NAC Guest Server - how to reactivate suspended users
I am wondering if it is possible to reactivate suspended users.
My customer wants to set up guest users for external consultants who are on site for a few weeks every year. He does not want to set up new users every year, instead reactivate the suspended accounts from the year before.
Is there a way to reactive suspended users?
Is this handled differently depending on the Time Profile used?
Start End
From First Login
From Creation
Time Used
Thanks,
Felix
Hi,
I am afraid that is not possible.
As you suspect, that is managed by the time profiles and you have those 4 options you mentioned:
Start End
From First Login
From Creation
Time Used
So once the account reaches the end of the duration that is set by the timeprofile, it is not possible anymore to use it.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.
Similar Messages
-
NAC Guest Server, How to change the password for a single user?
We have a NAC Guest Server which creates a complex password for all new users created.
We would like to have normal/simple password for a single user. How can I get this done on a NAC Guest Server.
Thanks in advance.Hi,
You can setup 3 different flavours of passwords:
http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/g_guestpol.html#wp1063249.
a. Username Policy 1 - Email address as username
Use the guest's email address as the username. If an overlapping account with the same email address exists, a random number is added to the end of the email address to make the username unique. Overlapping accounts are accounts that have the same email address and are valid for an overlapping period of time.
b. Username Policy 2 - Create username based on first and last names
Create a username based on combining the first name and last name of the guest. You can set a Minimum username length for this username from 1 to 20 characters (default is 10). User names shorter than the minimum length are padded up to the minimum specified length with a random number.
c. Username Policy 3 - Create random username
Create a username based upon a random mixture of Alphabetic, Numeric or Other characters. Type the characters to include to generate the random characters and the number to use from each set of characters.
Note: The total length of the username is determined by the total number of characters included.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it. -
NAC Guest Server hiw to delete/remove Guest User
Hi,
we are working with Cisco NAC Guest Server V2.0
Does anybody in the Communitie knows, how to delete/remove a Guest User, who's Account is Suspended or no longer needed in the Guest User Database.
Please let me know.
Sent from Cisco Technical Support iPad Apptx,
hm, can you tell me why, it is in future releases availble?
hajo
Sent from Cisco Technical Support iPad App -
Guest Wireless Users Not Able to Get to NAC Guest Server
First of all, I appreciate any of the help that can be offered on the post. Your solutions and suggestions have been valuable, in the past!
Here's the scenario. I have two internal WLC's, and one anchor mobility server, in the DMZ. The internal controllers are part of the 10.x.x.x range, while the DMZ WLC is in the 192.168.1.x range. We also have a NAC Guest Server, in the DMZ that has a 192.168.1.x address. Here's the problem, when a guest user uses our guest SSID, they're assigned a 172.16.x.x address, their traffic is intercepted, and they're presented with a login page. If they don't have login credentials, there's a "Register Here" link that takes them to the NAC Guest Server to self-register. When they click the "Register Here" link, for some reason they can't get to the NAC guest server. If I bring up a command prompt, and type in "telnet 192.168.1.x 80", it connects. The odd thing is that when I was testing, if I login with guest credentials, and then try to go to the NAC Guest Server self-service page, I can get to it with no problem. Would anyone have any ideas as to why?I may have missed something here, but isn't the point of the guest portal that you can't get anywhere on the network (except the guest portal) until you have authenticated?
-
NAC guest server-user poster assesment problem
Dear all,
Please assist me for NAC guest server poster assesment issue.
Scenario is like we have NAC guest server and all wireless guest users authenticate through Guest Server.
Its working fine.
But customer wants to apply poster assement on guest users through existing CAS and CAM.
Guest_users-------AP-------WLC------- NAC_Guest_Server----------internetThanks for reply.
Actually in my network we have cas and cam integrate with WLC for internal users. Its working fine.No issue. Poster assesment and authentication working fine.
We have also NGS server which is integrate with WLC for web authentication fow guest wireless users.
It is also working fine.Authentication happened through NGS server succesfully.
But now I wanted to force poster assesment for wireless guest users which are authenticated through NGS server. -
Cisco NAC Guest Server for Wireless Users integration with IP telephony
Hi Team
I have a client who has the following requirement. The cleint requires a Guest server inorder to serve wireless needs for guests at their office. They want the guest to get their authentication codes via SMS. The cleint will have a lobby IP Phone where the guest will press the services button confgiured on the IP Phone. IT will then prompt the guest to enter his mobile number. Once the guest enters his mobile number, the guest will recieve a text via sms gateway with login credentials. They want to offload this from the receptionist and it is for this reason that they require this functionality.
