Preventing mac osx users from using cisco vpn

Hi,
I have setup ASA to act as our vpn server with radius as my authentication server. Users use the cisco vpn client utility to vpn in which has the .pcf file. This .pcf file has the group password, name and so on. Some users went online and found websites to decrypt the group password and have used that on their local macs to vpn in.
That irritates me and i want to know how i can prevent them from logging on. Are there any ways to block by os type within ASA?
Please help!!
thanks

thanks i set it up to get 2 syslog messages: 713120 and 713904.
<165>Feb 09 2012 06:48:56: %ASA-5-713120: Group = vpnaccess-xyz123, Username = xyzcompany\jdoe, IP = 10.10.10.10, PHASE 2 COMPLETED (msgid=xxxxxx).
Which is good, now i know who is connected to my vpn and i get an alert, but i also want to know they type of OS they are using. When i do a lookup of syslog message id: 713904, that is suppose to give me the OS type (ex: winnt mac ox and so on), but i am not getting that.
Any reason why i dont get an alert from message id 713904, but i get one from 713120.
thanks

Similar Messages

How to prevent a portal user from using the BEx Analyzer ?

Hi,
we have different type of users : most users may use the portal as well
as the analyzer ;
we have one special user with extended authorizations : this user
should use the portal , where he has a limited set of queries to run
with hardcoded filters ==> this user should not be able to use the
analyzer however, since he then would be able to call all other queries
by using the find function ;
how can we make sure this user cannot use the analyzer , using SAP
authorizations ?
best regards,
Erwin Van Giel.

Hi,
if I remove the complete S_RFC authorization for the user then the BEx Analyzer cannot connect anymore to the BW system, but neither can the user run reports from the portal : it needs the S_RFC with 'SYST'.
If I only remove the RRMX from the S_TCODE and from the S_RFC, it does not prevent the user from starting the BEx Analyzer and connecting to the BW system. It only stops the user if he would start the RRMX transaction from within an SAPGUI session.
Perhaps there should be a value in the S_RFC that allows connections from the portal but not from the BEx Analyzer .... ?
so not solved yet ....
best regards,
Erwin.

Is it possible to prevent users from using the ''Purge'' option from the ''Recover deleted items'' in Office 365?

Hi,
After speaking with a Microsoft engineer over the phone, I've been told that there is no way to prevent users to go to their OWA and manually Purge specific items from the ''Recover deleted items''. The Microsoft tech told us to place the desired mailboxes
on a litigation-hold and that all data will be recoverable... but only from the time you place the mailbox onto Litigation-Hold and previous items, which doesn't take effect for new-coming emails.
1- From what I understand, any new items coming in the mailbox after the Litigation-Hold is put in place will still be ''purgeable'', right?
2- Is there a way (PowerShell, Security group, etc.) that can prevent a user from using the Purge option?
We are very surprised that there is absolutely no thread that talks about this issue, which in our opinion, is a major legal and security flaw from Office 365. This is a main concern for us to actually go with Office365. For instance, this means that at
any given time, if a user exchanges emails with a competitor, they can manually purge emails sent and receive as soon as it is sent/received, even after Litigation-Hold is in place.
Thank you for your reply and let us know if you have more questions.
Normand Bessette, IT support technician, Newad Media

Thank you for the reply.
Is there still a way to prevent users from using the Purge option, like with a Powershell script to disable Purge?

Problem accessing company resources remotely using Cisco VPN Client

I connect to my company's network remotely using Cisco VPN client both from a PC (v 4.0.1) and from a MacBook Pro (v 4.9.00)(same configs), and use Remote Desktop to connect to my work computer, and now i'm able to use Citrix to run applications on the company server.
The problem occurs on the Mac when I'm connecting from a location that uses the same private domain IP as our company's private domain. Our company's private domain is 192.168.1.x, so when I'm using the Mac on a WiFi router that happens to be set to 192.168.1.1, the Mac can connect using VPN but the remote desktop cannot connect to my work computer. Presumably, the Mac doesn't "know" that I'm trying to go through the VPN for the connection and not connect to something locally.
This problem seems to be unique to the Mac. Every Windows machine with the same client installed has no problems no matter what WiFi I've tried. The Mac works fine on any WiFi that is not 192.168.1.x.
However, since 192.168.1.x is very common (hotels, airports, etc., its a major problem with the Mac.
Suggestions are greatly appreciated!
Also, now that we're moving to Citrix, our administrator has created a webpage on the intranet that we launch applications from, but the Mac cannot find that page when connected to VPN from 192.168.1.x. Same problem.
Thanks in advance.

