Radius authentication with ISE - wrong IP address

Hello,
We are using ISE for radius authentication.  I have setup a new Cisco switch stack at one of our locations and setup the network device in ISE.  Unfortunately, when trying to authenticate, the ISE logs show a failure of "Could not locate Network Device or AAA Client" The reason for this failure is the log shows it's coming from the wrong IP address.  The IP address of the switch is 10.xxx.aaa.241, but the logs show it is 10.xxx.aaa.243.  I have removed and re-added the radius configs on both ISE and the switch, but it still comes in as .243.  There is another switch stack at that location (same model, IOS etc), that works properly.
The radius config on the switch:
aaa new-model
aaa authentication login default local
aaa authentication login Comm group radius local
aaa authentication enable default enable
aaa authorization exec default group radius if-authenticated
ip radius source-interface Vlanyy
radius server 10.xxx.yyy.zzz
 address ipv4 10.xxx.yyy.zzz auth-port 1812 acct-port 1813
 key 7 abcdefg
The log from ISE:
Overview
Event  5405 RADIUS Request dropped 
Username  
Endpoint Id  
Endpoint Profile  
Authorization Profile  
Authentication Details
Source Timestamp  2014-07-30 08:48:51.923 
Received Timestamp  2014-07-30 08:48:51.923 
Policy Server  ise
Event  5405 RADIUS Request dropped 
Failure Reason  11007 Could not locate Network Device or AAA Client 
Resolution  Verify whether the Network Device or AAA client is configured in: Administration > Network Resources > Network Devices 
Root cause  Could not find the network device or the AAA Client while accessing NAS by IP during authentication. 
Username  
User Type  
Endpoint Id  
Endpoint Profile  
IP Address  
Identity Store  
Identity Group  
Audit Session Id  
Authentication Method  
Authentication Protocol  
Service Type  
Network Device  
Device Type  
Location  
NAS IP Address  10.xxx.aaa.243 
NAS Port Id  tty2 
NAS Port Type  Virtual 
Authorization Profile  
Posture Status  
Security Group  
Response Time  
Other Attributes
ConfigVersionId  107 
Device Port  1645 
DestinationPort  1812 
Protocol  Radius 
NAS-Port  2 
AcsSessionID  ise1/186896437/1172639 
Device IP Address  10.xxx.aaa.243 
CiscoAVPair  
   Steps
  11001  Received RADIUS Access-Request 
  11017  RADIUS created a new session 
  11007  Could not locate Network Device or AAA Client 
  5405  
As a test, I setup a device using the .243 address.  While ISE claims it authenticates, it really doesn't.  I have to use my local account to access the device.
Any advice on how to resolve this issue would be appreciated.  Please let me know if more information is needed.