Has anyone done this sort of deployment ? We have already proposed NAC guest server and Wireless controller but we do not know whether the XML application for subscribing the service on the IP Phone is available directly with cisco or does it need to developed.
Kindly advice on the same.
Regards
AzeemHi Vishal,
Please note that if you want to return ACLs (and usually in wired web auth you need to), you will have to integrate with ACS as NGS itself cannot return ACLs in the reply radius attributes.
Basically the process is as follows:
1 - Client plugs cable on switch.
2 - Web auth is triggered on the port.
3 - default ACL permiting only DNS and DHCP is applyed so that the client PC can obtain IP address and open a browser.
4 - Client will be redirected to the NGS hotspot login page.
5 - Client will enter credentials.
6 - Client broswer will send an HTTP POST packet containing the credentials.
7 - The switch will intercept the POS packets and retrieve the credentials entered.
8 - The switch will send Radius Access-Request to the ACS.
9 - The ACS will use the NGS as External Identity source to authenticate the client.
10 - The NGS will reply with Radius Access-Accept to the ACS and the ACS will reply to the switch including the ACL in the Access-Accept.
11 - the Switch authorizes the client on the port and applies the ACL it received from the ACS.
Please follow the document Nicolas posted as it is a good one.
HTH,
Thanks -
Wired WebAuth only with NAC Guest Server (No ACS)
Ok, I have been fighting this for two days now. I want to use the webauth function on some of our Cisco 3750Gs ver
12.2(55)SE5 for guest access. I'm trying to use our NAC Guest Server ver: 2.0.3 as the backend portal and Radius server. We do not have ACS or any of the other components of ISE or NAC. I think the issue is the NGS server is not sending the d(ACL) back to switch. Guest work work fine from our WLCs.
switch debug: No Attributes in swtich debug
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Config NAS IP: 199.46.201.26
Mar 22 12:56:00.448 CDT: RADIUS/ENCODE(0000030C): acct_session_id: 1012
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): sending
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Send Access-Request to 10.199.33.20:1812 id 1645/19, len 177
Mar 22 12:56:00.448 CDT: RADIUS: authenticator 99 95 59 55 09 A9 D9 E1 - 2B 01 90 36 1B 8A 41 92
Mar 22 12:56:00.448 CDT: RADIUS: User-Name [1] 20 "[email protected]"
Mar 22 12:56:00.448 CDT: RADIUS: User-Password [2] 18 *
Mar 22 12:56:00.448 CDT: RADIUS: Framed-IP-Address [8] 6 199.46.201.231
Mar 22 12:56:00.448 CDT: RADIUS: Service-Type [6] 6 Outbound [5]
Mar 22 12:56:00.448 CDT: RADIUS: Message-Authenticato[80] 18
Mar 22 12:56:00.448 CDT: RADIUS: A2 57 B5 F2 A6 FB 46 71 D0 EA 26 54 95 90 F4 D0 [ WFq&T]
Mar 22 12:56:00.448 CDT: RADIUS: Vendor, Cisco [26] 49
Mar 22 12:56:00.448 CDT: RADIUS: Cisco AVpair [1] 43 "audit-session-id=C72EC91A000002FC0A6CD698"
Mar 22 12:56:00.448 CDT: RADIUS: NAS-Port-Type [61] 6 Ethernet [15]
Mar 22 12:56:00.448 CDT: RADIUS: NAS-Port [5] 6 50106
Mar 22 12:56:00.448 CDT: RADIUS: NAS-Port-Id [87] 22 "GigabitEthernet1/0/6"
Mar 22 12:56:00.448 CDT: RADIUS: NAS-IP-Address [4] 6 199.46.201.26
Mar 22 12:56:00.448 CDT: RADIUS(0000030C): Started 5 sec timeout
Mar 22 12:56:01.454 CDT: RADIUS: Received from id 1645/19 10.199.33.20:1812, Access-Reject, len 20
Mar 22 12:56:01.454 CDT: RADIUS: authenticator 92 98 05 84 6E 4B CF DD - B5 D7 90 25 10 59 7B E7
Mar 22 12:56:01.454 CDT: RADIUS(0000030C): Received from id 1645/19
NGS log:
rad_recv: Access-Request packet from host 199.46.201.26 port 1645, id=19, length=177
User-Name = "[email protected]"
User-Password = "5rRmpPt9"
Framed-IP-Address = 199.46.201.231
Service-Type = Outbound-User
Message-Authenticator = 0xa257b5f2a6fb4671d0ea26549590f4d0
Cisco-AVPair = "audit-session-id=C72EC91A000002FC0A6CD698"
NAS-Port-Type = Ethernet
NAS-Port = 50106
NAS-Port-Id = "GigabitEthernet1/0/6"
NAS-IP-Address = 199.46.201.26
+- entering group authorize {...}
[radius-user-auth] expand: %{User-Name} -> [email protected]
[radius-user-auth] expand: %{User-Password} -> 5rRmpPt9
[radius-user-auth] expand: %{NAS-IP-Address} -> 199.46.201.26
[radius-user-auth] expand: %{Calling-Station-Id} ->
Exec-Program output: Note: no attributes here
Exec-Program: returned: 1
++[radius-user-auth] returns reject
Delaying reject of request 12 for 1 seconds
Going to the next request
Waking up in 0.6 seconds.
