Remote Access using RSA ACE

Please can anyone help me regarding getting a windows dialup user to get access to internal resourced once authentication to RSA ACE server has been successful.
I have setup AAA authentication & authorization.
I can get the user to authentication to the RSA ACE server but after authentication i cannot get authorization to work but it has been configured in the list.see below
aaa authentication login default group tacacs+ local
aaa authentication login ACE group radius local
aaa authentication enable default group tacacs+ enable
aaa authentication ppp ACE if-needed
aaa authorization network ACE if-authenticated none
aaa accounting commands 15 default start-stop group tacacs+
interface Group-Async1
description ** modem lines **
ip unnumbered GigabitEthernet0/0
encapsulation ppp
ip route-cache policy
dialer in-band
dialer idle-timeout 600
dialer-group 1
autodetect encapsulation ppp
async mode interactive
peer default ip address pool DIALIN
ppp authentication pap ms-chap ms-chap-v2 ACE
ppp authorization ACE
group-range 1/0 1/7
line 1/0 1/7
login authentication ACE
modem InOut
transport input all
autoselect during-login
autoselect ppp
flowcontrol hardware
the debug message i get is as follows
AAA/AUTHOR (000000A3): Method list id=0 not configured. Skip author
The username/password window on the client PC just sits there and then times out...
Any help is welcome

Under the group Async you have:
interface Group-Async1
ppp authorization ACE
This line is normally not needed and I presume it is the cause of your trouble because there is no corresponding line in the aaa-section. This sample is from a working configuration:
interface Group-Async1
bandwidth 56
ip unnumbered Loopback1
encapsulation ppp
ip tcp header-compression passive
dialer in-band
dialer idle-timeout 300
dialer enable-timeout 8
dialer-group 1
async mode interactive
peer default ip address pool ippool
no keepalive
ppp authentication chap pap
group-range 65 76
regards,
Leo

Similar Messages

Remote access using cellphones with wifi possible???

is it possible to remotely access your desktop using cellphone using internet(wi-fi)

can you tell me what is wifi??is it not a internet connection? >
It means a particular suite of wireless networking protocols: 802.11
WiFi only means "internet" if the router you're connecting to is itself connected to the internet - which isn't necessarily the case. Don't use technical terms unless you know exactly what they mean as you risk making your question less clear.

Remote access using ssh/vnc

Hi All!
Recently, I have managed to configure my Airport Base station to accept SSH using the port mapping/forwarding feature...
The main goal is to remotely access my mac in the office using SSH and VNC.
I was able to do this however remote Mac is using a high resolution which makes it slow to manage.[really slow].
I am currently using a Windows SSH tool called Putty.. and Real VNC to manage remote mac.
I tried to change the setting of Real VNC to a lower resolution but it would not work..accessing the remote mac will only work if my Windows VNC is set to use the
"Full" colour level.
Is this a windows issue? I haven't tried using a VNC for Mac though..
any other tool that is available out there aside from Apple Remote desktop?
Thanks, All!!!!
DP

so the system server VNC refers to the MAC os x VNC...
No, Vine Server's System Server is Vine Server starting up at boot time and is always running. Vine Server existed before Mac OS X included its own VNC server, so Vine Server's terminology is a bit confusing, but it wasn't when the started using it (it even sounds confusing when I just said it ).
the Vine server itself is the stand alone vnc.
Yes. The Vine Server is a totally separate VNC server implementation. It may be run interactively, or it may be configured to start at system boot time so it is always running (this is the system server mode of Vine Server).
so , OS X's VNC is set to only accept high res..
I do not know if it can ONLY do the resolution of the display, but anytime I've tried to use a VNC client configured for lower resolution, the Mac OS X VNC server has not behaved well. Rather than fight it, I just resort to Vine Server. It has been a rock solid VNC server.
so connecting to the Vine server should be at any port not the 5900as this is the mac os vnc default port.
If you MAKE ABSOLUTELY SURE that the Mac OS X VNC server is NOT running, you can use port 5900 for Vine Server, but I find it is safer to just give the Vine Server its own port, and commonly that is port 5901, but the Vine Server can be configured to use any port you desire.
Since I do not use a VNC client on Windows, I can not recommend any clients. However, I have heard of the following:
RealVNC
TightVNC
UltraVNC
I am sure there are others, but not being plugged into Windows culture, my depth of knowledge is very limited.

