NAC Integrated with Guest Server

Hi all,
I encountered a problem which happened when I integrated NAC with Guest Server.
Hope I can find solution here!
When I create an account in Guest Server, the account will also be created in NAC as local user.
If I chose "Time Profile - Start-End", the account will be created in NAC.
But if I chose "Time Profile - from First Login", the account will not be created in NAC.
So the guest can't login with this account using "Time Profile - from First Login".
All the configuration in the document including "Radius Client and Accounting" was correctly configured.
But I still can't find the solution.
Please answer me if you know the answer. Thanks a lot!!!!
Jet Li
Taiwan SI

Hi Jet Li,
This should be expected since only time profiles with start-end are supported when integrating NGS with the NAC Appliance solution:
http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/g_guestpol.html#wp1063409
"Cisco NAC Guest Server Version 2.0 supports only start/end and from creation profiles when used with Cisco NAC Appliances"
Regards,
Fede
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Similar Messages

AD RMS 2012 integration with exchange server 2013

AD RMS 2012 integration with exchange server 2013
I would like to have a knowledge About this Topic
1.what is differrent if we use internal SSL certificate with Public Certificate and in this case i would like to use Mobile Phone I eed to import Root Certificate ?
2.Do I have problem? If I start to install AD RMS 2012 with SQL EXpress after that I want to chage it to SQL Server ?
3.when I use SQL Expres what I can do after Disk is full (10 GB)?
4.If AD RMS is down It will affect with email that it is already sent ?
5. Which Edition of outlook can produce IRM protected documents
6. To Use AD RMS Server 2012 through OWA, Outlook and Moblie Phone ,a CAL is required or not ?

Could you post the list of sites:
appcmd list site
The ones listening on port 80:
appcmd list site /bindings:http/*:80:
And on port 443:
appcmd list site /bindings:https/*:443:
Step by Step Screencasts and Video Tutorials

WLC not integrating with Radius Server

Hello world,
I have the following situation:
One WLC 2000 Series (software version 7.0.230.0) with multiple SSID`s, one is with 802.1x integrated with a Radius Server.
Everything worked fine until fiew days ago, when users were unable to logon via they`re certificates on Windows XP.
The infrastracture didn`t suffer modifications.
What i have checked: Radius certification isn`t expired, client certification isn`t expired, the password between controller and Radius is correct.
There are no ACL`s between the WLC and the remote Server. I can ping the devices, other SSIDs on the same controller (wpa/psk) are working correct.
The AP`s are 1242.
I have tried deleting the SSID, configure it back. The OS on Windows Server is 2003 Standard. The AP`s are configured H-Reap.
I have increased the Server Timeout from Radius Authentication Servers from 2 to 30 sec.
The message logs recived on WLC Trap Logs:
RADIUS server X.X.X.X:1812 failed to respond to request (ID 161) for client xx.xx.xx.xx.xx.xx/ user 'unknown'
The message from the debug dot1x aaa enable:
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_CALLING_STATION_ID(31) index=1
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_CALLED_STATION_ID(30) index=2
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_NAS_PORT(5) index=3
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_INT_CISCO_AUDIT_SESSION_ID(7) index=4
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_NAS_IP_ADDRESS(4) index=5
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_NAS_IDENTIFIER(32) index=6
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_VAP_ID(1) index=7
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_SERVICE_TYPE(6) index=8
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_FRAMED_MTU(12) index=9
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_NAS_PORT_TYPE(61) index=10
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_EAP_MESSAGE(79) index=11
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_RAD_STATE(24) index=12
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Adding AAA_ATT_MESS_AUTH(80) index=13
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df AAA EAP Packet created request = 0x1cff348c.. !!!!
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df Sending EAP Attribute (code=2, length=6, id=10) for mobile xx.xx.xx.xx.xx.xx.
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00000000: 02 0a 00 06 0d 00 ......
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.318: 00:15:e9:33:75:df [BE-req] Sending auth request to 'RADIUS' (proto 0x140001)
*radiusTransportThread: Mar 06 09:37:07.328: 00:15:e9:33:75:df [BE-resp] AAA response 'Interim Response'
*radiusTransportThread: Mar 06 09:37:07.328: 00:15:e9:33:75:df [BE-resp] Returning AAA response
*radiusTransportThread: Mar 06 09:37:07.328: 00:15:e9:33:75:df AAA Message 'Interim Response' received for mobile xx.xx.xx.xx.xx.xx.
*Dot1x_NW_MsgTask_7: Mar 06 09:37:07.329: 00:15:e9:33:75:df Skipping AVP (0/27) for mobile xx.xx.xx.xx.xx.xx.
The messages on Windows 2003 Standard:
User Y was denied access.
Fully-Qualified-User-Name = xx.domain.com/Users_T/user
NAS-IP-Address = X.X>X.X
NAS-Identifier = Cisco_
Called-Station-Identifier = ---------------------
Calling-Station-Identifier = ---------------------
Client-Friendly-Name = ---------------------
Client-IP-Address = ---------------------
NAS-Port-Type = Wireless - IEEE 802.11
NAS-Port = 1
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Wireless Policy
Authentication-Type = EAP
EAP-Type = Smart Card or other certificate
Reason-Code = 262
Reason = The supplied message is incomplete. The signature was not verified.User Y was denied access.
Fully-Qualified-User-Name = xx.domain.com/Users_T/user
NAS-IP-Address = X.X>X.X
NAS-Identifier = Cisco_
Called-Station-Identifier = ---------------------
Calling-Station-Identifier = ---------------------
Client-Friendly-Name = ---------------------
Client-IP-Address = ---------------------
NAS-Port-Type = Wireless - IEEE 802.11
NAS-Port = 1
Proxy-Policy-Name = Use Windows authentication for all users
Authentication-Provider = Windows
Authentication-Server = <undetermined>
Policy-Name = Wireless Policy
Authentication-Type = EAP
EAP-Type = Smart Card or other certificate
Reason-Code = 262
Reason = The supplied message is incomplete. The signature was not verified.
Can anyone help why i cannot log the users via 802.1x ?