Similar debug from NGS but auth request from WLC: See attributes are sent to wlc although not needed
rad_recv: Access-Request packet from host 10.100.16.100 port 32770, id=22, length=152
User-Name = "[email protected]"
User-Password = "5rRmpPt9"
Service-Type = Login-User
NAS-IP-Address = 10.100.16.100
NAS-Port = 13
NAS-Identifier = "ICTWLC01"
NAS-Port-Type = Ethernet
Airespace-Wlan-Id = 514
Calling-Station-Id = "10.198.12.211"
Called-Station-Id = "10.100.16.100"
Message-Authenticator = 0xc9383e767f0c228a2b8a0ece7069f366
+- entering group authorize {...}
[radius-user-auth] expand: %{User-Name} -> [email protected]
[radius-user-auth] expand: %{User-Password} -> 5rRmpPt9
[radius-user-auth] expand: %{NAS-IP-Address} -> 10.100.16.100
[radius-user-auth] expand: %{Calling-Station-Id} -> 10.198.12.211
Exec-Program output: Session-Timeout := 20002004, cisco-AVPair += priv-lvl=15, cisco-AVPair += auth-proxy:proxyacl#1=permit ip any any
Exec-Program-Wait: plaintext: Session-Timeout := 20002004, cisco-AVPair += priv-lvl=15, cisco-AVPair += auth-proxy:proxyacl#1=permit ip any any
Exec-Program: returned: 0
++[radius-user-auth] returns ok
[files] users: Matched entry DEFAULT at line 1
++[files] returns ok
Found Auth-Type = Accept
Auth-Type = Accept, accepting the user
+- entering group post-auth {...}
[sql] expand: %{User-Name} -> [email protected]
[sql] sql_set_user escaped user --> '[email protected]'
[sql] expand: %{User-Password} -> 5rRmpPt9
[sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('[email protected]', '5rRmpPt9', 'Access-Accept', NOW())
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('[email protected]', '5rRmpPt9', 'Access-Accept', NOW())
rlm_sql (sql): Reserving sql socket id: 12
rlm_sql_postgresql: Status: PGRES_COMMAND_OK
rlm_sql_postgresql: query affected rows = 1
rlm_sql (sql): Released sql socket id: 12
++[sql] returns ok
Sending Access-Accept of id 22 to 10.100.16.100 port 32770
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Accounting-Request packet from host 10.100.16.100 port 32770, id=30, length=170
config:
aaa new-model
aaa authentication login default group radius
aaa authentication login console group tacacs+ line
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization exec default group tacacs+ none
aaa authorization auth-proxy default group radius
aaa accounting auth-proxy default start-stop group radius
aaa accounting exec default stop-only group tacacs+
aaa accounting commands 15 default stop-only group tacacs+
ip device tracking
ip auth-proxy auth-proxy-banner http ^C HawkerBeechcraft Guest Network ^C
ip auth-proxy proxy http login expired page file flash:expired.html
ip auth-proxy proxy http login page file flash:login.html
ip auth-proxy proxy http success page file flash:success.html
ip auth-proxy proxy http failure page file flash:failed.html
ip admission auth-proxy-banner http ^C HawkerBeechcraft Guest Network ^C
ip admission proxy http login expired page file flash:expired.html
ip admission proxy http login page file flash:login.html
ip admission proxy http success page file flash:success.html
ip admission proxy http failure page file flash:failed.html
ip admission name web-auth-guest proxy http inactivity-time 60
dot1x system-auth-control
identity policy FAILOPEN
access-group PERMIT
interface GigabitEthernet1/0/6
switchport access vlan 301
switchport mode access
ip access-group pre-webauth-guest in
no logging event link-status
srr-queue bandwidth share 10 10 60 20
queue-set 2
priority-queue out
mls qos trust device cisco-phone
mls qos trust dscp
no snmp trap link-status
auto qos voip cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input AutoQoS-Police-CiscoPhone
ip admission web-auth-guest
ip http server
ip http secure-server
ip access-list extended PERMIT
permit ip any any
ip access-list extended pre-webauth-guest
permit udp any any eq bootps
permit udp any any eq domain
permit tcp any host 10.199.33.20 eq 8443
permit tcp any host 10.199.33.21 eq 8443
permit tcp any host 10.100.255.90 eq 8443
deny ip any any log
ip radius source-interface Vlan301
radius-server attribute 8 include-in-access-req
radius-server dead-criteria tries 2
radius-server host 10.199.33.20 auth-port 1812 acct-port 1813 key 7 022E5C782C130A74586F1C0D0D
radius-server vsa send authentication
I get the login and AUP page then the failed page... I never see the priv-lvl 15 or the proxyacl? How do I do this with Guest server only?