Well from the debug I would say there may be an issue with the addressing of the radius server on the switch.
radius-server host 10.xxx.xxx.xxx key******** <--- Make sure this address and Key matches what you have in ISE PSN and that switch. Watch for spaces in your key at the begining or end of the string.
What interface should your switch be sending the radius request?
ip radius source-interface VlanXXX vrf default
Here is what my debug looks like when it is working correctly.
Aug  4 15:58:47 EST: RADIUS/ENCODE(00000265): ask "Password: "
Aug  4 15:58:47 EST: RADIUS/ENCODE(00000265):Orig. component type = EXEC
Aug  4 15:58:47 EST: RADIUS(00000265): Config NAS IP: 10.xxx.xxx.251
Aug  4 15:58:47 EST: RADIUS/ENCODE(00000265): acct_session_id: 613
Aug  4 15:58:47 EST: RADIUS(00000265): sending
Aug  4 15:58:47 EST: RADIUS(00000265): Send Access-Request to 10.xxx.xxx.35:1645 id 1645/110, len 104
Aug  4 15:58:47 EST: RADIUS:  authenticator 97 FB CF 13 2E 6F 62 5D - 5B 10 1B BD BA EB C9 E3
Aug  4 15:58:47 EST: RADIUS:  User-Name           [1]   9   "admin"
Aug  4 15:58:47 EST: RADIUS:  Reply-Message       [18]  12 
Aug  4 15:58:47 EST: RADIUS:   50 61 73 73 77 6F 72 64 3A 20        [ Password: ]
Aug  4 15:58:47 EST: RADIUS:  User-Password       [2]   18  *
Aug  4 15:58:47 EST: RADIUS:  NAS-Port            [5]   6   3                        
Aug  4 15:58:47 EST: RADIUS:  NAS-Port-Id         [87]  6   "tty3"
Aug  4 15:58:47 EST: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]
Aug  4 15:58:47 EST: RADIUS:  Calling-Station-Id  [31]  15  "10.xxx.xxx.100"
Aug  4 15:58:47 EST: RADIUS:  Service-Type        [6]   6   Login                     [1]
Aug  4 15:58:47 EST: RADIUS:  NAS-IP-Address      [4]   6   10.xxx.xxx.251           
Aug  4 15:58:47 EST: RADIUS(00000265): Started 5 sec timeout
Aug  4 15:58:47 EST: RADIUS: Received from id 1645/110 10.xxx.xxx.35:1645, Access-Accept, len 127
Aug  4 15:58:47 EST: RADIUS:  authenticator 1B 98 AB 4F B1 F4 81 41 - 3D E1 E9 DB 33 52 54 C1
Aug  4 15:58:47 EST: RADIUS:  User-Name           [1]   9   "admin"
Aug  4 15:58:47 EST: RADIUS:  State               [24]  40 
Aug  4 15:58:47 EST: RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A 30 61  [ReauthSession:0a]
Aug  4 15:58:47 EST: RADIUS:   30 63 66 65 32 33 30 30 30 31 46 37 30 37 35 33  [0cfe230001F70753]
Aug  4 15:58:47 EST: RADIUS:   44 46 45 35 46 37            [ DFE5F7]
Aug  4 15:58:47 EST: RADIUS:  Class               [25]  58 
Aug  4 15:58:47 EST: RADIUS:   43 41 43 53 3A 30 61 30 63 66 65 32 33 30 30 30  [CACS:0a0cfe23000]
Aug  4 15:58:47 EST: RADIUS:   31 46 37 30 37 35 33 44 46 45 35 46 37 3A 50 52  [1F70753DFE5F7:PR]
Aug  4 15:58:47 EST: RADIUS:   59 49 53 45 30 30 32 2F 31 39 33 37 39 34 36 39  [YISE002/19379469]
Aug  4 15:58:47 EST: RADIUS:   38 2F 32 30 36 33 31 36          [ 8/206316]
Aug  4 15:58:47 EST: RADIUS(00000265): Received from id 1645/110
---------------------------------------------------------------------------------------------------------------This is after I added the incorrect Radius server address.
Aug  4 16:05:19 EST: RADIUS/ENCODE(00000268): ask "Password: "
Aug  4 16:05:19 EST: RADIUS/ENCODE(00000268):Orig. component type = EXEC
Aug  4 16:05:19 EST: RADIUS(00000268): Config NAS IP: 10.xxx.xxx.251
Aug  4 16:05:19 EST: RADIUS/ENCODE(00000268): acct_session_id: 616
Aug  4 16:05:19 EST: RADIUS(00000268): sending
Aug  4 16:05:19 EST: RADIUS(00000268): Send Access-Request to 10.xxx.xxx.55:1645 id 1645/112, len 104
Aug  4 16:05:19 EST: RADIUS:  authenticator FC 94 BA 5D 75 1F 84 08 - E0 56 05 3A 7F BC FB BB
Aug  4 16:05:19 EST: RADIUS:  User-Name           [1]   9   "admin"
Aug  4 16:05:19 EST: RADIUS:  Reply-Message       [18]  12 
Aug  4 16:05:19 EST: RADIUS:   50 61 73 73 77 6F 72 64 3A 20        [ Password: ]
Aug  4 16:05:19 EST: RADIUS:  User-Password       [2]   18  *
Aug  4 16:05:19 EST: RADIUS:  NAS-Port            [5]   6   7                        
Aug  4 16:05:19 EST: RADIUS:  NAS-Port-Id         [87]  6   "tty7"
Aug  4 16:05:19 EST: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]
Aug  4 16:05:19 EST: RADIUS:  Calling-Station-Id  [31]  15  "10.xxx.xxx.100"
Aug  4 16:05:19 EST: RADIUS:  Service-Type        [6]   6   Login                     [1]
Aug  4 16:05:19 EST: RADIUS:  NAS-IP-Address      [4]   6   10.xxx.xxx.251           
Aug  4 16:05:19 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:23 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:23 EST: RADIUS: Retransmit to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:23 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:29 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:29 EST: RADIUS: Retransmit to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:29 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:33 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:33 EST: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.xxx.xxx.55:1645,1646 is not responding.
Aug  4 16:05:33 EST: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.xxx.xxx.55:1645,1646 is being marked alive.
Aug  4 16:05:33 EST: RADIUS: Retransmit to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:33 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:38 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:38 EST: RADIUS: Fail-over to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:38 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:43 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:43 EST: RADIUS: Retransmit to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:43 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:48 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:48 EST: RADIUS: Retransmit to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:48 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:53 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:53 EST: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.xxx.xxx.55:1645,1646 is not responding.
Aug  4 16:05:53 EST: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.xxx.xxx.55:1645,1646 is being marked alive.
Aug  4 16:05:53 EST: RADIUS: Retransmit to (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:53 EST: RADIUS(00000268): Started 5 sec timeout
Aug  4 16:05:57 EST: RADIUS(00000268): Request timed out
Aug  4 16:05:57 EST: RADIUS: No response from (10.xxx.xxx.55:1645,1646) for id 1645/112
Aug  4 16:05:57 EST: RADIUS/DECODE: parse response no app start; FAIL
Aug  4 16:05:57 EST: RADIUS/DECODE: parse response; FAIL
This is a default template I use for all my devices routers or switches hope it helps. I have two PSN's that is why we have two radius-server host commands..
aaa authentication login vty group radius local enable
aaa authentication login con group radius local enable
aaa authentication dot1x default group radius
aaa authorization network default group radius 
aaa accounting system default start-stop group radius
ip radius source-interface VlanXXX vrf default
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 30 tries 3
radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646 key *********
radius-server host xxx.xxx.xxx.xxx auth-port 1645 acct-port 1646 key *********
radius-server vsa send accounting
radius-server vsa send authentication
You can use this in the switch to test radius
test aaa group radius server 10.xxx.xxx.xxx <username> <password>