Help needed setting up IP Cameras for remote access using Air Port Extreme

Does anyone know how to access IP Cams remotely and open the ports on the Air Port Extreme using a PC? I have several iPhone Apps I can use but I cannot get the ports opened and on a PC it seems less intuitive than the MAC directions.

That manual page is not fully correct. There is written:
Public UDP Port(s): <enter the appropriate UDP port value(s)>
Public TCP Port(s): <enter the appropriate TCP port value(s)>
Private IP Address: <enter the reserved IP address of the host device (from step 1)>
Private UDP Port(s): <enter the same Public UDP Ports or your choice>
Private TCP Port(s): <enter the same Public TCP Ports or your choice>
But it should be:
Public UDP Port(s): <enter unique UDP Ports of your choice>
Public TCP Port(s): <enter unique TCP Ports of your choice>
Private IP Address: <enter the reserved IP address of the host device (from step 1)>
Private UDP Port(s): <enter the UDP Ports used by your device>
Private TCP Port(s): <enter the TCP Ports used by your device>
Make sure you use the same ports in the private settings as you have defined in your IP camera. Normally a camera will use port 80 by default, so use 80 here.
The Public ports must all be unique. If you have not defined a port 80 here, you can also use 80. This will fail however when using multiple cameras. I for instance have 5 IP cameras and use the public ports 8451, 8452, 8453 etc.

Remote access using a web browser

Does anyone know how secure your system is accessing labview remotely.
Whenever you're accessing Labview(port 80) from a remote location
through a web browser there is nothing stopping a hacker from gaining
access to your system.
Is there anyway to prevent outside access to the sytem?

Casey wrote:
> Does anyone know how secure your system is accessing labview remotely.
> Whenever you're accessing Labview(port 80) from a remote location
> through a web browser there is nothing stopping a hacker from gaining
> access to your system.
>
> Is there anyway to prevent outside access to the sytem?
Well, if you prevent outside access you automatically prevent access
altogether so you won't be able to use a browser to connect to it. If a
browser can connect anyone with some TCP/IP knowledge can connect too.
If you want to disable that possibility you also disable access by browsers.
However the WebServer in LabVIEW is fairly secure and it is quite
unlikely that you can abuse it to gain access to your machine. The
biggest risk would be a DOS attack which in older versions of LabVIEW
were possible at some time.
You have some options. If you only need access to the WebServer from
your Intranet, simply don't allow routing from outside traffic to your
LabVIEW computer at all. You configure this in your firewall.
I assume you have a firewall, (not the playtoy included in Windows XP
but a real one) because if you haven't you have a lot more and bigger
problems to worry before you even think about a possible vulnerability
in the LabVIEW WebServer.
If you do need to have outside access to your LabVIEW WebServer you can
configure the firewall to only allow outside access to port 80 on your
LabVIEW computers IP address. And if that seems still scary to you the
better approach is to use a real WebServer such as Apache and do
everything there. Don't forget the firewall though. Eventhough Apache
may have some security problems every now and then, they are usually
discovered fast and fixed even faster. So if you monitor the situation
and react on known vulneribilities you can have a very secure system.
LabVIEW vulneribilities are often not found as fast because a lot less
people use it and even fewer try to actually seek out such systems and
attack them on purpose.
Rolf Kalbermatter
Rolf Kalbermatter
CIT Engineering Netherlands
a division of Test & Measurement Solutions

Remote access using ssh

when i am accessing from rhel4 iam getting error.
ssh 140.87.240.168
ssh: connect to host 140.87.240.168 port 22: No route to host

1. make sure you have started the sshd service in your target Linux box
2. Enable ssh access in your firewall policy(or tune off your firefall)

Can Samsung ATIV 32 bit OS, 1.80GHz, Windows 8 be networked for Remote access using Tier Medical software

I was able to successfully download and connect to my employer's Tier Software. I tried to run the TIER training module and received an error message with a code number and problem with Tier.exe. When I contacted our system
administrator as directed by this error message I was told that my screen was not big enough because it was a tablet and the screen is 10.1 inches. New Hires are required to have a computer or a laptop that runs The Tier Medical software purchased at
our expense. There is no Full -time computer administrator. I would like to encourage the employer to consider a consultation with a Tier consultant or computer consultant and what the approximate cost would be. This could resolve my problem
and at least 2 other health service professionals the expense of buying a new computer. Please advise me about some alternative solutions if there are any.