Help!Without the ACS, only with the NAC guest is possible?
They can send me sample configuration? -
NAC Guest Server and WLC, WCS
I have setup a NAC Guest Server to allow users to sign up guest account via Active Directory. How do I tight this into WLC or WCS?
Hi
Try this:
http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a00809d6b9a.shtml
Regards
Greg -
Has anybody implemented NAC guest server in conjunction with SMS tokens.
Is there some docs. on how to?The following APIs allow administrators to create, delete, and view local user accounts on the CAM:
â¢getlocaluserlist
â¢addlocaluser
â¢deletelocaluser
Local users are those internally validated by the CAM as opposed to an external authentication server. These APIs are intended to support guest access for dynamic token user access generation, providing the ability to:
â¢Use a webpage to access Cisco NAC Appliance API to insert a visitor username/password combination, such as [email protected]/jdoe112805, and then assign a role, such as guest1day.
â¢Delete all guest users associated with the guest access role for that day.
â¢List all usernames associated with the guest access role.
These APIs support most implementations of guest user access dynamic token/password generation and allow the removal of those users for a guest role.
You must create the front-end generation password/token. For accounting purposes, Cisco NAC Appliance provides RADIUS accounting functionality only.
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_apiapx.html#wp1012025 -
Dear All,
I just need to confirm that is it possible that we add same WLC to CAS(wireless users) and NAC Guest Server(wireless guest users) or I must need one more WLC for NAC guest server.
Regards,Hello Nomair
You do not need seperate WLC's.. NAC guest servers are just normal radius servers, used for authentication. You can integrate your existing WLC's, which are added on IB or OOB to your CAS, with the guest server. I'm attaching a doc which gives info on how to setup wlc's and guest servers.
Hope this helps.. all the best.. happy new year to you. rate replies if found useful..
Raj -
NAC Guest Server SMTP Authentication
Does anyone know if you are able to set your SMTP server in the NAC Guest Server to do SMTP Authentication? Our old Exchange server just let us specify the SMTP server and send the guest accounts their Username and Password to their outside accounts. Our new Exchange server requires SMTP authentication, but we do not see the option available in the NAC Guest Server interface. We are running NAC Guest Server 1.1.3. Any ideas would be appreciated. Thanks!
I have Cisco NAC Guester server 2.0.2 and have sort of similar issues.
I configured the Base DN to the OU of the sponsor groups in AD and then map that particular group in roles. Users from that group can log on fine and create guest accounts.
The problem is, it seems that other users from that OU seems to be able to log on as sponsors too. How do I restrcit this to just that sponsore group? I tried changing the Base DN to the OU of the sponsore group then enter CN=sponsorgroup to narrow it to just that group but still other users can log in as sponsors. -
NAC guest server in a Intranet iframe
Does anybody have tips on how to integrate the NAC guest server sponsor login into a Intranet page.
Maybe even get the active directory credentials from the intranet page login?
One method could be a iframe, but again have anybody done this in a clever way?
Best regards,
Steffen LindemannThe same server cannot be used in Inband and OOB at the same time. In OOB, you have an auth vlan to which all users are initially moved to.In this auth vlan, the user traffic will hit the NAC Server. You can configure the ACLs on the Unauthenticated role such that guest access is provided in the unauth role itself. The guest users wont have to authenticate or go through posture. They will have guest access in the auth vlan. Hence a user connects to a switchport and will get moved to the auth vlan. In the auth vlan, the guest users will have guest access already. Other users can go ahead and authenticate and then get moved to an access vlan for intranet access.
-
NAC Guest Server and Multiple Guest SSID's/Splashpages
Hi All,
If I have multiple guest SSID's on a single controller and I use NGS as the Radius. How do I configure NGS to "send" the clients to differnet login pages corresponding to the SSID they came from.