Similar Messages

  • HT4061 I have an iphone 4 and cannot access my email account-it was set up with the wrong email address. How do I resolve this issue?

    i have an i phone 4 and it has been set up with the wrong email address. How can I rest the email address?

    Did you purchase or download the apps with your old ID?  Apps are tied to the ID that is was purchased from.
    If it is a new app you bought with your new ID, you can go into settings - appstore- apple id and then log out.

  • ACS 5.3 Radius authentication with ASA and DACL

    Hi,
    I am trying to do Radius authentication on the ACS 5.3 for VPN access (cisco client) using a downloadable ACL with AD identity
    Clients are connecting to an ASA 5510 with image asa843-K8.bin
    I followed the configuration example on the Cisco site, but I am having some problems
    First : AD identity is not triggered, I put a profile  :
    Status
    Name
    Conditions
    Results
    Hit Count
    NDG:Location
    Time And   Date
    AD1:memberOf
    Authorization   Profiles
    1
    TestVPNDACL
    -ANY-
    -ANY-
    equals Network Admin
    TEST DACL
    0
    But if I am getting no hits on it, Default Access is being used (Permit Access)
    So I tried putting the DACL in the default profile, but when connecting I am immediately disconnected.
    I can see the DACL/ASA being authenticated in the ACS log but no success
    I am using my user which is member of the Network Admin Group.
    Am I missing something?
    Any help greatly appreciated!
    Wim

