam jep = jie.getDefaultJPEGEncodeParam(bi);
          jep.setDensityUnit(JPEGEncodeParam.DENSITY_UNIT_DOTS_INCH);
          jep.setXDensity(1200);
          jep.setYDensity(1200);
          jep.setQuality(1, false);
          jie.setJPEGEncodeParam(jep);
          jie.encode(bi);
using ImageIO?
"Stupid" Eclipse+Maven refuse to compile this legacy code.It's an Eclipse error, not a Java/compiler error as such. To fix it, I believe you have to check your plug-in configuration -- imported packages here or exported packages there. Try adding "com.sun.image.codec.jpeg" to the imported packages. Something along those lines. Anyway, bottom line: this is not an issue with the code.
Furthermore, lookee here: GIAD

WRT160Nv3 problem with blocking traffic using Access Restrictions

Hi.
I want something quite simple. Block Youtube. I go into "Access Restrictions", choose a name for policy 1, enable it, choose the pc from the pc list, but then...
if a click Deny, all other options will be disabled (greyed out, can't click nor write on them).
Therefore, I can't put the urls I want (youtube).
I tried writing the url with "allow" and then change it to "deny" but it will block ALL traffic.
No good.
So, how do I make a new policy just to block this one URL?
Is it normal that when I click and choose "Deny" everything gets disabled afterwards?
Thanks in advance.
Regards,
Leo
Solved!
Go to Solution.

for internet access policy DENY means to restrict internet access during specified days and hours. this will block ALL internet traffic for the said schedule. website blocking by URL, blocking by means of keyword and blocking applications would then be NOT AVAILABLE as the computers would not have internet access to begin with if you have such a policy disabled.
for your case, you may want to try to set restriction to ALLOW internet access then specify youtube.com under Website Blocking by URL. this would allow computers to have access to the internet all the time (if you have the schedule set to EVERYDAY) or during specific days and hours but NOT have access to youtube.

Machine Access Restriction Timeout

Similar Messages

Maybe you are looking for