Hi,
I presume you have split-tunneling activated.
1. Make sure the 192.168.1.x is on the protected networks and on the MacBook client, disable "Allow local LAN access"
2. Create a separate group for the Mac users and assgn them a different pool (192.168.100.x )and advertise it in your company to point to the VPN Concentrator.
3. Use the NAT feature on your VPN concentrator.
If this helped, please rate.
Regards,
Daniel

I'm in syria and they blocked me from using any VPN service please help without VPN i can't open the store help please ( using iphone 5 version 9.1.4 )

I'm in syria and they blocked me from using any VPN service please help without VPN i can't open the store help please ( using iphone 5 version 9.1.4 )

There is nothing that anyone here on a user forum can do to help you. If it is a local issue in Syria, then you need to take it up with your phone company or authorities there who have prevented you from using VPN.
Nobody here can help you.

I have 10.8.3 installed. I use Cisco VPN but this hangs after 57 minutes and 35 seconds. I disconnect but can't reconnect straight away but have to wait about 10 minutes then have another 57 minutes

I use a mac with 10.8.3 installed. I use Cisco VPN & citrix receiver to connect to work via my home wireless which connects & works brilliantly but then hangs after 57 minutes and about 35 seconds. I disconnect but can't reconnect straight away although it goes through the motions but doesn't find a connection. I have to wait about 10 minutes (or restart the MAC) then it connects fine again and I have another 57 minutes. I previously used 10.6 for a while without any problems and then the VPN just stopped connecting? after trying to resolve without success I upgraded the OS hoping that this might fix the issue which it has but created this other problem! I can live with it but thought there may be some way to correct this surely. I'm not heavily technically minded and have read reports about the racoon service may be causing this but not sure how you do this very simply step by step
Thank you for any ideas you can give

I use a mac with 10.8.3 installed. I use Cisco VPN & citrix receiver to connect to work via my home wireless which connects & works brilliantly but then hangs after 57 minutes and about 35 seconds. I disconnect but can't reconnect straight away although it goes through the motions but doesn't find a connection. I have to wait about 10 minutes (or restart the MAC) then it connects fine again and I have another 57 minutes. I previously used 10.6 for a while without any problems and then the VPN just stopped connecting? after trying to resolve without success I upgraded the OS hoping that this might fix the issue which it has but created this other problem! I can live with it but thought there may be some way to correct this surely. I'm not heavily technically minded and have read reports about the racoon service may be causing this but not sure how you do this very simply step by step
Thank you for any ideas you can give

Tunneling using Cisco VPN Client 4.9

Hello,
in recent times I used the Cisco VPN Client 4.7 with no problems:
1. I installed the software
2. I started "Internet Connect.app", created a VPN connection (PPTP) with no entries
3. created a new network connection ("Tunnel to company"), with ETH and VPN (PPTP) enabled
4. the ethernet interface points at the local router wich is connected to my ISP
5. DHCP-Client-ID: our.company.de, DNS-Server: no entry, Domain-Names: our.company.de
6. Proxies: our companies proxies
7. the VPN (PPTP) interface is configuered as PPP, DNS-Server: our companies server IPs, Domain-Names: no entries, Proxy: no entries
8. Starting the Cisco VPN Client I configuered an new session, connected, ok
As said, this was in the old days.
Now using Cisco VPN Client 4.9 on a MacBookPro (Intel) this works also with one exception:
I can establish a network connection (ping, smb, AFP, intranet/HTTP) only using the companies fully qualified domain name, e.g.:
1. ping server1: unable to resolve name
2. ping server1.our.company.de: works as exspected
I am using Cisco VPN Client 4.9.00 (0050), Mac OS X 4.8 with all available updates.
Any help would be appreciated
Roland

...
trying the same (without the "Internet Config.app" / VPN PPTP) using VPN Tracker works fine. But I don´t want to spend Euro 79.-...
Roland

How many luns does mac OSX support from a single target (array) is it 255??

How many luns does mac OSX support from a single target (array) is it 255?
For example, if using the Dual-channel 4Gb Fibre Channel PCI Express card? Is it 255, 512 or higher? I know it uses the ATTO driver, but I can't find any documentaiton about the upper limits of how many luns this HBA can address from a single target array on a SAN. Thanks.