    Hello Stephen,
    As per the IP Pools feature, the ACS 5.x does not include such functionality. It is not on the ACS 5.x roadmap either as the recommended scenario would be to use a dedicated DHCP server.
    ACS 4.x included that functionality, however, it was not the best solution as the ACS returned the IP Address value as a RADIUS Attribute instead of acting as a real DCHP server.
    As per the IMEI and MISDN I am assuming you are referring to International Mobile Equipment Identity and Mobile Subscriber ISDN. Correct me if I am wrong.
    In that case it seems that the ACS 5.x should be able to Allow or Deny access based on Radius Attribute 30 (Called-Station-Id) and 31 (Calling-Station-Id).
    In that case you might want to use the End-Station Filters feature and use it as the condition for the Rule. The End-Station Filter feature uses CLI/DNIS where CLI is Radius Attribute 31 and DNIS is Attribute 30.
    I am assuming a Generic Username will be embedded on the devices request. In that case you will define which end-user devices will be granted access based on the above attributes.
    Here is a snapshot of the section:

  • Apple macosx machine authentication with ISE using EAP-TLS

    Hello,
    On a ongoing setup we are using eap-tls authentication with account validation against AD. We have our own CA (microsoft based). ISE version 1.2.1 patch 1.
    With windows machines all is working well. We are using computer authentication only.
    Now the problem is that we wish to do the same with MAC OSX machines.
    We are using casper software suite and are able to push certificates into macosx, and are doing machine authentication.
    in ISE the certificate authentication profile is being set to look at the subject alternative name - DNS name of the machines. Whenever we set it to the UPN (hostname$) windows accounts are not found in ad.
    When MAC OSX authenticate as machines (they have a computer account in AD) they present themselves with RADIUS-Username = hostname$ instead of host/hostname.
    The consequence is that by lacking the host/, ISE considers that this is a user authentication, instead of a computer one, and when it sets off to find the account, it searches in User class instead of Computer - which obviously returns no results.
    Is anybody aware of any way to force MAC OSX to present a host/hostname RADIUS-Username when authenticating?
    Any similar experiences of authenticating MAC OSX with ISE and machine/computer authentication are welcome.
    Thanks
    Gustavo Novais

    Additional information from the above question.
    I have the following setup;
    ACS 3.2(3) built 11 appliance
    -Cisco AP1200 wireless access point
    -Novell NDS to be used as an external database
    -Windows 2003 enterprise with standalone Certificate Authorithy Services Installed
    -Windows XP SP2 Client
    My Goal is to use Windows XP Native Wlan Utility to connect to AP using EAP-TLS authentication against Novell NDS.
    Tried to connect using Cisco compatible wlaN utility and authenticate using EAP-GTC against Novell NDS for for users, it works fine and perfectly.
    When connecting using EAP-TLS, I am getting an error from ACS failed attempt "Auth type Not supported by External DB". But in the ACS documentation says that it supports EAP-TLS. How true is this? Is there anybody have the same problem? Do I need to upgrade my ACS? What should I do? What other authentication type could be used to utilize native WinXP Wlan Utility?
    Please help...
    Thanks