Unfortunately your post is off topic here, in the TechNet Site Feedback forum, because it is not Feedback about the TechNet Website or Subscription. This is a standard response I’ve written up in advance to help many people (thousands, really.)
who post their question in this forum in error, but please don’t ignore it. The links I share below I’ve collected to help you get right where you need to go with your issue.
For technical issues with Microsoft products that you would run into as an
end user of those products, one great source of info and help is
http://answers.microsoft.com, which has sections for Windows, Hotmail, Office, IE, and other products. Office related forums are also here:
http://office.microsoft.com/en-us/support/contact-us-FX103894077.aspx
For Technical issues with Microsoft products that you might have as an
IT professional (like technical installation issues, or other IT issues), you should head to the TechNet Discussion forums at
http://social.technet.microsoft.com/forums/en-us, and search for your product name.
For issues with products you might have as a Developer (like how to talk to APIs, what version of software do what, or other developer issues), you should head to the MSDN discussion forums at
http://social.msdn.microsoft.com/forums/en-us, and search for your product or issue.
If you’re asking a question particularly about one of the Microsoft Dynamics products, a great place to start is here:
http://community.dynamics.com/
If you really think your issue is related to the subscription or the TechNet Website, and I screwed up, I apologize! Please repost your question to the discussion forum and include much more detail about your problem, that could include screenshots
of the issue (do not include subscription information or product keys in your screenshots!), and/or links to the problem you’re seeing.
If you really had no idea where to post this question but you still posted it here, you still shouldn’t have because we have a forum just for you! It’s called the Where is the forum for…? forum and it’s here:
http://social.msdn.microsoft.com/forums/en-us/whatforum/
Moving to off topic.
Thanks, Mike
MSDN and TechNet Subscriptions Support <br/> Read the Subscriptions <a href="http://blogs.msdn.com/msdnsubscriptions">Blog! </a>

How to Use synchronous RFC calls during test run for remote accesses

there is a Setting for the usage of RFC accesses from a tested system
using eCATT.
'X' - Use asynchronous RFC calls during test run for remote accesses
' ' - Use synchronous RFC calls during test run for remote accesses
I developed an eCATT as following :
SAPGUI ( SAPGUI_1 , Target_system_1 ).
SAPGUI ( SAPGUI_2 , Target_system_2 ).
My question is how to run the eCATT in a synchronous RFC calls
PS: I do not want to change the Target_system to the same one in the
above script of ecatt.Because I need to run it in 2 different Target
systems sometime.
for example, I give a Target_system_3 when run this eCATT
I want the SAPGUI_1 and SAPGUI_2 run the Target_system_3 but not the
Target_system_1 or Target_system_2 .
Could you please tell me how to make it without the changes in script?
Edited by: Weitong Liu on Mar 24, 2011 9:44 AM

Hi Liu,
Weitong Liu wrote:
> ' ' - Use synchronous RFC calls during test run for remote accesses
This is the standard option value. Asynchronous are not the standard way and used only for very special purposes.
Weitong Liu wrote:
> I developed an eCATT as following :
> SAPGUI ( SAPGUI_1 , Target_system_1 ).
> SAPGUI ( SAPGUI_2 , Target_system_2 ).
> My question is how to run the eCATT in a synchronous RFC calls
The commands will be executed in sequence. So each call will be synchronously replayed against TS1 and TS2.
What is you issue with this standard procedure?
Kind regards,
Christoph

I have remote access from my IMAC to my windows PC at work. How do I set up the keyboard functions to work on the work PC when I work from home?

I have remote access using my IMAC. The computer at work is a Windows PC, how do I set up the IMAC's keyboard to function as the same one at work?

Port 3389 should be open on your work network. Check with your admin. They know what ports are open on your work firewall.

Unstable remote access to extreme external hard drive

Why can't I reliably access a usb hard drive plugged in the back of my airport extreme over the internet?
I've bought a new dsl modem (Netgear). I've upgraded to a static ip. This helped for a while. But as far as I can tell, after I access the usb hard drive via wireless at home it seems to break the ability to connect to the same network remotely. The extreme and network name show up in the left pane of the finder window, but it will not connect. The Extreme is in bridge mode; the hard drive is a WD but NOT formatted as a mac journaled format. I have tried also tried a powered usb port. Does not make a difference.
I have the latest airport extreme, and running the latest Maverics on a 6 month old MacBook Pro. What is happening? What am I doing wrong? I've had this problem for months.