Hi,
The card should be an ATTO 42ES whcih supports 255 LUNS per channel
Here's the info from the attached link
Consider the following Celerity FC host adapter guidelines:
• ATTO 4-Gb and 8-Gb FC cards (PCI-X and PCIe only) are supported. • Latest HP-specific ATTO Celerity FC host adapter driver • Latest HP-specific ATTO Configuration Tool • A maximum of 256 targets per host adapter channel are supported. • A maximum of 255 logical unit numbers (LUNs) per host adapter channel are supported. • PowerPC- and Intel-based servers are supported.
http://www.attotech.com/pdfs/MacOSFCconnEVA5697-7653.pdf
Hope that helps
Beatle

Is there a way to prevent an end-user from changing their own password?

All you guru's out there, I need your help. Is there a way to prevent an end-user from changing their own password? Is there a function or procedure I can create or what?

In this case, you do not want someone (whoever they are DBA etc) to connect as that
particuler user to change the password.Yes, but I wouldn't expect the users to[i] know that password. The connnect would be handled automatically, behind the scenes.
The clear implication of the OP's question and response was that users would not be allowed to change their own passwords. I'm guessing this is in response to a policy that says users mustn't have simple passwords like 123abc or mom. In such a scenario a better approach would be to apply regexp to a user's password to ensure it contains a mix of letters, numbers, punctuation, etc to achieve the desired level of complexity.
So questions, should not be regarded as daft Agreed, but the same is unfortunately not always true of business decisions. As the OP has told us not to ask we cannot know why they want to do this. Personally, I think a user's individual password should always be their responsibility; anything else strikes me as insecure. YMMV.
Cheers, APC

Restrict users from using Manual series

Hi SAP,
Is there a way to restrict users from using the Manual series?
Thanks,
Janice

Hi Rahul,
Ok, i have seen already the authorization for document manual numbering and it is available only for 8.8 versions and not on 2007 version of SAP.
Anyway, when im doing the testing i found out that for banking transactions like incoming, user can still use the manual series even if he has no authorization for manual document numbering.
Another concern from our client was the use of manual series only, is it also possible in SAP? I tried to give user authorization in the manual document numbering and no authorization to series group no but user cannot already open the transaction window. Let us know if their inquiry is possible so i could inform them that only manual series can be restricted.
Thanks for your help.
Regards,
Janice

Prevent Mac OS X from changing resolution

I have a Mac Mini connected to my Sony 46xbr8 HDTV, and every time I turn the TV off, Mac OS X changes screen resolution to what seems to be arbitrary one. Just now it switched to 1280x1024, screwed all windows up along the way, and even if I connect to it via a Remote Desktop and change the resolution back to 1920x1080 - the system menu remains 1280 pixels wide, and the rest of the space where the menu should be is empty.
Is there a way to prevent Mac OS X from changing the resolution (other than leaving my TV on at all times)?

So, is there no other way to prevent Mac OS X from changing resolutions, when the TV is off??? It wouldn't have been a problem, if it didn't change all open window sizes, but every time I turn on the TV - all windows become tiny...
I've installed Windows 7 in BootCamp on the Mac Mini, and God, it works SO MUCH BETTER than Apple's own OS on their own computer!!! It does indeed look like now Windows 7 "just works", and Apple's Mac OS X - "just doesn't"... So far it looks like Apple is losing it...

Is there a way to prevent AD users from accessing the VPN?

I have ASA 5510's that authenticate users to the Active Directory. Is there a way to prevent users, that even though they are validated through the AD from being to establish a VPN connection?

Haven't tested this lately, but with the ipsec client, you used to be able to go to an AD user's "dial-in" tab, and there was a check box there for "allow remote access" or something that. If this was checked, they could authenticate via IAS, if not, they couldn't. This allowed only selected users within AD to use the VPN. Not sure if this is still the case, but it's a start...

Small Business w/Mac Mini Running Server OSX, Connect From Home Solution - VPN?