I can configure different splash pages in HotSpots section but how do I map the different SSID's from the controller to the different splash pages. Then I guess that raises the question when I generate guest users on NGS is it possile to only allow them associate to a specific SSID.
TIA,
Eoin.Hi Nicolas,
Thanks for the reply. I can see that config on the WLC and have used it before where there is only a single guest SSID. What I dont know is if the NAC Guest server sees radius requests coming from different guest SSID's on the same WLC. How does the NAC Guest server apply the correct guest policy to that user. And when sponsors genereate guest accounts how do they specific which policy is to be applied to that guest so it can only get access to a specfic guest network/SSID I'm not sure where the "mapping" of accounts/splash pages/policies takes place on the NAC guest server. I've only ever set up NAC Guest when there has been a single guest SSID.
Regards,
Eoin. -
NAC Guest Server - Self Service
Hello all,
I have a problem with NAC Guest Server and the self service feature.
When I use the self service feature with auto login it works fine.
But the customer would like to disable the auto login feature and the guest has to fill in his username /password.
These credentials will created by the NAC
When I click "add user", there is the message: user successful created.
but I don't have the possibilty to reach the login page with username/password with my browser.
But There is no redirect to the login page with username/password and when I refresh the browser or restat my browser, I will always reach the "self service" page.
I hope someone had a similar problem and can help.
thanks
Martinhave you allowed pop-ups on the browsers?
did you try switching the browser?
Regards
F.H -
Just wanted to know if this will work or not...
I was looking at a design from a client and they had two CAM and CAS plus a Guest server. My client wants to use the equipment above for guest access. The problem I'm having is that I'm building a wireless network with guest anchor WLC's in the DMZ. So my wireless users will be tunneled to the DMZ controller. Also, the WLC can have a splash page uploaded to it and also authenticate users locally in the DB. They don't want any remediation, just authentication.... is this a waste of money or would would actually implement this?I've some (very) basic questions.
Let's say guest vlan = x
1)vlan x should be created on the foreign controllers as on the anchor controller, with the same properties
2)on the anchor controller a dynamic interface has to be created acting as default gateway for the guest clients.
3)it's advised to place the guest server in the guest vlan? Eg. Somewhere in the server farm?
4)Once traffic coming from the guests is arrived at the anchor controller. (I know to less of WLC ;)) Will it forwarded with as source IP, the IP of the anchor controller towards the anchor default gateway (firewall or internet router?)
4)authentication: user connect to SSID guest and opens a browser. The user is redirected and a login page is displayed. Is this page downloaded from the anchor controller? I think it is and pushed via WCS. So Guest NAC server has nothing to deal with this page? Correct?
The anchor controller polls the nac guest server with the given credentials. Anchor controller forwards the credentials to the NAC guest server. The NGS replies with authenticated or not. If authenticated. The guest can browse. Probably on regular base, the anchor controller will poll the NAC guest in order to check if he's still authenticated and if enabled pass information to the NAC guest for accounting. Is this somehow ok?
I've found to open the following ports in the firewall:
UDP 97 for EoIP
UDP 16666 for intercontroller traffic
and 1812/1813 for Radius.
Thanks in advance
Maybe you are looking for
-
Urgent: Problem starting manually created SID !
Hello everybody. I've just installed Ora 8i (8.1.6) PE on Windows 98. I'm trying to create a SID using the ORADIM tool and then start it. The creation (command ORADIM -NEW) was OK, but when starting with the following command: oradim -startup -sid or
-
Does ipad have bluetooth to be able to connect iphone internet to the ipad?
does ipad have bluetooth that will allow the iphone's internet to be used by the ipad?
-
SQL Server Express 2008 - 1617 versus 1600
Hello, My SQL Server Express 2008 R2 version is 10.50.1617.0. Two of my instances (SQLEXPRESS and SQLEXPRESS2) are also version 10.50.1617.0. However, when I install a new instance, the version is 10.50.1600.0 (SQLEXPRESS3). How can I install a new i
-
Can I make links to elements inside a component edge?? as if they are anchors
I have a menu on dreamweaver with HTML and a component edge, and I want to link to elements (one,two,three,four) inside to component edge it is possible?
-
8.02 POA crashes w/ntdll.dll fault after power loss
Hi, Running GW 8.0.2 on Windows 2003 server (POA, MTA and GWIA). After power loss on Friday, POA will not stay up for long - crashes with: "Faulting application gwpoa.exe, version 8.0.2.10840, faulting module ntdll.dll version 5.2.3790.4455" error. M