6) I'm not following this. Looking at my modem, it is set to ppoe (has to be); modem is set in modem & router mode; ip address and DNS are set for "get automatically from ISP; LAN port set with DHCP ON; and interestingly, two different ip addresses (0.2 and 0.5) for devices with the name of my network as the device--and both of these have the same MAC address.
Bridge the adsl modem.. instead of using it as modem router, use it as modem only.
Look up instructions for your exact model modem on how to bridge.. Of all the companies Netgear can be the most difficult and occasionally impossible to bridge. But you should try.. or borrow a simple modem that can be easily bridged.
In the AE, setup the WAN, instead of dhcp use PPPOE, and put your username and password for ISP there.
This puts the AE as the main router of the network.. and puts the public IP on its WAN interface.. this can be extremely helpful when you have access issues.
5) I don't know how to locate the port I am using.
You should specific the port in the setup.
See the Tesserax doco on remote access using port forwarding.
https://discussions.apple.com/docs/DOC-3413
In the document he shows how to setup using 8888 which is port translated to 548.. much better for security than opening known AFP port to the world.

Rsa securid with remote access dial-in service problem

Hello,
I tried to setting rsa secured with remote access dial-in service on cisco 2600 box. Everything works well except when token in new pin or next token mode. The dial-up client can not enter second passcode, do not have second pop-up window, so all authentications was fail. My dial-up client is windows 2000 or xp.
Please suggest me too.
Thanks,
Nitass

While I agree with you that the terminal window solution is more complex and less user friendly than the standard Windows DialUp window/authentication, the terminal window does provide a solution to the new pin or next token issue which the standard Windows does not.
I work with a customer who uses RSA token to authenticate dial in users. We have found the solution to the issue you are dealing with to be either the terminal window where the user can deal with their problem or to have someone take administrative action on the RSA server to reset/resync the users token.
So as I see it you have a choice to make: either present terminal window as an alternative setup on the user PC or when they can not login on dial up have them call the Help Desk and have someone deal with it for them. One solution is somewhat less user friendly but does allow the user to deal with their own problem, and the other solution is more user firendly and puts more load on the Network Support staff.
I would also wonder why you have so many users in new pin and next token mode? Perhaps if you can figure how to minimize the frequency of these modes you can minimize the problem of difficulty authenticating for your users.
HTH
Rick

Secutiry - Remote Access, RSA, SSO

Dear Freinds,
Would like to understand the pre-requisite (requirement) for Remote Access , RSA , SSO (Single Sign-on), Mobile user authentication in network setup. Same has been proposed for our network and may deploy shortly. Users will be approx. or less then 100.
As of now , we are only using Cisco ASA 5525 Security appliances. Please suggest, what all devices , appliances, licences we require for the same
Rgds

Hi Experts,
One modification.....Just forget about the 5525 existing ASA.
Suggest the solution for Remote Access , RSA , SSO (Single Sign-on), Mobile user authentication in network setup along with the additional appliances (If require any) to achieve the solution.
Rgds

How can I access a database remote without using dblink, synonyms,aliases?

My store procedure access a remote tables using dblink, synonyms, alias, but by business company requirenments I nedd to use another data base access method. My PL/SQL statement looks like
select c.cus_id, c.cus_name, p.bankaccno
into v_cus_id, v_cus_name, v_bankaccno
from customer c, payment@finantial p
where c.cus_id = p.cus_id
Are any method else to connect to several remote databases concurrently?
If Yes, plase say me how is it, or tell me where do I obtain some examples, or any documentation.
Edited by: user518321 on Apr 21, 2009 1:58 PM
Ok, But I must not use any of these data base access method, metioned: dbliks, aliases, synonyms.
Edited by: user518321 on Apr 21, 2009 2:05 PM
Ok, It is enough for now, I am surprised for the response time and for their arguments, thanks a lot.
Edited by: user518321 on Apr 21, 2009 2:50 PM

If you want to access a table in a remote database using SQL, you will need a database link. It would be exceptionally odd for the business to require that you access a remote database and to prohibit the use of database links. What is the business reason for that combination?
If you want to look into rather more esoteric solutions, you could load a JDBC driver for the remote database, write a Java stored procedure that queries the remote table using that JDBC driver, and then cobble together some PL/SQL that joins the two result sets. You won't be able to reference the remote table in SQL and the solution won't scale well as data volumes increase and you'll be writing a whole lot of code to manually join tables together, but it does avoid database links. Of course, whatever concerns lead to the ban on database links would probably apply to loading a JDBC driver into the database and writing Java stored procedures to access the remote database, but since you haven't explained the reasoning behind the restrictions, we're just guessing.
Justin

How to set up my elderly parent with Mac so that I can use remote access to help her?