  • WLC 4402 RADIUS Authentication with IAS

    Hello
    I configured a WLAN with PEAP (CHAP v2)and Radius authentication to a Win 2003 IAS Radius Server.
    On the controller 4402 the layer 2 security is set to WPA1+WPA2 with 802.1x authentication.
    The IAS server don't use the configured policy when a authentication reguest arrive.
    I there an issue with special RADIUS attributes or configuration items on the IAS Server?
    The following event appear in the windows logs:
    User STANS\kaesmr was denied access.
    Fully-Qualified-User-Name = STANS\kaesmr
    NAS-IP-Address = 172.17.25.6
    NAS-Identifier = keynet-01
    Called-Station-Identifier = 00-18-74-FB-CA-20:keynet
    Calling-Station-Identifier = 00-16-CE-52-C8-EB
    Client-Friendly-Name = Wireless-Controller
    Client-IP-Address = 172.17.25.6
    NAS-Port-Type = Wireless - IEEE 802.11
    NAS-Port = 1
    Proxy-Policy-Name = Windows-Authentifizierung f?r alle Benutzer verwenden
    Authentication-Provider = Windows
    Authentication-Server = <undetermined>
    Policy-Name = <undetermined>
    Authentication-Type = Extension
    EAP-Type = <undetermined>
    Reason-Code = 21
    Reason = The request was rejected by a third-party extension DLL file.

    What I understand from your post is that the authentication is not handled by your IAS server. IF I am correct, the problem might be with the "Allow AA override" option disabled in your WLAN. If it is enabled, then the AAA server or your IAS server will override the security parameters set locally on the controller.
    So, first ensure whether "Allow AAA override" is enabled under Controller--->WLAN field.
    Also, chek out the logs of the IAS server for obtaining more info on this.

  • APC (UPS) RADIUS authentication with ACS 5.X

    I am trying to do RADIUS authentication for APC (UPS) using ACS 5.2 Appliance. It is working fine with ACS 4.2, but unfortunately not with ACS 5.2. I tried creating RADIUS VSA (Vendor Specific Attributes) for APC in ACS 5.2.
    According to the APC dictionary file
    VENDOR APC 318
    # Attributes
    ATTRIBUTE APC-Service-Type 1 integer APC
    ATTRIBUTE APC-Outlets 2 string APC
    VALUE APC-Service-Type Admin 1
    VALUE APC-Service-Type Device 2
    VALUE APC-Service-Type ReadOnly 3
    # For devices with outlet users only
    VALUE APC-Service-Type Outlet 4
    I have added the attributes in blue(attached), how do I add the VALUE's (shown red) in ACS 5.2? What else should I do to get this working?
    The hit count on the ACS shows that it is getting authentication request from the APC appliance.
    Thanks in advance.

    Hi,
    I am working on the same issue and i manage to login (using Ldap A/D backend authentication). When using the standard Radius attribute Service-Type (1 for read-only and 6 for admin) i manage to get this working. I am however trying to use the APC VSAs (as above) without any success. The objective is to have outlet management for specific users, admin or read-only others. Did u manage to get this working and how?
    ./G

  • Integrating RADIUS authentication with JAAS ???

    Hi,
    I have username/password JAAS authentication in my application.
    Now I have to support RADIUS authentication on top of the existing username/password authenticaiton.
    I am in the process of defining a login module for RADIUS.
    Is there any opensource login module existing for RADIUS ??
    After defining the RADIUS login module where to configure the multiple authentication policies ??
    Thanks,
    Dyanesh.

    This sample configuration shows how to set up a remote access VPN connection between a Cisco VPN Client (4.x for Windows) and the PIX 500 Series Security Appliance 7.x using a Cisco Secure Access Control Server (ACS version 3.2) for extended authentication (Xauth).
    http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008080f2d1.shtml