Okay that is good..... this is what I would do next. I would create a test ssid that uses PEAP MSchapv2 and create a new policy in IAS that is basic. Allow 802.1x wireless and user group only and see if you can reconfigure one of the XP machines for PEAP. Can you also post a screen shot of your polices (connection and network) so we can review it.

Portal integration with Exchange server 2003 issues.

Hello,
We are using NW04s EP 7.0 SP16 and Exchange server 2003. We are trying to perform OWA and Groupware integration. Both the servers are in the same domain.
I have followed all the steps in the notes and documents available there in SDN. There are few issues:
1) The latest KerbMap filter has been configured in Exchange backend server. SAP note 785343 says that the exchange frontend server needs to be configured for anonymous authentication to enable pass-through authentication. But doing this breaks the form based authentication in exchange server, and it also poses security risk when the backend exchange server is behind the firewall. How do we enable pass-through authentication so that the exchange frontend passes the mysapsso2 cookie to the exchange backend server?
2) When I try to create an appointment or try to view the appointments, it gives an error message saying " No logon data found for system Exchange". The Exchange system has been configured for SAP Logon Ticket, and the user mapping fields were left empty. Why should it prompt for user mapping when the logon method is "SAP Logon Ticket"?
There are many documents out there, but none is the latest with clear steps. Can anyone point me in the right direction please?
Thanks,
~Yasin

As far as I remember, when Exchange 2003 is installed on a Domain Controller, it uses the local DC as a GC. You need to set back the 2003 DC as GC and restart it.
I believe, you are aware that demoting/promoting a DC with Exchange server on it is not supported by MS. The best approach is to:
Introduce an Exchange 2010 member server
Move all resources from Exchange 2003 to Exchange 2010
Decommission Exchange 2003
Demote the 2003 DC
Step by Step Screencasts and Video Tutorials

WebGate 10.1.4.3 integration with IIS server

Need help with OAM WebGate on IIS 7
WebGate version is 10.1.4.3 and according to docs it is compatible with IIS 7. IIS is running on x64 windows- in 32 bit mode.
However, I am running into issues with the webgate integration with ISAPI (the plugin).
The installation has gone fine, however, the webgate does not seem to be integrated with the ISAPI plugin.
The protected url is not being protected.
The following post refers that with IIS7 and webgate 10.1.4.3 - one has to manually configure the WebServer. ie during installation of the webgate, it asks whether you want to do it manually or let the install program do it automatically for you. This post says that one has to do this manually. Here is the reference
OAM WebGate 10g for IIS 7
Has anyone noticed this behavior?
How to check in the IIS server or local webgate install that the webserver is integrated with webgate?