I want to set my elderly mother up with a new Mac mini so that I can use remote access to show her how use email, browse the internet, share photos. (She lives in KY, I live in OR)
She has had an iPhone and an iPad for about 6 months and she can barely use them without becoming frustrated.   I want to be able to see her screen with her and show her how to do things.
My plan is to set her up with a Mac mini and I'll use my MacBookAir to remote into her system. I'm buying the mini to configure and then I'll mail it to her.
My question is whether to try to use Back to My Mac or Teamviewer for remote access
I have broadband with comcast and she has broadband with Access Cable. Each have their company modem/routers--neither of us have Airport Express.
I have my own iCloud account and she has her own.   If I use Back to My Mac, it seems that I would need to set up a separate account on my Mac that would sync to her iCloud account.
Teamviewer seems easier because I don't have to use a separate account.   Any advice?   Anything that I'm not thinking about?

As Linc says, you can establish a Screen Sharing session via iMessage and Facetime. The advantage of these 2 approaches is that once your Mom gets used to using them, she will be more comfortable using them to communicate with you. I've talked to my Mom via iChat (aka iMessage) more since she learned to use them, then in all the years before that (including when I was a child ). And just being able to see your Mom via Facetime can be useful when you want to gage how she is doing.
However, if you are any distance from your Mom, they you want backup methods incase something goes wrong.
So beside iMessage/Facetime, the next best would be Back-to-My-Mac via iCloud, however, you will want to establish her Mac as using your account so that you have the right to take control remotely.
An alternative that does not mix up your iCloud acounts would be to use TeamViewer.com (which has an unattended mode so you can do off-hour maintenance when your Mom is not around; or check up on her to find out if she is dating - Turns out if I had been paying attention, I would not have been blind-sided by my Mom getting Married again last Summer - she is in her 80's! ).
LogMeIn.com, as dwb says, can be used the same was as TeamViewer.com
Both LogMeIn.com and TeamViewer.com are very good at making it easy to get through the home router and if you are having any problems connecting using other Methods, TeamViewer.com or LogMeIn.com will most likely not have any issues.
Back-to-My-Mac allows screen sharing and file sharing so you can transfer files as well as control the screen.
Screen Sharing via Messages allows cooperative file transfer. That is to say, you can try pushing a file to your Mom, but she has to accept each transfer.
TeamViewer.com has an unattended file transfer mode.
LogMeIn.com requires the paid version to transfer files. However, there are other ways to transfer files, such as downloading them from the original source on your Mom's system while using screen sharing, using Dropbox (or similar), emailing them, etc...
Of course if you are really network savvy, you can roll your own via ssh tunnels, port forwarding routers, getting dynamic DNS names, transferring files via scp, or tunneling AFP file sharing, tunneling your screen sharing sessions. Lots of fun and excitement playing with terminal commands

Can i use same address pool for different remote access VPN tunnel groups and policy

Hi all,
i want to create a different remote access VPN profile in ASA. ihave one RA vpn already configured for some purpose.
can i use the same ip address pool used for the existing one for the new tunnel-group (to avoid add rotuing on internal devices for new pool) and its a temporary requirement)
thanks in advance
Shnail

Thanks Karsten..
but still i can have filtering right? iam planning to create a new group policy and tunnelgroup and use the existing pool for new RA and i have to do some filetring also. for the new RA i have to restrict access to a particualr server ,my existing RA have full access.
so iam planning to create new local usernames for the new RA and new group policy with vpn-filter value access-list to apply for that user as below, this will achive waht i need right??
access-list 15 extended permit tcp any host 192.168.205.134 eq 80
username test password password test
username test attributes
vpn-group-policy TEST
vpn-filter value 15
group-policy TEST internal
group-policy TEST attributes
dns-server value 192.168.200.16
vpn-filter value 15
vpn-tunnel-protocol IPSec
address-pools value existing-pool
tunnel-group RAVPN type ipsec-ra
tunnel-group RAVPN general-attributes
address-pool existing-pool
default-group-policy TEST
tunnel-group Payroll ipsec-attributes
pre-shared-key xxx

Remote Access using RSA ACE

Similar Messages

Maybe you are looking for