  • Wirelss AP1140 Radius authentication with Microsoft IAS

    Hi,
    I have a Cisco C1140 Ap. I have cnfigured the device. Initially for testing i used WPA and authenticated locally. I have now setup a radius server and added my AP in as a client etc. I have changed my SSID's to authenticate with the radius server and i am having issues authenticating.
    I can connect via a PC and an iphone. They say that i am connected but i get no ip address and the debugs state that the authentication fails:
    000466: Sep 5 14:33:07.074 AEST: %DOT11-7-AUTH_FAILED: Station 40a6.d967.8b13 Authentication failed
    000467: Sep 5 14:33:28.368 AEST: %DOT11-7-AUTH_FAILED: Station bc77.3771.b15f Authentication failed
    000468: Sep 5 14:33:39.837 AEST: %DOT11-7-AUTH_FAILED: Station 40a6.d967.8b13 Authentication failed
    I can see the Radius server as connected
    imc-syd-ap1#show aaa servers
    RADIUS: id 4, priority 1, host 10.10.0.2, auth-port 1645, acct-port 1646
    State: current UP, duration 4337s, previous duration 0s
    Dead: total time 0s, count 0
    Authen: request 0, timeouts 0
    Response: unexpected 0, server error 0, incorrect 0, time 0ms
    Transaction: success 0, failure 0
    Author: request 0, timeouts 0
    Response: unexpected 0, server error 0, incorrect 0, time 0ms
    Transaction: success 0, failure 0
    Account: request 0, timeouts 0
    Response: unexpected 0, server error 0, incorrect 0, time 0ms
    Transaction: success 0, failure 0
    Elapsed time since counters last cleared: 1h12m
    The debugs show:
    000474: Sep 5 14:36:00.969 AEST: %DOT11-7-AUTH_FAILED: Station bc77.3771.b15f Authentication failed
    000475: Sep 5 14:36:01.485 AEST: AAA/BIND(00000109
    show dot11 associations:
    imc-syd-ap1#show dot11 associations
    802.11 Client Stations on Dot11Radio0:
    SSID [IMC-Wireless-Data] :
    MAC Address IP address Device Name Parent State
    bc77.3771.b15f 0.0.0.0 ccx-client DAVID self AAA_Auth
    Any ideas or recomendations would be greatly appreciated
    Thanks
    Below is a copy of my wireless config:
    version 12.4
    no service pad
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname xxxxxxxxxxxxxx
    logging buffered 40960 debugging
    enable secret 5 xxxxxxxxxxxxx
    aaa new-model
    aaa group server tacacs+ IMC
    server 172.16.100.3
    aaa group server radius AUTHVPN
    server 10.10.0.2 auth-port 1645 acct-port 1646
    server 10.11.0.24 auth-port 1645 acct-port 1646
    aaa authentication login default group IMC local enable
    aaa authorization exec default group IMC local if-authenticated
    aaa session-id common
    clock timezone AEST 10
    clock summer-time AEDT recurring 1 Sun Oct 2:00 1 Sun Apr 3:00
    no ip domain lookup
    ip domain name imc.net.au
    dot11 syslog
    dot11 ssid IMC-Wireless-Data
    vlan 10
    authentication open eap AUTHVPN
    authentication network-eap AUTHVPN
    guest-mode
    mbssid guest-mode
    infrastructure-ssid optional
    information-element ssidl
    dot11 ssid IMC-Wireless-Voice
    vlan 14
    authentication open eap AUTHVPN
    authentication network-eap AUTHVPN
    mbssid guest-mode
    information-element ssidl
    dot11 aaa authentication attributes service login-only
    bridge irb
    interface Dot11Radio0
    no ip address
    no ip route-cache
    encryption mode wep mandatory
    ssid IMC-Wireless-Data
    ssid IMC-Wireless-Voice
    antenna gain 0
    mbssid
    station-role root
    interface Dot11Radio0.10
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface Dot11Radio0.14
    encapsulation dot1Q 14
    no ip route-cache
    bridge-group 14
    bridge-group 14 subscriber-loop-control
    bridge-group 14 block-unknown-source
    no bridge-group 14 source-learning
    no bridge-group 14 unicast-flooding
    bridge-group 14 spanning-disabled
    interface Dot11Radio1
    no ip address
    no ip route-cache
    encryption mode wep mandatory
    ssid IMC-Wireless-Data
    ssid IMC-Wireless-Voice
    antenna gain 0
    no dfs band block
    mbssid
    channel dfs
    station-role root
    interface Dot11Radio1.10
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    bridge-group 1 subscriber-loop-control
    bridge-group 1 block-unknown-source
    no bridge-group 1 source-learning
    no bridge-group 1 unicast-flooding
    bridge-group 1 spanning-disabled
    interface Dot11Radio1.14
    encapsulation dot1Q 14
    no ip route-cache
    bridge-group 14
    bridge-group 14 subscriber-loop-control
    bridge-group 14 block-unknown-source
    no bridge-group 14 source-learning
    no bridge-group 14 unicast-flooding
    bridge-group 14 spanning-disabled
    interface GigabitEthernet0
    description IMC-Wireless-Data
    no ip address
    no ip route-cache
    duplex auto
    speed auto
    no keepalive
    interface GigabitEthernet0.10
    description IMC-Wireless-Data
    encapsulation dot1Q 10 native
    no ip route-cache
    bridge-group 1
    no bridge-group 1 source-learning
    bridge-group 1 spanning-disabled
    interface GigabitEthernet0.14
    description IMC-Wireless-Voice
    encapsulation dot1Q 14
    no ip route-cache
    bridge-group 14
    no bridge-group 14 source-learning
    bridge-group 14 spanning-disabled
    interface BVI1
    description IMC-Wireless-Data
    ip address 10.10.0.245 255.255.255.0
    no ip route-cache
    ip default-gateway 10.10.0.254
    ip http server
    ip http authentication local
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    access-list 111 permit tcp any any eq telnet
    access-list 111 permit tcp any any eq www
    access-list 111 permit tcp any any eq 22
    snmp-server community public RO
    snmp-server enable traps tty
    tacacs-server host 172.16.100.3 key 7 xxxxxxxxxxxxxxxxxxx
    tacacs-server directed-request
    radius-server host 10.10.0.2 auth-port 1645 acct-port 1646 key 7 xxxxxxxxxxxxxxxxxxx
    bridge 1 route ip
    wlccp wds aaa authentication attributes service login-only
    line con 0
    line vty 0 4
    access-class 111 in
    exec-timeout 5 0
    line vty 5 15
    access-class 111 in
    exec-timeout 5 0
    sntp server 10.10.0.254
    end