I am trying to setup my Mac Mini running OS X Server (Mountain Lion) to be accessed from users at home (for file sharing and Contact Services). Is a VPN the best solution? (Small business setup - privacy/security a concern).
Hi everyone, and Thanks for the help in advance!
I am currently setting up a network for my company (small business) and have a few questions. We have a Mac Mini (mid-2012) running Server OS X Mountain Lion, and 5 MBP's (our work computers- all running latest version of Mountain Lion).
To summarize:
My goal = Setup a secure way of connecting the MBP's to the server when our personnel are at home (for file sharing).
I am switching all of the users from local to network (we didn't need the network functionality when we first setup the server, and we are now expanding our use of it). This is going to occur this weekend, as downtime for the server is needed to make the changes.
After I establish the Open Directory and all of that, I will be setting up Contact Services (to share a master list of contacts with the members of our department) and we already have some Calendar sharing setup.
The purpose of this is to enable our employees the option of working necessary overtime from home so they can be with their families instead of in the office all the time. It is a noble cause and I want to set this up the best that I can for them.
This being said... I'm no Mac Genius, and this stuff can get very confusing very fast. I have read a little about VPN's, and am wondering if this is the solution to my problem. We need to establish a SECURE way of connecting to the server from remote locations, enabling us to pull needed files from the server.
If anybody can offer some advice on this I would really appreciate it. I love Apple products and I have faith that this is as easy as I've been told it is.
Thank you very much for your time and consideration!

No, it wasn't difficult at all to setup in OS X Server. I use a free internet domain name from DynDNS.com. I don't know if they still offer free ones anymore. You can not use VPN and 'Back to My Mac' at the same time as they use some or all of the same ports.
I'm at work and not on my Mac at the moment so this is from memory.
Within OS X Server, I enabled the VPN Service (default L2TP) and used my free domain name in the VPN Host Name and a Secret passphrase. This put an entry in my Airport Extreme router for VPN (port mapping).
Within the client Mac, I added a VPN network connnection (System Preferences /Network). I pointed to my free domain name in the Server Address, used my Server account name in the account name. I think there's an Authentication button that I clicked. I entered my Server account password, the Secret passphrase in the Secret field, checked a box to show VPN icon in Menu Bar and exited out of that. Then clicked the Advanced button and checked the box to send all traffic over VPN connection.
I had VPN authentication issues at first when trying to connect to test out the connection. I just kept trying as I knew I had all the settings correct and it would finally connect after about 3-4 tries. After that, I sometimes have to connect more than once to actually connect to my Server via VPN. But it does work nice. I brought my MBP into work once to test it out and was able to connect to my home Server via VPN and use Screen Sharing and had access to all my shared folders.

Is there a way to prevent a user from using the graph cursor legend to delete a cursor?

I would like to have 2 cursors on a graph that can't be deleted by the user.

Hi Dennis,
I'm having this problem as well, and found your post. Are you referring to the Enabled State of the entire graph? If so, this prevents the user from moving the cursor at all while the VI is running, which, of course, defeats the purpose of having a cursor at all. Ideally, I would like to show the cursor palette and disable it's run-time shortcut menu. This doesn't appear to be possible. One workaround would be to hide the palle and instead include some indicators that show the cursors' values. I'd prefer to show the palette to keep the program simpler.
Any other solutions?
Thanks,
Alan
Alan Blankman, Technical Product Marketing Manager and LabVIEW Developer
LeCroy Corporation
800-553-2769 x 4412
http://www.lecroy.com
[email protected]

Resources for migration from legacy Cisco VPN client to AnyConnect?

As the legacy client is now officially EOL'd, and it is having issues with Windows 7 - the need has presented itself to migrate to AnyConnect.
The complicating issue here is that many of the machines that need to be migrated connect remotely and never touch a corporate LAN - as such - I need to devise a means to remotely and seamlessly (as much as possible) migrate from old to new. Sounds a bit like changing the wings on a flying plane, but I'm guessing others have had to face the same issue. By procrastinating this migration - my hope is that your blood spilled will be mine saved? (Just kidding. Sorta).
Any tips, input, suggestion, procedures, FAQs, good luck wishes, etc. greatly appreciated.
Cheers,
JP

Hi Andy
Anyconnect licensing is a little complicated, but 99% of the time you only need the "Essentials" AnyConnect license for your ASAs. This gives you everything that you have using the old Cisco VPN Client.
Essentials is licensed per ASA, and not per user like the other ASA AnyConnect licenses.
AnyConnect Premium gives you all that Essentials give you plus "clientless" VPN (Web portal type stuff).
Configuration wize - it's pretty simple and similar to how you configure the old VPN support. There's a wizard to assist you in configuring it if you like that kind of thing.
HTH
Barry Hesk
Intrinsic Network Solutions

Preventing mac osx users from using cisco vpn

Similar Messages

Maybe you are looking for