You can see list of ISAPI filters in IIS Manager -> Connections Pane (at root or specific web site) -> ISAPI filters
In the list you should see oam webgate dll in isapi filter section.
http://www.iis.net/configreference/system.webserver/isapifilters
Also to verify if webgate has been enabled on iis server , you can hit http(s)://web site/obrar.cgi .. This is a special webgate url and if you hit this directly webgate would correctly respond back with error message (Oracle Access Manager operation error).
Did you create policies in OAM to protect specific urls ? If not then you should create policy.

DPS integration with InDesign Server

Is there a way to integrate DPS functionality (create, upload, share folios) with InDesign Server, e.g. through the scripting API?
Suppose I have an automated InDesign workflow and I want to publish the result to acrobat.com. Is this possible? Is this planned for a future version?
I found a reference to the "Folio Producer SDK" in the DPS buying guide but could find any other information about this at all...
Thanks

AFAIK DSP has part of the production workflow NOT inside InDesign, so also InDesign Server alone can not be used to produce a digital magazine automatically. So its not about blocking, but having a better integration of the different parts into basic InDesign.
Whether this will happen in the near or medium to far future (CS6, CS7...) we all don't know, but if they were integrated they possibly would be available in InDesign Server API/SDK too, as the code base is pretty much the same (except for the whole Java interfacing).
IMHO InDesign will NEVER integrate all these production steps, as DPS is a lot about multimedia production workflow. A workflow system aka Woodwing for instance therefore is a wise solution to look at. Especially, as you can start at as low as €169 monthly with Enterprise 7 for DPS integration (in the near future with Enterprise 7.5).

SCOM 2012 R2 Integration with Lync Server 2013

Hi,
I am trying to configure SCOM 2012 R2 to work with Lync server 2013 standard edition. I have successfully installed and tested Lync Server 2013. But the problem is, I never worked on SCOM application before and I can not find any easy documents online. So
could you please help me and suggest any step by step guide for the same purpose!
BR,
Ajit

Hi,
Glad to hear that you have solved the issue. For the second question, what did you want to do with the Windows Server (anything to do with Lync Server)? As it is another question, you can also post another case on Technet forum and more engineers will help
you solve the issue.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Discuss Advanced Integration with InDesign Server

This is a topic that will be presented at the May 11th-15th Creative Suite Developer Summit. Use this thread to discuss the presentation.

AFAIK DSP has part of the production workflow NOT inside InDesign, so also InDesign Server alone can not be used to produce a digital magazine automatically. So its not about blocking, but having a better integration of the different parts into basic InDesign.
Whether this will happen in the near or medium to far future (CS6, CS7...) we all don't know, but if they were integrated they possibly would be available in InDesign Server API/SDK too, as the code base is pretty much the same (except for the whole Java interfacing).
IMHO InDesign will NEVER integrate all these production steps, as DPS is a lot about multimedia production workflow. A workflow system aka Woodwing for instance therefore is a wise solution to look at. Especially, as you can start at as low as €169 monthly with Enterprise 7 for DPS integration (in the near future with Enterprise 7.5).

NAC integration with WLC

Any doc on implementing inband wireless with NAC?
Lets say 2 SSIDs. 1 staff that has 30 networks based on 30 locations and 1 guest network for all locations. The Controller is trunked to the switch. How do u force the traffic to go to CAS?
Thanks in advance!