    Inside the ssid, when you put "authentication open" it's an eap_method that follows. You put your AUTHVPN aaa server group name. that's wrong.
    aaa authentication login  group AUTHVPN
    and adjust your "authentication open eap " to match with that method name.
    Also your group authvpn contains a 2nd server that is undefined in yoru global config ...
    Nicolas

  • DACL in the Host Mode of Multi-Authentication with ISE

    Hi Folks,
    I'm wondering if the dACL can be applied per user in one port with the multi-authentication host mode. There are more than one users under one port with a hub, is it possible to apply each user a ACL by ISE so that they can gain different access permissions. Thanks

    If you have multiple active sessions on a single port, the profiling service issues a CoA with the Reauth option even though you have configured CoA with the Port Bounce option. This function avoids disconnecting other sessions, a situation that might occur with the Port Bounce option.
    Please go through the link for the installation steps and form the page 413.
    http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_ug.pdf

  • Radius authentication with MSCHAP

    Hi,
    I have a few 2960 and 3650 switches in my network. I have the aaa authentication login configured for RADIUS but it is only using PAP which is unencrypted.
    The 2960 switches are running version 15.2 and the 3650 are on 3.02. The RADIUS server I am using is Microsoft NPS which can do other methods of encryption.
    Is it possible to do mschap or any other type of encryption with the switches to authenticate management access?
    Regards,
    Waqas

    This sample configuration shows how to set up a remote access VPN connection between a Cisco VPN Client (4.x for Windows) and the PIX 500 Series Security Appliance 7.x using a Cisco Secure Access Control Server (ACS version 3.2) for extended authentication (Xauth).
    http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008080f2d1.shtml

  • WAP200 and .1x/radius authentication with multiple SSIDs

    Apparently it's not possible to define more than a single radius server when using multiple SSIDs with WAP200. Unfortunately WAP200 doesn't add the name of the SSID as a radius attribute, so it's not possible to make distinction whether the user is trying to log in to SSID A or B. Does anyone have any ideas or workarounds for this limitation? Of course the best solution would be if Cisco/Linksys fixed the firmware so that the SSID of the logging in user would be sent to the radius server as an extra attribute or appended to the client mac address.