In-Band Virtual Gateway is the recommended configuration. What you have in the link is In-Band Real IP. You can use either one... with real ip you will need static routes. In IN-Band virtual gateway, the NAC will bridge the traffic from the untrusted to the trusted.
Basically the ssid is mapped to a vlan like 50 and that is passed onto a dot1q trunk to the switch. Vlan 50 is not routed and the only other port on vlan 50 is the untrusted port on the CAS. The CAS then bridges that to... lets say vlan 51 which is routed on the network.
Every time I have to deploy one of these, it still confuses me somewhat... So hope this doesn't confuse you.

Cisco UCM 8.5.1 integrated with ARC server 5.1 for console services-configuration of ARC secondary subscriber

We have a setup wherein we have integrated ARC server for exchange console services to the call manager.In our cluster CTI Manager services are running on two subscribers-one of them is a primary and the other is secondary.Similary , we have ARC server installed on a primary server and a secondary server.ARC Server uses TAPI and CISCO TSP to integrae with the call manager.In the secondary ARC server, when we go to to ARC aConnect admionistration- console connect-Queue location we see the the same queue location numbers as configured in primary ARC server.When we try to change the queue location numbers, it fails to update ,throws up a pop up which says"Queue location cannot be pointed to a routing device.Kindly select a different number".Could you suggest where the conflict might have been occuring and how can we update the queue location numbers in ARC secondary server?Could you also please explain how the CISCO TSP and TAPI function together?

Thanks a lot Brad,
All is working, just a couple of question, i'm also using voice recognition, it works but it doens't has the
play external messages option, is there any specific i have to set or say?
The touchtone command in my classic conversation is not 7 but i have to execute a little procedure following the
menu, somenthing like 0 --> 9 --> 1 ---> 7 ( external message option ) --> 1
Is there any way to change or abbreviate this ?
Thanks again
Michele

Calendar Integration with Portal Server 6.0

Hi,
I have installed Calender Server 5.1.1 with portal server6.0..When click the Launch Calendar channel link in my portal page,it takes me to login page for Calendar Server on.I expected it to take me to the calendar page .I donot want to re-authenticate every time i launch a calendar.Any ideas??
Thanks,
Ramnath

Quickest path to success...
stop the cal server
cd to Install Path/cal/bin/config
edit ics.conf
change "service.htttp.ipsecurity" from yes to no
save you changes
restart the server
hope this helps

Crystal reports integration with sql server and visual studio 2010

when I am trying to open a crystal report through code ( visual basic 2010 ) I get the error
the report has no tables
I am using SQL SERVER 2008 R2
HERE IS THE CODE I WROTE
Imports System.Data
Imports System.Data.OleDb
Imports CrystalDecisions.CrystalReports.Engine
Imports CrystalDecisions.Windows.Forms
Imports CrystalDecisions.Shared
Public Class frmRep
    Dim objConnection As New OleDbConnection("Provider=SQLOLEDB;Data Source=ASHRAF-PC\SQLEXPRESS;Integrated Security=SSPI;Initial Catalog=TEST")
    Dim objDataAdapter As New OleDbDataAdapter()
    Dim objDataSet As New DataSet()
    Private Sub CrystalReportViewer1_Load(sender As System.Object, e As System.EventArgs) Handles CrystalReportViewer1.Load
    End Sub
    Private Sub frmRep_Load(sender As Object, e As System.EventArgs) Handles Me.Load
        Dim cr As New ReportDocument
        objDataAdapter.SelectCommand = New OleDbCommand()
        objDataAdapter.SelectCommand.Connection = objConnection
        objDataAdapter.SelectCommand.CommandType = CommandType.Text
        objDataAdapter.SelectCommand.CommandText = "select * from bands"
        objConnection.Open()
        objDataAdapter.Fill(objDataSet, "bands")
        objConnection.Close()
        cr.Load("D:\MY VB 2010 PROJECTS\test2\test2\CrystalReport1.rpt")
        cr.SetDataSource(objDataSet.Tables("bands"))
        CrystalReportViewer1.ReportSource = cr
        CrystalReportViewer1.Refresh()
    End Sub
End Class

I suggest you post that question in a Crystal Reports forum.
Markus

UCCX 8.0 database integration with SQL Server 2005 Express

Dear Support Community,
I need to set up a script to read SQL Server 2005 Express records.
The SQL Server 2005 Express is compatible with the UCCX 8.0?
Let me know if you need more information

Nope, SQL Express is not supported. Please refer the comp matrix here http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/crs/express_compatibility/matrix/crscomtx.pdf
Supported Enterprise DBs with UCCX 8.0 are
Oracle 10g R2, Oracle 10g XE
Sybase Adaptive Server 12
IBM DB2 8.2
MS SQL Server 2000
MS SQL Server 2005
MS SQL Server 2008
HTH
GP.
Pls rate helpful posts !!

Integration with Weblogic Server 10.3.x

Hello!
When I use mod_oc4j in OAS 10.1.2., then I can use the directive Oc4jMount configured OHS. If you use this directive html-code that is returned to the client will contain only the URL that hosts the portal. Get some opaque proxy (much like mod_rewrite's [P] flag).
Use mod_proxy, or mod_rewrite did not succeed - in html-code returned to the client portal to prescribe direct links to portlets.
My problem is that Oc4jMount can use ajp13, and my server with portlets (Weblogic) gives information via http.
Is there a way to mount http-resource in Oracle Application Server Portal 10.1.2?
Is this possible to use portal based on Oracle Application Server Portal 10.1.2 and portlets for this portal deployed on Weblogic 10.3.x ?
Thx for any information.

I've been trying to get this to work... No luck as of yet...
My problem now is that I get this exception when I don't have pitchfork-1.0-m5.jar on the my domains classpath.
<30.mar.2009 kl 17.37 CEST> <Warning> <Deployer> <BEA-149078> <Stack trace for message 149004
java.lang.ClassNotFoundException: org.springframework.jee.spi.PitchforkUtilsImpl
at java.net.URLClassLoader$1.run(URLClassLoader.java:200)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:276)
Truncated. see log file for complete stacktrace
However if I put it on wls calsspath I get a AbstractMethodError:
<30.mar.2009 kl 12.59 CEST> <Warning> <EJB> <BEA-010065> <MessageDrivenBean threw an Exception in onMessage(). The exception was:
java.lang.AbstractMethodError: org.springframework.jee.intercept.CachingAdvisorChainFactory.getInterceptorsAndDynamicInterceptionAdvice(Lorg/springfr
amework/aop/framework/Advised;Ljava/lang/reflect/Method;Ljava/lang/ClassLjava/util/List;.
java.lang.AbstractMethodError: org.springframework.jee.intercept.CachingAdvisorChainFactory.getInterceptorsAndDynamicInterceptionAdvice(Lorg/springfra
mework/aop/framework/Advised;Ljava/lang/reflect/Method;Ljava/lang/ClassLjava/util/List;
I've tried various tips found http://forum.springframework.org/showthread.php?t=38361 and also tried setting the “component-factory-class-name” tag in weblogic-ejb-jar.xml and weblogic-application.xml but still get ClassNotFoundException.
Gaute

NAC integration with LDAP

Is possible this integration?. The idea is that the agent will do authentication with LDAP directly

Hi Anoop,
To adapt an SAP Workflow, you can create a configuration. In this configuration you can redefine values for steps of the workflow definition. These values are evaluated at runtime instead of the values originally defined.
You can configure the following step types:
Activity
User decision
Document from template
Wait
Moreover,Features
You can set the following data individually in the step definition of the configurable step types:
1)Responsible agents
2)Excluded agents
3)Message recipient for completion
4)Priority
5)Requested start
6)Indicator denoting whether the step is included in the    workflow log
7)Activation of a latest end, a latest start, or a requested end with the reaction Send mail
This URL privides info about various workflow codes http://help.sap.com/erp2005_ehp_02/helpdata/en/9b/572614f6ca11d1952e0000e82dec10/content.htm
Regds,
Krutarth
·        Reference date/time for latest end, latest start, and requested end
·        Message recipient for missed deadline
·        Information about the work item display

NAC Integrated with Guest Server

Similar Messages

Maybe you are looking for