    Security option for an SSID can be unique and can be configured when you configure a SSID or under VLAN . Note that each vlan is uniquely mapped to induvidual SSID.

  • Mail (Mavericks) replies with the wrong email address

    Currently using Mavericks, 10.9.5, on my MacBook Pro (15", early 2011 version), and the default Mail app.
    I belong to a fair number of email discussion groups, most specifically with Yahoo! Groups, and I've set up a specific account and email address for use with that service.  I also have currently setup several other email addresses within Mail, all seven of them are POP3 accounts.
    Yahoo! requires me to send email to the group from the address that is registered, but Mail doesn't use the correct email address as the default when I reply to the posts despite the fact that the original message was sent to the correct account.  Mail uses the email address from the account that's at the top of the Inbox listing for the address, not the one I want used.  I usually find out that messages sent were on the incorrect address when I get the bounce back from Yahoo! indicating I sent from the wrong address.  Digging through the sent items, setting the address correctly and resending fixes the original fault, but my iPhone (all versions of iOS 6, 7 and 8) replies correctly, but Mavericks Mail does not.
    Has anyone else had this happen to them, and was the upgrade to Yosemite the fix?  Or is it still broken there?
    TIA,
    Jon

    Open Mail preferences and select the Composing tab. Check the Send New Messages From box and see what is selected. Either select an account to send from as default or select Account of selected mailbox.
    Also open the Accounts tab and check the outgoing server for the account. Be sure you have the correct SMTP server set for that account and check the box to use only that server for that account. Do the same for all accounts making sure you have the correct server for each account. If there is a problem with that server, you will get a pop up asking to select a different server in the event of a failure. Otherwise, if that box is not checked, it will just select another server if there is a problem with the one for that account. That could be your problem.
    Send a test message to verify that. You can also reorder the mailboxes under the inbox by dragging each to the order you want. Depending on the settings in preferences, either the highlighted account will be the sending account or the default address you set in the list. Replies should always come from the address that was sent too.

  • Problem with payment/ wrong billing address

    Why Adobe doesnt accept my
    card even tho my billing adress is corect and ? Every single time I try it says something like " Your billing address doesn't match with your billing one". I've checked it with my bank and it is correct. I am getting really frustrated. Any ideas guys ?

    Hi Robert91,
    Please contact the support for your billing related queries:
    http://helpx.adobe.com/in/contact.html
    Regards,
    Sheena

  • I signed up with the wrong email address for itunes and have been using it for 2 years, now it wants me to validate the address, but I can't.  HELP

    Please help.  Is there anyway to change my email address on my apple id?

    Well, your first mistake was making a new Apple ID. You only needed to go into Manage your Apple ID and change the Apple ID from the Yahoo email to your new email. Then, all the purchases you made with that old Apple ID would still be tied to your updated Apple ID.
    As it is, you now have a totally new Apple ID, but the purchases you made with that old Apple ID are still (and will forever be) tied to it.
    Your best bet is to log into Manage your Apple ID with the old ID (regardless of what Yahoo did with it, it is still a functional Apple ID, unless you had that disable for security reasons). Once you have logged into it, change the password on it to match the password on your new ID. Then when you are asked for a password to update an app, it won't matter which of the two Apple IDs is displaying. You will just type in the same password and your app will be updated.
    Cheers,
    GB

  • How can I cancel my icloud account when I don't know the password that it has with my wrong email address?

    My IPhone5 wants my password, but it doesn't have the right email address on it.  It won't let me delete the icloud because it demands that I give it the password that icloud has stored.  Please help!

    The iCloud account is your account ? If it's somebody else's account then you will need to contact that person and ask them to remove the phone from their account.
    If it is your account then see if you can get the password reset via http://appleid.apple.com
    If you can't then try contacting Support in your country and see if they get you access to it : http://support.apple.com/kb/HT5699
    (For info this is the Using iPad forum.)

Maybe you are looking for